mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-20 11:29:35 +00:00
DL6ER
3a3e7a049f
`validate_rrset()` returns the start of the closest encloser as an offset
into the owner name, and `prove_non_existence_nsec3()` is meant to stop
its search there. It compares `name - closest_encloser` with that offset,
but `closest_encloser` only moves forward from `name`, so the difference
is never positive and the search never stops at the encloser the RRSIG
labels field gives.
A wildcard answer one label below the closest encloser is not affected,
as the NSEC3 covering the next closer name covers the query name itself.
Two or more labels below, dnsmasq looks for an NSEC3 matching the closest
encloser, which RFC 5155 section 7.2.6 does not require the zone to send,
and returns SERVFAIL with EDE 12 (NSEC Missing). An example is
foo.login.us2.yubico.com, answered from *.us2.yubico.com.
The comparison came with f603a4f ("Fix a corner-case in DNSSEC validation
with wildcards."), which replaced the name compare. Swap the operands.
Signed-off-by: DL6ER <dl6er@dl6er.de>