Fix #661 dont sign NSEC3 when len(zone name) > 222

Thanks Jan-Piet Mens.

diff --git a/Changelog b/Changelog
index ec7b45e36ffb077d6032904b93d701ce82c52814..cab9031b4395de5b6e95d23bb4ea18a86cd00e3e 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -86,6 +86,8 @@ TBD
        * bugfix #708: warnings and errors with xcode 6.1/7.0
        * bugfix #754: Memory leak in ldns_str2rdf_ipseckey
          Thanks Xiali Yan
+       * bugfix #661: Fail NSEC3 signing when NSEC domainname length
+         would overflow.  Thanks Jan-Piet Mens.
 
 1.6.17 2014-01-10
        * Fix ldns_dnssec_zone_new_frm_fp_l to allow the last parsed line of a

diff --git a/dnssec_sign.c b/dnssec_sign.c
index 940a7de160d87de3ac85bb21849d31881addedf2..cd77951ae2a238fb6d6b739ce11a8c0d7b2cdee6 100644 (file)
--- a/dnssec_sign.c
+++ b/dnssec_sign.c
@@ -887,6 +887,10 @@ ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
                nsec_ttl = LDNS_DEFAULT_TTL;
        }
 
+       if (ldns_rdf_size(zone->soa->name) > 222) {
+               return LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW;
+       }
+
        if (zone->hashed_names) {
                ldns_traverse_postorder(zone->hashed_names,
                                ldns_hashed_names_node_free, NULL);

diff --git a/error.c b/error.c
index fde9c2652f6079cb3aed244b89fdca9882486e7f..30ffdc88a1a80632310dd2d3de6b7a4244ebb9dc 100644 (file)
--- a/error.c
+++ b/error.c
@@ -145,6 +145,8 @@ ldns_lookup_table ldns_error_str[] = {
         { LDNS_STATUS_RDATA_OVERFLOW, "Rdata size overflow" },
        { LDNS_STATUS_SYNTAX_SUPERFLUOUS_TEXT_ERR,
                "Syntax error, superfluous text present" },
+        { LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW,
+               "The NSEC3 domainname length overflow" },
        { 0, NULL }
 };
 

diff --git a/ldns/error.h b/ldns/error.h
index 7d7983e84d012b4e04a91b69c12cec773dd38e18..fc31737d9a838b26003d2d4e7bf16caf8cf15330 100644 (file)
--- a/ldns/error.h
+++ b/ldns/error.h
@@ -127,7 +127,8 @@ enum ldns_enum_status {
        LDNS_STATUS_TYPE_NOT_IN_BITMAP,
        LDNS_STATUS_INVALID_RDF_TYPE,
        LDNS_STATUS_RDATA_OVERFLOW,
-       LDNS_STATUS_SYNTAX_SUPERFLUOUS_TEXT_ERR
+       LDNS_STATUS_SYNTAX_SUPERFLUOUS_TEXT_ERR,
+       LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
 };
 typedef enum ldns_enum_status ldns_status;