2495. [bug] Tighten RRSIG checks. [RT #18795]

diff --git a/CHANGES b/CHANGES
index 218b154cc6fb71dac32dac383de0514262cd99b7..2a56b245222c0969463540a9a661e1e0d70dcc2b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2495.  [bug]           Tighten RRSIG checks. [RT #18795]
+
 2494.  [bug]           isc/radix.h, dns/sdlz.h and dns/dlz.h were not being
                        installed. [RT #18826]
 

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index ec0b82712864ccfb3a4cc84a3b9952edd81a19e3..133c678d453757f3f8c526cb2fd611c5357f5d50 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.204.94.2 2008/06/02 23:46:32 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.204.94.3 2008/11/14 22:57:29 marka Exp $ */
 
 /*! \file */
 
@@ -2129,6 +2129,9 @@ main(int argc, char *argv[]) {
                                fatal("cannot load dnskey %s: %s", argv[i],
                                      isc_result_totext(result));
 
+                       if (!dns_name_equal(gorigin, dst_key_name(newkey)))
+                               fatal("key %s not at origin\n", argv[i]);
+
                        key = ISC_LIST_HEAD(keylist);
                        while (key != NULL) {
                                dst_key_t *dkey = key->key;
@@ -2166,6 +2169,9 @@ main(int argc, char *argv[]) {
                        fatal("cannot load dnskey %s: %s", dskeyfile[i],
                              isc_result_totext(result));
 
+               if (!dns_name_equal(gorigin, dst_key_name(newkey)))
+                       fatal("key %s not at origin\n", dskeyfile[i]);
+
                key = ISC_LIST_HEAD(keylist);
                while (key != NULL) {
                        dst_key_t *dkey = key->key;

diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 98d7579a037d952c30c3bbfa66171f798084e2c7..99506cccc52c11cac79adeadc041e3d6b81ae9b7 100644 (file)
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: dnssec.c,v 1.91 2007/09/14 04:32:50 marka Exp $
+ * $Id: dnssec.c,v 1.91.58.1 2008/11/14 22:57:29 marka Exp $
  */
 
 /*! \file */
@@ -366,6 +366,9 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
        if (ret != ISC_R_SUCCESS)
                return (ret);
 
+       if (set->type != sig.covered)
+               return (DNS_R_SIGINVALID);
+
        if (isc_serial_lt(sig.timeexpire, sig.timesigned))
                return (DNS_R_SIGINVALID);
 
@@ -381,6 +384,27 @@ dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
                        return (DNS_R_SIGEXPIRED);
        }
 
+       /*
+        * NS, SOA and DNSSKEY records are signed by their owner.
+        * DS records are signed by the parent.
+        */
+       switch (set->type) {
+       case dns_rdatatype_ns:
+       case dns_rdatatype_soa:
+       case dns_rdatatype_dnskey:
+               if (!dns_name_equal(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               break;
+       case dns_rdatatype_ds:
+               if (dns_name_equal(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               /* FALLTHROUGH */
+       default:
+               if (!dns_name_issubdomain(name, &sig.signer))
+                       return (DNS_R_SIGINVALID);
+               break;
+       }
+
        /*
         * Is the key allowed to sign data?
         */
@@ -541,6 +565,9 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
                if (!is_zone_key(pubkey) ||
                    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
                        goto next;
+               /* Corrupted .key file? */
+               if (!dns_name_equal(name, dst_key_name(pubkey)))
+                       goto next;
                keys[count] = NULL;
                result = dst_key_fromfile(dst_key_name(pubkey),
                                          dst_key_id(pubkey),

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index f36ad20552a1203296f9d153911a14471647c77f..8f92a8f55791d429bab8bbd31324baed40ae0b1d 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.11.92.2 2008/03/31 23:46:42 tbox Exp $
+ * $Id: dst_api.c,v 1.11.92.3 2008/11/14 22:57:29 marka Exp $
  */
 
 /*! \file */
@@ -947,6 +947,13 @@ dst_key_read_public(const char *filename, int type,
        NEXTTOKEN(lex, opt, &token);
        if (token.type != isc_tokentype_string)
                BADTOKEN();
+
+       /*
+        * We don't support "@" in .key files.
+        */
+       if (!strcmp(DST_AS_STR(token), "@"))
+               BADTOKEN();
+
        dns_fixedname_init(&name);
        isc_buffer_init(&b, DST_AS_STR(token), strlen(DST_AS_STR(token)));
        isc_buffer_add(&b, strlen(DST_AS_STR(token)));

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 8019a9399cb0d82ca93b85ca151b5c7dd5ad4ec6..c92c45331c78e4695cfef0f3f6351703178ba593 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.155.52.6 2008/08/21 04:56:39 marka Exp $ */
+/* $Id: validator.c,v 1.155.52.7 2008/11/14 22:57:29 marka Exp $ */
 
 #include <config.h>
 
@@ -1130,6 +1130,23 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {
                 */
                if (dns_rdatatype_atparent(val->event->rdataset->type))
                        return (DNS_R_CONTINUE);
+       } else {
+               /*
+                * SOA and NS RRsets can only be signed by a key with   
+                * the same name.
+                */
+               if (val->event->rdataset->type == dns_rdatatype_soa ||
+                   val->event->rdataset->type == dns_rdatatype_ns) {
+                       const char *typename;
+
+                       if (val->event->rdataset->type == dns_rdatatype_soa)
+                               typename = "SOA";
+                       else
+                               typename = "NS";
+                       validator_log(val, ISC_LOG_DEBUG(3),
+                                     "%s signer mismatch", typename);
+                       return (DNS_R_CONTINUE);
+               }
        }
 
        /*
@@ -1701,6 +1718,10 @@ validatezonekey(dns_validator_t *val) {
                                             &sigrdata);
                        result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+                       if (!dns_name_equal(val->event->name, &sig.signer))
+                               continue;
+
                        result = dns_keytable_findkeynode(val->keytable,
                                                          val->event->name,
                                                          sig.algorithm,
@@ -1941,7 +1962,11 @@ validatezonekey(dns_validator_t *val) {
                        if (ds.key_tag != sig.keyid ||
                            ds.algorithm != sig.algorithm)
                                continue;
-
+                       if (!dns_name_equal(val->event->name, &sig.signer)) {
+                               validator_log(val, ISC_LOG_DEBUG(3),
+                                             "DNSKEY signer mismatch");
+                               continue;
+                       }
                        dstkey = NULL;
                        result = dns_dnssec_keyfromrdata(val->event->name,
                                                         &keyrdata,