From 81b8e58565c0b07b7d38a2ff6307e5275026a1d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 4 Nov 2025 14:24:41 +0100 Subject: [PATCH] Add test case into dnssec system test for new regression https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195 Resolves: RHEL-123329 --- ...9.20-CVE-2025-8677-dual-signing-test.patch | 137 ++++++++++++++++++ bind9.18.spec | 3 + 2 files changed, 140 insertions(+) create mode 100644 bind-9.20-CVE-2025-8677-dual-signing-test.patch diff --git a/bind-9.20-CVE-2025-8677-dual-signing-test.patch b/bind-9.20-CVE-2025-8677-dual-signing-test.patch new file mode 100644 index 0000000..cbfff8e --- /dev/null +++ b/bind-9.20-CVE-2025-8677-dual-signing-test.patch @@ -0,0 +1,137 @@ +From 748bf1ee0681bd2a2bc0b3dfa8634787017818c3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Sat, 1 Nov 2025 12:00:59 +0100 +Subject: [PATCH] Add a system test with one good and one bad algorithm + +The case where there would be one supported algorithm and one already +unsupported (like RSAMD5 or RSASHA1) was missing. + +(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd) +--- + bin/tests/system/dnssec/clean.sh | 1 + + bin/tests/system/dnssec/ns2/example.db.in | 4 +++ + bin/tests/system/dnssec/ns2/sign.sh | 3 ++- + bin/tests/system/dnssec/ns3/named.conf.in | 6 +++++ + bin/tests/system/dnssec/ns3/sign.sh | 31 +++++++++++++++++++++++ + bin/tests/system/dnssec/tests.sh | 11 ++++++++ + 6 files changed, 55 insertions(+), 1 deletion(-) + +diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh +index 1a933ad..aa35122 100644 +--- a/bin/tests/system/dnssec/clean.sh ++++ b/bin/tests/system/dnssec/clean.sh +@@ -69,6 +69,7 @@ rm -f ./ns3/dnskey-unsupported.example.db.tmp + rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl + rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db + rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db ++rm -f ./ns3/extrabadkey.example.db + rm -f ./ns3/future.example.db ./ns3/trusted-future.key + rm -f ./ns3/inline.example.db.signed + rm -f ./ns3/kskonly.example.db +diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in +index f711f58..63d41e5 100644 +--- a/bin/tests/system/dnssec/ns2/example.db.in ++++ b/bin/tests/system/dnssec/ns2/example.db.in +@@ -168,4 +168,8 @@ ns.managed-future A 10.53.0.3 + revkey NS ns.revkey + ns.revkey A 10.53.0.3 + ++; A secure subdomain with extra bad key ++extrabadkey NS ns3.extrabadkey ++ns3.extrabadkey A 10.53.0.3 ++ + dname-at-apex-nsec3 NS ns3 +diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh +index b60e82a..eb00806 100644 +--- a/bin/tests/system/dnssec/ns2/sign.sh ++++ b/bin/tests/system/dnssec/ns2/sign.sh +@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \ + ttlpatch split-dnssec split-smart expired expiring upper lower \ + dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \ + dnskey-nsec3-unknown managed-future revkey \ +- dname-at-apex-nsec3 occluded; do ++ dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ ++ extrabadkey; do + cp "../ns3/dsset-$subdomain.example." . + done + +diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in +index 680cff5..3536046 100644 +--- a/bin/tests/system/dnssec/ns3/named.conf.in ++++ b/bin/tests/system/dnssec/ns3/named.conf.in +@@ -84,6 +84,12 @@ zone "insecure2.example" { + allow-update { any; }; + }; + ++zone "extrabadkey.example" { ++ type primary; ++ file "extrabadkey.example.db.signed"; ++ allow-update { any; }; ++}; ++ + zone "insecure.nsec3.example" { + type primary; + file "insecure.nsec3.example.db"; +diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh +index 14fc709..743a0e4 100644 +--- a/bin/tests/system/dnssec/ns3/sign.sh ++++ b/bin/tests/system/dnssec/ns3/sign.sh +@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}." + cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \ + "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile" + "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null ++ ++# ++# ++# ++zone=extrabadkey.example. ++infile=template.db.in ++zonefile=extrabadkey.example.db ++ ++# Add KSK and ZSK that we will mangle to RSAMD5 ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" ++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Mangle the signatures to RSAMD5 and save them for future use ++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5" ++ ++# Now add normal KSK and ZSK to the zone file ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" ++ ++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file ++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile" ++ ++# Sign normally ++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Add the mangled signatures to signed zone file ++cat "$zonefile.signed.rsamd5" >> "$zonefile.signed" ++rm "$zonefile.signed.rsamd5" +diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh +index c7b1c3a..e908317 100644 +--- a/bin/tests/system/dnssec/tests.sh ++++ b/bin/tests/system/dnssec/tests.sh +@@ -4468,5 +4468,16 @@ n=$((n + 1)) + if [ "$ret" -ne 0 ]; then echo_i "failed"; fi + status=$((status + ret)) + ++echo_i "checking extra-bad-algorithm positive validation ($n)" ++ret=0 ++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1 ++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1 ++digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 ++grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1 ++grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1 ++n=$((n + 1)) ++test "$ret" -eq 0 || echo_i "failed" ++status=$((status + ret)) ++ + echo_i "exit status: $status" + [ $status -eq 0 ] || exit 1 +-- +2.51.1 + diff --git a/bind9.18.spec b/bind9.18.spec index bd86e29..615a480 100644 --- a/bind9.18.spec +++ b/bind9.18.spec @@ -141,6 +141,8 @@ Patch224: bind-9.18-CVE-2025-40778.patch Patch225: bind-9.18-CVE-2025-40780.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194 Patch226: bind-9.20-CVE-2025-8677-dual-signing.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195 +Patch227: bind-9.20-CVE-2025-8677-dual-signing-test.patch %{?systemd_ordering} Requires: coreutils @@ -990,6 +992,7 @@ fi; %changelog * Fri Oct 31 2025 Petr Menšík - 32:9.18.29-7 - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) +- Add upstream created test to this regression * Thu Oct 23 2025 Petr Menšík - 32:9.18.29-6 - Refuse malformed DNSKEY records (CVE-2025-8677)