upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-14 22:10:01 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/lib/isc
History
Ondřej Surý 8b2c490811 Enforce strict RSA DNSKEY shape during DNSSEC validation 
A resolver that validated DNSSEC accepted RSA DNSKEYs of any modulus
size up to OpenSSL's compile-time ceiling, and accepted any public
exponent the wire format could carry.  RSA verification cost grows
sharply with the modulus length, so an authoritative server could
publish an oversized DNSKEY to make each signature check on the
resolver many times more expensive than for a normally sized key.

The intended verify-time cap had no effect because the helper it called
returned the public-exponent bit length rather than the modulus bit
length, so the test was always satisfied.  Replace it with an honest
modulus-range check and a stricter exponent check that accepts only odd
exponents in the closed range [3, 2^32 + 1] (covering every Fermat
prime up to F5 and the odd intermediate values seen in deployed keys),
reject anything outside those bounds at every RSA key load path so an
invalid key never reaches the verifier, and keep the same checks at the
verifier as a backstop against future load paths.
2026-06-08 18:00:27 +02:00
..
crypto Remove OpenSSL memory tracking support from the ossl3.c module 2026-04-28 14:42:40 +00:00
include Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 18:00:27 +02:00
netmgr Fix spelling typos in comments and code 2026-06-01 16:58:16 +02:00
ossl_wrap Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 18:00:27 +02:00
.gitignore Add support for User Statically Defined Tracing (USDT) probes 2023-08-21 18:39:53 +02:00
ascii.c Consolidate some ASCII tables in isc/ascii and isc/hex 2022-09-12 12:18:57 +01:00
assertions.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
async.c Remove unused isc_mutexblock and isc_condition units 2025-03-01 07:33:09 +01:00
async_p.h Change the isc_async API to use cds_wfcqueue internally 2023-05-12 14:16:25 +02:00
backtrace.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
base32.c standardize CHECK and RETERR macros 2025-12-03 13:26:28 -08:00
base64.c Add enum for use with isc_base64_tobuffer and isc_hex_tobuffer 2026-01-27 23:57:34 +11:00
commandline.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
counter.c Cleanup the isc_counter unit 2025-02-21 09:51:42 +00:00
dir.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno2result.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno2result.h Remove C++ support from the public header 2024-12-18 13:10:39 +01:00
error.c Remove do-nothing header <isc/print.h> 2023-02-15 16:44:47 +00:00
file.c Stop isc_file_safecreate from following symlinks 2026-04-29 16:56:25 +02:00
getaddresses.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
hash.c Use SipHash-1-3 for hash tables, keep SipHash-2-4 for cookies 2026-05-15 08:15:59 +02:00
hashmap.c Use arc4random for CSPRNG when available 2025-10-02 13:26:07 +02:00
heap.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
helper.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
hex.c Add enum for use with isc_base64_tobuffer and isc_hex_tobuffer 2026-01-27 23:57:34 +11:00
histo.c Fix spelling typos in comments and code 2026-06-01 16:58:16 +02:00
ht.c Fix spelling typos in comments and code 2026-06-01 16:58:16 +02:00
httpd.c Clear errno before calling strtol 2026-03-17 10:51:37 +11:00
interfaceiter.c use a standard CLEANUP macro 2025-12-03 13:45:43 -08:00
iterated_hash.c expose isc__crypto_md in isc/ossl_wrap.h 2026-02-02 11:50:14 +03:00
jemalloc_shim.h Provide more information when the memory allocation fails 2025-11-28 14:42:21 +01:00
job.c Use unique names for probes.d files 2025-09-24 13:18:13 +02:00
job_p.h Use proper padding instead of using alignas() 2024-02-08 10:54:35 +01:00
lex.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
lib.c Call rcu_barrier earlier in the destructor 2025-04-25 13:13:44 +02:00
log.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
loop.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
loop_p.h Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
managers.c Cleanup setting netmgr ports from isc_managers_create() 2026-02-20 16:37:44 +01:00
md.c expose isc__crypto_md in isc/ossl_wrap.h 2026-02-02 11:50:14 +03:00
mem.c Add system test for delegdb size preservation across rndc flush 2026-05-28 13:59:38 +02:00
mem_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
meminfo.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
meson.build Add low contention stats counter 2026-03-26 10:19:25 +01:00
mutex.c Move the library init and shutdown to executables 2025-02-22 16:19:00 +01:00
mutex_p.h Use library constructor to create default mutex attr once 2022-07-13 13:19:32 +02:00
net.c Rename isc_net_getudpportrange() to isc_net_getportrange() 2026-02-20 14:06:23 +01:00
netaddr.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
netscope.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
openssl_shim.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
openssl_shim.h switch isc_md_type_t to a proper enum 2026-02-02 11:12:55 +03:00
os.c Implement IP_LOCAL_PORT_RANGE socket option for Linux 2026-02-20 14:06:23 +01:00
os_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
parseint.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
picohttpparser.c Fix spelling typos in comments and code 2026-06-01 16:58:16 +02:00
picohttpparser.h Update picohttpparser.{c,h} with upstream repository 2024-12-08 11:14:37 +00:00
portset.c clean up uses of ISC_R_NOMEMORY 2025-01-23 15:54:57 -08:00
probes-isc.d Use unique names for probes.d files 2025-09-24 13:18:13 +02:00
proxy2.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
quota.c Fix isc_quota bug 2025-02-20 10:56:00 +00:00
radix.c Fix INSIST copy-paste error checking RADIX_V4 instead of RADIX_V6 2026-03-14 11:03:31 +01:00
random.c Use arc4random for CSPRNG when available 2025-10-02 13:26:07 +02:00
ratelimiter.c Dispatch ratelimiter events under the lock 2026-04-30 10:16:32 +02:00
regex.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
region.c Incrementally apply AXFR transfer 2024-11-22 15:00:55 +01:00
result.c Switch UDP fetches to TCP on the first response with a wrong query id 2026-05-14 15:56:18 +02:00
rwlock.c Use sequentially consistent ordering in the adaptive rwlock handshake 2026-06-08 17:51:17 +02:00
safe.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
serial.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
signal.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
sockaddr.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
stats.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
statsmulti.c Convert isc_statsmulti to use ISC_REFCOUNT_IMPL 2026-03-26 10:19:25 +01:00
stdio.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
stdtime.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
string.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
symtab.c Switch symtab to use fxhash hashing 2025-03-20 11:26:09 +01:00
syslog.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
tests Move all the unit tests to /tests/<libname>/ 2022-05-28 14:53:02 -07:00
thread.c Add support for setting thread stack size 2025-08-05 10:46:09 +02:00
thread_p.h Document the current default stack sizes on different systems 2025-08-05 10:46:09 +02:00
tid.c Only update the global tid_count once 2026-06-04 12:03:29 +02:00
time.c Simplify add/sub/mul overflow checks 2025-08-26 15:32:53 +02:00
timer.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
tls.c OpenSSL 4 compatibility fix 2026-03-16 10:01:18 +00:00
tm.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
url.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
utf8.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
uv.c ensure file descriptors 0-2 are in use before using libuv 2025-08-28 08:16:06 +02:00
work.c Enforce isc_work enqueue loop affinity 2026-03-14 06:32:50 +01:00
xml.c Change the 'isc_g_mctx' to be always available 2025-08-04 11:29:50 +02:00