upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-12 15:30:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in

Browse source 
messages. [RT #44804]

(cherry picked from commit 07741d43c8)
This commit is contained in:
Mark Andrews 2017-08-25 08:38:19 +10:00
parent f1b8d01e34
commit 99f5031371
7 changed files with 57 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
CHANGES
View file

@ -1,3 +1,6 @@
4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in
messages. [RT #44804]
4686. [bug] dnssec-settime -p could print a bogus warning about
key deletion scheduled before its inactivation when a
key had an inactivation date set but no deletion date

1
bin/dig/dighost.c
View file

@ -1578,6 +1578,7 @@ dig_ednsoptname_t optnames[] = {
{ 12, "PADDING" }, /* RFC 7830 */
{ 12, "PAD" }, /* shorthand */
{ 13, "CHAIN" }, /* RFC 7901 */
{ 14, "KEY-TAG" }, /* RFC 8145 */
{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
};

26
bin/tests/system/digdelv/tests.sh
View file

@ -280,6 +280,7 @@ if [ -x ${DIG} ] ; then
echo "I:skipping 'dig +idnout' as IDN support is not enabled ($n)"
fi
n=`expr $n + 1`
echo "I:checking that dig warns about .local queries ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 local soa > dig.out.test$n 2>&1 || ret=1
@ -287,6 +288,31 @@ if [ -x ${DIG} ] ; then
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I:check that dig processes +ednsopt=key-tag and FORMERR is returned ($n)"
$DIG $DIGOPTS @10.53.0.3 +ednsopt=key-tag a.example +qr > dig.out.test$n 2>&1 || ret=1
grep "; KEY-TAG$" dig.out.test$n > /dev/null || ret=1
grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I:check that dig processes +ednsopt=key-tag:<value-list> ($n)"
$DIG $DIGOPTS @10.53.0.3 +ednsopt=key-tag:00010002 a.example +qr > dig.out.test$n 2>&1 || ret=1
grep "; KEY-TAG: 1, 2$" dig.out.test$n > /dev/null || ret=1
grep "status: FORMERR" dig.out.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I:check that dig processes +ednsopt=key-tag:<malformed-value-list> and FORMERR is returned ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 +ednsopt=key-tag:0001000201 a.example +qr > dig.out.test$n 2>&1 || ret=1
grep "; KEY-TAG: 00 01 00 02 01" dig.out.test$n > /dev/null || ret=1
grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
else
echo "$DIG is needed, so skipping these dig tests"
fi

5
doc/arm/notes.xml
View file

@ -114,6 +114,11 @@
[RT #44696]
</para>
</listitem>
<listitem>
<para>
EDNS KEY TAG options are verified and printed.
</para>
</listitem>
</itemizedlist>
</section>

1
lib/dns/include/dns/message.h
View file

@ -107,6 +107,7 @@
#define DNS_OPT_EXPIRE 9 /*%< EXPIRE opt code */
#define DNS_OPT_COOKIE 10 /*%< COOKIE opt code */
#define DNS_OPT_PAD 12 /*%< PAD opt code */
#define DNS_OPT_KEY_TAG 14 /*%< Key tag opt code */
/*%< The number of EDNS options we know about. */
#define DNS_EDNSOPTIONS 4

16
lib/dns/message.c
View file

@ -3490,6 +3490,22 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
ADD_STRING(target, "; EXPIRE");
} else if (optcode == DNS_OPT_PAD) {
ADD_STRING(target, "; PAD");
} else if (optcode == DNS_OPT_KEY_TAG) {
ADD_STRING(target, "; KEY-TAG");
if (optlen > 0U && (optlen % 2U) == 0U) {
const char *sep = ": ";
isc_uint16_t id;
while (optlen > 0U) {
id = isc_buffer_getuint16(&optbuf);
snprintf(buf, sizeof(buf), "%s%u",
sep, id);
ADD_STRING(target, buf);
sep = ", ";
optlen -= 2;
}
ADD_STRING(target, "\n");
continue;
}
} else {
ADD_STRING(target, "; OPT=");
snprintf(buf, sizeof(buf), "%u", optcode);

5
lib/dns/rdata/generic/opt_41.c
View file

@ -185,6 +185,11 @@ fromwire_opt(ARGS_FROMWIRE) {
return (DNS_R_OPTERR);
isc_region_consume(&sregion, length);
break;
case DNS_OPT_KEY_TAG:
if (length == 0 || (length % 2) != 0)
return (DNS_R_OPTERR);
isc_region_consume(&sregion, length);
break;
default:
isc_region_consume(&sregion, length);
break;