Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-20 10:48:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

DNSSEC: Handle non-root trust anchors, and check we have a root trust anchor.

Browse Source
This commit is contained in:
Simon Kelley
2016-01-12 11:28:58 +00:00
parent 5757371d43
commit a63b8b89e6
2 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/dnsmasq.c
View File

@@ -169,8 +169,16 @@ int main (int argc, char **argv)
if (option_bool(OPT_DNSSEC_VALID)) if (option_bool(OPT_DNSSEC_VALID))
{ {
#ifdef HAVE_DNSSEC #ifdef HAVE_DNSSEC
if (!daemon->ds) struct ds_config *ds;
die(_("no trust anchors provided for DNSSEC"), NULL, EC_BADCONF);
/* Must have at least a root trust anchor, or the DNSSEC code
can loop forever. */
for (ds = daemon->ds; ds; ds = ds->next)
if (ds->name[0] == 0)
break;
if (!ds)
die(_("no root trust anchor provided for DNSSEC"), NULL, EC_BADCONF);
if (daemon->cachesize < CACHESIZ) if (daemon->cachesize < CACHESIZ)
die(_("cannot reduce cache size from default when DNSSEC enabled"), NULL, EC_BADCONF); die(_("cannot reduce cache size from default when DNSSEC enabled"), NULL, EC_BADCONF);

19
src/dnssec.c
View File

@@ -1873,10 +1873,27 @@ static int prove_non_existence(struct dns_header *header, size_t plen, char *key
*/ */
static int zone_status(char *name, int class, char *keyname, time_t now) static int zone_status(char *name, int class, char *keyname, time_t now)
{ {
int name_start = strlen(name); int name_start = strlen(name); /* for when TA is root */
struct crec *crecp; struct crec *crecp;
char *p; char *p;
/* First, work towards the root, looking for a trust anchor.
This can either be one configured, or one previously cached.
We can assume, if we don't find one first, that there is
a trust anchor at the root. */
for (p = name; p; p = strchr(p, '.'))
{
if (*p == '.')
p++;
if (cache_find_by_name(NULL, p, now, F_DS))
{
name_start = p - name;
break;
}
}
/* Now work away from the trust anchor */
while (1) while (1)
{ {
strcpy(keyname, &name[name_start]); strcpy(keyname, &name[name_start]);