shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-03-08 20:58:20 +03:00
Code

resolved: only attempt non-answer SOA RRs if they are parents of our query

Browse Source 
There's no value in authenticating SOA RRs that are neither answer to
our question nor parent of our question (the latter being relevant so
that we have a TTL from the SOA field for negative caching of the actual
query).

By being to eager here, and trying to authenticate too much we run the
risk of creating cyclic deps between our transactions which then causes
the over-all authentication to fail.

Fixes: #9771
This commit is contained in:
Lennart Poettering 2018-12-17 21:14:17 +01:00
parent 1a126325eb
commit d5acaa51db
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/resolve/resolved-dns-transaction.c
View File

@ -2142,6 +2142,14 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
* it. */
continue;
/* Only bother with this if the SOA/NS RR we are looking at is actually a parent of
* what we are looking for, otherwise there's no value in it for us. */
r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
if (r < 0)
return r;
if (r == 0)
continue;
}
r = dnssec_has_rrsig(t->answer, rr->key);