upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-17 04:02:54 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Also use NSEC with longest closest encloser for CNAME responses.

Browse source 
git-svn-id: file:///svn/unbound/trunk@4463 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Ralph Dolmans 2018-01-29 14:44:39 +00:00
parent 0121427ef1
commit f4ff97c297
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
validator/validator.c
View file

@ -1309,6 +1309,9 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
int nsec3s_seen = 0; /* nsec3s seen */
struct ub_packed_rrset_key* s;
size_t i;
uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
int ce_labs = 0;
int prev_ce_labs = 0;
/* the AUTHORITY section */
for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
@ -1327,9 +1330,19 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
ce = nsec_closest_encloser(qchase->qname, s);
nxdomain_valid_nsec = 1;
}
if(val_nsec_proves_no_wc(s, qchase->qname,
qchase->qname_len))
nxdomain_valid_wnsec = 1;
nsec_ce = nsec_closest_encloser(qchase->qname, s);
ce_labs = dname_count_labels(nsec_ce);
/* Use longest closest encloser to prove wildcard. */
if(ce_labs > prev_ce_labs ||
(ce_labs == prev_ce_labs &&
nxdomain_valid_wnsec == 0)) {
if(val_nsec_proves_no_wc(s, qchase->qname,
qchase->qname_len))
nxdomain_valid_wnsec = 1;
else
nxdomain_valid_wnsec = 0;
}
prev_ce_labs = ce_labs;
if(val_nsec_proves_insecuredelegation(s, qchase)) {
verbose(VERB_ALGO, "delegation is insecure");
chase_reply->security = sec_status_insecure;