mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 05:57:52 +00:00
Code Issues Releases Wiki Activity

Warn if there is excessive NSEC3 iterations

Browse Source
This commit is contained in:
Mark Andrews 2021-04-23 14:23:00 +10:00
parent aa26cde2ae
commit c9f5f8a059
1 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
lib/dns/zone.c
View File

@ -3869,13 +3869,12 @@ cleanup:
static isc_result_t
check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
bool ok = false;
dns_dbnode_t *node = NULL;
dns_rdataset_t rdataset;
dns_dbversion_t *version = NULL;
dns_rdata_nsec3param_t nsec3param;
bool ok = false;
dns_rdataset_t rdataset;
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
bool dynamic = (zone->type == dns_zone_master)
? dns_zone_isdynamic(zone, false)
: false;
@ -3906,18 +3905,21 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
goto cleanup;
}
/*
* For dynamic zones we must support every algorithm so we can
* regenerate all the NSEC3 chains.
* For non-dynamic zones we only need to find a supported algorithm.
*/
for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
result = dns_rdataset_next(&rdataset))
{
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdataset_current(&rdataset, &rdata);
result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
dns_rdata_reset(&rdata);
INSIST(result == ISC_R_SUCCESS);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
/*
* For dynamic zones we must support every algorithm so we
* can regenerate all the NSEC3 chains.
* For non-dynamic zones we only need to find a supported
* algorithm.
*/
if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NSEC3TESTZONE) &&
nsec3param.hash == DNS_NSEC3_UNKNOWNALG && !dynamic)
{
@ -3945,6 +3947,16 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
} else {
ok = true;
}
/*
* Warn if the zone has excessive NSEC3 iterations.
*/
if (nsec3param.iterations > dns_nsec3_maxiterations()) {
dnssec_log(zone, ISC_LOG_WARNING,
"excessive NSEC3PARAM iterations %u > %u",
nsec3param.iterations,
dns_nsec3_maxiterations());
}
}
if (result == ISC_R_NOMORE) {
result = ISC_R_SUCCESS;