Skip to content

D
Dnsmasq
Commit bce6e1bc authored by Simon Kelley's avatar Simon Kelley
Browse files
Options

RRSIGs in DS and DNSKEY cached answers.

parent 824202ef
Show whitespace changes
Inline Side-by-side
Showing with 74 additions and 51 deletions
src/cache.c
View file @ bce6e1bc
...@@ -722,7 +722,7 @@ static void add_hosts_cname(struct crec *target) ...@@ -722,7 +722,7 @@ static void add_hosts_cname(struct crec *target)
if (hostname_isequal(cache_get_name(target), a->target) && if (hostname_isequal(cache_get_name(target), a->target) &&
(crec = whine_malloc(sizeof(struct crec)))) (crec = whine_malloc(sizeof(struct crec))))
{ {
crec->flags = F_FORWARD | F_IMMORTAL | F_NAMEP | F_CONFIG | F_CNAME | F_DNSSECOK; crec->flags = F_FORWARD | F_IMMORTAL | F_NAMEP | F_CONFIG | F_CNAME;
crec->name.namep = a->alias; crec->name.namep = a->alias;
crec->addr.cname.target.cache = target; crec->addr.cname.target.cache = target;
crec->addr.cname.uid = target->uid; crec->addr.cname.uid = target->uid;
...@@ -859,14 +859,14 @@ static int read_hostsfile(char *filename, int index, int cache_size, struct crec ...@@ -859,14 +859,14 @@ static int read_hostsfile(char *filename, int index, int cache_size, struct crec
if (inet_pton(AF_INET, token, &addr) > 0) if (inet_pton(AF_INET, token, &addr) > 0)
{ {
flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4 | F_DNSSECOK; flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4;
addrlen = INADDRSZ; addrlen = INADDRSZ;
domain_suffix = get_domain(addr.addr.addr4); domain_suffix = get_domain(addr.addr.addr4);
} }
#ifdef HAVE_IPV6 #ifdef HAVE_IPV6
else if (inet_pton(AF_INET6, token, &addr) > 0) else if (inet_pton(AF_INET6, token, &addr) > 0)
{ {
flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6 | F_DNSSECOK; flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6;
addrlen = IN6ADDRSZ; addrlen = IN6ADDRSZ;
domain_suffix = get_domain6(&addr.addr.addr6); domain_suffix = get_domain6(&addr.addr.addr6);
} }
...@@ -984,7 +984,7 @@ void cache_reload(void) ...@@ -984,7 +984,7 @@ void cache_reload(void)
if (hostname_isequal(a->target, intr->name) && if (hostname_isequal(a->target, intr->name) &&
((cache = whine_malloc(sizeof(struct crec))))) ((cache = whine_malloc(sizeof(struct crec)))))
{ {
cache->flags = F_FORWARD | F_NAMEP | F_CNAME | F_IMMORTAL | F_CONFIG | F_DNSSECOK; cache->flags = F_FORWARD | F_NAMEP | F_CNAME | F_IMMORTAL | F_CONFIG;
cache->name.namep = a->alias; cache->name.namep = a->alias;
cache->addr.cname.target.int_name = intr; cache->addr.cname.target.int_name = intr;
cache->addr.cname.uid = -1; cache->addr.cname.uid = -1;
...@@ -1022,7 +1022,7 @@ void cache_reload(void) ...@@ -1022,7 +1022,7 @@ void cache_reload(void)
(cache = whine_malloc(sizeof(struct crec)))) (cache = whine_malloc(sizeof(struct crec))))
{ {
cache->name.namep = nl->name; cache->name.namep = nl->name;
cache->flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4 | F_NAMEP | F_CONFIG | F_DNSSECOK; cache->flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4 | F_NAMEP | F_CONFIG;
add_hosts_entry(cache, (struct all_addr *)&hr->addr, INADDRSZ, 0, (struct crec **)daemon->packet, revhashsz); add_hosts_entry(cache, (struct all_addr *)&hr->addr, INADDRSZ, 0, (struct crec **)daemon->packet, revhashsz);
} }
#ifdef HAVE_IPV6 #ifdef HAVE_IPV6
...@@ -1030,7 +1030,7 @@ void cache_reload(void) ...@@ -1030,7 +1030,7 @@ void cache_reload(void)
(cache = whine_malloc(sizeof(struct crec)))) (cache = whine_malloc(sizeof(struct crec))))
{ {
cache->name.namep = nl->name; cache->name.namep = nl->name;
cache->flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6 | F_NAMEP | F_CONFIG | F_DNSSECOK; cache->flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6 | F_NAMEP | F_CONFIG;
add_hosts_entry(cache, (struct all_addr *)&hr->addr6, IN6ADDRSZ, 0, (struct crec **)daemon->packet, revhashsz); add_hosts_entry(cache, (struct all_addr *)&hr->addr6, IN6ADDRSZ, 0, (struct crec **)daemon->packet, revhashsz);
} }
#endif #endif
...@@ -1100,7 +1100,7 @@ static void add_dhcp_cname(struct crec *target, time_t ttd) ...@@ -1100,7 +1100,7 @@ static void add_dhcp_cname(struct crec *target, time_t ttd)
if (aliasc) if (aliasc)
