diff --git a/pom.xml b/pom.xml index 14b407d..38eb6d1 100644 --- a/pom.xml +++ b/pom.xml @@ -45,8 +45,14 @@ org.slf4j - slf4j-jdk14 - 1.7.18 + slf4j-log4j12 + 1.7.26 + test + + + log4j + log4j + 1.2.17 test diff --git a/src/main/java/org/jitsi/dnssec/validator/NSEC3ValUtils.java b/src/main/java/org/jitsi/dnssec/validator/NSEC3ValUtils.java index e9ba3ca..0df67f2 100644 --- a/src/main/java/org/jitsi/dnssec/validator/NSEC3ValUtils.java +++ b/src/main/java/org/jitsi/dnssec/validator/NSEC3ValUtils.java @@ -736,7 +736,7 @@ public SecurityStatus proveNoDS(List nsec3s, Name qname, Name zonename) return SecurityStatus.SECURE; } - // Otherwise, we are probably in the opt-in case. + // Otherwise, we are probably in the opt-out case. CEResponse ce = this.proveClosestEncloser(qname, zonename, nsec3s); if (ce.status != SecurityStatus.SECURE) { return SecurityStatus.BOGUS; @@ -745,11 +745,11 @@ public SecurityStatus proveNoDS(List nsec3s, Name qname, Name zonename) // If we had the closest encloser proof, then we need to check that the // covering NSEC3 was opt-in -- the proveClosestEncloser step already // checked to see if the closest encloser was a delegation or DNAME. - if (ce.ncNsec3.getFlags() == 1) { - return SecurityStatus.SECURE; + if ((ce.ncNsec3.getFlags() & Flags.OPT_OUT) != Flags.OPT_OUT) { + return SecurityStatus.BOGUS; } - return SecurityStatus.BOGUS; + //RFC5155 section 9.2: if nc has optout then no AD flag set + return SecurityStatus.INSECURE; } - } diff --git a/src/main/java/org/jitsi/dnssec/validator/ValidatingResolver.java b/src/main/java/org/jitsi/dnssec/validator/ValidatingResolver.java index 28a96ec..3b2f061 100644 --- a/src/main/java/org/jitsi/dnssec/validator/ValidatingResolver.java +++ b/src/main/java/org/jitsi/dnssec/validator/ValidatingResolver.java @@ -912,15 +912,21 @@ private KeyEntry dsReponseToKeForNodata(SMessage response, Message request, SRRs switch (this.n3valUtils.proveNoDS(nsec3s, qname, nsec3Signer)) { case INSECURE: - logger.debug("nsec3s proved no delegation."); - return null; + // case insecure also continues to unsigned space. + // If nsec3-iter-count too high or optout, then treat below as unsigned case SECURE: KeyEntry nullKey = KeyEntry.newNullKeyEntry(qname, qclass, nsec3TTL); nullKey.setBadReason(R.get("insecure.ds.nsec3")); return nullKey; - default: + case INDETERMINATE: + logger.debug("nsec3s for the referral proved no delegation."); + return null; + case BOGUS: bogusKE.setBadReason(R.get("failed.ds.nsec3")); return bogusKE; + default: + bogusKE.setBadReason(R.get("unknown.ds.nsec3")); + return bogusKE; } } diff --git a/src/main/resources/messages.properties b/src/main/resources/messages.properties index 4dc55d9..7d834b1 100644 --- a/src/main/resources/messages.properties +++ b/src/main/resources/messages.properties @@ -41,8 +41,9 @@ failed.ds.nowildcardproof=NSEC for wildcard does not prove absence of DS. failed.ds.nsec.ent=NSEC for empty non-terminal did not verify. insecure.ds.nsec.ent=NSEC for empty non-terminal proved no DS. failed.ds.nonconclusive=NSEC proof did not conclusively point to DS or no DS. -failed.ds.nsec3=NSEC3s proved bogus. -insecure.ds.nsec3=NSEC3s proved no DS. +failed.ds.nsec3=NSEC3s for the referral did not prove no DS. +unknown.ds.nsec3=no DS but also no proof of that +insecure.ds.nsec3=NSEC3s for the referral proved no DS. failed.ds.unknown=Ran out of validation options, thus bogus. failed.ds.notype=Encountered an unhandled type ({0}) of DS response, thus bogus. failed.ds.nodigest=No supported digest ID for DS for {0}. diff --git a/src/test/java/org/jitsi/dnssec/TestBase.java b/src/test/java/org/jitsi/dnssec/TestBase.java index de0ef69..a21ba3a 100644 --- a/src/test/java/org/jitsi/dnssec/TestBase.java +++ b/src/test/java/org/jitsi/dnssec/TestBase.java @@ -42,6 +42,8 @@ import org.powermock.core.classloader.annotations.PrepareForTest; import org.powermock.modules.junit4.PowerMockRunner; import org.powermock.reflect.Whitebox; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.xbill.DNS.ARecord; import org.xbill.DNS.DClass; import org.xbill.DNS.DNSSEC; @@ -61,6 +63,8 @@ @RunWith(PowerMockRunner.class) @PrepareForTest({DNSSEC.class, TestInvalid.class}) public abstract class TestBase { + private static final Logger logger = LoggerFactory.getLogger(TestBase.class); + private final static boolean offline = !Boolean.getBoolean("org.jitsi.dnssecjava.online"); private final static boolean partialOffline = "partial".equals(System.getProperty("org.jitsi.dnssecjava.offline")); private final static boolean record = Boolean.getBoolean("org.jitsi.dnssecjava.record"); @@ -168,7 +172,7 @@ public void setup() throws NumberFormatException, IOException, DNSSECException { resolver = new ValidatingResolver(new SimpleResolver("62.192.5.131") { @Override public Message send(Message query) throws IOException { - System.out.println("---" + key(query)); + logger.info("---{}", key(query)); Message response = queryResponsePairs.get(key(query)); if (response != null) { return response; @@ -188,7 +192,6 @@ else if ((offline && !partialOffline) || unboundTest || alwaysOffline) { }); resolver.loadTrustAnchors(getClass().getResourceAsStream("/trust_anchors")); - System.err.println("--------------"); } protected void add(Message m) throws IOException { diff --git a/src/test/java/org/jitsi/dnssec/unbound/rpl/RplParser.java b/src/test/java/org/jitsi/dnssec/unbound/rpl/RplParser.java index 2cae5d0..7bba9f4 100644 --- a/src/test/java/org/jitsi/dnssec/unbound/rpl/RplParser.java +++ b/src/test/java/org/jitsi/dnssec/unbound/rpl/RplParser.java @@ -113,7 +113,7 @@ else if (data[2].equals("CHECK_ANSWER")) { rpl.trustAnchors.add(rrset); } else if (line.matches("\\s*val-override-date:.*")) { - rpl.date = DateTime.parse(line.substring(line.indexOf("\"") + 1, line.length() - 2), DateTimeFormat.forPattern("yyyyMMddHHmmss")); + rpl.date = DateTime.parse(line.substring(line.indexOf("\"") + 1, line.length() - 2), DateTimeFormat.forPattern("yyyyMMddHHmmss").withZoneUTC()); } else if (line.matches("\\s*val-nsec3-keysize-iterations:.*")) { String[] data = line.substring(line.indexOf("\"") + 1, line.length() - 1).split("\\s"); diff --git a/src/test/resources/log4j.properties b/src/test/resources/log4j.properties new file mode 100644 index 0000000..63cf99d --- /dev/null +++ b/src/test/resources/log4j.properties @@ -0,0 +1,5 @@ +log4j.rootLogger = TRACE, CONSOLE + +log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender +log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout +log4j.appender.CONSOLE.layout.conversionPattern=%d{yyyy-MM-dd HH:mm:ss.SSS} %20c{1}: %m%n diff --git a/src/test/resources/unbound/val_entds.rpl b/src/test/resources/unbound/val_entds.rpl index 5ea2d5c..2377d14 100644 --- a/src/test/resources/unbound/val_entds.rpl +++ b/src/test/resources/unbound/val_entds.rpl @@ -131,22 +131,6 @@ example.com. 3600 IN RRSIG NSEC 3 2 3600 20070926134150 20070829134 ENTRY_END ; response for query in question - delegation - -ENTRY_BEGIN -MATCH opcode -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -c.5.6.example.com. IN DS -SECTION ANSWER -c.5.6.example.com. 3600 IN DS 2854 3 1 4449f16fa7d712283aa43cc8dcc8e07c05856e08 -c.5.6.example.com. 3600 IN RRSIG DS 3 5 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCgiF7eFL89mSqjUPEpQuL5QEa1OgIUWdfUmMkwVBwOgmxlxZIKfGs5od0= ;{id = 2854} -SECTION AUTHORITY -SECTION ADDITIONAL -ns.c.5.6.example.com. IN A 1.2.3.6 -ENTRY_END -RANGE_END - ; and all other queries, receive a delegation to c.5.6.example.com. ENTRY_BEGIN MATCH opcode @@ -218,11 +202,12 @@ MATCH opcode ADJUST copy_id copy_query REPLY AA QR NOERROR SECTION QUESTION -b.3.4.c.5.6.example.com. IN DS -SECTION ANSWER +; dnssecjava: modify query to avoid overlap in query cache, match is not implemented +4.c.5.6.example.com. IN NS +SECTION AUTHORITY +b.3.4.c.5.6.example.com. IN NS ns.b.3.4.c.5.6.example.com. b.3.4.c.5.6.example.com. 3600 IN DS 30899 5 1 849ebbdefa338db3e6c3ddffd58851523ba701de b.3.4.c.5.6.example.com. 3600 IN RRSIG DS 3 8 3600 20070926134150 20070829134150 2854 c.5.6.example.com. MC0CFEuXbvClpAOx7E1SXeH0d+Q4jpySAhUAtbEbQ8qtRF5chUOWNtg31ESAjWg= ;{id = 2854} -SECTION AUTHORITY SECTION ADDITIONAL ns.b.3.4.c.5.6.example.com. IN A 1.2.3.7 ENTRY_END