From d5acaa51db2a9963d525a7927e1f55482435bb79 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 17 Dec 2018 21:14:17 +0100 Subject: [PATCH 1/2] resolved: only attempt non-answer SOA RRs if they are parents of our query There's no value in authenticating SOA RRs that are neither answer to our question nor parent of our question (the latter being relevant so that we have a TTL from the SOA field for negative caching of the actual query). By being to eager here, and trying to authenticate too much we run the risk of creating cyclic deps between our transactions which then causes the over-all authentication to fail. Fixes: #9771 --- src/resolve/resolved-dns-transaction.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c index cc748ac95e..30f798df36 100644 --- a/src/resolve/resolved-dns-transaction.c +++ b/src/resolve/resolved-dns-transaction.c @@ -2142,6 +2142,14 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) { if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate * it. */ continue; + + /* Only bother with this if the SOA/NS RR we are looking at is actually a parent of + * what we are looking for, otherwise there's no value in it for us. */ + r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key)); + if (r < 0) + return r; + if (r == 0) + continue; } r = dnssec_has_rrsig(t->answer, rr->key); From 6d72da2f3ef5331a465b08d045d573ce92279915 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 17 Dec 2018 21:16:48 +0100 Subject: [PATCH 2/2] resolved: mention which RRs we query when requesting them to authenticate some other RR --- src/resolve/resolved-dns-transaction.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c index 30f798df36..4a2d2ccbde 100644 --- a/src/resolve/resolved-dns-transaction.c +++ b/src/resolve/resolved-dns-transaction.c @@ -2284,21 +2284,21 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) { r = dns_name_parent(&name); if (r > 0) { type = DNS_TYPE_SOA; - log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).", - t->id, dns_resource_key_name(t->key)); + log_debug("Requesting parent SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty DS response).", + name, t->id, dns_resource_key_name(t->key)); } else name = NULL; } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) { type = DNS_TYPE_DS; - log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).", - t->id, dns_resource_key_name(t->key)); + log_debug("Requesting DS (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).", + name, t->id, name); } else { type = DNS_TYPE_SOA; - log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).", - t->id, dns_resource_key_name(t->key)); + log_debug("Requesting SOA (→ %s) to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).", + name, t->id, name); } if (name) {