The removed function declaration have never been implemented in libresolv.
+2016-09-21 Florian Weimer <fweimer@redhat.com>
+
+ [BZ #20591]
+ Remove obsolete DNSSEC support.
+ * resolv/arpa/nameser.h (ns_key_types, NS_KEY_*, NS_ALG_*)
+ (NS_MD5_RSA_*, NS_DSA_*, NS_NXT_*, ns_sign, ns_sign2, ns_sign_tcp)
+ (ns_sign_tcp2, ns_sign_tcp_init, ns_find_tsig, ns_verify)
+ (ns_verify_tcp, ns_verify_tcp_init): Remove.
+ (ns_cert_types): Add comment.
+ * resolv/ns_print.c (ns_sprintrrf): Do not handle DNSSEC records
+ separately.
+ (KEY_RSA, KEY_HMAC_MD5, dst_s_id_calc, dst_s_get_int16)
+ (dst_s_dns_key_id): Remove.
+ * resolv/res_debug.c (__p_key_syms, __p_cert_syms): Remove unused
+ variables.
+
2016-09-21 Florian Weimer <fweimer@redhat.com>
[BZ #20524]
for the Linux quota interface which predates kernel version 2.4.22 has
been removed.
+* DNSSEC-related declarations and definitions have been removed from the
+ <arpa/nameser.h> header file, and libresolv will no longer attempt to
+ decode the data part of DNSSEC record types. Previous versions of glibc
+ only implemented minimal support for the previous version of DNSSEC, which
+ is incompatible with the currently deployed version.
+
Security related changes:
On ARM EABI (32-bit), generating a backtrace for execution contexts which
ns_c_max = 65536
} ns_class;
-/* DNSSEC constants. */
-
-typedef enum __ns_key_types {
- ns_kt_rsa = 1, /*%< key type RSA/MD5 */
- ns_kt_dh = 2, /*%< Diffie Hellman */
- ns_kt_dsa = 3, /*%< Digital Signature Standard (MANDATORY) */
- ns_kt_private = 254 /*%< Private key type starts with OID */
-} ns_key_types;
-
+/* Certificate type values in CERT resource records. */
typedef enum __ns_cert_types {
cert_t_pkix = 1, /*%< PKIX (X.509v3) */
cert_t_spki = 2, /*%< SPKI */
cert_t_oid = 254 /*%< OID private type */
} ns_cert_types;
-/* Flags field of the KEY RR rdata. */
-#define NS_KEY_TYPEMASK 0xC000 /*%< Mask for "type" bits */
-#define NS_KEY_TYPE_AUTH_CONF 0x0000 /*%< Key usable for both */
-#define NS_KEY_TYPE_CONF_ONLY 0x8000 /*%< Key usable for confidentiality */
-#define NS_KEY_TYPE_AUTH_ONLY 0x4000 /*%< Key usable for authentication */
-#define NS_KEY_TYPE_NO_KEY 0xC000 /*%< No key usable for either; no key */
-/* The type bits can also be interpreted independently, as single bits: */
-#define NS_KEY_NO_AUTH 0x8000 /*%< Key unusable for authentication */
-#define NS_KEY_NO_CONF 0x4000 /*%< Key unusable for confidentiality */
-#define NS_KEY_RESERVED2 0x2000 /* Security is *mandatory* if bit=0 */
-#define NS_KEY_EXTENDED_FLAGS 0x1000 /*%< reserved - must be zero */
-#define NS_KEY_RESERVED4 0x0800 /*%< reserved - must be zero */
-#define NS_KEY_RESERVED5 0x0400 /*%< reserved - must be zero */
-#define NS_KEY_NAME_TYPE 0x0300 /*%< these bits determine the type */
