Blame SOURCES/bind-9.11-CVE-2018-5745-testfix.patch

302b22
From aea8a7bab922a8793f6c50af30bdfa424a7f706d Mon Sep 17 00:00:00 2001
302b22
From: Petr Mensik <pemensik@redhat.com>
302b22
Date: Thu, 5 Sep 2019 20:24:25 +0200
302b22
Subject: [PATCH] Fix mkeys test changes backported
302b22
MIME-Version: 1.0
302b22
Content-Type: text/plain; charset=UTF-8
302b22
Content-Transfer-Encoding: 8bit
302b22
302b22
Squashed commit of the following:
302b22
302b22
commit a6cbd45fcfe2b1dc5339da72eed0ffeb27afdf81
302b22
Author: Petr Mensik <pemensik@redhat.com>
302b22
Date:   Thu Sep 5 20:01:21 2019 +0200
302b22
302b22
    Backport fixes to mkeys test
302b22
302b22
    It relied on some features backported in more recent versions, but not
302b22
    present in our version. Make test pass with current features. Fixes some
302b22
    mistakes when backporting original upstream commits.
302b22
302b22
commit be97d4d9d9f9568aa497e618ffbe2aba0841d035
302b22
Author: Michał Kępień <michal@isc.org>
302b22
Date:   Tue Mar 26 10:51:16 2019 +0100
302b22
302b22
    Add "-r $RANDFILE" where it is missing
302b22
302b22
    If the path to the source of random data is not passed explicitly to
302b22
    dnssec-keygen or dnssec-signzone and the --with-randomdev compile-time
302b22
    switch is not used, the aforementioned utilities will hang if the
302b22
    default source of random data (/dev/random) runs out of entropy.  Use
302b22
    "-r $RANDFILE" to prevent that from happening in affected system tests.
302b22
302b22
    (cherry picked from commit 59e1329e9b3aff72d8e36db8d0ca980d540decb3)
302b22
302b22
commit fd651e87b9bddcae7ef894b165d209a9693dc204
302b22
Author: Matthijs Mekking <matthijs@isc.org>
302b22
Date:   Thu Dec 20 15:23:07 2018 +0100
302b22
302b22
    Remove dig_with_opts
302b22
302b22
    (cherry picked from commit bb2c242c396d3c6893eb6a27e59af5a3b53452bc)
302b22
302b22
commit 84264e082ffe0c5439a0c789ceb7f8308d1b9b7e
302b22
Author: Matthijs Mekking <github@pletterpet.nl>
302b22
Date:   Wed Dec 19 10:16:10 2018 +0100
302b22
302b22
    Replace DSA with Reserved algorithm
302b22
302b22
    (cherry picked from commit 17cdde1e56abae5c3bf5256ecbdacbd8cbef05b6)
302b22
    (cherry picked from commit 0e9a8da68c89cb99b1892e8b0705b71c92532844)
302b22
302b22
commit e335f239aca4bdbf8160fe9bc1ef3cfba15ae06f
302b22
Author: Matthijs Mekking <github@pletterpet.nl>
302b22
Date:   Tue Dec 18 12:14:04 2018 +0100
302b22
302b22
    Allow unsupported alg in zone /w dnssec-signzone
302b22
302b22
    dnssec-signzone should sign a zonefile that contains a DNSKEY record
302b22
    with an unsupported algorithm.  Current behavior is that it will
302b22
    fail, hitting a fatal error.  The fix detects unsupported algorithms
302b22
    and will not try to add it to the keylist.
302b22
302b22
    Also when determining the maximum iterations for NSEC3, don't take
302b22
    into account DNSKEY records in the zonefile with an unsupported
302b22
    algorithm.
302b22
302b22
    (cherry picked from commit 1dd11fc754baf396bb3040527087b14f0678dd83)
302b22
