Ondřej Surý 78a7f7da4f Enforce strict RSA DNSKEY shape during DNSSEC validation ... A resolver that validated DNSSEC accepted RSA DNSKEYs of any modulus size up to OpenSSL's compile-time ceiling, and accepted any public exponent the wire format could carry. RSA verification cost grows sharply with the modulus length, so an authoritative server could publish an oversized DNSKEY to make each signature check on the resolver many times more expensive than for a normally sized key. The intended verify-time cap had no effect because the helper it called returned the public-exponent bit length rather than the modulus bit length, so the test was always satisfied. Replace it with an honest modulus-range check and a stricter exponent check that accepts only odd exponents in the closed range [3, 2^32 + 1] (covering every Fermat prime up to F5 and the odd intermediate values seen in deployed keys), reject anything outside those bounds at every RSA key load path so an invalid key never reaches the verifier, and keep the same checks at the verifier as a backstop against future load paths. (cherry picked from commit 8b2c490811)		2026-06-08 20:54:22 +02:00
..
bench	Enforce NSEC3 record consistency	2026-02-24 17:10:52 +01:00
dns	Enforce strict RSA DNSKEY shape during DNSSEC validation	2026-06-08 20:54:22 +02:00
include/tests	ISC_RUN_TEST_IMPL should use a static declaration	2026-01-29 00:26:35 +11:00
isc	Call tzset() after setenv("TZ", ...) in unit tests	2026-05-26 17:09:11 +02:00
isccfg	Add none parameter to query-source and query-source-v6 to disable IPv4 or IPv6 upstream queries	2024-12-10 11:58:20 +01:00
libtest	Rename 'free' variable to 'nfree' to not clash with free()	2025-07-22 14:28:15 +02:00
ns	wrap ns_client_error() for unit testing	2025-02-26 00:55:51 +00:00
.gitignore	Move all the unit tests to /tests/<libname>/	2022-05-28 14:53:02 -07:00
Makefile.am	Move resconf_test.c to tests/dns and cleanup	2024-12-12 22:50:22 +00:00
unit-test-driver.sh.in	Reformat shell scripts with shfmt	2023-10-26 10:23:50 +02:00