wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-23 11:54:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates to a345b075b3b8696a18631b46e53ab654354ed961 following review.

Browse Source
This commit is contained in:
Simon Kelley committed 2026-05-10 21:49:40 +01:00
1 parent e3a26d092e
commit 9f651f3398
1 file changed
+12 -11
Download Patch File Download Diff File Expand all files Collapse all files
src/dnssec.c
+12 -11
View File
@@ -1320,15 +1320,15 @@ static int prove_non_existence_nsec(struct dns_header *header, size_t plen, unsi
if (rdlen < 2 || rdlen < p[1] + 2)
return DNSSEC_FAIL_BADPACKET;
/* If we can prove that there's no NS record, return that information. */
if (nons && check_type_bitmap(p, T_NS))
*nons = 0;
/* NSEC with the same name as the RR we're testing, check
that the type in question doesn't appear in the type map */
if (check_type_bitmap(p, type))
return DNSSEC_FAIL_NONSEC;
/* If we can prove that there's no NS record, return that information. */
if (nons && check_type_bitmap(p, T_NS))
*nons = 0;
/* A CNAME answer would also be valid, so if there's a CNAME it should
have been returned. */
if (check_type_bitmap(p, T_CNAME))
@@ -1337,7 +1337,7 @@ static int prove_non_existence_nsec(struct dns_header *header, size_t plen, unsi
/* If the SOA bit is set for a DS record, then we have the
DS from the wrong side of the delegation. For the root DS,
this is expected. */
if (name_labels != 0 && check_type_bitmap(p, T_DS))
if (name_labels != 0 && type == T_DS && check_type_bitmap(p, T_SOA))
return DNSSEC_FAIL_NONSEC;
/* RFC 6672 5.3.4.1. */
@@ -1433,6 +1433,7 @@ static int base32_decode(char *in, unsigned char *out)
return p - out;
}
/* return 1 if we can prove record _doesn't_ exist */
static int check_nsec3_coverage(struct dns_header *header, size_t plen, int digest_len, unsigned char *digest, int type,
char *workspace1, char *workspace2, unsigned char **nsecs, int nsec_count, int *nons, int name_labels)
{
@@ -1477,23 +1478,23 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige
if (rdlen < 2 || rdlen < p[1] + 2)
return 0;
/* If we can prove that there's no NS record, return that information. */
if (nons && check_type_bitmap(p, T_NS))
*nons = 0;
/* Does the NSEC3 say our type exists? */
if (check_type_bitmap(p, type))
return 0;
/* If we can prove that there's no NS record, return that information. */
if (nons && check_type_bitmap(p, T_NS))
*nons = 0;
/* A CNAME answer would also be valid, so if there's a CNAME it should
have been returned. */
if (check_type_bitmap(p, T_CNAME))
return DNSSEC_FAIL_NONSEC;
return 0;
/* If the SOA bit is set for a DS record, then we have the
DS from the wrong side of the delegation. For the root DS,
this is expected. */
if (name_labels != 0 && check_type_bitmap(p, T_DS))
if (name_labels != 0 && type == T_DS && check_type_bitmap(p, T_SOA))
return 0;
rdlen -= p[1] + 2;