interesting
/
getdns
mirror of https://github.com/getdnsapi/getdns.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

DNSSEC bugfix found with static analysis 

* Fix for DNSSEC bug in finding most specific key when
  trust anchor proves non-existance of one of the labels
  along the authentication chain other than the non-
  existance of a DS record on a zonecut.
This commit is contained in:
Willem Toorop 2018-11-22 10:21:48 +01:00
parent 4ff9816e39
commit 6b10570842
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,4 +1,8 @@
* 2018-0?-??: Version 1.4.3 * 2018-0?-??: Version 1.4.3
* Fix for DNSSEC bug in finding most specific key when
trust anchor proves non-existance of one of the labels
along the authentication chain other than the non-
existance of a DS record on a zonecut.
* Enhancement getdnsapi/stubby#56 & getdnsapi/stubby#130: * Enhancement getdnsapi/stubby#56 & getdnsapi/stubby#130:
Configurable minimum and maximum TLS versions with Configurable minimum and maximum TLS versions with
getdns_context_set_tls_min_version() and getdns_context_set_tls_min_version() and

17
src/dnssec.c
View File

@ -2606,7 +2606,7 @@ static int chain_node_get_trusted_keys(
*keys = ta; *keys = ta;
return GETDNS_DNSSEC_SECURE; return GETDNS_DNSSEC_SECURE;
} }
/* ta is parent's ZSK */ /* ta is parent's ZSK proving insecurity below this node? */
if ((keytag = key_proves_nonexistance( if ((keytag = key_proves_nonexistance(
mf, now, skew, ta, &node->ds, &opt_out))) { mf, now, skew, ta, &node->ds, &opt_out))) {
node->ds_signer = keytag; node->ds_signer = keytag;
@ -2621,12 +2621,18 @@ static int chain_node_get_trusted_keys(
* key_proves_nonexistance() will set opt_out also for * key_proves_nonexistance() will set opt_out also for
* these conditions. * these conditions.
*/ */
return opt_out ? GETDNS_DNSSEC_INSECURE if (opt_out)
: GETDNS_DNSSEC_SECURE; return GETDNS_DNSSEC_INSECURE;
}
if ((keytag = a_key_signed_rrset_no_wc( /* If this is not an insecurity proof,
* continue searching one label up.
*/
/* ta is parent's ZSK authenticating DS? */
} else if ((keytag = a_key_signed_rrset_no_wc(
mf, now, skew, ta, &node->ds))) { mf, now, skew, ta, &node->ds))) {
node->ds_signer = keytag; node->ds_signer = keytag;
/* DS should authenticate the DNSKEY rrset now */
if ((keytag = ds_authenticates_keys( if ((keytag = ds_authenticates_keys(
mf, now, skew, &node->ds, &node->dnskey))) { mf, now, skew, &node->ds, &node->dnskey))) {
*keys = &node->dnskey; *keys = &node->dnskey;
@ -2635,6 +2641,7 @@ static int chain_node_get_trusted_keys(
? GETDNS_DNSSEC_INSECURE ? GETDNS_DNSSEC_INSECURE
: GETDNS_DNSSEC_SECURE; : GETDNS_DNSSEC_SECURE;
} }
/* DS without DNSKEY rrset == BOGUS */
return GETDNS_DNSSEC_BOGUS; return GETDNS_DNSSEC_BOGUS;
} }
} else } else