-#define NS_KEY_NAME_USER 0x0000 /*%< key is assoc. with user */
-#define NS_KEY_NAME_ENTITY 0x0200 /*%< key is assoc. with entity eg host */
-#define NS_KEY_NAME_ZONE 0x0100 /*%< key is zone key */
-#define NS_KEY_NAME_RESERVED 0x0300 /*%< reserved meaning */
-#define NS_KEY_RESERVED8 0x0080 /*%< reserved - must be zero */
-#define NS_KEY_RESERVED9 0x0040 /*%< reserved - must be zero */
-#define NS_KEY_RESERVED10 0x0020 /*%< reserved - must be zero */
-#define NS_KEY_RESERVED11 0x0010 /*%< reserved - must be zero */
-#define NS_KEY_SIGNATORYMASK 0x000F /*%< key can sign RR's of same name */
-#define NS_KEY_RESERVED_BITMASK ( NS_KEY_RESERVED2 | \
- NS_KEY_RESERVED4 | \
- NS_KEY_RESERVED5 | \
- NS_KEY_RESERVED8 | \
- NS_KEY_RESERVED9 | \
- NS_KEY_RESERVED10 | \
- NS_KEY_RESERVED11 )
-#define NS_KEY_RESERVED_BITMASK2 0xFFFF /*%< no bits defined here */
-/* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
-#define NS_ALG_MD5RSA 1 /*%< MD5 with RSA */
-#define NS_ALG_DH 2 /*%< Diffie Hellman KEY */
-#define NS_ALG_DSA 3 /*%< DSA KEY */
-#define NS_ALG_DSS NS_ALG_DSA
-#define NS_ALG_EXPIRE_ONLY 253 /*%< No alg, no security */
-#define NS_ALG_PRIVATE_OID 254 /*%< Key begins with OID giving alg */
-/* Protocol values */
-/* value 0 is reserved */
-#define NS_KEY_PROT_TLS 1
-#define NS_KEY_PROT_EMAIL 2
-#define NS_KEY_PROT_DNSSEC 3
-#define NS_KEY_PROT_IPSEC 4
-#define NS_KEY_PROT_ANY 255
-
-/* Signatures */
-#define NS_MD5RSA_MIN_BITS 512 /*%< Size of a mod or exp in bits */
-#define NS_MD5RSA_MAX_BITS 4096
- /* Total of binary mod and exp */
-#define NS_MD5RSA_MAX_BYTES ((NS_MD5RSA_MAX_BITS+7/8)*2+3)
- /* Max length of text sig block */
-#define NS_MD5RSA_MAX_BASE64 (((NS_MD5RSA_MAX_BYTES+2)/3)*4)
-#define NS_MD5RSA_MIN_SIZE ((NS_MD5RSA_MIN_BITS+7)/8)
-#define NS_MD5RSA_MAX_SIZE ((NS_MD5RSA_MAX_BITS+7)/8)
-
-#define NS_DSA_SIG_SIZE 41
-#define NS_DSA_MIN_SIZE 213
-#define NS_DSA_MAX_BYTES 405
-
-/* Offsets into SIG record rdata to find various values */
-#define NS_SIG_TYPE 0 /*%< Type flags */
-#define NS_SIG_ALG 2 /*%< Algorithm */
-#define NS_SIG_LABELS 3 /*%< How many labels in name */
-#define NS_SIG_OTTL 4 /*%< Original TTL */
-#define NS_SIG_EXPIR 8 /*%< Expiration time */
-#define NS_SIG_SIGNED 12 /*%< Signature time */
-#define NS_SIG_FOOT 16 /*%< Key footprint */
-#define NS_SIG_SIGNER 18 /*%< Domain name of who signed it */
-/* How RR types are represented as bit-flags in NXT records */
-#define NS_NXT_BITS 8
-#define NS_NXT_BIT_SET( n,p) (p[(n)/NS_NXT_BITS] |= (0x80>>((n)%NS_NXT_BITS)))
-#define NS_NXT_BIT_CLEAR(n,p) (p[(n)/NS_NXT_BITS] &= ~(0x80>>((n)%NS_NXT_BITS)))
-#define NS_NXT_BIT_ISSET(n,p) (p[(n)/NS_NXT_BITS] & (0x80>>((n)%NS_NXT_BITS)))
-#define NS_NXT_MAX 127
-
/*%
* EDNS0 extended flags and option codes, host order.