{ {
aliasc->flags = F_FORWARD | F_NAMEP | F_DHCP | F_CNAME | F_CONFIG | F_DNSSECOK; aliasc->flags = F_FORWARD | F_NAMEP | F_DHCP | F_CNAME | F_CONFIG;
if (ttd == 0) if (ttd == 0)
aliasc->flags |= F_IMMORTAL; aliasc->flags |= F_IMMORTAL;
else else
...@@ -1188,7 +1188,7 @@ void cache_add_dhcp_entry(char *host_name, int prot, ...@@ -1188,7 +1188,7 @@ void cache_add_dhcp_entry(char *host_name, int prot,
if (crec) /* malloc may fail */ if (crec) /* malloc may fail */
{ {
crec->flags = flags | F_NAMEP | F_DHCP | F_FORWARD | F_DNSSECOK; crec->flags = flags | F_NAMEP | F_DHCP | F_FORWARD;
if (ttd == 0) if (ttd == 0)
crec->flags |= F_IMMORTAL; crec->flags |= F_IMMORTAL;
else else
......
src/rfc1035.c
View file @ bce6e1bc
...@@ -1544,17 +1544,50 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, ...@@ -1544,17 +1544,50 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
} }
#ifdef HAVE_DNSSEC #ifdef HAVE_DNSSEC
if ((qtype == T_DNSKEY || qtype == T_ANY) && (crecp = cache_find_by_name(NULL, name, now, F_DNSKEY))) if (qtype == T_DNSKEY || qtype == T_DS || qtype == T_RRSIG)
{ {
do { int gotone = 0;
char *keydata; struct blockdata *keydata;
if (crecp->uid == qclass && /* Do we have RRSIG? Can't do DS or DNSKEY otherwise. */
(qtype == T_DNSKEY || (crecp->flags & F_CONFIG)) && crecp = NULL;
(keydata = blockdata_retrieve(crecp->addr.key.keydata, crecp->addr.key.keylen, NULL))) while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY | F_DS)))
if (crecp->uid == qclass && (qtype == T_RRSIG || crecp->addr.sig.type_covered == qtype))
break;
if (crecp)
{ {
ans = 1; if (qtype == T_RRSIG)
if (!dryrun) ans = gotone = 1;
else if (qtype == T_DS)
{
crecp = NULL;
while ((crecp = cache_find_by_name(crecp, name, now, F_DS)))
if (crecp->uid == qclass)
{
ans = gotone = 1;
if (!dryrun && (keydata = blockdata_retrieve(crecp->addr.ds.keydata, crecp->addr.ds.keylen, NULL)))
{
struct all_addr a;
a.addr.keytag = crecp->addr.ds.keytag;
log_query(F_KEYTAG | (crecp->flags & F_CONFIG), name, &a, "DS keytag %u");
if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
crec_ttl(crecp, now), &nameoffset,
T_DS, qclass, "sbbt",
crecp->addr.ds.keytag, crecp->addr.ds.algo, crecp->addr.ds.digest, crecp->addr.ds.keylen, keydata))
anscount++;
}
}
}
else if (qtype == T_DNSKEY)
{
crecp = NULL;
while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY)))
if (crecp->uid == qclass)
{
ans = gotone = 1;
if (!dryrun && (keydata = blockdata_retrieve(crecp->addr.key.keydata, crecp->addr.key.keylen, NULL)))
{ {
struct all_addr a; struct all_addr a;
a.addr.keytag = crecp->addr.key.keytag; a.addr.keytag = crecp->addr.key.keytag;
...@@ -1566,32 +1599,22 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, ...@@ -1566,32 +1599,22 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
anscount++; anscount++;
} }
} }
} while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY)));
} }
if ((qtype == T_DS || qtype == T_ANY) && (crecp = cache_find_by_name(NULL, name, now, F_DS))) /* Now do RRSIGs */
{ if (gotone)
do {
char *keydata;
if (crecp->uid == qclass &&
(qtype == T_DS || (crecp->flags & F_CONFIG)) &&
(keydata = blockdata_retrieve(crecp->addr.ds.keydata, crecp->addr.ds.keylen, NULL)))
{
ans = 1;
if (!dryrun)
{ {
struct all_addr a; crecp = NULL;
a.addr.keytag = crecp->addr.ds.keytag; while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY | F_DS)))
log_query(F_KEYTAG | (crecp->flags & F_CONFIG), name, &a, "DS keytag %u"); if (crecp->uid == qclass && (qtype == T_RRSIG || (sec_reqd && crecp->addr.sig.type_covered == qtype)) &&
if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, !dryrun &&
(keydata = blockdata_retrieve(crecp->addr.sig.keydata, crecp->addr.sig.keylen, NULL)) &&
add_resource_record(header, limit, &trunc, nameoffset, &ansp,
crec_ttl(crecp, now), &nameoffset, crec_ttl(crecp, now), &nameoffset,
T_DS, qclass, "sbbt", T_RRSIG, qclass, "t", crecp->addr.sig.keylen, keydata))
crecp->addr.ds.keytag, crecp->addr.ds.algo, crecp->addr.ds.digest, crecp->addr.ds.keylen, keydata))
anscount++; anscount++;
} }
} }
} while ((crecp = cache_find_by_name(crecp, name, now, F_DS)));
} }
#endif #endif
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment