mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

3175. [bug] Fix how DNSSEC positive wildcard responses from a

Browse Source 
NSEC3 signed zone are validated.  Stop sending a
                        unnecessary NSEC3 record when generating such
                        responses. [RT #26200]
This commit is contained in:
Mark Andrews
2011-10-20 21:42:11 +00:00
parent 1946c596b4
commit ada40193c8
4 changed files with 68 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
lib/dns/validator.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: validator.c,v 1.205 2011/10/15 05:00:15 marka Exp $ */
/* $Id: validator.c,v 1.206 2011/10/20 21:42:11 marka Exp $ */
#include <config.h>
@@ -1922,13 +1922,14 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
isc_result_t result;
dns_fixedname_t fixed;
isc_boolean_t ignore = ISC_FALSE;
dns_name_t *wild;
val->attributes |= VALATTR_TRIEDVERIFY;
dns_fixedname_init(&fixed);
wild = dns_fixedname_name(&fixed);
again:
result = dns_dnssec_verify2(val->event->name, val->event->rdataset,
key, ignore, val->view->mctx, rdata,
dns_fixedname_name(&fixed));
key, ignore, val->view->mctx, rdata, wild);
if (result == DNS_R_SIGEXPIRED && val->view->acceptexpired) {
ignore = ISC_TRUE;
goto again;
@@ -1943,9 +1944,20 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
"verify rdataset (keyid=%u): %s",
keyid, isc_result_totext(result));
if (result == DNS_R_FROMWILDCARD) {
if (!dns_name_equal(val->event->name,
dns_fixedname_name(&fixed)))
if (!dns_name_equal(val->event->name, wild)) {
dns_name_t *closest;
unsigned int labels;
/*
* Compute the closest encloser in case we need it
* for the NSEC3 NOQNAME proof.
*/
closest = dns_fixedname_name(&val->closest);
dns_name_copy(wild, closest, NULL);
labels = dns_name_countlabels(closest) - 1;
dns_name_getlabelsequence(closest, 1, labels, closest);
val->attributes |= VALATTR_NEEDNOQNAME;
}
result = ISC_R_SUCCESS;
}
return (result);
@@ -2873,9 +2885,9 @@ findnsec3proofs(dns_validator_t *val) {
dns_name_t *name, tname;
isc_result_t result;
isc_boolean_t exists, data, optout, unknown;
isc_boolean_t setclosest, setnearest;
isc_boolean_t setclosest, setnearest, *setclosestp;
dns_fixedname_t fclosest, fnearest, fzonename;
dns_name_t *closest, *nearest, *zonename;
dns_name_t *closest, *nearest, *zonename, *closestp;
dns_name_t **proofs = val->event->proofs;
dns_rdataset_t *rdataset, trdataset;
@@ -2922,6 +2934,25 @@ findnsec3proofs(dns_validator_t *val) {
if (dns_name_countlabels(zonename) == 0)
return (ISC_R_SUCCESS);
/*
* If the val->closest is set then we want to use it otherwise
* we need to discover it.
*/
if (dns_name_countlabels(dns_fixedname_name(&val->closest)) != 0) {
char namebuf[DNS_NAME_FORMATSIZE];
dns_name_format(dns_fixedname_name(&val->closest),
namebuf, sizeof(namebuf));
validator_log(val, ISC_LOG_DEBUG(3), "closest encloser from "
"wildcard signature '%s'", namebuf);
dns_name_copy(dns_fixedname_name(&val->closest), closest, NULL);
closestp = NULL;
setclosestp = NULL;
} else {
closestp = closest;
setclosestp = &setclosest;
}
for (result = val_rdataset_first(val, &name, &rdataset);
result == ISC_R_SUCCESS;
result = val_rdataset_next(val, &name, &rdataset))
@@ -2939,8 +2970,8 @@ findnsec3proofs(dns_validator_t *val) {
unknown = ISC_FALSE;
(void)nsec3noexistnodata(val, val->event->name, name, rdataset,
zonename, &exists, &data, &optout,
&unknown, &setclosest, &setnearest,
closest, nearest);
&unknown, setclosestp, &setnearest,
closestp, nearest);
if (setclosest)
proofs[DNS_VALIDATOR_CLOSESTENCLOSER] = name;
if (unknown)