*/
int ns_name_skip (const u_char **, const u_char *) __THROW;
void ns_name_rollback (const u_char *, const u_char **,
const u_char **) __THROW;
-int ns_sign (u_char *, int *, int, int, void *,
- const u_char *, int, u_char *, int *, time_t) __THROW;
-int ns_sign2 (u_char *, int *, int, int, void *,
- const u_char *, int, u_char *, int *, time_t,
- u_char **, u_char **) __THROW;
-int ns_sign_tcp (u_char *, int *, int, int,
- ns_tcp_tsig_state *, int) __THROW;
-int ns_sign_tcp2 (u_char *, int *, int, int,
- ns_tcp_tsig_state *, int,
- u_char **, u_char **) __THROW;
-int ns_sign_tcp_init (void *, const u_char *, int,
- ns_tcp_tsig_state *) __THROW;
-u_char *ns_find_tsig (u_char *, u_char *) __THROW;
-int ns_verify (u_char *, int *, void *, const u_char *, int,
- u_char *, int *, time_t *, int) __THROW;
-int ns_verify_tcp (u_char *, int *, ns_tcp_tsig_state *, int)
- __THROW;
-int ns_verify_tcp_init (void *, const u_char *, int,
- ns_tcp_tsig_state *) __THROW;
int ns_samedomain (const char *, const char *) __THROW;
int ns_subdomain (const char *, const char *) __THROW;
int ns_makecanon (const char *, char *, size_t) __THROW;
static int addtab(size_t len, size_t target, int spaced,
char **buf, size_t *buflen);
-static u_int16_t dst_s_dns_key_id(const u_char *, const int);
-
/* Macros. */
#define T(x) \
break;
}
- case ns_t_key: {
- char base64_key[NS_MD5RSA_MAX_BASE64];
- u_int keyflags, protocol, algorithm, key_id;
- const char *leader;
- int n;
-
- if (rdlen < 0U + NS_INT16SZ + NS_INT8SZ + NS_INT8SZ)
- goto formerr;
-
- /* Key flags, Protocol, Algorithm. */
- key_id = dst_s_dns_key_id(rdata, edata-rdata);
- keyflags = ns_get16(rdata); rdata += NS_INT16SZ;
- protocol = *rdata++;
- algorithm = *rdata++;
- len = SPRINTF((tmp, "0x%04x %u %u",
- keyflags, protocol, algorithm));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Public key data. */
- len = b64_ntop(rdata, edata - rdata,
- base64_key, sizeof base64_key);
- if (len < 0)
- goto formerr;
- if (len > 15) {
- T(addstr(" (", 2, &buf, &buflen));
- leader = "\n\t\t";
- spaced = 0;
- } else
- leader = " ";
- for (n = 0; n < len; n += 48) {
- T(addstr(leader, strlen(leader), &buf, &buflen));
- T(addstr(base64_key + n, MIN(len - n, 48),
- &buf, &buflen));
- }
- if (len > 15)
- T(addstr(" )", 2, &buf, &buflen));
- n = SPRINTF((tmp, " ; key_tag= %u", key_id));
- T(addstr(tmp, n, &buf, &buflen));
-
- break;
- }
-
- case ns_t_sig: {
- char base64_key[NS_MD5RSA_MAX_BASE64];
- u_int type, algorithm, labels, footprint;
- const char *leader;
- u_long t;
- int n;
-
- if (rdlen < 22U)
- goto formerr;
-
- /* Type covered, Algorithm, Label count, Original TTL. */
- type = ns_get16(rdata); rdata += NS_INT16SZ;
- algorithm = *rdata++;
- labels = *rdata++;
- t = ns_get32(rdata); rdata += NS_INT32SZ;
- len = SPRINTF((tmp, "%s %d %d %lu ",
- p_type(type), algorithm, labels, t));
- T(addstr(tmp, len, &buf, &buflen));
- if (labels > (u_int)dn_count_labels(name))
- goto formerr;
-
- /* Signature expiry. */
- t = ns_get32(rdata); rdata += NS_INT32SZ;
- len = SPRINTF((tmp, "%s ", p_secstodate(t)));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Time signed. */
- t = ns_get32(rdata); rdata += NS_INT32SZ;
- len = SPRINTF((tmp, "%s ", p_secstodate(t)));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Signature Footprint. */
- footprint = ns_get16(rdata); rdata += NS_INT16SZ;
- len = SPRINTF((tmp, "%u ", footprint));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Signer's name. */
- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
-
- /* Signature. */
- len = b64_ntop(rdata, edata - rdata,
- base64_key, sizeof base64_key);
- if (len > 15) {
- T(addstr(" (", 2, &buf, &buflen));
- leader = "\n\t\t";
- spaced = 0;
- } else
- leader = " ";
- if (len < 0)
- goto formerr;
- for (n = 0; n < len; n += 48) {
- T(addstr(leader, strlen(leader), &buf, &buflen));
- T(addstr(base64_key + n, MIN(len - n, 48),
- &buf, &buflen));
- }
- if (len > 15)
- T(addstr(" )", 2, &buf, &buflen));
- break;
- }
-
- case ns_t_nxt: {
- int n, c;
-
- /* Next domain name. */
- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
-
- /* Type bit map. */
- n = edata - rdata;
- for (c = 0; c < n*8; c++)
- if (NS_NXT_BIT_ISSET(c, rdata)) {
- len = SPRINTF((tmp, " %s", p_type(c)));
- T(addstr(tmp, len, &buf, &buflen));
- }
- break;
- }
-
case ns_t_cert: {
u_int c_type, key_tag, alg;
int n;
}
return (spaced);
}
-
-/* DST algorithm codes */
-#define KEY_RSA 1
-#define KEY_HMAC_MD5 157
-
-/*%
- * calculates a checksum used in dst for an id.
