aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDoug Barton <dougb@FreeBSD.org>2009-03-21 21:37:05 +0000
committerDoug Barton <dougb@FreeBSD.org>2009-03-21 21:37:05 +0000
commit6b52fc0a792f3f68a9bec5413913e371e9e6227f (patch)
treed52ef9bd84e11e48602591b6a7c6d7359ecf70bd
parenta60329dc0b1fdca9ddbd07bc19a811d6422771eb (diff)
downloadsrc-6b52fc0a792f3f68a9bec5413913e371e9e6227f.tar.gz
src-6b52fc0a792f3f68a9bec5413913e371e9e6227f.zip
Vendor import of BIND 9.4.3-P2vendor/bind9/9.4.3-P2
Notes
Notes: svn path=/vendor/bind9/dist/; revision=190218 svn path=/vendor/bind9/9.4.3-P2/; revision=190219; tag=vendor/bind9/9.4.3-P2
-rw-r--r--CHANGES5
-rw-r--r--lib/dns/validator.c79
-rw-r--r--version4
3 files changed, 74 insertions, 14 deletions
diff --git a/CHANGES b/CHANGES
index f3d53ee25330..8d1f22b8e381 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+ --- 9.4.3-P2 released ---
+
+2579. [bug] DNSSEC lookaside validation failed to handle unknown
+ algorithms. [RT #19479]
+
--- 9.4.3-P1 released ---
2522. [security] Handle -1 from DSA_do_verify().
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index e68633646ac5..685434bf299e 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: validator.c,v 1.119.18.41 2008/08/21 04:59:42 marka Exp $ */
+/* $Id: validator.c,v 1.119.18.41.2.1 2009/03/17 02:23:49 marka Exp $ */
/*! \file */
@@ -211,6 +211,37 @@ exit_check(dns_validator_t *val) {
return (ISC_TRUE);
}
+/*
+ * Check that we have atleast one supported algorithm in the DLV RRset.
+ */
+static inline isc_boolean_t
+dlv_algorithm_supported(dns_validator_t *val) {
+ dns_rdata_t rdata = DNS_RDATA_INIT;
+ dns_rdata_dlv_t dlv;
+ isc_result_t result;
+
+ for (result = dns_rdataset_first(&val->dlv);
+ result == ISC_R_SUCCESS;
+ result = dns_rdataset_next(&val->dlv)) {
+ dns_rdata_reset(&rdata);
+ dns_rdataset_current(&val->dlv, &rdata);
+ result = dns_rdata_tostruct(&rdata, &dlv, NULL);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+ if (!dns_resolver_algorithm_supported(val->view->resolver,
+ val->event->name,
+ dlv.algorithm))
+ continue;
+
+ if (dlv.digest_type != DNS_DSDIGEST_SHA256 &&
+ dlv.digest_type != DNS_DSDIGEST_SHA1)
+ continue;
+
+ return (ISC_TRUE);
+ }
+ return (ISC_FALSE);
+}
+
/*%
* Look in the NSEC record returned from a DS query to see if there is
* a NS RRset at this name. If it is found we are at a delegation point.
@@ -2297,19 +2328,36 @@ dlvfetched(isc_task_t *task, isc_event_t *event) {
sizeof(namebuf));
dns_rdataset_clone(&val->frdataset, &val->dlv);
val->havedlvsep = ISC_TRUE;
- validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found", namebuf);
- dlv_validator_start(val);
+ if (dlv_algorithm_supported(val)) {
+ validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found",
+ namebuf);
+ dlv_validator_start(val);
+ } else {
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "DLV %s found with no supported algorithms",
+ namebuf);
+ markanswer(val);
+ validator_done(val, ISC_R_SUCCESS);
+ }
} else if (eresult == DNS_R_NXRRSET ||
eresult == DNS_R_NXDOMAIN ||
eresult == DNS_R_NCACHENXRRSET ||
eresult == DNS_R_NCACHENXDOMAIN) {
- result = finddlvsep(val, ISC_TRUE);
+ result = finddlvsep(val, ISC_TRUE);
if (result == ISC_R_SUCCESS) {
- dns_name_format(dns_fixedname_name(&val->dlvsep),
- namebuf, sizeof(namebuf));
- validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found",
- namebuf);
- dlv_validator_start(val);
+ if (dlv_algorithm_supported(val)) {
+ dns_name_format(dns_fixedname_name(&val->dlvsep),
+ namebuf, sizeof(namebuf));
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "DLV %s found", namebuf);
+ dlv_validator_start(val);
+ } else {
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "DLV %s found with no supported "
+ "algorithms", namebuf);
+ markanswer(val);
+ validator_done(val, ISC_R_SUCCESS);
+ }
} else if (result == ISC_R_NOTFOUND) {
validator_log(val, ISC_LOG_DEBUG(3), "DLV not found");
markanswer(val);
@@ -2372,9 +2420,16 @@ startfinddlvsep(dns_validator_t *val, dns_name_t *unsecure) {
}
dns_name_format(dns_fixedname_name(&val->dlvsep), namebuf,
sizeof(namebuf));
- validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found", namebuf);
- dlv_validator_start(val);
- return (DNS_R_WAIT);
+ if (dlv_algorithm_supported(val)) {
+ validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found", namebuf);
+ dlv_validator_start(val);
+ return (DNS_R_WAIT);
+ }
+ validator_log(val, ISC_LOG_DEBUG(3), "DLV %s found with no supported "
+ "algorithms", namebuf);
+ markanswer(val);
+ validator_done(val, ISC_R_SUCCESS);
+ return (ISC_R_SUCCESS);
}
/*%
diff --git a/version b/version
index e9569219e7d1..1eb5a692d923 100644
--- a/version
+++ b/version
@@ -1,4 +1,4 @@
-# $Id: version,v 1.29.134.23.2.1 2008/12/24 00:21:22 marka Exp $
+# $Id: version,v 1.29.134.23.2.2 2009/03/17 02:23:49 marka Exp $
#
# This file must follow /bin/sh rules. It is imported directly via
# configure.
@@ -7,4 +7,4 @@ MAJORVER=9
MINORVER=4
PATCHVER=3
RELEASETYPE=-P
-RELEASEVER=1
+RELEASEVER=2