    (cherry picked from commit 040e132f1692ce8bb1ac83032ee761b3278f0272)
302b22
302b22
commit a1c345c8ab39201fe6e0cd7f19696d6a2f8b5522
302b22
Author: Matthijs Mekking <github@pletterpet.nl>
302b22
Date:   Tue Dec 18 12:10:05 2018 +0100
302b22
302b22
    Add dnssec-signzone tests with unsupported alg
302b22
302b22
    dnssec-signzone should sign a zonefile that contains a DNSKEY record
302b22
    with an unsupported algorithm.
302b22
302b22
    (cherry picked from commit 6d976b37c1b2b2c4bcede89252cf26b6f170c142)
302b22
    (cherry picked from commit 8619318a1e6207e487438a93bd7a620967091347)
302b22
    (cherry picked from commit 9f81119c0256378683c20e8e01a874378cabfcbc)
302b22
---
302b22
 bin/tests/system/dnssec/clean.sh              |  4 ++
302b22
 bin/tests/system/dnssec/ns2/example.db.in     |  5 ++-
302b22
 .../ns3/dnskey-unsupported-2.example.db.in    | 27 ++++++++++++
302b22
 .../ns3/dnskey-unsupported.example.db.in      | 27 ++++++++++++
302b22
 bin/tests/system/dnssec/ns3/named.conf.in     | 10 +++++
302b22
 bin/tests/system/dnssec/ns3/sign.sh           | 42 ++++++++++++++++++-
302b22
 .../dnssec/ns3/unsupported-algorithm.key      |  1 +
302b22
 bin/tests/system/dnssec/tests.sh              | 20 +++++++++
302b22
 bin/tests/system/dupsigs/ns1/reset_keys.sh    |  2 +
302b22
 bin/tests/system/mkeys/ns6/setup.sh           |  2 +-
302b22
 bin/tests/system/mkeys/setup.sh               |  2 +
302b22
 bin/tests/system/mkeys/tests.sh               |  6 +--
302b22
 lib/dns/dnssec.c                              |  8 ++++
302b22
 lib/dns/include/dns/dnssec.h                  |  2 +-
302b22
 lib/dns/nsec3.c                               | 11 ++++-
302b22
 15 files changed, 161 insertions(+), 8 deletions(-)
302b22
 create mode 100644 bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
302b22
 create mode 100644 bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
302b22
 create mode 100644 bin/tests/system/dnssec/ns3/unsupported-algorithm.key
302b22
302b22
diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
302b22
index 1873c4b586..0fcff23797 100644
302b22
--- a/bin/tests/system/dnssec/clean.sh
302b22
+++ b/bin/tests/system/dnssec/clean.sh
302b22
@@ -55,6 +55,10 @@ rm -f ns3/future.example.db ns3/trusted-future.key
302b22
 rm -f ns3/inline.example.db.signed
302b22
 rm -f ns3/kskonly.example.db
302b22
 rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
302b22
+rm -f ./ns3/dnskey-unsupported.example.db
302b22
+rm -f ./ns3/dnskey-unsupported.example.db.tmp
302b22
+rm -f ./ns3/dnskey-unsupported-2.example.db
302b22
+rm -f ./ns3/dnskey-unsupported-2.example.db.tmp
302b22
 rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
302b22
 rm -f ns3/nsec3.nsec3.example.db
302b22
 rm -f ns3/nsec3.optout.example.db
302b22
diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
302b22
index 0b831ec94e..6afffe00f3 100644
302b22
--- a/bin/tests/system/dnssec/ns2/example.db.in
302b22
+++ b/bin/tests/system/dnssec/ns2/example.db.in
302b22
@@ -97,6 +97,9 @@ ns.optout-unknown	A	10.53.0.3
302b22
 dnskey-unknown		NS	ns.dnskey-unknown
302b22
 ns.dnskey-unknown	A	10.53.0.3
302b22
 
