diff --git a/CHANGES b/CHANGES index fcd52335fb..257a5a5237 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ +3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185] + 3703. [func] To improve recursive resolver performance, cache records which are still being requested by clients can now be automatically refreshed from the diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index b19e3d7b85..1f25601fac 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -2387,5 +2387,19 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I:check the acceptance of seconds as inception and expiration times ($n)" +ret=0 +in="NSEC 8 0 86400 1390003200 1389394800 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i+UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2rOo=" + +exp="NSEC 8 0 86400 20140118000000 20140110230000 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i +UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2 rOo=" + +out=`echo "IN RRSIG $in" | $RRCHECKER -p | sed 's/^IN.RRSIG.//'` +[ "$out" = "$exp" ] || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + + + echo "I:exit status: $status" exit $status diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c index f200c5788b..7bda5159a2 100644 --- a/lib/dns/rdata/generic/rrsig_46.c +++ b/lib/dns/rdata/generic/rrsig_46.c @@ -90,7 +90,19 @@ fromtext_rrsig(ARGS_FROMTEXT) { */ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, ISC_FALSE)); - RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_expire)); + if (strlen(DNS_AS_STR(token)) <= 10U && + *DNS_AS_STR(token) != '-' && *DNS_AS_STR(token) != '+') { + char *end; + unsigned long l; + + l = strtoul(DNS_AS_STR(token), &end, 10); + if (l == ULONG_MAX || *end != 0) + RETTOK(DNS_R_SYNTAX); + if ((isc_uint64_t)l > (isc_uint64_t)0xffffffff) + RETTOK(ISC_R_RANGE); + time_expire = l; + } else + RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_expire)); RETERR(uint32_tobuffer(time_expire, target)); /* @@ -98,7 +110,19 @@ fromtext_rrsig(ARGS_FROMTEXT) { */ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, ISC_FALSE)); - RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_signed)); + if (strlen(DNS_AS_STR(token)) <= 10U && + *DNS_AS_STR(token) != '-' && *DNS_AS_STR(token) != '+') { + char *end; + unsigned long l; + + l = strtoul(DNS_AS_STR(token), &end, 10); + if (l == ULONG_MAX || *end != 0) + RETTOK(DNS_R_SYNTAX); + if ((isc_uint64_t)l > (isc_uint64_t)0xffffffff) + RETTOK(ISC_R_RANGE); + time_signed = l; + } else + RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_signed)); RETERR(uint32_tobuffer(time_signed, target)); /*