From c910c520cf87519de9db6c481feecfac30ee7558 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 8 Jun 2018 15:37:49 +0200 Subject: [PATCH 1/4] resolved: fix DNSKEY validation against DS Let's use the wireformat name, not the text version. Fixes: #8901 --- src/resolve/resolved-dns-dnssec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c index 3ad68c96fb7..a7e157bf46b 100644 --- a/src/resolve/resolved-dns-dnssec.c +++ b/src/resolve/resolved-dns-dnssec.c @@ -1153,7 +1153,7 @@ static int digest_to_gcrypt_md(uint8_t algorithm) { } int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds, bool mask_revoke) { - char owner_name[DNSSEC_CANONICAL_HOSTNAME_MAX]; + uint8_t wire_format[DNS_WIRE_FOMAT_HOSTNAME_MAX]; _cleanup_(gcry_md_closep) gcry_md_hd_t md = NULL; size_t hash_size; int md_algorithm, r; @@ -1192,7 +1192,7 @@ int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds, if (ds->ds.digest_size != hash_size) return 0; - r = dnssec_canonicalize(dns_resource_key_name(dnskey->key), owner_name, sizeof(owner_name)); + r = dns_name_to_wire_format(dns_resource_key_name(dnskey->key), wire_format, sizeof(wire_format), true); if (r < 0) return r; @@ -1200,7 +1200,7 @@ int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds, if (!md) return -EIO; - gcry_md_write(md, owner_name, r); + gcry_md_write(md, wire_format, r); if (mask_revoke) md_add_uint16(md, dnskey->dnskey.flags & ~DNSKEY_FLAG_REVOKE); else @@ -1213,7 +1213,7 @@ int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds, if (!result) return -EIO; - return memcmp(result, ds->ds.digest, ds->ds.digest_size) != 0; + return memcmp(result, ds->ds.digest, ds->ds.digest_size) == 0; } int dnssec_verify_dnskey_by_ds_search(DnsResourceRecord *dnskey, DnsAnswer *validated_ds) { From 6d67385fcd6d24d5e1cc8509a4b426c9973bf904 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 8 Jun 2018 15:38:56 +0200 Subject: [PATCH 2/4] test: add www.dnssec-bogus.sg to list of domains to test in DNSSEC complex test --- src/resolve/test-dnssec-complex.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/resolve/test-dnssec-complex.c b/src/resolve/test-dnssec-complex.c index 072738fb744..efacce6cc86 100644 --- a/src/resolve/test-dnssec-complex.c +++ b/src/resolve/test-dnssec-complex.c @@ -146,6 +146,10 @@ int main(int argc, char* argv[]) { test_rr_lookup(bus, ".wilda.rhybar.ecdsa.0skar.cz", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED); test_hostname_lookup(bus, ".wilda.rhybar.ecdsa.0skar.cz", AF_INET, BUS_ERROR_DNSSEC_FAILED); + /* Missing DS for DNSKEY */ + test_rr_lookup(bus, "www.dnssec-bogus.sg", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED); + test_hostname_lookup(bus, "www.dnssec-bogus.sg", AF_INET, BUS_ERROR_DNSSEC_FAILED); + /* NXDOMAIN in NSEC domain */ test_rr_lookup(bus, "hhh.nasa.gov", DNS_TYPE_A, _BUS_ERROR_DNS "NXDOMAIN"); test_hostname_lookup(bus, "hhh.nasa.gov", AF_UNSPEC, _BUS_ERROR_DNS "NXDOMAIN"); From 6561918f5977a39e1e29b975f52b06f1569da6f3 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 8 Jun 2018 15:41:37 +0200 Subject: [PATCH 3/4] resolved: use Oxford comma at once place As suggested by @keszybz in https://github.com/systemd/systemd/pull/9235#pullrequestreview-127150950 --- man/systemd-resolved.service.