resolved: refuse accepting EDNS0 OPT RRs with a non-root domain

2015-12-18 18:57:08 +01:00
parent 4b548ef382
commit ff7febd50a
1 changed files with 7 additions and 1 deletions
@@ -1997,13 +1997,19 @@ int dns_packet_extract(DnsPacket *p) {

                for (i = 0; i < n; i++) {
                        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
+                        bool cache_flush;

-                        r = dns_packet_read_rr(p, &rr, NULL);
+                        r = dns_packet_read_rr(p, &rr, &cache_flush, NULL);
                        if (r < 0)
                                goto finish;

                        if (rr->key->type == DNS_TYPE_OPT) {

+                                if (!dns_name_is_root(DNS_RESOURCE_KEY_NAME(rr->key))) {
+                                        r = -EBADMSG;
+                                        goto finish;
+                                }
+
                                /* The OPT RR is only valid in the Additional section */
                                if (i < DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)) {
                                        r = -EBADMSG;