upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-24 03:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reduce the number of verifiations required

Browse source 
In selfsigned_dnskey only call dns_dnssec_verify if the signature's
key id matches a revoked key, the trust is pending and the key
matches a trust anchor.  Previously named was calling dns_dnssec_verify
unconditionally resulted in busy work.

(cherry picked from commit e68fecbdaa)
This commit is contained in:
Mark Andrews 2022-11-24 14:18:20 +11:00 committed by Petr Špaček
parent 19f8033840
commit 3cb366b1e0
No known key found for this signature in database
GPG key ID: ABD587CDF06581AE
1 changed files with 37 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
lib/dns/validator.c
View file

@ -1397,26 +1397,50 @@ selfsigned_dnskey(dns_validator_t *val) {
continue;
}
/*
* If the REVOKE bit is not set we have a
* theoretically self signed DNSKEY RRset.
* This will be verified later.
*/
if ((key.flags & DNS_KEYFLAG_REVOKE) == 0) {
answer = true;
continue;
}
result = dns_dnssec_keyfromrdata(name, &keyrdata, mctx,
&dstkey);
if (result != ISC_R_SUCCESS) {
continue;
}
result = dns_dnssec_verify(name, rdataset, dstkey, true,
val->view->maxbits, mctx,
&sigrdata, NULL);
/*
* If this RRset is pending and it is trusted,
* see if it was self signed by this DNSKEY.
*/
if (DNS_TRUST_PENDING(rdataset->trust) &&
dns_view_istrusted(val->view, name, &key))
{
result = dns_dnssec_verify(
name, rdataset, dstkey, true,
val->view->maxbits, mctx, &sigrdata,
NULL);
if (result == ISC_R_SUCCESS) {
/*
* The key with the REVOKE flag has
* self signed the RRset so it is no
* good.
*/
dns_view_untrust(val->view, name, &key);
}
} else if (rdataset->trust >= dns_trust_secure) {
/*
* We trust this RRset so if the key is
* marked revoked remove it.
*/
dns_view_untrust(val->view, name, &key);
}
dst_key_free(&dstkey);
if (result != ISC_R_SUCCESS) {
continue;
}
if ((key.flags & DNS_KEYFLAG_REVOKE) == 0) {
answer = true;
continue;
}
dns_view_untrust(val->view, name, &key);
}
}