From 50138e36ffc6d05d8c32a5b6ac1d4c5d32377450 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 4 May 2026 21:38:56 +0200 Subject: [PATCH 1/2] resolve: enforce the search domain limit earlier The search domain limit is already enforced by dns_search_domain_new(), but in this case it's way too late. Let's enforce it during the first loop to avoid unnecessary parsing. --- src/resolve/resolved-link-bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c index ed4485671c..f30ed5d22b 100644 --- a/src/resolve/resolved-link-bus.c +++ b/src/resolve/resolved-link-bus.c @@ -321,7 +321,7 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_ if (r < 0) return r; - for (;;) { + for (unsigned n_names = 0;; n_names++) { _cleanup_free_ char *prefixed = NULL; const char *name; int route_only; @@ -339,6 +339,8 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_ return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid search domain %s", name); if (!route_only && dns_name_is_root(name)) return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Root domain is not suitable as search domain"); + if (n_names >= LINK_SEARCH_DOMAINS_MAX) + return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED, "Too many search domains per link"); if (route_only) { prefixed = strjoin("~", name); From 17e6a3e2a88e822b730f298ebb9fdb526a04a2e2 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 4 May 2026 22:07:46 +0200 Subject: [PATCH 2/2] resolve: limit the number NTAs to something sensible --- src/resolve/resolved-link-bus.c | 3 +++ src/resolve/resolved-link.h | 1 + 2 files changed, 4 insertions(+) diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c index f30ed5d22b..ba5b00c239 100644 --- a/src/resolve/resolved-link-bus.c +++ b/src/resolve/resolved-link-bus.c @@ -683,6 +683,9 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v if (r < 0) return r; + if (strv_length(ntas) > LINK_NEGATIVE_TRUST_ANCHORS_MAX) + return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED, "Too many negative trust anchors per link"); + STRV_FOREACH(i, ntas) { r = dns_name_is_valid(*i); if (r < 0) diff --git a/src/resolve/resolved-link.h b/src/resolve/resolved-link.h index 44a6b511c1..4c81bdbe66 100644 --- a/src/resolve/resolved-link.h +++ b/src/resolve/resolved-link.h @@ -11,6 +11,7 @@ #define LINK_SEARCH_DOMAINS_MAX 1024 #define LINK_DNS_SERVERS_MAX 256 +#define LINK_NEGATIVE_TRUST_ANCHORS_MAX 2048 typedef struct LinkAddress { Link *link;