Skip to content

Commit

Permalink
auth: provide dns packet when doing lookup for presigned signatures
Browse files Browse the repository at this point in the history
  • Loading branch information
@d-wibowo
d-wibowo committed Jun 28, 2024
1 parent 19090fb commit 3a764ef
Show file tree
Hide file tree
Showing 5 changed files with 12 additions and 11 deletions.
4 changes: 2 additions & 2 deletions pdns/dbdnsseckeeper.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -630,7 +630,7 @@ bool DNSSECKeeper::checkKeys(const DNSName& zone, std::optional<std::reference_w
return retval;
}

void DNSSECKeeper::getPreRRSIGs(UeberBackend& db, vector<DNSZoneRecord>& rrs, uint32_t signTTL)
void DNSSECKeeper::getPreRRSIGs(UeberBackend& db, vector<DNSZoneRecord>& rrs, uint32_t signTTL, DNSPacket* p)

Check warning on line 633 in pdns/dbdnsseckeeper.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

method 'getPreRRSIGs' can be made static (readability-convert-member-functions-to-static - Level=Warning)

Check warning on line 633 in pdns/dbdnsseckeeper.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'db' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)

Check warning on line 633 in pdns/dbdnsseckeeper.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'p' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)
{
if(rrs.empty()) {
return;
Expand All @@ -640,7 +640,7 @@ void DNSSECKeeper::getPreRRSIGs(UeberBackend& db, vector<DNSZoneRecord>& rrs, ui

DNSZoneRecord dzr;

db.lookup(QType(QType::RRSIG), !rr.wildcardname.empty() ? rr.wildcardname : rr.dr.d_name, rr.domain_id);
db.lookup(QType(QType::RRSIG), !rr.wildcardname.empty() ? rr.wildcardname : rr.dr.d_name, rr.domain_id, p);
while(db.get(dzr)) {
auto rrsig = getRR<RRSIGRecordContent>(dzr.dr);
if (rrsig->d_type == rr.dr.d_type) {
Expand Down
3 changes: 2 additions & 1 deletion pdns/dnssecinfra.hh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
*/
#pragma once
#include "dnsrecords.hh"
#include "dnspacket.hh"

#include <string>
#include <vector>
Expand Down Expand Up @@ -291,7 +292,7 @@ string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const
void incrementHash(std::string& raw);
void decrementHash(std::string& raw);

void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSZoneRecord>& rrs);
void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSZoneRecord>& rrs, DNSPacket* p=nullptr);

Check warning on line 295 in pdns/dnssecinfra.hh

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

function 'addRRSigs' has a definition with different parameter names (readability-inconsistent-declaration-parameter-name - Level=Warning)

void addTSIG(DNSPacketWriter& pw, TSIGRecordContent& trc, const DNSName& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);
bool validateTSIG(const std::string& packet, size_t sigPos, const TSIGTriplet& tt, const TSIGRecordContent& trc, const std::string& previousMAC, const std::string& theirMAC, bool timersOnly, unsigned int dnsHeaderOffset=0);
Expand Down
4 changes: 2 additions & 2 deletions pdns/dnsseckeeper.hh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
#include <boost/multi_index/sequenced_index.hpp>
#include "dnssecinfra.hh"
#include "dnsrecords.hh"
#include "dnspacket.hh"
#include "ueberbackend.hh"
#include "lock.hh"

Expand Down Expand Up @@ -208,7 +209,7 @@ public:
bool checkNSEC3PARAM(const NSEC3PARAMRecordContent& ns3p, string& msg);
bool setNSEC3PARAM(const DNSName& zname, const NSEC3PARAMRecordContent& n3p, const bool& narrow=false);
bool unsetNSEC3PARAM(const DNSName& zname);
void getPreRRSIGs(UeberBackend& db, vector<DNSZoneRecord>& rrs, uint32_t signTTL);
void getPreRRSIGs(UeberBackend& db, vector<DNSZoneRecord>& rrs, uint32_t signTTL, DNSPacket* p=nullptr);
bool isPresigned(const DNSName& zname, bool useCache=true);
bool setPresigned(const DNSName& zname);
bool unsetPresigned(const DNSName& zname);
Expand Down Expand Up @@ -303,7 +304,6 @@ private:
static size_t s_maxEntries;
};

