[GitHub] [trafficcontrol] elsloo opened a new issue #4092: DNSSEC key maintenance and snapshot race condition

[GitBox <gi...@apache.org>]

elsloo opened a new issue #4092: DNSSEC key maintenance and snapshot race condition
URL: https://github.com/apache/trafficcontrol/issues/4092
 
 
   <!--
   ************ STOP!! ************
   If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact
   the Apache Software Foundation Security Team at security@trafficcontrol.apache.org and follow the
   guidelines at https://www.apache.org/security/ regarding vulnerability disclosure.
   -->
   
   <!--
   - For *SUPPORT QUESTIONS*, use the
   [Traffic Control slack channels](https://traffic-control-cdn.slack.com) or [Traffic Control mailing lists](http://trafficcontrol.apache.org/mailing_lists/).
   - Before submitting, please **SEARCH GITHUB** for a similar issue or PR. -->
   
   ## I'm submitting a ...
   <!-- (check all that apply with "[x]") -->
   <!--- security vulnerability (STOP!! - see above)-->
   - [X] bug report
   - [ ] new feature / enhancement request
   - [ ] improvement request (usability, performance, tech debt, etc.)
   - [ ] other <!--(Please do not submit support requests here - see above)-->
   
   ## Traffic Control components affected ...
   <!-- (check all that apply with "[x]") -->
   - [ ] CDN in a Box
   - [X] Documentation
   - [ ] Grove
   - [ ] Traffic Control Client
   - [ ] Traffic Monitor
   - [ ] Traffic Ops
   - [ ] Traffic Ops ORT
   - [ ] Traffic Portal
   - [X] Traffic Router
   - [ ] Traffic Stats
   - [ ] Traffic Vault
   - [ ] unknown
   
   ## Current behavior:
   <!-- Describe how the bug manifests / how the current features are insufficient. -->
   If DNSSEC is enabled on an ATC CDN a possible race condition exists that can lead to data loss inside the ZoneManager. If new DNSSEC keys are detected by the DNSSEC key maintenance process, it begins a full resign of all zone material. If a CRConfig snapshot is performed, and it propagates to the Traffic Router while the zone signing activity is running, it cancels that activity. When that happens, data loss occurs inside the ZoneManager due to improper exception handling. Eventually ZoneManager recovers when the CRConfig is processed. During the delta, Traffic Router may respond with REFUSED for some or all DNS queries.
   
   ## Expected / new behavior:
   <!-- Describe what the behavior would be without the bug / how the feature would improve Traffic Control -->
   The new behavior moves the data structure swaps into the try block such that if the zone signing activity started by the key maintenance routine is terminated, the swaps do not occur. This allows the CRConfig to replace that process, sign the new data correctly with the new keys, then perform the swap.
   
   ## Minimal reproduction of the problem with instructions:
   <!--
   If the current behavior is a bug or you can illustrate your feature request better with an example,
   please provide the *STEPS TO REPRODUCE* and include the applicable TC version.
   -->
   With DNSSEC enabled, and with many delivery services enabled configure the keystore.maintenance.interval CRConfig.json parameter to something small, perhaps 10 seconds. Snapshot the CRConfig. After this change has been processed, create a new delivery service and wait for 10 seconds, then snapshot. If the test delivery service configuration is sufficient for the key maintenance routine to still be running when the CRConfig snapshot propagates to the CRConfig, results will be REFUSED for the CDN TLD until the CRConfig completes processing.
   
   ## Anything else:
   <!-- e.g. stacktraces, related issues, suggestions how to fix -->
   
   <!--
   Licensed to the Apache Software Foundation (ASF) under one
   or more contributor license agreements.  See the NOTICE file
   distributed with this work for additional information
   regarding copyright ownership.  The ASF licenses this file
   to you under the Apache License, Version 2.0 (the
   "License"); you may not use this file except in compliance
   with the License.  You may obtain a copy of the License at
   
       http://www.apache.org/licenses/LICENSE-2.0
   
   Unless required by applicable law or agreed to in writing,
   software distributed under the License is distributed on an
   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   KIND, either express or implied.  See the License for the
   specific language governing permissions and limitations
   under the License.
   -->

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services