mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

check all RSA algorithms for weak keys

Browse Source
This commit is contained in:
Mark Andrews
2019-02-18 12:34:44 +11:00
parent 56106437b0
commit 30a50f9be4
1 changed files with 29 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
lib/dns/zone.c
View File

@@ -3220,8 +3220,6 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdataset_t rdataset;
isc_result_t result;
bool logit, foundrsa = false;
const char *algorithm;
result = dns_db_findnode(db, &zone->origin, false, &node);
if (result != ISC_R_SUCCESS) {
@@ -3260,20 +3258,42 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
* a more conservative choice would be 65537 (F4, the fourth
* fermat number).
*/
if (dnskey.algorithm == DST_ALG_RSASHA1 &&
dnskey.datalen > 1 && dnskey.data[0] == 1 &&
if (dnskey.datalen > 1 && dnskey.data[0] == 1 &&
dnskey.data[1] == 3)
{
if (dnskey.algorithm == DST_ALG_RSASHA1) {
logit = !foundrsa;
foundrsa = true;
const char *algorithm = "";
isc_region_t r;
bool logit = true;
dns_rdata_toregion(&rdata, &r);
switch (dnskey.algorithm) {
case DNS_KEYALG_RSAMD5:
algorithm = "RSAMD5";
break;
case DNS_KEYALG_RSASHA1:
algorithm = "RSASHA1";
break;
case DNS_KEYALG_NSEC3RSASHA1:
algorithm = "NSEC3RSASHA1";
break;
case DNS_KEYALG_RSASHA256:
algorithm = "RSASHA236";
break;
case DNS_KEYALG_RSASHA512:
algorithm = "RSASHA512";
break;
default:
logit = false;
break;
}
if (logit) {
dnssec_log(zone, ISC_LOG_WARNING,
"weak %s (%u) key found "
"(exponent=3)", algorithm,
dnskey.algorithm);
"(exponent=3, id=%u)", algorithm,
dnskey.algorithm,
dst_region_computeid(&r));
}
}
dns_rdata_reset(&rdata);