WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-06 18:07:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix CVE-2023-50387, DNSSEC verification complexity can be exploited to

Browse Source 
exhaust CPU resources and stall DNS resolvers.
This commit is contained in:
W.C.A. Wijngaards
2024-02-13 13:02:08 +01:00
parent 3352b1090e
commit 882903f2fa
14 changed files with 259 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testcode/unitverify.c
+2 -1
View File
@@ -180,6 +180,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
enum sec_status sec;
char* reason = NULL;
uint8_t sigalg[ALGO_NEEDS_MAX+1];
int verified = 0;
if(vsig) {
log_nametypeclass(VERB_QUERY, "verify of rrset",
rrset->rk.dname, ntohs(rrset->rk.type),
@@ -188,7 +189,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
/* ok to give null as qstate here, won't be used for answer section. */
sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason, NULL,
LDNS_SECTION_ANSWER, NULL);
LDNS_SECTION_ANSWER, NULL, &verified);
if(vsig) {
printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
reason?reason:"");