picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

resolved: refuse validating wildcard RRs for SOA, NSEC3, DNAME

This commit is contained in:
Lennart Poettering 2016-01-13 02:29:31 +01:00
parent 7160eb1b86
commit e8233bce19
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/resolve/dns-type.c
View File

@ -120,6 +120,21 @@ bool dns_type_may_redirect(uint16_t type) {
DNS_TYPE_KEY);
}
bool dns_type_may_wildcard(uint16_t type) {
/* The following records may not be expanded from wildcard RRsets */
if (dns_type_is_pseudo(type))
return false;
return !IN_SET(type,
DNS_TYPE_NSEC3,
DNS_TYPE_SOA,
/* Prohibited by https://tools.ietf.org/html/rfc4592#section-4.4 */
DNS_TYPE_DNAME);
}
bool dns_type_is_dnssec(uint16_t type) {
return IN_SET(type,
DNS_TYPE_DS,

1
src/resolve/dns-type.h
View File

@ -131,6 +131,7 @@ bool dns_type_is_valid_rr(uint16_t type);
bool dns_type_may_redirect(uint16_t type);
bool dns_type_is_dnssec(uint16_t type);
bool dns_type_is_obsolete(uint16_t type);
bool dns_type_may_wildcard(uint16_t type);
bool dns_class_is_pseudo(uint16_t class);
bool dns_class_is_valid_rr(uint16_t class);

5
src/resolve/resolved-dns-dnssec.c
View File

@ -548,6 +548,11 @@ int dnssec_verify_rrset(
r = dns_name_suffix(DNS_RESOURCE_KEY_NAME(key), rrsig->rrsig.labels, &source);
if (r < 0)
return r;
if (r > 0 && !dns_type_may_wildcard(rrsig->rrsig.type_covered)) {
/* We refuse to validate NSEC3 or SOA RRs that are synthesized from wildcards */
*result = DNSSEC_INVALID;
return 0;
}
if (r == 1) {
/* If we stripped a single label, then let's see if that maybe was "*". If so, we are not really
* synthesized from a wildcard, we are the wildcard itself. Treat that like a normal name. */