WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix that dnscrypt configuration does not crash, due to

Browse Source 
inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
This commit is contained in:
W.C.A. Wijngaards
2026-06-16 10:40:10 +02:00
parent 4693c00c9f
commit a45e54555d
3 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dnscrypt/dnscrypt.c
+8 -1
View File
@@ -830,7 +830,14 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
if(memcmp(current_keypair->crypt_publickey,
env->signed_certs[c].server_publickey,
crypto_box_PUBLICKEYBYTES) == 0) {
dnsccert *current_cert = &env->certs[cert_id++];
dnsccert* current_cert;
if(cert_id >= env->signed_certs_count) {
log_err("dnscrypt: secret key %s matches a cert that "
"is already bound to another key (duplicate "
"dnscrypt-secret-key?)", head->str);
return -1;
}
current_cert = &env->certs[cert_id++];
found_cert = 1;
current_cert->keypair = current_keypair;
memcpy(current_cert->magic_query,
doc/Changelog
+4 -1
View File
@@ -32,7 +32,10 @@
list does not crash later. The newly created RRset is
linked after creation has succeeded. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
- Fix that dnscrypt configuration does not crash, due to
inconsistency between secret and public keys. Also
duplicate files are skipped. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
15 June 2026: Wouter
- Fix to add `max-transfer-size` and `max-transfer-time` that
util/configparser.y
+8 -4
View File
@@ -3862,10 +3862,12 @@ dnsc_dnscrypt_provider: VAR_DNSCRYPT_PROVIDER STRING_ARG
dnsc_dnscrypt_provider_cert: VAR_DNSCRYPT_PROVIDER_CERT STRING_ARG
{
OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", $2));
if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, $2))
if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, $2)) {
log_warn("dnscrypt-provider-cert %s is a duplicate", $2);
if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, $2))
free($2);
} else if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, $2)) {
fatal_exit("out of memory adding dnscrypt-provider-cert");
}
}
;
dnsc_dnscrypt_provider_cert_rotated: VAR_DNSCRYPT_PROVIDER_CERT_ROTATED STRING_ARG
@@ -3878,10 +3880,12 @@ dnsc_dnscrypt_provider_cert_rotated: VAR_DNSCRYPT_PROVIDER_CERT_ROTATED STRING_A
dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG
{
OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", $2));
if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, $2))
if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, $2)) {
log_warn("dnscrypt-secret-key: %s is a duplicate", $2);
if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, $2))
free($2);
} else if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, $2)) {
fatal_exit("out of memory adding dnscrypt-secret-key");
}
}
;
dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG