Check if DNSKEY Zone-Key bit is set on RRSIG Verify (#1258)
This commit is contained in:
parent
c99ea652e3
commit
2a9acc8d83
|
@ -372,6 +372,8 @@ func sign(k crypto.Signer, hashed []byte, hash crypto.Hash, alg uint8) ([]byte,
|
|||
// Verify validates an RRSet with the signature and key. This is only the
|
||||
// cryptographic test, the signature validity period must be checked separately.
|
||||
// This function copies the rdata of some RRs (to lowercase domain names) for the validation to work.
|
||||
// It also checks that the Zone Key bit (RFC 4034 2.1.1) is set on the DNSKEY
|
||||
// and that the Protocol field is set to 3 (RFC 4034 2.1.2).
|
||||
func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
|
||||
// First the easy checks
|
||||
if !IsRRset(rrset) {
|
||||
|
@ -392,6 +394,12 @@ func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
|
|||
if k.Protocol != 3 {
|
||||
return ErrKey
|
||||
}
|
||||
// RFC 4034 2.1.1 If bit 7 has value 0, then the DNSKEY record holds some
|
||||
// other type of DNS public key and MUST NOT be used to verify RRSIGs that
|
||||
// cover RRsets.
|
||||
if k.Flags&ZONE == 0 {
|
||||
return ErrKey
|
||||
}
|
||||
|
||||
// IsRRset checked that we have at least one RR and that the RRs in
|
||||
// the set have consistent type, class, and name. Also check that type and
|
||||
|
|
Loading…
Reference in New Issue