ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

[master] fix RSA parsing when md5 disabled

Browse Source 
4645.	[bug]		Fix PKCS#11 RSA parsing when MD5 is disabled.
			[RT #45300]
This commit is contained in:
Evan Hunt
2017-06-29 15:53:35 -07:00
parent 916234485b
commit b05b3fab3c
4 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
[RT #45300]
4644. [placeholder]
4643. [security] An error in TSIG handling could permit unauthorized

2
bin/tests/system/pkcs11/clean.sh
View File

@@ -7,7 +7,7 @@
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
rm -f K* ns1/K* keyset-* dsset-* ns1/*.db ns1/*.signed ns1/*.jnl
rm -f dig.out pin
rm -f dig.out* pin upd.log*
rm -f ns1/*.key ns1/named.memstats
rm -f supported
rm -f ns*/named.lock

13
bin/tests/system/pkcs11/tests.sh
View File

@@ -37,7 +37,12 @@ for alg in $algs; do
echo "I:testing inline signing with PKCS#11 keys ($alg)"
$NSUPDATE > /dev/null <<END || status=1
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg.0 || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
count0=`grep RRSIG dig.out.$alg.0 | wc -l`
$NSUPDATE -v > upd.log.$alg <<END || status=1
server 10.53.0.1 5300
ttl 300
zone $alg.example.
@@ -48,11 +53,11 @@ END
echo "I:waiting 20 seconds for key changes to take effect"
sleep 20
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out || ret=1
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
count=`grep RRSIG dig.out | wc -l`
if [ $count != 4 ]; then echo "I:failed"; status=1; fi
count=`grep RRSIG dig.out.$alg | wc -l`
if [ $count -le $count0 ]; then echo "I:failed"; status=1; fi
echo "I:testing PKCS#11 key destroy ($alg)"
ret=0

5
lib/dns/dst_parse.c
View File

@@ -605,7 +605,12 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
goto fail;
}
#ifdef PK11_MD5_DISABLE
check = check_data(priv, alg == DST_ALG_RSA ? DST_ALG_RSASHA1 : alg,
ISC_TRUE, external);
#else
check = check_data(priv, alg, ISC_TRUE, external);
#endif
if (check < 0) {
ret = DST_R_INVALIDPRIVATEKEY;
goto fail;