diff options
author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2022-04-19 03:58:50 +0900 |
---|---|---|
committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2022-04-19 03:58:58 +0900 |
commit | 26b23d11870185b2ddab51bb1684d6761e8aa553 (patch) | |
tree | 51ff940e740dc5e5dd76e53ca9e6f4aff4767b29 /src/resolve/resolved-dns-transaction.c | |
parent | cd2cdba2fedf2dc71ff6429157c2e3b39938a93d (diff) | |
download | systemd-26b23d11870185b2ddab51bb1684d6761e8aa553.tar.gz |
resolve: always request records to validate negative answer
Otherwise, dns_transaction_requires_nsec() may not find no required
transaction, and return true. That sets
`answer_dnssec_result = DNSSEC_NO_SIGNATURE`, and the entire transaction fails.
Fixes #21414.
Diffstat (limited to 'src/resolve/resolved-dns-transaction.c')
-rw-r--r-- | src/resolve/resolved-dns-transaction.c | 28 |
1 files changed, 11 insertions, 17 deletions
diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c index cec3cea7c5..cc0e629a63 100644 --- a/src/resolve/resolved-dns-transaction.c +++ b/src/resolve/resolved-dns-transaction.c @@ -2213,7 +2213,7 @@ static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const return link_negative_trust_anchor_lookup(t->scope->link, name); } -static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) { +static int dns_transaction_has_negative_answer(DnsTransaction *t) { int r; assert(t); @@ -2232,14 +2232,7 @@ static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) { r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(dns_transaction_key(t))); if (r < 0) return r; - if (r > 0) - return false; - - /* The answer does not contain any RRs that match to the - * question. If so, let's see if there are any NSEC/NSEC3 RRs - * included. If not, the answer is unsigned. */ - - return !dns_answer_contains_nsec_or_nsec3(t->answer); + return !r; } static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) { @@ -2563,14 +2556,15 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) { * we got. Now, let's request what we need to validate what we * didn't get... */ - r = dns_transaction_has_unsigned_negative_answer(t); + r = dns_transaction_has_negative_answer(t); if (r < 0) return r; if (r > 0) { - const char *name; + const char *name, *signed_status; uint16_t type = 0; name = dns_resource_key_name(dns_transaction_key(t)); + signed_status = dns_answer_contains_nsec_or_nsec3(t->answer) ? "signed" : "unsigned"; /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this * could also be used as indication that we are not at a zone apex, but in real world setups there are @@ -2583,21 +2577,21 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) { r = dns_name_parent(&name); if (r > 0) { type = DNS_TYPE_SOA; - log_debug("Requesting parent SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty DS response).", - name, t->id, dns_resource_key_name(dns_transaction_key(t))); + log_debug("Requesting parent SOA (→ %s) to validate transaction %" PRIu16 " (%s, %s empty DS response).", + name, t->id, dns_resource_key_name(dns_transaction_key(t)), signed_status); } else name = NULL; } else if (IN_SET(dns_transaction_key(t)->type, DNS_TYPE_SOA, DNS_TYPE_NS)) { type = DNS_TYPE_DS; - log_debug("Requesting DS (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).", - name, t->id, name); + log_debug("Requesting DS (→ %s) to validate transaction %" PRIu16 " (%s, %s empty SOA/NS response).", + name, t->id, name, signed_status); } else { type = DNS_TYPE_SOA; - log_debug("Requesting SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).", - name, t->id, name); + log_debug("Requesting SOA (→ %s) to validate transaction %" PRIu16 " (%s, %s empty non-SOA/NS/DS response).", + name, t->id, name, signed_status); } if (name) { |