X Tutup
Skip to content

Commit 43e6779

Browse files
committed
resolved: when we find a DNAME RR, don't insist in a signed CNAME RR
If we have a signed DNAME RR response, there's no need to insist on a signature for a CNAME RR response, after all it is unlikely to be signed, given the implicit synthethis of CNAME through DNAME RRs.
1 parent cde3d68 commit 43e6779

File tree

3 files changed

+67
-9
lines changed

3 files changed

+67
-9
lines changed

src/resolve/resolved-dns-answer.c

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -821,3 +821,40 @@ void dns_answer_dump(DnsAnswer *answer, FILE *f) {
821821
fputc('\n', f);
822822
}
823823
}
824+
825+
bool dns_answer_has_dname_for_cname(DnsAnswer *a, DnsResourceRecord *cname) {
826+
DnsResourceRecord *rr;
827+
int r;
828+
829+
assert(cname);
830+
831+
/* Checks whether the answer contains a DNAME record that indicates that the specified CNAME record is
832+
* synthesized from it */
833+
834+
if (cname->key->type != DNS_TYPE_CNAME)
835+
return 0;
836+
837+
DNS_ANSWER_FOREACH(rr, a) {
838+
_cleanup_free_ char *n = NULL;
839+
840+
if (rr->key->type != DNS_TYPE_DNAME)
841+
continue;
842+
if (rr->key->class != cname->key->class)
843+
continue;
844+
845+
r = dns_name_change_suffix(cname->cname.name, rr->dname.name, DNS_RESOURCE_KEY_NAME(rr->key), &n);
846+
if (r < 0)
847+
return r;
848+
if (r == 0)
849+
continue;
850+
851+
r = dns_name_equal(n, DNS_RESOURCE_KEY_NAME(cname->key));
852+
if (r < 0)
853+
return r;
854+
if (r > 0)
855+
return 1;
856+
857+
}
858+
859+
return 0;
860+
}

src/resolve/resolved-dns-answer.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ int dns_answer_remove_by_rr(DnsAnswer **a, DnsResourceRecord *rr);
8383
int dns_answer_copy_by_key(DnsAnswer **a, DnsAnswer *source, const DnsResourceKey *key, DnsAnswerFlags or_flags);
8484
int dns_answer_move_by_key(DnsAnswer **to, DnsAnswer **from, const DnsResourceKey *key, DnsAnswerFlags or_flags);
8585

86+
bool dns_answer_has_dname_for_cname(DnsAnswer *a, DnsResourceRecord *cname);
87+
8688
static inline unsigned dns_answer_size(DnsAnswer *a) {
8789
return a ? a->n_rrs : 0;
8890
}

src/resolve/resolved-dns-transaction.c

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1827,6 +1827,12 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
18271827
if (r > 0)
18281828
continue;
18291829

1830+
r = dns_answer_has_dname_for_cname(t->answer, rr);
1831+
if (r < 0)
1832+
return r;
1833+
if (r > 0)
1834+
continue;
1835+
18301836
name = DNS_RESOURCE_KEY_NAME(rr->key);
18311837
r = dns_name_parent(&name);
18321838
if (r < 0)
@@ -2719,17 +2725,30 @@ int dns_transaction_validate_dnssec(DnsTransaction *t) {
27192725
if (r < 0)
27202726
return r;
27212727
if (r > 0) {
2722-
/* This is a primary response
2723-
* to our question, and it
2724-
* failed validation. That's
2725-
* fatal. */
2726-
t->answer_dnssec_result = result;
2727-
return 0;
2728+
2729+
/* Look for a matching DNAME for this CNAME */
2730+
r = dns_answer_has_dname_for_cname(t->answer, rr);
2731+
if (r < 0)
2732+
return r;
2733+
if (r == 0) {
2734+
/* Also look among the stuff we already validated */
2735+
r = dns_answer_has_dname_for_cname(validated, rr);
2736+
if (r < 0)
2737+
return r;
2738+
}
2739+
2740+
if (r == 0) {
2741+
/* This is a primary response to our question, and it failed validation. That's
2742+
* fatal. */
2743+
t->answer_dnssec_result = result;
2744+
return 0;
2745+
}
2746+
2747+
/* This is a primary response, but we do have a DNAME RR in the RR that can replay this
2748+
* CNAME, hence rely on that, and we can remove the CNAME in favour of it. */
27282749
}
27292750

2730-
/* This is just some auxiliary
2731-
* data. Just remove the RRset and
2732-
* continue. */
2751+
/* This is just some auxiliary data. Just remove the RRset and continue. */
27332752
r = dns_answer_remove_by_key(&t->answer, rr->key);
27342753
if (r < 0)
27352754
return r;

0 commit comments

Comments
 (0)
X Tutup