shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-09 01:18:19 +03:00
Code

resolved: probe for dnssec support in allow-downgrade mode

Browse Source 
Previously, sd-resolved unnecessarily requested SOA records for each dns
label in the query, even though they are not needed for the chain of
trust. Since 47690634f1, only the necessary records are queried when
validating.

This is actually a problem in allow-downgrade mode, since we will no
longer attempt a query for a record that we know is signed a priori, and
will therefore never update our belief about the state of dnssec support
in the recursive resolver.

Rectify this by reintroducing a query for the root zone SOA in the
allow-downgrade case, specifically to test that the resolver attaches
the RRSIGs which we know must exist.

Fixes: 47690634f1 ("resolved: don't request the SOA for every dns label")
This commit is contained in:
Ronan Pigott 2024-04-30 22:15:18 -07:00 committed by Luca Boccassi
parent dafcba5940
commit 5237ffdf2b
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/resolve/resolved-dns-transaction.c
View File

@ -2695,6 +2695,21 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
if (r < 0)
return r;
if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE && dns_name_is_root(name)) {
_cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
/* We made it all the way to the root zone. If we are in allow-downgrade
* mode, we need to make at least one request that we can be certain should
* have been signed, to test for servers that are not dnssec aware. */
soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
if (!soa)
return -ENOMEM;
log_debug("Requesting root zone SOA to probe dnssec support.");
r = dns_transaction_request_dnssec_rr(t, soa);
if (r < 0)
return r;
}
break;
}