mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-02 15:45:25 +00:00
Code Issues Releases Wiki Activity

Warn if there is excessive NSEC3 iterations

Browse Source
This commit is contained in:
Mark Andrews
2021-04-23 14:23:00 +10:00
parent aa26cde2ae
commit c9f5f8a059
1 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
lib/dns/zone.c
View File

@@ -3869,13 +3869,12 @@ cleanup:
static isc_result_t static isc_result_t
check_nsec3param(dns_zone_t *zone, dns_db_t *db) { check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
bool ok = false;
dns_dbnode_t *node = NULL; dns_dbnode_t *node = NULL;
dns_rdataset_t rdataset;
dns_dbversion_t *version = NULL; dns_dbversion_t *version = NULL;
dns_rdata_nsec3param_t nsec3param; dns_rdata_nsec3param_t nsec3param;
bool ok = false; dns_rdataset_t rdataset;
isc_result_t result; isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
bool dynamic = (zone->type == dns_zone_master) bool dynamic = (zone->type == dns_zone_master)
? dns_zone_isdynamic(zone, false) ? dns_zone_isdynamic(zone, false)
: false; : false;
@@ -3906,18 +3905,21 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
goto cleanup; goto cleanup;
} }
/*
* For dynamic zones we must support every algorithm so we can
* regenerate all the NSEC3 chains.
* For non-dynamic zones we only need to find a supported algorithm.
*/
for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
result = dns_rdataset_next(&rdataset)) result = dns_rdataset_next(&rdataset))
{ {
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdataset_current(&rdataset, &rdata); dns_rdataset_current(&rdataset, &rdata);
result = dns_rdata_tostruct(&rdata, &nsec3param, NULL); result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
dns_rdata_reset(&rdata); RUNTIME_CHECK(result == ISC_R_SUCCESS);
INSIST(result == ISC_R_SUCCESS);
/*
* For dynamic zones we must support every algorithm so we
* can regenerate all the NSEC3 chains.
* For non-dynamic zones we only need to find a supported
* algorithm.
*/
if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NSEC3TESTZONE) && if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NSEC3TESTZONE) &&
nsec3param.hash == DNS_NSEC3_UNKNOWNALG && !dynamic) nsec3param.hash == DNS_NSEC3_UNKNOWNALG && !dynamic)
{ {
@@ -3945,6 +3947,16 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
} else { } else {
ok = true; ok = true;
} }
/*
* Warn if the zone has excessive NSEC3 iterations.
*/
if (nsec3param.iterations > dns_nsec3_maxiterations()) {
dnssec_log(zone, ISC_LOG_WARNING,
"excessive NSEC3PARAM iterations %u > %u",
nsec3param.iterations,
dns_nsec3_maxiterations());
}
} }
if (result == ISC_R_NOMORE) { if (result == ISC_R_NOMORE) {
result = ISC_R_SUCCESS; result = ISC_R_SUCCESS;