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml index 91887861ee2..96458096167 100644 --- a/man/systemd-resolved.service.xml +++ b/man/systemd-resolved.service.xml @@ -79,7 +79,7 @@ /etc/systemd/resolved.conf, the per-link static settings in /etc/systemd/network/*.network files (in case systemd-networkd.service8 is - used), the per-link dynamic settings received over DHCP and any DNS server information made available by other + used), the per-link dynamic settings received over DHCP, and any DNS server information made available by other system services. See resolved.conf5 and systemd.network5 for details From 5e55cde9b8e808747a3d278ca30d6b18dd2a7459 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 8 Jun 2018 16:05:18 +0200 Subject: [PATCH 4/4] resolved: fix typo in macro name --- src/libsystemd-network/dhcp6-option.c | 2 +- src/resolve/resolved-dns-dnssec.c | 6 +++--- src/shared/dns-domain.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/libsystemd-network/dhcp6-option.c b/src/libsystemd-network/dhcp6-option.c index 53531332c26..977fbeddbd9 100644 --- a/src/libsystemd-network/dhcp6-option.c +++ b/src/libsystemd-network/dhcp6-option.c @@ -141,7 +141,7 @@ int dhcp6_option_append_ia(uint8_t **buf, size_t *buflen, DHCP6IA *ia) { } int dhcp6_option_append_fqdn(uint8_t **buf, size_t *buflen, const char *fqdn) { - uint8_t buffer[1 + DNS_WIRE_FOMAT_HOSTNAME_MAX]; + uint8_t buffer[1 + DNS_WIRE_FORMAT_HOSTNAME_MAX]; int r; assert_return(buf && *buf && buflen && fqdn, -EINVAL); diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c index a7e157bf46b..ef996a418dd 100644 --- a/src/resolve/resolved-dns-dnssec.c +++ b/src/resolve/resolved-dns-dnssec.c @@ -700,7 +700,7 @@ int dnssec_verify_rrset( usec_t realtime, DnssecResult *result) { - uint8_t wire_format_name[DNS_WIRE_FOMAT_HOSTNAME_MAX]; + uint8_t wire_format_name[DNS_WIRE_FORMAT_HOSTNAME_MAX]; DnsResourceRecord **list, *rr; const char *source, *name; _cleanup_(gcry_md_closep) gcry_md_hd_t md = NULL; @@ -1153,7 +1153,7 @@ static int digest_to_gcrypt_md(uint8_t algorithm) { } int dnssec_verify_dnskey_by_ds(DnsResourceRecord *dnskey, DnsResourceRecord *ds, bool mask_revoke) { - uint8_t wire_format[DNS_WIRE_FOMAT_HOSTNAME_MAX]; + uint8_t wire_format[DNS_WIRE_FORMAT_HOSTNAME_MAX]; _cleanup_(gcry_md_closep) gcry_md_hd_t md = NULL; size_t hash_size; int md_algorithm, r; @@ -1269,7 +1269,7 @@ static int nsec3_hash_to_gcrypt_md(uint8_t algorithm) { } int dnssec_nsec3_hash(DnsResourceRecord *nsec3, const char *name, void *ret) { - uint8_t wire_format[DNS_WIRE_FOMAT_HOSTNAME_MAX]; + uint8_t wire_format[DNS_WIRE_FORMAT_HOSTNAME_MAX]; gcry_md_hd_t md = NULL; size_t hash_size; int algorithm; diff --git a/src/shared/dns-domain.h b/src/shared/dns-domain.h index 67208587cd9..e680288344b 100644 --- a/src/shared/dns-domain.h +++ b/src/shared/dns-domain.h @@ -25,7 +25,7 @@ #define DNS_HOSTNAME_MAX 253 /* Maximum length of a full hostname, on the wire, including the final NUL byte */ -#define DNS_WIRE_FOMAT_HOSTNAME_MAX 255 +#define DNS_WIRE_FORMAT_HOSTNAME_MAX 255 /* Maximum number of labels per valid hostname */ #define DNS_N_LABELS_MAX 127