check_dnssec_trace coredump

[mpiscaer]

Hi,

When I try to use the monitoringplug check_dnssec_trace and try to validate dnssec domains, when the validation is OK, I get an OK.

But the the validate fails I get a core dump

• dnssec.nl OK
• dnssec-failed.org: core dump
• github: not signed core dump

I have complied the script on an ubuntu precise.
Description: Ubuntu 12.04.5 LTS
Release: 12.04
Codename: precise

I use very dependency from the ubuntu repository.

I this normal behaviour?

Kind regards,

M. Piscaer

root@monitoringplug:/usr/local/lib/nagios/plugins# ./check_dnssec_trace -D dnssec.nl -k root.keys
OK - Trust for 'dnssec.nl' successfull traces from '.'
root@monitoringplug:/usr/local/lib/nagios/plugins# echo $?
0
root@monitoringplug:/usr/local/lib/nagios/plugins# ./check_dnssec_trace -D dnssec-failed.org -k root.keys
check_dnssec_trace: rdata.c:26: ldns_rdf_size: Assertion `rd != ((void )0)' failed.
Aborted (core dumped)
root@monitoringplug:/usr/local/lib/nagios/plugins# echo $?
134
root@monitoringplug:/usr/local/lib/nagios/plugins# ./check_dnssec_trace -D github.com -k root.keys
** glibc detected *** ./check_dnssec_trace: munmap_chunk(): invalid pointer: 0x0000000000407e5f ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7db26)[0x7febcf6f4b26]
./check_dnssec_trace[0x402973]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7febcf69876d]
./check_dnssec_trace[0x402d09]
======= Memory map: ========
00400000-0040a000 r-xp 00000000 fc:01 4556166 /usr/local/lib/nagios/plugins/check_dnssec_trace
00609000-0060a000 r--p 00009000 fc:01 4556166 /usr/local/lib/nagios/plugins/check_dnssec_trace
0060a000-0060b000 rw-p 0000a000 fc:01 4556166 /usr/local/lib/nagios/plugins/check_dnssec_trace
01a2c000-01a4d000 rw-p 00000000 00:00 0 [heap]
7febcec6b000-7febcec80000 r-xp 00000000 fc:01 4512830 /lib/x86_64-linux-gnu/libgcc_s.so.1
7febcec80000-7febcee7f000 ---p 00015000 fc:01 4512830 /lib/x86_64-linux-gnu/libgcc_s.so.1
7febcee7f000-7febcee80000 r--p 00014000 fc:01 4512830 /lib/x86_64-linux-gnu/libgcc_s.so.1
7febcee80000-7febcee81000 rw-p 00015000 fc:01 4512830 /lib/x86_64-linux-gnu/libgcc_s.so.1
7febcee81000-7febcee97000 r-xp 00000000 fc:01 4512844 /lib/x86_64-linux-gnu/libz.so.1.2.3.4
7febcee97000-7febcf096000 ---p 00016000 fc:01 4512844 /lib/x86_64-linux-gnu/libz.so.1.2.3.4
7febcf096000-7febcf097000 r--p 00015000 fc:01 4512844 /lib/x86_64-linux-gnu/libz.so.1.2.3.4
7febcf097000-7febcf098000 rw-p 00016000 fc:01 4512844 /lib/x86_64-linux-gnu/libz.so.1.2.3.4
7febcf098000-7febcf09a000 r-xp 00000000 fc:01 4512727 /lib/x86_64-linux-gnu/libdl-2.15.so
7febcf09a000-7febcf29a000 ---p 00002000 fc:01 4512727 /lib/x86_64-linux-gnu/libdl-2.15.so
7febcf29a000-7febcf29b000 r--p 00002000 fc:01 4512727 /lib/x86_64-linux-gnu/libdl-2.15.so
7febcf29b000-7febcf29c000 rw-p 00003000 fc:01 4512727 /lib/x86_64-linux-gnu/libdl-2.15.so
7febcf29c000-7febcf44e000 r-xp 00000000 fc:01 4512753 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7febcf44e000-7febcf64d000 ---p 001b2000 fc:01 4512753 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7febcf64d000-7febcf668000 r--p 001b1000 fc:01 4512753 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7febcf668000-7febcf673000 rw-p 001cc000 fc:01 4512753 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7febcf673000-7febcf677000 rw-p 00000000 00:00 0
7febcf677000-7febcf82b000 r-xp 00000000 fc:01 4512699 /lib/x86_64-linux-gnu/libc-2.15.so
7febcf82b000-7febcfa2a000 ---p 001b4000 fc:01 4512699 /lib/x86_64-linux-gnu/libc-2.15.so
7febcfa2a000-7febcfa2e000 r--p 001b3000 fc:01 4512699 /lib/x86_64-linux-gnu/libc-2.15.so
7febcfa2e000-7febcfa30000 rw-p 001b7000 fc:01 4512699 /lib/x86_64-linux-gnu/libc-2.15.so
7febcfa30000-7febcfa35000 rw-p 00000000 00:00 0
7febcfa35000-7febcfa7b000 r-xp 00000000 fc:01 4535179 /usr/lib/libldns.so.1.6.11
7febcfa7b000-7febcfc7a000 ---p 00046000 fc:01 4535179 /usr/lib/libldns.so.1.6.11
7febcfc7a000-7febcfc7b000 r--p 00045000 fc:01 4535179 /usr/lib/libldns.so.1.6.11
7febcfc7b000-7febcfc7f000 rw-p 00046000 fc:01 4535179 /usr/lib/libldns.so.1.6.11
7febcfc7f000-7febcfca1000 r-xp 00000000 fc:01 4512749 /lib/x86_64-linux-gnu/ld-2.15.so
7febcfe95000-7febcfe99000 rw-p 00000000 00:00 0
7febcfe9e000-7febcfea1000 rw-p 00000000 00:00 0
7febcfea1000-7febcfea2000 r--p 00022000 fc:01 4512749 /lib/x86_64-linux-gnu/ld-2.15.so
7febcfea2000-7febcfea4000 rw-p 00023000 fc:01 4512749 /lib/x86_64-linux-gnu/ld-2.15.so
7ffc91acf000-7ffc91af0000 rw-p 00000000 00:00 0 [stack]
7ffc91b3d000-7ffc91b3f000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted (core dumped)
root@monitoringplug:/usr/local/lib/nagios/plugins# echo $?
134