class DNSPacket;
uint32_t localtime_format_YYYYMMDDSS(time_t t, uint32_t seq);
// for SOA-EDIT
uint32_t calculateEditSOA(uint32_t old_serial, DNSSECKeeper& dk, const DNSName& zonename);
Expand Down
10 changes: 5 additions & 5 deletions pdns/dnssecsigner.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -145,15 +145,15 @@ static int getRRSIGsForRRSET(DNSSECKeeper& dk, const DNSName& signer, const DNSN
// this is the entrypoint from DNSPacket
static void addSignature(DNSSECKeeper& dk, UeberBackend& db, const DNSName& signer, const DNSName& signQName, const DNSName& wildcardname, uint16_t signQType,
uint32_t signTTL, DNSResourceRecord::Place signPlace,
sortedRecords_t& toSign, vector<DNSZoneRecord>& outsigned, uint32_t origTTL)
sortedRecords_t& toSign, vector<DNSZoneRecord>& outsigned, uint32_t origTTL, DNSPacket* p)

Check warning on line 148 in pdns/dnssecsigner.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'p' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)
{
//cerr<<"Asked to sign '"<<signQName<<"'|"<<DNSRecordContent::NumberToType(signQType)<<", "<<toSign.size()<<" records\n";
if(toSign.empty())
return;
vector<RRSIGRecordContent> rrcs;
if(dk.isPresigned(signer)) {
//cerr<<"Doing presignatures"<<endl;
dk.getPreRRSIGs(db, outsigned, origTTL); // does it all
dk.getPreRRSIGs(db, outsigned, origTTL, p); // does it all
}
else {
if(getRRSIGsForRRSET(dk, signer, wildcardname.countLabels() ? wildcardname : signQName, signQType, signTTL, toSign, rrcs) < 0) {
Expand Down Expand Up @@ -203,7 +203,7 @@ static bool getBestAuthFromSet(const set<DNSName>& authSet, const DNSName& name,
return false;
}

void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const set<DNSName>& authSet, vector<DNSZoneRecord>& rrs)
void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const set<DNSName>& authSet, vector<DNSZoneRecord>& rrs, DNSPacket* p)

Check warning on line 206 in pdns/dnssecsigner.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'dk' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)

Check warning on line 206 in pdns/dnssecsigner.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'db' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)

Check warning on line 206 in pdns/dnssecsigner.cc

View workflow job for this annotation

GitHub Actions / Analyze (cpp, auth) 

parameter name 'p' is too short, expected at least 3 characters (readability-identifier-length - Level=Warning)
{
stable_sort(rrs.begin(), rrs.end(), rrsigncomp);

Expand All @@ -222,7 +222,7 @@ void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const set<DNSName>& authSet,
for(auto pos = rrs.cbegin(); pos != rrs.cend(); ++pos) {
if(pos != rrs.cbegin() && (signQType != pos->dr.d_type || signQName != pos->dr.d_name)) {
if (getBestAuthFromSet(authSet, authQName, signer))
addSignature(dk, db, signer, signQName, wildcardQName, signQType, signTTL, signPlace, toSign, signedRecords, origTTL);
addSignature(dk, db, signer, signQName, wildcardQName, signQType, signTTL, signPlace, toSign, signedRecords, origTTL, p);
}
signedRecords.push_back(*pos);
signQName = pos->dr.d_name.makeLowerCase();
Expand All @@ -248,6 +248,6 @@ void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const set<DNSName>& authSet,
}
}
if (getBestAuthFromSet(authSet, authQName, signer))
addSignature(dk, db, signer, signQName, wildcardQName, signQType, signTTL, signPlace, toSign, signedRecords, origTTL);
addSignature(dk, db, signer, signQName, wildcardQName, signQType, signTTL, signPlace, toSign, signedRecords, origTTL, p);
rrs.swap(signedRecords);
}
2 changes: 1 addition & 1 deletion pdns/packethandler.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1817,7 +1817,7 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
}
}
if(doSigs)
addRRSigs(d_dk, B, authSet, r->getRRS());
addRRSigs(d_dk, B, authSet, r->getRRS(), &p);

if(PC.enabled() && !noCache && p.couldBeCached())
PC.insert(p, *r, r->getMinTTL()); // in the packet cache
Expand Down

0 comments on commit 3a764ef

Please sign in to comment.