upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix validation in case a trust anchor enters into a zone with

Browse source 
unsupported algorithms.


git-svn-id: file:///svn/unbound/trunk@2205 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2010-08-04 08:36:27 +00:00
parent 0db4fd57a7
commit 4c4671a63f
2 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/Changelog
View file

@ -1,3 +1,7 @@
4 August 2010: Wouter
- Fix validation in case a trust anchor enters into a zone with
unsupported algorithms.
3 August 2010: Wouter 3 August 2010: Wouter
- updated ldns tarball with bugfixes. - updated ldns tarball with bugfixes.
- release tag 1.4.6. - release tag 1.4.6.

13
validator/val_sigcrypt.c
View file

@ -462,6 +462,8 @@ void algo_needs_init_dnskey(struct algo_needs* n,
memset(n->needs, 0, sizeof(uint8_t)*ALGO_NEEDS_MAX); memset(n->needs, 0, sizeof(uint8_t)*ALGO_NEEDS_MAX);
for(i=0; i<num; i++) { for(i=0; i<num; i++) {
algo = (uint8_t)dnskey_get_algo(dnskey, i); algo = (uint8_t)dnskey_get_algo(dnskey, i);
if(!dnskey_algo_id_is_supported(algo))
continue;
if(n->needs[algo] == 0) { if(n->needs[algo] == 0) {
n->needs[algo] = 1; n->needs[algo] = 1;
total++; total++;
@ -482,6 +484,8 @@ void algo_needs_init_ds(struct algo_needs* n, struct ub_packed_rrset_key* ds,
if(ds_get_digest_algo(ds, i) != fav_ds_algo) if(ds_get_digest_algo(ds, i) != fav_ds_algo)
continue; continue;
algo = (uint8_t)ds_get_key_algo(ds, i); algo = (uint8_t)ds_get_key_algo(ds, i);
if(!dnskey_algo_id_is_supported(algo))
continue;
if(n->needs[algo] == 0) { if(n->needs[algo] == 0) {
n->needs[algo] = 1; n->needs[algo] = 1;
total++; total++;
@ -546,6 +550,11 @@ dnskeyset_verify_rrset(struct module_env* env, struct val_env* ve,
} }
algo_needs_init_dnskey(&needs, dnskey); algo_needs_init_dnskey(&needs, dnskey);
if(algo_needs_num_missing(&needs) == 0) {
verbose(VERB_QUERY, "DNSKEY has no known algorithms");
*reason = "DNSKEY has no known algorithms";
return sec_status_insecure;
}
for(i=0; i<num; i++) { for(i=0; i<num; i++) {
sec = dnskeyset_verify_rrset_sig(env, ve, *env->now, rrset, sec = dnskeyset_verify_rrset_sig(env, ve, *env->now, rrset,
dnskey, i, &sortree, reason); dnskey, i, &sortree, reason);
@ -631,6 +640,10 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
size_t numchecked = 0; size_t numchecked = 0;
int buf_canon = 0; int buf_canon = 0;
verbose(VERB_ALGO, "verify sig %d %d", (int)tag, algo); verbose(VERB_ALGO, "verify sig %d %d", (int)tag, algo);
if(!dnskey_algo_id_is_supported(algo)) {
verbose(VERB_QUERY, "verify sig: unknown algorithm");
return sec_status_insecure;
}
for(i=0; i<num; i++) { for(i=0; i<num; i++) {
/* see if key matches keytag and algo */ /* see if key matches keytag and algo */