ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Fail processing incoming DNS message on first validation failure

Browse Source 
Stop processing the DNS validation when first validation failure occurs
in the DNS message.
This commit is contained in:
Mark Andrews
2024-02-01 21:47:29 +01:00
committed by Michał Kępień
parent 439e16e4de
commit 0add293477
2 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/include/dns/validator.h
+1
View File
@@ -148,6 +148,7 @@ struct dns_validator {
unsigned int depth;
unsigned int authcount;
unsigned int authfail;
bool failed;
isc_stdtime_t start;
};
lib/dns/validator.c
+7 -14
View File
@@ -1591,20 +1591,9 @@ validate_answer(dns_validator_t *val, bool resume) {
continue;
}
do {
isc_result_t tresult;
vresult = verify(val, val->key, &rdata,
val->siginfo->keyid);
if (vresult == ISC_R_SUCCESS) {
break;
}
tresult = select_signing_key(val, val->keyset);
if (tresult != ISC_R_SUCCESS) {
break;
}
} while (1);
vresult = verify(val, val->key, &rdata, val->siginfo->keyid);
if (vresult != ISC_R_SUCCESS) {
val->failed = true;
validator_log(val, ISC_LOG_DEBUG(3),
"failed to verify rdataset");
} else {
@@ -1641,9 +1630,13 @@ validate_answer(dns_validator_t *val, bool resume) {
} else {
validator_log(val, ISC_LOG_DEBUG(3),
"verify failure: %s",
isc_result_totext(result));
isc_result_totext(vresult));
resume = false;
}
if (val->failed) {
result = ISC_R_NOMORE;
break;
}
}
if (result != ISC_R_NOMORE) {
validator_log(val, ISC_LOG_DEBUG(3),