302b22
+dnskey-unsupported	NS	ns.dnskey-unsupported
302b22
+ns.dnskey-unsupported	A	10.53.0.3
302b22
+
302b22
 dnskey-nsec3-unknown	NS	ns.dnskey-nsec3-unknown
302b22
 ns.dnskey-nsec3-unknown	A	10.53.0.3
302b22
 
302b22
@@ -111,7 +114,7 @@ ns.rsasha256		A	10.53.0.3
302b22
 rsasha512		NS	ns.rsasha512
302b22
 ns.rsasha512		A	10.53.0.3
302b22
 
302b22
-kskonly 		NS	ns.kskonly
302b22
+kskonly			NS	ns.kskonly
302b22
 ns.kskonly		A	10.53.0.3
302b22
 
302b22
 update-nsec3		NS	ns.update-nsec3
302b22
diff --git a/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
302b22
new file mode 100644
302b22
index 0000000000..c9e7c2b3da
302b22
--- /dev/null
302b22
+++ b/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
302b22
@@ -0,0 +1,27 @@
302b22
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
302b22
+;
302b22
+; This Source Code Form is subject to the terms of the Mozilla Public
302b22
+; License, v. 2.0. If a copy of the MPL was not distributed with this
302b22
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
302b22
+;
302b22
+; See the COPYRIGHT file distributed with this work for additional
302b22
+; information regarding copyright ownership.
302b22
+
302b22
+$TTL 300	; 5 minutes
302b22
+@			IN SOA	mname1. . (
302b22
+				2000042407 ; serial
302b22
+				20         ; refresh (20 seconds)
302b22
+				20         ; retry (20 seconds)
302b22
+				1814400    ; expire (3 weeks)
302b22
+				3600       ; minimum (1 hour)
302b22
+				)
302b22
+			NS	ns
302b22
+ns			A	10.53.0.3
302b22
+
302b22
+a			A	10.0.0.1
302b22
+b			A	10.0.0.2
302b22
+d			A	10.0.0.4
302b22
+z			A	10.0.0.26
302b22
+a.a.a.a			A	10.0.0.3
302b22
+*.e			A	10.0.0.6
302b22
+child			NS	ns2.example.
302b22
diff --git a/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
302b22
new file mode 100644
302b22
index 0000000000..c9e7c2b3da
302b22
--- /dev/null
302b22
+++ b/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
302b22
@@ -0,0 +1,27 @@
302b22
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
302b22
+;
302b22
+; This Source Code Form is subject to the terms of the Mozilla Public
302b22
+; License, v. 2.0. If a copy of the MPL was not distributed with this
302b22
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
302b22
+;
302b22
+; See the COPYRIGHT file distributed with this work for additional
302b22
+; information regarding copyright ownership.
302b22
+
302b22
+$TTL 300	; 5 minutes
302b22
+@			IN SOA	mname1. . (
302b22
+				2000042407 ; serial
302b22
+				20         ; refresh (20 seconds)
302b22
+				20         ; retry (20 seconds)
302b22
+				1814400    ; expire (3 weeks)
302b22
+				3600       ; minimum (1 hour)
302b22
+				)
302b22
+			NS	ns
302b22
+ns			A	10.53.0.3
302b22
+
302b22
+a			A	10.0.0.1
302b22
+b			A	10.0.0.2
302b22
+d			A	10.0.0.4
302b22
+z			A	10.0.0.26
302b22
+a.a.a.a			A	10.0.0.3
302b22
+*.e			A	10.0.0.6
302b22
+child			NS	ns2.example.
302b22
diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
302b22
index 14ebbc8ea8..6aa5d5350d 100644
302b22
--- a/bin/tests/system/dnssec/ns3/named.conf.in
302b22
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
302b22
@@ -150,6 +150,16 @@ zone "dnskey-unknown.example" {
302b22
 	file "dnskey-unknown.example.db.signed";
302b22
 };
302b22
 
302b22
+zone "dnskey-unsupported.example" {
302b22
+	type master;
302b22
+	file "dnskey-unsupported.example.db.signed";
302b22
+};
302b22
+
302b22
+zone "dnskey-unsupported-2.example" {
302b22
+	type master;
302b22
+	file "dnskey-unsupported-2.example.db.signed";
302b22
+};
302b22
+
302b22
 zone "dnskey-nsec3-unknown.example" {
302b22
 	type master;
302b22
 	nsec3-test-zone yes;
302b22
diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
302b22
index f95a6b7ea8..99e9b4958f 100644
302b22
--- a/bin/tests/system/dnssec/ns3/sign.sh
302b22
+++ b/bin/tests/system/dnssec/ns3/sign.sh
302b22
@@ -12,6 +12,12 @@
302b22
 SYSTEMTESTTOP=../..
302b22
 . $SYSTEMTESTTOP/conf.sh
302b22
 
