shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-09-22 13:45:21 +03:00
Code Activity

Merge pull request #23114 from yuwata/resolve-dnssec

Browse Source 
resolve: always request additional record to verify negative answer
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2022-05-17 16:53:09 +02:00
committed by GitHub
parent 776fabbc8b 26b23d1187
commit 80c48dd3a2
2 changed files with 13 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/resolve/resolved-dns-dnssec.c
View File

@@ -778,8 +778,7 @@ static hash_md_t algorithm_to_implementation_id(uint8_t algorithm) {
static void dnssec_fix_rrset_ttl( static void dnssec_fix_rrset_ttl(
DnsResourceRecord *list[], DnsResourceRecord *list[],
unsigned n, unsigned n,
DnsResourceRecord *rrsig, DnsResourceRecord *rrsig) {
usec_t realtime) {
assert(list); assert(list);
assert(n > 0); assert(n > 0);
@@ -1110,7 +1109,7 @@ int dnssec_verify_rrset(
/* Now, fix the ttl, expiry, and remember the synthesizing source and the signer */ /* Now, fix the ttl, expiry, and remember the synthesizing source and the signer */
if (r > 0) if (r > 0)
dnssec_fix_rrset_ttl(list, n, rrsig, realtime); dnssec_fix_rrset_ttl(list, n, rrsig);
if (r == 0) if (r == 0)
*result = DNSSEC_INVALID; *result = DNSSEC_INVALID;

28
src/resolve/resolved-dns-transaction.c
View File

@@ -2211,7 +2211,7 @@ static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const
return link_negative_trust_anchor_lookup(t->scope->link, name); return link_negative_trust_anchor_lookup(t->scope->link, name);
} }
static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) { static int dns_transaction_has_negative_answer(DnsTransaction *t) {
int r; int r;
assert(t); assert(t);
@@ -2230,14 +2230,7 @@ static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(dns_transaction_key(t))); r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(dns_transaction_key(t)));
if (r < 0) if (r < 0)
return r; return r;
if (r > 0) return !r;
return false;
/* The answer does not contain any RRs that match to the
* question. If so, let's see if there are any NSEC/NSEC3 RRs
* included. If not, the answer is unsigned. */
return !dns_answer_contains_nsec_or_nsec3(t->answer);
} }
static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) { static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
@@ -2561,14 +2554,15 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
* we got. Now, let's request what we need to validate what we * we got. Now, let's request what we need to validate what we
* didn't get... */ * didn't get... */
r = dns_transaction_has_unsigned_negative_answer(t); r = dns_transaction_has_negative_answer(t);
if (r < 0) if (r < 0)
return r; return r;
if (r > 0) { if (r > 0) {
const char *name; const char *name, *signed_status;
uint16_t type = 0; uint16_t type = 0;
name = dns_resource_key_name(dns_transaction_key(t)); name = dns_resource_key_name(dns_transaction_key(t));
signed_status = dns_answer_contains_nsec_or_nsec3(t->answer) ? "signed" : "unsigned";
/* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
* could also be used as indication that we are not at a zone apex, but in real world setups there are * could also be used as indication that we are not at a zone apex, but in real world setups there are
@@ -2581,21 +2575,21 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
r = dns_name_parent(&name); r = dns_name_parent(&name);
if (r > 0) { if (r > 0) {
type = DNS_TYPE_SOA; type = DNS_TYPE_SOA;
log_debug("Requesting parent SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty DS response).", log_debug("Requesting parent SOA (→ %s) to validate transaction %" PRIu16 " (%s, %s empty DS response).",
name, t->id, dns_resource_key_name(dns_transaction_key(t))); name, t->id, dns_resource_key_name(dns_transaction_key(t)), signed_status);
} else } else
name = NULL; name = NULL;
} else if (IN_SET(dns_transaction_key(t)->type, DNS_TYPE_SOA, DNS_TYPE_NS)) { } else if (IN_SET(dns_transaction_key(t)->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
type = DNS_TYPE_DS; type = DNS_TYPE_DS;
log_debug("Requesting DS (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).", log_debug("Requesting DS (→ %s) to validate transaction %" PRIu16 " (%s, %s empty SOA/NS response).",
name, t->id, name); name, t->id, name, signed_status);
} else { } else {
type = DNS_TYPE_SOA; type = DNS_TYPE_SOA;
log_debug("Requesting SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).", log_debug("Requesting SOA (→ %s) to validate transaction %" PRIu16 " (%s, %s empty non-SOA/NS/DS response).",
name, t->id, name); name, t->id, name, signed_status);
} }
if (name) { if (name) {