shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-04 09:18:12 +03:00
Code

resolved: validate noerror response for CNAMEs

Browse Source 
CNAME doesn't exist at the zone apex. When we get an unsigned noerror
response to a direct query for a CNAME record, we don't yet know if this
name is zone apex. We already request the correct DS record in this
case, but previously skipped it at validation time, causing the answer
to appear bogus. Make sure to also consider the DS record for the query
name for negative replies.
This commit is contained in:
Ronan Pigott 2024-10-20 23:16:49 -07:00
parent 88bbf187a9
commit fe01376e44
2 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/resolve/resolved-dns-transaction.c
View File

@ -3073,16 +3073,6 @@ static int dns_transaction_requires_nsec(DnsTransaction *t) {
name = dns_resource_key_name(dns_transaction_key(t));
if (IN_SET(dns_transaction_key(t)->type, DNS_TYPE_DS, DNS_TYPE_CNAME, DNS_TYPE_DNAME)) {
/* We got a negative reply for this DS/CNAME/DNAME lookup? Check the parent in this case to
* see if this answer should have been signed. */
r = dns_name_parent(&name);
if (r < 0)
return r;
if (r == 0)
return true;
}
/* For all other RRs we check the DS on the same level to see
* if it's signed. */

2
test/units/TEST-75-RESOLVED.sh
View File

@ -496,6 +496,8 @@ testcase_08_resolved() {
grep -qF "15 mail.unsigned.test." "$RUN_OUT"
run resolvectl query --legend=no -t MX unsigned.test
grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT"
run dig @ns1.unsigned.test +noall +comments unsigned.test CNAME
grep -qF "status: NOERROR" "$RUN_OUT"
: "--- ZONE: signed.test (static DNSSEC) ---"
# Check the trust chain (with and without systemd-resolved in between