302b22
+# Default algorithm for testing
302b22
+# In more recent versions set in conf.sh, include here for backward copatibility
302b22
+DEFAULT_ALGORITHM=RSASHA256
302b22
+DEFAULT_ALGORITHM_NUMBER=8
302b22
+DEFAULT_BITS=1280
302b22
+
302b22
 zone=secure.example.
302b22
 infile=secure.example.db.in
302b22
 zonefile=secure.example.db
302b22
@@ -193,7 +199,7 @@ cat $infile $keyname.key >$zonefile
302b22
 $SIGNER -P -3 - -U -A -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
302b22
 
302b22
 #
302b22
-# A zone with a unknown DNSKEY algorithm.
302b22
+# A zone that is signed with an unknown DNSKEY algorithm.
302b22
 # Algorithm 7 is replaced by 100 in the zone and dsset.
302b22
 #
302b22
 zone=dnskey-unknown.example.
302b22
@@ -211,6 +217,40 @@ awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { prin
302b22
 DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
302b22
 $DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
302b22
 
302b22
+#
302b22
+# A zone that is signed with an unsupported DNSKEY algorithm (3).
302b22
+# Algorithm 7 is replaced by 255 in the zone and dsset.
302b22
+#
302b22
+zone=dnskey-unsupported.example.
302b22
+infile=dnskey-unsupported.example.db.in
302b22
+zonefile=dnskey-unsupported.example.db
302b22
+
302b22
+keyname=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
302b22
+
302b22
+cat "$infile" "$keyname.key" > "$zonefile"
302b22
+
302b22
+"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
302b22
+
302b22
+awk '$4 == "DNSKEY" { $7 = 255; print } $4 == "RRSIG" { $6 = 255; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
302b22
+
302b22
+DSFILE="dsset-$(echo ${zone} |sed -e "s/\\.$//g")$TP"
302b22
+$DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
302b22
+
302b22
+#
302b22
+# A zone with a published unsupported DNSKEY algorithm (Reserved).
302b22
+# Different from above because this key is not intended for signing.
302b22
+#
302b22
+zone=dnskey-unsupported-2.example.
302b22
+infile=dnskey-unsupported-2.example.db.in
302b22
+zonefile=dnskey-unsupported-2.example.db
302b22
+
302b22
+ksk=$("$KEYGEN" -f KSK -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
302b22
+zsk=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
302b22
+
302b22
+cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"
302b22
+
302b22
+"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
302b22
+
302b22
 #
302b22
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
302b22
 # Algorithm 7 is replaced by 100 in the zone and dsset.
302b22
diff --git a/bin/tests/system/dnssec/ns3/unsupported-algorithm.key b/bin/tests/system/dnssec/ns3/unsupported-algorithm.key
302b22
new file mode 100644
302b22
index 0000000000..cc8bb9a51d
302b22
--- /dev/null
302b22
+++ b/bin/tests/system/dnssec/ns3/unsupported-algorithm.key
302b22
@@ -0,0 +1 @@
302b22
+dnskey-unsupported-2.example.	IN	DNSKEY	257 3 255 BJ0eV4dQC0pihdFXiVdlXjPDkzbv4fC+opEvK0RaDU7LLwFXPAi6DOc6tm7vcSr5Tgdnpoal3S4WqHuVw6I1pzy5mPPIZ3OpLSY/QeOyGc2QRAZtOXxiGxERHRjyAk7emlgGscM0Vty2oJVYRgTPX0lTwKX/V2H+mjEgp7u3tyG3cj5XBUQ8J0KUoqkrn1ZKrizH27aWiDaBUvqxJUcotaDhnydkNtcHoQIedm2b4qbyTQsdRkddJiSWxpveEcj3AMdt2PjU6Q4rgSWOc5ylPnW/O+GqqCEAkalGSF7ud0Nl3FVVR9iGwV/73FHzpBLawfkcHaODFmKRjzGqok8giKCih2vdNsxlx7gdJWJIPYYx/ZqNGc2ewzuAnnleJpZdXFo8uL3HYk6Pl51sSkfVUmcn/SM+ ;{id = 38688 (ksk), size = 768b}
302b22
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
302b22
index b1907c73a5..fdbfbdb779 100644
302b22
--- a/bin/tests/system/dnssec/tests.sh
302b22
+++ b/bin/tests/system/dnssec/tests.sh
302b22
@@ -3347,6 +3347,26 @@ n=`expr $n + 1`
302b22
 if [ $ret != 0 ]; then echo_i "failed"; fi
302b22
 status=`expr $status + $ret`
302b22
 
