diff options
| author | Vladimír Čunát <vladimir.cunat@nic.cz> | 2024-02-13 14:17:57 +0100 |
|---|---|---|
| committer | Vladimír Čunát <vladimir.cunat@nic.cz> | 2024-02-13 14:17:57 +0100 |
| commit | ef88fc42b695636c0ec05aff02169e6d8404f93b (patch) | |
| tree | d929118f331f88d9a8b9f6dc1750a411c5f020d3 /lib/dnssec/nsec3.c | |
| parent | Merge !1497: lib/dnssec: allow validating some RRsets around 64 KiB size (diff) | |
| parent | Release 6.0.6 (diff) | |
| download | knot-resolver-6.0.6.tar.xz knot-resolver-6.0.6.zip | |
Merge branch 'release-6.0.6' into 6.0v6.0.6
Diffstat (limited to 'lib/dnssec/nsec3.c')
| -rw-r--r-- | lib/dnssec/nsec3.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/dnssec/nsec3.c b/lib/dnssec/nsec3.c index 037d5bdc..4199f25f 100644 --- a/lib/dnssec/nsec3.c +++ b/lib/dnssec/nsec3.c @@ -71,7 +71,7 @@ static int hash_name(dnssec_binary_t *hash, const dnssec_nsec3_params_t *params, return kr_error(EINVAL); if (!name) return kr_error(EINVAL); - if (kr_fails_assert(params->iterations <= KR_NSEC3_MAX_ITERATIONS)) { + if (kr_fails_assert(!kr_nsec3_limited_params(params))) { /* This if is mainly defensive; it shouldn't happen. */ return kr_error(EINVAL); } @@ -146,6 +146,18 @@ static int closest_encloser_match(int *flags, const knot_rrset_t *nsec3, const knot_dname_t *encloser = knot_wire_next_label(name, NULL); *skipped = 1; + /* Avoid doing too much work on SHA1, mitigating: + * CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU + * We log nothing here; it wouldn't be easy from this place + * and huge SNAME should be suspicious on its own. + */ + const int max_labels = knot_dname_labels(nsec3->owner, NULL) - 1 + + kr_nsec3_max_depth(¶ms); + for (int l = knot_dname_labels(encloser, NULL); l > max_labels; --l) { + encloser = knot_wire_next_label(encloser, NULL); + ++(*skipped); + } + while(encloser) { ret = hash_name(&name_hash, ¶ms, encloser); if (ret != 0) @@ -565,7 +577,7 @@ int kr_nsec3_wildcard_answer_response_check(const knot_pkt_t *pkt, knot_section_ const knot_rrset_t *rrset = knot_pkt_rr(sec, i); if (rrset->type != KNOT_RRTYPE_NSEC3) continue; - if (knot_nsec3_iters(rrset->rrs.rdata) > KR_NSEC3_MAX_ITERATIONS) { + if (kr_nsec3_limited_rdata(rrset->rrs.rdata)) { /* Avoid hashing with too many iterations. * If we get here, the `sname` wildcard probably ends up bogus, * but it gets downgraded to KR_RANK_INSECURE when validator |