WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-26 03:34:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

- xfr-tsig, use tsig_parse_verify_reply_xfr for zone transfers with TSIG.

Browse Source
This commit is contained in:
W.C.A. Wijngaards
2025-09-10 15:45:37 +02:00
parent 63aa70ab32
commit bebd6c0f96
1 changed files with 23 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/authzone.c
+23 -19
View File
@@ -5877,6 +5877,7 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
struct module_env* env, int* gonextonfail, int* transferdone)
{
uint8_t* wire = sldns_buffer_begin(pkt);
size_t initial_rr_scan_num = xfr->task_transfer->rr_scan_num;
int i;
if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
verbose(VERB_ALGO, "xfr to %s failed, packet too small",
@@ -5899,25 +5900,6 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
xfr->task_transfer->master->host);
return 0;
}
/* check tsig */
if(xfr->task_transfer->tsig) {
if(xfr->task_transfer->rr_scan_num == 0) {
/* Check TSIG reply on first packet. */
if(!tsig_find_rr(pkt)) {
verbose(VERB_ALGO, "TSIG expected, but not found in reply for xfr to %s",
xfr->task_transfer->master->host);
return 0;
}
if(!tsig_parse_verify_reply(xfr->task_transfer->tsig,
pkt, env->tsig_key_table,
(uint64_t)*env->now)) {
verbose(VERB_ALGO, "valid TSIG expected in xfr reply to %s, but it was not valid",
xfr->task_transfer->master->host);
return 0;
}
}
sldns_buffer_rewind(pkt);
}
if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) {
char rcode[32];
sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode,
@@ -6179,6 +6161,28 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
sldns_buffer_skip(pkt, (ssize_t)rdlen);
}
/* check tsig */
if(xfr->task_transfer->tsig) {
sldns_buffer_rewind(pkt);
if(!tsig_find_rr(pkt)) {
/* Check TSIG reply on first packet. */
if(initial_rr_scan_num == 0) {
verbose(VERB_ALGO, "TSIG expected, but not found in reply for xfr to %s",
xfr->task_transfer->master->host);
return 0;
}
/* No TSIG could be for sign every NTH packet. */
sldns_buffer_set_position(pkt, sldns_buffer_limit(pkt));
}
if(!tsig_parse_verify_reply_xfr(xfr->task_transfer->tsig,
pkt, env->tsig_key_table, (uint64_t)*env->now,
*transferdone)) {
verbose(VERB_ALGO, "valid TSIG expected in xfr reply to %s, but it was not valid",
xfr->task_transfer->master->host);
return 0;
}
}
return 1;
}