mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-05 09:05:40 +00:00
Code Issues Releases Wiki Activity

handle CDS deletion record in consistancy checks

Browse Source
This commit is contained in:
Mark Andrews
2020-01-13 15:08:17 +11:00
parent 77332eb2c8
commit 0adb4b25d3
2 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
lib/dns/zone.c
View File

@@ -19177,9 +19177,11 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
/*
* For each DNSSEC algorithm in the CDS RRset there must be
* a matching DNSKEY record.
* a matching DNSKEY record with the exception of a CDS deletion
* record which must be by itself.
*/
if (dns_rdataset_isassociated(&cds)) {
bool delete = false;
memset(algorithms, 0, sizeof(algorithms));
for (result = dns_rdataset_first(&cds);
result == ISC_R_SUCCESS;
@@ -19188,6 +19190,16 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
dns_rdata_cds_t structcds;
dns_rdataset_current(&cds, &crdata);
/*
* CDS deletion record has this form "0 0 0 00" which
* is 5 zero octets.
*/
if (crdata.length == 5U &&
memcmp(crdata.data, "\0\0\0\0", 5) == 0)
{
delete = true;
continue;
}
CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL));
if (algorithms[structcds.algorithm] == 0)
algorithms[structcds.algorithm] = 1;
@@ -19211,7 +19223,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
goto failure;
}
for (i = 0; i < sizeof(algorithms); i++) {
if (algorithms[i] == 1) {
if (delete) {
if (algorithms[i] != 0) {
result = DNS_R_BADCDNSKEY;
goto failure;
}
} else if (algorithms[i] == 1) {
result = DNS_R_BADCDNSKEY;
goto failure;
}