shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-27 07:22:31 +03:00
Code

resolved: do not reject NSEC records with empty bitmaps

Browse Source 
The assumption that no NSEC bitmap could be empty due to the presence of the bit representing
the record itself turns out to be flawed. See (the admittedly experimental) RFC4956 for a
counter example.
This commit is contained in:
Tom Gundersen 2015-11-25 22:22:38 +01:00
parent af143e3b69
commit 09eaf68ce4
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/resolve/resolved-dns-packet.c
View File

@ -1746,12 +1746,9 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
if (r < 0)
goto fail;
/* The types bitmap must contain at least the NSEC record itself, so an empty bitmap means
something went wrong */
if (bitmap_isclear(rr->nsec.types)) {
r = -EBADMSG;
goto fail;
}
/* We accept empty NSEC bitmaps. The bit indicating the presence of the NSEC record itself
* is redundant and in e.g., RFC4956 this fact is used to define a use for NSEC records
* without the NSEC bit set. */
break;