upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-12 21:52:47 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[v9_10] fix RSA parsing when md5 disabled

Browse source 
4645.	[bug]		Fix PKCS#11 RSA parsing when MD5 is disabled.
			[RT #45300]

(cherry picked from commit b05b3fab3c)
This commit is contained in:
Evan Hunt 2017-06-29 15:54:54 -07:00
parent 2c00a11db3
commit e195feb456
4 changed files with 18 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
CHANGES
View file

@ -1,3 +1,6 @@
4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
[RT #45300]
--- 9.10.6b1 released ---
4643. [security] An error in TSIG handling could permit unauthorized

2
bin/tests/system/pkcs11/clean.sh
View file

@ -15,6 +15,6 @@
# PERFORMANCE OF THIS SOFTWARE.
rm -f K* ns1/K* keyset-* dsset-* ns1/*.db ns1/*.signed ns1/*.jnl
rm -f dig.out pin
rm -f dig.out* pin upd.log*
rm -f ns1/*.key ns1/named.memstats
rm -f supported

13
bin/tests/system/pkcs11/tests.sh
View file

@ -45,7 +45,12 @@ for alg in $algs; do
echo "I:testing inline signing with PKCS#11 keys ($alg)"
$NSUPDATE > /dev/null <<END || status=1
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg.0 || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
count0=`grep RRSIG dig.out.$alg.0 | wc -l`
$NSUPDATE -v > upd.log.$alg <<END || status=1
server 10.53.0.1 5300
ttl 300
zone $alg.example.
@ -56,11 +61,11 @@ END
echo "I:waiting 20 seconds for key changes to take effect"
sleep 20
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out || ret=1
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
count=`grep RRSIG dig.out | wc -l`
if [ $count != 4 ]; then echo "I:failed"; status=1; fi
count=`grep RRSIG dig.out.$alg | wc -l`
if [ $count -le $count0 ]; then echo "I:failed"; status=1; fi
echo "I:testing PKCS#11 key destroy ($alg)"
ret=0

5
lib/dns/dst_parse.c
View file

@ -612,7 +612,12 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
goto fail;
}
#ifdef PK11_MD5_DISABLE
check = check_data(priv, alg == DST_ALG_RSA ? DST_ALG_RSASHA1 : alg,
ISC_TRUE, external);
#else
check = check_data(priv, alg, ISC_TRUE, external);
#endif
if (check < 0) {
ret = DST_R_INVALIDPRIVATEKEY;
goto fail;