2495. [bug] Tighten RRSIG checks. [RT #18795]

diff --git a/CHANGES b/CHANGES
index f487d338ba911035ad4c499b7e666583f3017f62..63e4b99376e425dfcc76586a9f6b04561e7fd13a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2495.  [bug]           Tighten RRSIG checks. [RT #18795]
+
 2494.  [bug]           isc/radix.h, dns/sdlz.h and dns/dlz.h were not being
                        installed. [RT #18826]
 

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 9af08dd53cd6893597bfaa8f350335b93d3c0d6e..f446ef3478d89d2e463f3ba9606b4ea9f1bc1114 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.208 2008/09/26 01:27:08 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.209 2008/11/14 22:53:46 marka Exp $ */
 
 /*! \file */
 
@@ -2784,6 +2784,9 @@ main(int argc, char *argv[]) {
                                fatal("cannot load dnskey %s: %s", argv[i],
                                      isc_result_totext(result));
 
+                       if (!dns_name_equal(gorigin, dst_key_name(newkey)))
+                               fatal("key %s not at origin\n", argv[i]);
+
                        key = ISC_LIST_HEAD(keylist);
                        while (key != NULL) {
                                dst_key_t *dkey = key->key;
@@ -2821,6 +2824,9 @@ main(int argc, char *argv[]) {
                        fatal("cannot load dnskey %s: %s", dskeyfile[i],
                              isc_result_totext(result));
 
+               if (!dns_name_equal(gorigin, dst_key_name(newkey)))
+                       fatal("key %s not at origin\n", dskeyfile[i]);
+
                key = ISC_LIST_HEAD(keylist);
                while (key != NULL) {
                        dst_key_t *dkey = key->key;

diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 98d7579a037d952c30c3bbfa66171f798084e2c7..2ffe8f856c9dba8f98411ba1080b7a97cedc3cd1 100644 (file)
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: dnssec.c,v 1.91 2007/09/14 04:32:50 marka Exp $
+ * $Id: dnssec.c,v 1.92 2008/11/14 22:53:46 marka Exp $
  */
 
 /*! \file */
@@ -366,6 +366,9 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
        if (ret != ISC_R_SUCCESS)
                return (ret);
 
+       if (set->type != sig.covered)
+               return (DNS_R_SIGINVALID);
+
        if (isc_serial_lt(sig.timeexpire, sig.timesigned))
                return (DNS_R_SIGINVALID);
 
@@ -381,6 +384,27 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
                        return (DNS_R_SIGEXPIRED);
        }
 
+       /*
+        * NS, SOA and DNSSKEY records are signed by their owner.
+        * DS records are signed by the parent.
+        */
+       switch (set->type) {
+       case dns_rdatatype_ns:
+       case dns_rdatatype_soa:
+       case dns_rdatatype_dnskey:
+               if (!dns_name_equal(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               break;
+       case dns_rdatatype_ds:
+               if (dns_name_equal(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               /* FALLTHROUGH */
+       default:
+               if (!dns_name_issubdomain(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               break;
+       }
+
        /*
         * Is the key allowed to sign data?
         */
@@ -541,6 +565,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
                if (!is_zone_key(pubkey) ||
                    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
                        goto next;
+               /* Corrupted .key file? */
+               if (!dns_name_equal(name, dst_key_name(pubkey)))
+                       goto next;
                keys[count] = NULL;
                result = dst_key_fromfile(dst_key_name(pubkey),
                                          dst_key_id(pubkey),

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 4bfcfe8df66fb7c088f76ee61c15ee79c894c1e4..32f894d51350a1fbe82c4977a1eb8082cf31d479 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.15 2008/09/24 02:46:22 marka Exp $
+ * $Id: dst_api.c,v 1.16 2008/11/14 22:53:46 marka Exp $
  */
 
 /*! \file */
@@ -997,6 +997,13 @@ dst_key_read_public(const char *filename, int type,
        NEXTTOKEN(lex, opt, &token);
        if (token.type != isc_tokentype_string)
                BADTOKEN();
+
+       /*
+        * We don't support "@" in .key files.
+        */
+       if (!strcmp(DST_AS_STR(token), "@"))
+               BADTOKEN();
+
        dns_fixedname_init(&name);
        isc_buffer_init(&b, DST_AS_STR(token), strlen(DST_AS_STR(token)));
        isc_buffer_add(&b, strlen(DST_AS_STR(token)));

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index cd6de2d3fdf8f409e4aa2970a09d0a3938690090..27f158d66b8ed77cc34b632f7ac2912e00b0a0f6 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.162 2008/09/24 02:46:22 marka Exp $ */
+/* $Id: validator.c,v 1.163 2008/11/14 22:53:46 marka Exp $ */
 
 #include <config.h>
 
@@ -1544,6 +1544,23 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {
                 */
                if (dns_rdatatype_atparent(val->event->rdataset->type))
                        return (DNS_R_CONTINUE);
+       } else {
+               /*
+                * SOA and NS RRsets can only be signed by a key with   
+                * the same name.
+                */
+               if (val->event->rdataset->type == dns_rdatatype_soa ||
+                   val->event->rdataset->type == dns_rdatatype_ns) {
+                       const char *typename;
+
+                       if (val->event->rdataset->type == dns_rdatatype_soa)
+                               typename = "SOA";
+                       else
+                               typename = "NS";
+                       validator_log(val, ISC_LOG_DEBUG(3),
+                                     "%s signer mismatch", typename);
+                       return (DNS_R_CONTINUE);
+               }
        }
 
        /*
@@ -2115,6 +2132,10 @@ validatezonekey(dns_validator_t *val) {
                                             &sigrdata);
                        result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+                       if (!dns_name_equal(val->event->name, &sig.signer))
+                               continue;
+
                        result = dns_keytable_findkeynode(val->keytable,
                                                          val->event->name,
                                                          sig.algorithm,
@@ -2355,7 +2376,11 @@ validatezonekey(dns_validator_t *val) {
                        if (ds.key_tag != sig.keyid ||
                            ds.algorithm != sig.algorithm)
                                continue;
-
+                       if (!dns_name_equal(val->event->name, &sig.signer)) {
+                               validator_log(val, ISC_LOG_DEBUG(3),
+                                             "DNSKEY signer mismatch");
+                               continue;
+                       }
                        dstkey = NULL;
                        result = dns_dnssec_keyfromrdata(val->event->name,
                                                         &keyrdata,