302b22
+echo_i "checking that unsupported DNSKEY algorithm validates as insecure ($n)"
302b22
+ret=0
302b22
+$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported.example A > dig.out.ns3.test$n
302b22
+$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unsupported.example A > dig.out.ns4.test$n
302b22
+grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
302b22
+grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1
302b22
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
302b22
+n=$((n+1))
302b22
+test "$ret" -eq 0 || echo_i "failed"
302b22
+status=$((status+ret))
302b22
+
302b22
+echo_i "checking that unsupported DNSKEY algorithm is in DNSKEY RRset ($n)"
302b22
+ret=0
302b22
+$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported-2.example DNSKEY > dig.out.test$n
302b22
+grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
302b22
+grep "dnskey-unsupported-2\.example\..*IN.*DNSKEY.*257 3 255" dig.out.test$n > /dev/null || ret=1
302b22
+n=$((n+1))
302b22
+test "$ret" -eq 0 || echo_i "failed"
302b22
+status=$((status+ret))
302b22
+
302b22
 echo_i "check that a lone non matching CDNSKEY record is rejected ($n)"
302b22
 ret=0
302b22
 (
302b22
diff --git a/bin/tests/system/dupsigs/ns1/reset_keys.sh b/bin/tests/system/dupsigs/ns1/reset_keys.sh
302b22
index f03503f762..42ce8ac20b 100644
302b22
--- a/bin/tests/system/dupsigs/ns1/reset_keys.sh
302b22
+++ b/bin/tests/system/dupsigs/ns1/reset_keys.sh
302b22
@@ -22,6 +22,8 @@ timetodnssec() {
302b22
 }
302b22
 
302b22
 KEYDIR=keys/signing.test
302b22
+KEYGEN="$KEYGEN -r $RANDFILE"
302b22
+
302b22
 KSK=`$KEYGEN -a RSASHA256 -b 1024 -K $KEYDIR -q -f KSK $zone`
302b22
 
302b22
 ZSK0=`$KEYGEN -a RSASHA256 -b 1024 -K $KEYDIR -q $zone`
302b22
diff --git a/bin/tests/system/mkeys/ns6/setup.sh b/bin/tests/system/mkeys/ns6/setup.sh
302b22
index 5ba1647da5..6f196c20db 100644
302b22
--- a/bin/tests/system/mkeys/ns6/setup.sh
302b22
+++ b/bin/tests/system/mkeys/ns6/setup.sh
302b22
@@ -16,7 +16,7 @@ zone=.
302b22
 zonefile=root.db
302b22
 
302b22
 # an RSA key
302b22
-rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
302b22
+rsakey=`$KEYGEN -a rsasha256 -b 2048 -r $RANDFILE -qfk rsasha256.`
302b22
 
302b22
 # a key with unsupported algorithm
302b22
 unsupportedkey=Kunknown.+255+00000
302b22
diff --git a/bin/tests/system/mkeys/setup.sh b/bin/tests/system/mkeys/setup.sh
302b22
index 100a86959b..79c877f85d 100644
302b22
--- a/bin/tests/system/mkeys/setup.sh
302b22
+++ b/bin/tests/system/mkeys/setup.sh
302b22
@@ -21,6 +21,8 @@ copy_setports ns1/named1.conf.in ns1/named.conf
302b22
 copy_setports ns2/named.conf.in ns2/named.conf
302b22
 copy_setports ns3/named.conf.in ns3/named.conf
302b22
 copy_setports ns5/named.conf.in ns5/named.conf
302b22
+copy_setports ns6/named.conf.in ns6/named.conf
302b22
+copy_setports ns7/named.conf.in ns7/named.conf
302b22
 
302b22
 cp ns5/named1.args ns5/named.args
302b22
 
302b22
diff --git a/bin/tests/system/mkeys/tests.sh b/bin/tests/system/mkeys/tests.sh
302b22
index b8410902d7..3533dbadbb 100644
302b22
--- a/bin/tests/system/mkeys/tests.sh
302b22
+++ b/bin/tests/system/mkeys/tests.sh
302b22
@@ -297,7 +297,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
302b22
 status=`expr $status + $ret`
302b22
 