- * takes an array of bytes and a length.
- * returns a 16 bit checksum.
- */
-static u_int16_t
-dst_s_id_calc(const u_char *key, const int keysize)
-{
- u_int32_t ac;
- const u_char *kp = key;
- int size = keysize;
-
- if (!key || (keysize <= 0))
- return (0xffffU);
-
- for (ac = 0; size > 1; size -= 2, kp += 2)
- ac += ((*kp) << 8) + *(kp + 1);
-
- if (size > 0)
- ac += ((*kp) << 8);
- ac += (ac >> 16) & 0xffff;
-
- return (ac & 0xffff);
-}
-
-/*%
- * dst_s_get_int16
- * This routine extracts a 16 bit integer from a two byte character
- * string. The character string is assumed to be in network byte
- * order and may be unaligned. The number returned is in host order.
- * Parameter
- * buf A two byte character string.
- * Return
- * The converted integer value.
- */
-
-static u_int16_t
-dst_s_get_int16(const u_char *buf)
-{
- u_int16_t a = 0;
- a = ((u_int16_t)(buf[0] << 8)) | ((u_int16_t)(buf[1]));
- return (a);
-}
-
-/*%
- * dst_s_dns_key_id() Function to calculate DNSSEC footprint from KEY record
- * rdata
- * Input:
- * dns_key_rdata: the raw data in wire format
- * rdata_len: the size of the input data
- * Output:
- * the key footprint/id calculated from the key data
- */
-static u_int16_t
-dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
-{
- if (!dns_key_rdata)
- return 0;
-
- /* compute id */
- if (dns_key_rdata[3] == KEY_RSA) /*%< Algorithm RSA */
- return dst_s_get_int16((const u_char *)
- &dns_key_rdata[rdata_len - 3]);
- else if (dns_key_rdata[3] == KEY_HMAC_MD5)
- /* compatibility */
- return 0;
- else
- /* compute a checksum on the key part of the key rr */
- return dst_s_id_calc(dns_key_rdata, rdata_len);
-}
-
-
-/*! \file */
{0, (char *)0}
};
-const struct res_sym __p_key_syms[] attribute_hidden = {
- {NS_ALG_MD5RSA, "RSA", "RSA KEY with MD5 hash"},
- {NS_ALG_DH, "DH", "Diffie Hellman"},
- {NS_ALG_DSA, "DSA", "Digital Signature Algorithm"},
- {NS_ALG_EXPIRE_ONLY, "EXPIREONLY", "No algorithm"},
- {NS_ALG_PRIVATE_OID, "PRIVATE", "Algorithm obtained from OID"},
- {0, NULL, NULL}
-};
-
-const struct res_sym __p_cert_syms[] attribute_hidden = {
- {cert_t_pkix, "PKIX", "PKIX (X.509v3) Certificate"},
- {cert_t_spki, "SPKI", "SPKI certificate"},
- {cert_t_pgp, "PGP", "PGP certificate"},
- {cert_t_url, "URL", "URL Private"},
- {cert_t_oid, "OID", "OID Private"},
- {0, NULL, NULL}
-};
-
/*
* Names of RR types and qtypes. Types and qtypes are the same, except
* that T_ANY is a qtype but not a type. (You can ask for records of type
projects / thirdparty / glibc.git / commitdiff
