- Fix negative cache NSEC3 parameter compares for zero length NSEC3

  salt.

diff --git a/doc/Changelog b/doc/Changelog
index 9172b2199bf584ed839304042b36b5bfc903bc8c..885ac55a75a4fa0288c81f3c12c1ff70c89730b5 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+30 September 2024: Wouter
+       - Fix negative cache NSEC3 parameter compares for zero length NSEC3
+         salt.
+
 25 September 2024: Wouter
        - Fix #1144: [FR] log timestamps in ISO8601 format with timezone.
          This adds the option `log-time-iso: yes` that logs in ISO8601

diff --git a/validator/val_neg.c b/validator/val_neg.c
index 52bc6838726096b21cef19eaf610d5be38f01362..b5b678fdea68258979a2f9cd0948610f6ba9988f 100644 (file)
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -823,7 +823,8 @@ void neg_insert_data(struct val_neg_cache* neg,
                        it <= neg->nsec3_max_iter &&
                        (h != zone->nsec3_hash || it != zone->nsec3_iter ||
                        slen != zone->nsec3_saltlen || 
-                       memcmp(zone->nsec3_salt, s, slen) != 0)) {
+                       (slen != 0 && zone->nsec3_salt && s
+                         && memcmp(zone->nsec3_salt, s, slen) != 0))) {
 
                        if(slen > 0) {
                                uint8_t* sa = memdup(s, slen);
@@ -1206,7 +1207,8 @@ neg_params_ok(struct val_neg_zone* zone, struct ub_packed_rrset_key* rrset)
                return 0;
        return (h == zone->nsec3_hash && it == zone->nsec3_iter &&
                slen == zone->nsec3_saltlen &&
-               memcmp(zone->nsec3_salt, s, slen) == 0);
+               (slen != 0 && zone->nsec3_salt && s
+                 && memcmp(zone->nsec3_salt, s, slen) == 0));
 }
 
 /** get next closer for nsec3 proof */

diff --git a/validator/val_nsec3.c b/validator/val_nsec3.c
index e790e99825eac9e9dbae45bbb7f8298779ecc726..998fcc4e38ee1d22942215610122f82fbb4eb87b 100644 (file)
--- a/validator/val_nsec3.c
+++ b/validator/val_nsec3.c
@@ -565,7 +565,8 @@ nsec3_get_hashed(sldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo,
        sldns_buffer_clear(buf);
        sldns_buffer_write(buf, nm, nmlen);
        query_dname_tolower(sldns_buffer_begin(buf));
-       sldns_buffer_write(buf, salt, saltlen);
+       if(saltlen != 0)
+               sldns_buffer_write(buf, salt, saltlen);
        sldns_buffer_flip(buf);
        hash_len = nsec3_hash_algo_size_supported(algo);
        if(hash_len == 0) {
@@ -580,7 +581,8 @@ nsec3_get_hashed(sldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo,
        for(i=0; i<iter; i++) {
                sldns_buffer_clear(buf);
                sldns_buffer_write(buf, res, hash_len);
-               sldns_buffer_write(buf, salt, saltlen);
+               if(saltlen != 0)
+                       sldns_buffer_write(buf, salt, saltlen);
                sldns_buffer_flip(buf);
                if(!secalgo_nsec3_hash(algo,
                        (unsigned char*)sldns_buffer_begin(buf),