[jiuka]

This is a bug in the ldns version of precise. The called function should return a list of keys or NULL but raises a core dump. A manual compiled version of ldns 1.6.17 on trusty solves the problem.

http://nlnetlabs.nl/projects/ldns/doc/dnssec__verify_8c.html#ab2760e11af154c225f3ce6809aa1ae46

[mpiscaer]

Tnks, I have compiled ldns on an trusy machine.

The validation works on a domein that has been signed wrong like dnssec-failed.org, but domains that are not signed still gives me a coredump:

ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.3 LTS
Release: 14.04
Codename: trusty
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ /usr/local/lib/nagios/plugins/check_dnssec_trace --help
check_dnssec_trace v0.1 (monitoringplug 0.17.0-rc.1)
ldns v1.6.17
Copyright (c) 2009 - 2010 Marius Rieder marius.rieder@durchmesser.ch
Copyright (c) 2010-2014 Monitoring Plugins

Check description: Check if the zone signature is tracable.

Usage:
check_dnssec_trace [-H host] -D domain [-T domain] [-k file] [-t timeout]

Options:
-h, --help
Print detailed help screen.
-V, --version
Print version information.
-v, --verbose
Show details for command-line debugging.
-t, --timeout=INTEGER
Seconds before the check return with a timeout alert.
--eopt=[section][@file]
Read additional opts from section in ini-File.
--perfdata
Print performance data (if available).
-H, --hostname=ADDRESS
Host name or IP Address.
--tcp
Use TCP for DNS queries.
-D, --domain=DOMAIN
The name of the domain to check.
-T, --trace-from=DOMAIN
The name of the domain to trace from. (default: .)
-k, --trusted-keys=FILE
File to read trust-anchors from.

Keyfile Format:
The keyfile should be a Zonefile alike list of Trusted Keys or DS.
Create the file with 'dig -t <DNSKEY|DS> +noall +answer > file'.
Do not forget to verify the DNSKEY/DS record against a trustworthy source.
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ /usr/local/lib/nagios/plugins/check_dnssec_trace -D dnssec.nl -k /usr/local/lib/nagios/plugins/root.keys
OK - Trust for 'dnssec.nl' successfull traces from '.'
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ echo $?
0
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ /usr/local/lib/nagios/plugins/check_dnssec_trace -D dnssec-failed.org -k /usr/local/lib/nagios/plugins/root.keys
CRITICAL - No valid Signatur for SOA of 'dnssec-failed.org'
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ echo $?
2
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ /usr/local/lib/nagios/plugins/check_dnssec_trace -D github.com -k /usr/local/lib/nagios/plugins/root.keys*** Error in `/usr/local/lib/nagios/plugins/check_dnssec_trace': munmap_chunk(): invalid pointer: 0x0000000000407abf ***
Aborted (core dumped)
ubuntu@monitoringplug2:/usr/local/lib/nagios/plugins$ echo $?
134