302b22
 echo_i "reinitialize trust anchors"
302b22
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
302b22
+$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} . ns2
302b22
 rm -f ns2/managed-keys.bind*
302b22
 nextpart ns2/named.run > /dev/null
302b22
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns2
302b22
@@ -714,10 +714,10 @@ status=`expr $status + $ret`
302b22
 
302b22
 echo_i "reinitialize trust anchors, add unsupported algorithm ($n)"
302b22
 ret=0
302b22
-$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mkeys ns6
302b22
+$PERL $SYSTEMTESTTOP/stop.pl --port ${CONTROLPORT} . ns6
302b22
 rm -f ns6/managed-keys.bind*
302b22
 nextpart ns6/named.run > /dev/null
302b22
-$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns6
302b22
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} . ns6
302b22
 # log when an unsupported algorithm is encountered during startup
302b22
 wait_for_log "skipping managed key for 'unsupported\.': algorithm is unsupported" ns6/named.run
302b22
 if [ $ret != 0 ]; then echo_i "failed"; fi
302b22
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
302b22
index 1045f8ff21..984f28be26 100644
302b22
--- a/lib/dns/dnssec.c
302b22
+++ b/lib/dns/dnssec.c
302b22
@@ -1681,6 +1681,14 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
302b22
 	     result = dns_rdataset_next(&keys)) {
302b22
 		dns_rdata_reset(&rdata);
302b22
 		dns_rdataset_current(&keys, &rdata);
302b22
+
302b22
+		/* Skip unsupported algorithms */
302b22
+		REQUIRE(rdata.type == dns_rdatatype_key ||
302b22
+			rdata.type == dns_rdatatype_dnskey);
302b22
+		REQUIRE(rdata.length > 3);
302b22
+		if (!dst_algorithm_supported(rdata.data[3]))
302b22
+			goto skip;
302b22
+
302b22
 		RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &pubkey));
302b22
 		dst_key_setttl(pubkey, keys.ttl);
302b22
 
302b22
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
302b22
index 75e32202a9..9a638852d7 100644
302b22
--- a/lib/dns/include/dns/dnssec.h
302b22
+++ b/lib/dns/include/dns/dnssec.h
302b22
@@ -299,7 +299,7 @@ dns_dnssec_findmatchingkeys2(dns_name_t *origin, const char *directory,
302b22
 /*%<
302b22
  * Search 'directory' for K* key files matching the name in 'origin'.
302b22
  * Append all such keys, along with use hints gleaned from their
302b22
- * metadata, onto 'keylist'.
302b22
+ * metadata, onto 'keylist'.  Skip any unsupported algorithms.
302b22
  *
302b22
  *	Requires:
302b22
  *\li		'keylist' is not NULL
302b22
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
302b22
index 37b6a8a7fe..0729886c9f 100644
302b22
--- a/lib/dns/nsec3.c
302b22
+++ b/lib/dns/nsec3.c
302b22
@@ -1801,8 +1801,17 @@ dns_nsec3_maxiterations(dns_db_t *db, dns_dbversion_t *version,
302b22
 	     result == ISC_R_SUCCESS;
302b22
 	     result = dns_rdataset_next(&rdataset)) {
302b22
 		dns_rdata_t rdata = DNS_RDATA_INIT;
302b22
-
302b22
 		dns_rdataset_current(&rdataset, &rdata);
302b22
+
302b22
+		/* Skip unsupported algorithms when
302b22
+		 * calculating the maximum iterations.
302b22
+		 */
302b22
+		REQUIRE(rdata.type == dns_rdatatype_key ||
302b22
+			rdata.type == dns_rdatatype_dnskey);
302b22
+		REQUIRE(rdata.length > 3);
302b22
+		if (!dst_algorithm_supported(rdata.data[3]))
302b22
+			continue;
302b22
+
302b22
 		isc_buffer_init(&buffer, rdata.data, rdata.length);
302b22
 		isc_buffer_add(&buffer, rdata.length);
302b22
 		CHECK(dst_key_fromdns(dns_db_origin(db), rdataset.rdclass,
302b22
-- 
302b22
2.20.1
302b22