bin/named/update.c
/*
 * Prevent the zone entering a inconsistent state where
 * NSEC only DNSKEYs are present with NSEC3 chains.
 */
Prevent the zone entering a inconsistent state where
NSEC only DNSKEYs are present with NSEC3 chains.
Prevent the zone entering a inconsistent state where NSEC only DNSKEYs are present with NSEC3 chains .
static isc_result_t
check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
	     dns_dbversion_t *ver, dns_diff_t *diff)
{
	dns_difftuple_t *tuple;
	isc_boolean_t nseconly = ISC_FALSE, nsec3 = ISC_FALSE;
	isc_result_t result;
	unsigned int iterations = 0, max;
	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
	for (tuple = ISC_LIST_HEAD(diff->tuples);
	     tuple != NULL;
	     tuple = ISC_LIST_NEXT(tuple, link)) {
		if (tuple->op != DNS_DIFFOP_ADD)
			continue;
		if (tuple->rdata.type == dns_rdatatype_dnskey) {
			isc_uint8_t alg;
			alg = tuple->rdata.data[3];
			if (alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 ||
			    alg == DST_ALG_DSA || alg == DST_ALG_ECC) {
				nseconly = ISC_TRUE;
				break;
			}
		} else if (tuple->rdata.type == dns_rdatatype_nsec3param) {
			nsec3 = ISC_TRUE;
			break;
		}
	}
	if (!nseconly)
		CHECK(dns_nsec_nseconly(db, ver, &nseconly));
	if (!nsec3)
		CHECK(dns_nsec3_activex(db, ver, ISC_FALSE,
					privatetype, &nsec3));
	if (nseconly && nsec3) {
		update_log(client, zone, ISC_LOG_ERROR,
			   "NSEC only DNSKEYs and NSEC3 chains not allowed");
		result = DNS_R_REFUSED;
		goto failure;
	}
	CHECK(get_iterations(db, ver, privatetype, &iterations));
	CHECK(dns_nsec3_maxiterations(db, ver, client->mctx, &max));
	if (max != 0 && iterations > max) {
		update_log(client, zone, ISC_LOG_ERROR,
			   "too many NSEC3 iterations (%u) for "
			   "weakest DNSKEY (%u)", iterations, max);
		result = DNS_R_REFUSED;
		goto failure;
	}
 failure:
	return (result);
}
static isc_result_t check_dnssec ( ns_client_t * client , dns_zone_t * zone , dns_db_t * db , dns_dbversion_t * ver , dns_diff_t * diff ) { dns_difftuple_t * tuple ; isc_boolean_t nseconly = ISC_FALSE , nsec3 = ISC_FALSE ; isc_result_t result ; unsigned int iterations = 0 , max ; dns_rdatatype_t privatetype = dns_zone_getprivatetype ( zone ) ; for ( tuple = ISC_LIST_HEAD ( diff -> tuples ) ; tuple != NULL ; tuple = ISC_LIST_NEXT ( tuple , link ) ) { if ( tuple -> op != DNS_DIFFOP_ADD ) continue ; if ( tuple -> rdata . type == dns_rdatatype_dnskey ) { isc_uint8_t alg ; alg = tuple -> rdata . data [ 3 ] ; if ( alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 || alg == DST_ALG_DSA || alg == DST_ALG_ECC ) { nseconly = ISC_TRUE ; break ; } } else if ( tuple -> rdata . type == dns_rdatatype_nsec3param ) { nsec3 = ISC_TRUE ; break ; } } if ( ! nseconly ) CHECK ( dns_nsec_nseconly ( db , ver , & nseconly ) ) ; if ( ! nsec3 ) CHECK ( dns_nsec3_activex ( db , ver , ISC_FALSE , privatetype , & nsec3 ) ) ; if ( nseconly && nsec3 ) { update_log ( client , zone , ISC_LOG_ERROR , " " ) ; result = DNS_R_REFUSED ; goto failure ; } CHECK ( get_iterations ( db , ver , privatetype , & iterations ) ) ; CHECK ( dns_nsec3_maxiterations ( db , ver , client -> mctx , & max ) ) ; if ( max != 0 && iterations > max ) { update_log ( client , zone , ISC_LOG_ERROR , " " " " , iterations , max ) ; result = DNS_R_REFUSED ; goto failure ; } failure : return ( result ) ; }
Prevent the zone entering a inconsistent state where
 NSEC only DNSKEYs are present with NSEC3 chains.
Prevent the zone entering a inconsistent state where NSEC only DNSKEYs are present with NSEC3 chains .
/* Scan the tuples for an NSEC-only DNSKEY or an NSEC3PARAM */ /* Check existing DB for NSEC-only DNSKEY */ /* Check existing DB for NSEC3 */ /* Refuse to allow NSEC3 with NSEC-only keys */ /* Verify NSEC3 params */