DNS KSK rollover, local_unbound and 11.2-STABLE

Sat Oct 13 07:25:14 UTC 2018

13.10.2018 3:41, Dag-Erling Smørgrav wrote:

> Eugene Grosbein <eugen at grosbein.net> writes:
>> It seems that 11.2-STABLE still has old unbound version 1.5.10 having
>> no option trust-anchor-signaling.
>>
>> Can it be a reason that my home router running stable/11 r338011 as
>> NanoBSD with stock local_unbound
>> as DNS recursive service for LAN stopped working today?
> 
> No.  If it was working before, it already had both KSKs.

It worked a day before, and before that too.

> Try this:
> 
> % /usr/bin/host -c CH -t TXT trustanchor.unbound <router-ip>
> trustanchor.unbound descriptive text ". 19036 20326"
> 
> The first number is the old KSK, the second number is the new KSK.

# /usr/bin/host -c CH -t TXT trustanchor.unbound 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

Host trustanchor.unbound not found: 5(REFUSED)

# /usr/bin/host -c CH -t TXT version.bind 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

version.bind descriptive text "unbound 1.5.10"

> You can also check that your root.key has both entries:
> 
> % grep -c '^[^;]' /var/unbound/root.key
> 2

# grep -c '^[^;]' /var/unbound/root.key
1

This nanobsd was last updated using r338011 stable/12 sources.
Run-time changes to its RAM-based /var partition do not survive reboots, though.

> or just look inside:
> 
> . 172800 IN DNSKEY [...] ;{id = 19036 (ksk), size = 2048b} [...]
> . 172800 IN DNSKEY [...] ;{id = 20326 (ksk), size = 2048b} [...]
> 
> In any case, if unbound-anchor is unable to get and validate the KSK, it
> will fall back to getting it over http (using an unvalidated DNS lookup)
> and verifying the accompanying signature against a hardcoded x509
> certificate which is valid until 2023.

# cat /var/unbound/root.key
; autotrust trust anchor file
;;id: . 1
;;last_queried: 1539414586 ;;Sat Oct 13 14:09:46 2018
;;last_success: 1451318744 ;;Mon Dec 28 23:05:44 2015
;;next_probe_time: 1539415104 ;;Sat Oct 13 14:18:24 2018
;;query_failed: 159
;;query_interval: 43200
;;retry_time: 8640
.       172800  IN      DNSKEY  257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1448912140 ;;Tue Dec  1 02:35:40 2015

I've ran unbound-anchor manually and it changed /var/unbound/root.key to:

; autotrust trust anchor file
;;id: . 1
;;last_queried: 1539414744 ;;Sat Oct 13 14:12:24 2018
;;last_success: 1451318744 ;;Mon Dec 28 23:05:44 2015
;;next_probe_time: 1539415104 ;;Sat Oct 13 14:18:24 2018
;;query_failed: 171
;;query_interval: 43200
;;retry_time: 8640
.       172800  IN      DNSKEY  257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1448912140 ;;Tue Dec  1 02:35:40 2015

I've ran it again in verbose mode:

# unbound-anchor -vv
/var/unbound/root.key has content
last successful probe: Mon Dec 28 23:05:44 2015
the last successful probe was more than 30 days ago
/var/unbound/icannbundle.pem: No such file or directory
using builtin certificate
have 1 trusted certificates
trusted certificates (0/1)
        Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US
        Validity
            Not Before: Dec 23 04:19:12 2009 GMT
            Not After : Dec 18 04:19:12 2029 GMT
        Subject: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US
resolved server address 72.21.81.189
resolved server address 2606:2800:11f:bb5:f27:227f:1bbf:a0e
connect to 2606:2800:11f:bb5:f27:227f:1bbf:a0e
server SSL certificate
        Issuer: C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA
        Validity
            Not Before: Aug 31 00:00:00 2018 GMT
            Not After : Apr 23 12:00:00 2020 GMT
        Subject: C=US, ST=California, L=Los Angeles, O=Verizon Digital Media Services, Inc., CN=s2.wpc.edgecastcdn.net
SSL_write: GET /root-anchors/root-anchors.xml HTTP/1.1
SSL_write: Host: data.iana.org
SSL_write: User-Agent: unbound-anchor/1.5.10
SSL_write:
header: 'HTTP/1.1 200 OK'
header: 'Accept-Ranges: bytes'
header: 'Cache-Control: max-age=86400'
header: 'Content-Type: text/xml'
header: 'Date: Sat, 13 Oct 2018 07:14:35 GMT'
header: 'Etag: "28b-54794f6820000"'
header: 'Expires: Sun, 14 Oct 2018 07:14:35 GMT'
header: 'Last-Modified: Fri, 03 Feb 2017 00:00:00 GMT'
header: 'Server: ECAcc (nya/7964)'
header: 'Strict-Transport-Security: max-age=48211200; preload'
header: 'X-Cache: HIT'
header: 'X-Frame-Options: SAMEORIGIN'
header: 'Content-Length: 651'
at 0/651
read 651 data
fetched root-anchors/root-anchors.xml (651 bytes)
connect to 72.21.81.189
server SSL certificate
        Issuer: C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA
        Validity
            Not Before: Aug 31 00:00:00 2018 GMT
            Not After : Apr 23 12:00:00 2020 GMT
        Subject: C=US, ST=California, L=Los Angeles, O=Verizon Digital Media Services, Inc., CN=s2.wpc.edgecastcdn.net
SSL_write: GET /root-anchors/root-anchors.p7s HTTP/1.1
SSL_write: Host: data.iana.org
SSL_write: User-Agent: unbound-anchor/1.5.10
SSL_write:
header: 'HTTP/1.1 200 OK'
header: 'Accept-Ranges: bytes'
header: 'Cache-Control: max-age=86400'
header: 'Content-Type: application/pkcs7-signature'
header: 'Date: Sat, 13 Oct 2018 07:14:36 GMT'
header: 'Etag: "fff-54794f6820000"'
header: 'Expires: Sun, 14 Oct 2018 07:14:36 GMT'
header: 'Last-Modified: Fri, 03 Feb 2017 00:00:00 GMT'
header: 'Server: ECAcc (nya/79A2)'
header: 'Strict-Transport-Security: max-age=48211200; preload'
header: 'X-Cache: HIT'
header: 'X-Frame-Options: SAMEORIGIN'
header: 'Content-Length: 4095'
at 0/4095
read 4095 data
fetched root-anchors/root-anchors.p7s (4095 bytes)
parsed the PKCS7 signature
setup the X509_STORE
signer 0: Subject: /O=ICANN/CN=dnssec at iana.org/emailAddress=dnssec at iana.org
the PKCS7 signature verified
XML was parsed successfully, 2 keys
success: the anchor has been updated using the cert

Now I see that this files is updated frequently without my manual intervention,
every minute or so, but it still contains only old KSK and shows

;;last_success: 1451318744 ;;Mon Dec 28 23:05:44 2015