From a8f158b9296c7bc1d0f627715e626cc50a331efc Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Sat, 2 Jan 2016 21:33:17 +0100
Subject: [PATCH] resolved: don't accept NSEC3 iteration fields unbounded

---
 src/resolve/resolved-dns-dnssec.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c
index e4b32c7e4b..7736a67d96 100644
--- a/src/resolve/resolved-dns-dnssec.c
+++ b/src/resolve/resolved-dns-dnssec.c
@@ -53,6 +53,9 @@
 /* Permit a maximum clock skew of 1h 10min. This should be enough to deal with DST confusion */
 #define SKEW_MAX (1*USEC_PER_HOUR + 10*USEC_PER_MINUTE)
 
+/* Maximum number of NSEC3 iterations we'll do. */
+#define NSEC3_ITERATIONS_MAX 2048
+
 /*
  * The DNSSEC Chain of trust:
  *
@@ -1087,6 +1090,9 @@ int dnssec_nsec3_hash(DnsResourceRecord *nsec3, const char *name, void *ret) {
         if (nsec3->key->type != DNS_TYPE_NSEC3)
                 return -EINVAL;
 
+        if (nsec3->nsec3.iterations > NSEC3_ITERATIONS_MAX)
+                return -EOPNOTSUPP;
+
         algorithm = nsec3_hash_to_gcrypt_md(nsec3->nsec3.algorithm);
         if (algorithm < 0)
                 return algorithm;
@@ -1155,6 +1161,9 @@ static int nsec3_is_good(DnsResourceRecord *rr, DnsAnswerFlags flags, DnsResourc
         /* Ignore NSEC3 RRs whose algorithm we don't know */
         if (nsec3_hash_to_gcrypt_md(rr->nsec3.algorithm) < 0)
                 return 0;
+        /* Ignore NSEC3 RRs with an excessive number of required iterations */
+        if (rr->nsec3.iterations > NSEC3_ITERATIONS_MAX)
+                return 0;
 
         if (!nsec3)
                 return 1;