[PATCH] Remove obsolete DNSSEC support [BZ #20591]
Petr Spacek
pspacek@redhat.com
Tue Sep 20 07:06:00 GMT 2016
On 9.9.2016 13:43, Florian Weimer wrote:
> The removed function declaration have never been implemented in libresolv.
>
> 2016-09-09 Florian Weimer <fweimer@redhat.com>
>
> [BZ #20591]
> Remove obsolete DNSSEC support.
> * resolv/arpa/nameser.h (ns_key_types, NS_KEY_*, NS_ALG_*)
> (NS_MD5_RSA_*, NS_DSA_*, NS_NXT_*, ns_sign, ns_sign2, ns_sign_tcp)
> (ns_sign_tcp2, ns_sign_tcp_init, ns_find_tsig, ns_verify)
> (ns_verify_tcp, ns_verify_tcp_init): Remove.
> (ns_cert_types): Add comment.
> * resolv/ns_print.c (ns_sprintrrf): Do not handle DNSSEC records
> separately.
> (KEY_RSA, KEY_HMAC_MD5, dst_s_id_calc, dst_s_get_int16)
> (dst_s_dns_key_id): Remove.
> * resolv/res_debug.c (__p_key_syms, __p_cert_syms): Remove unused
> variables.
>
> diff --git a/NEWS b/NEWS
> index ba1ec71..5566125 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -40,6 +40,12 @@ Version 2.25
> for the Linux quota interface which predates kernel version 2.4.22 has
> been removed.
>
> +* DNSSEC-related declarations and definitions have been removed from the
> + <arpa/nameser.h> header file, and libresolv will no longer attempt to
> + decode the data part of DNSSEC record types. Previous versions of glibc
> + only implemented minimal support for the previous version of DNSSEC, which
> + is incompatible with the currently deployed version.
> +
> Security related changes:
>
> On ARM EABI (32-bit), generating a backtrace for execution contexts which
> diff --git a/resolv/arpa/nameser.h b/resolv/arpa/nameser.h
> index 04f8844..cdbec23 100644
> --- a/resolv/arpa/nameser.h
> +++ b/resolv/arpa/nameser.h
> @@ -326,15 +326,7 @@ typedef enum __ns_class {
> ns_c_max = 65536
> } ns_class;
>
> -/* DNSSEC constants. */
> -
> -typedef enum __ns_key_types {
> - ns_kt_rsa = 1, /*%< key type RSA/MD5 */
> - ns_kt_dh = 2, /*%< Diffie Hellman */
> - ns_kt_dsa = 3, /*%< Digital Signature Standard (MANDATORY) */
> - ns_kt_private = 254 /*%< Private key type starts with OID */
> -} ns_key_types;
> -
> +/* Certificate type values in CERT resource records. */
> typedef enum __ns_cert_types {
> cert_t_pkix = 1, /*%< PKIX (X.509v3) */
> cert_t_spki = 2, /*%< SPKI */
> @@ -343,82 +335,6 @@ typedef enum __ns_cert_types {
> cert_t_oid = 254 /*%< OID private type */
> } ns_cert_types;
>
> -/* Flags field of the KEY RR rdata. */
> -#define NS_KEY_TYPEMASK 0xC000 /*%< Mask for "type" bits */
> -#define NS_KEY_TYPE_AUTH_CONF 0x0000 /*%< Key usable for both */
> -#define NS_KEY_TYPE_CONF_ONLY 0x8000 /*%< Key usable for confidentiality */
> -#define NS_KEY_TYPE_AUTH_ONLY 0x4000 /*%< Key usable for authentication */
> -#define NS_KEY_TYPE_NO_KEY 0xC000 /*%< No key usable for either; no key */
> -/* The type bits can also be interpreted independently, as single bits: */
> -#define NS_KEY_NO_AUTH 0x8000 /*%< Key unusable for authentication */
> -#define NS_KEY_NO_CONF 0x4000 /*%< Key unusable for confidentiality */
> -#define NS_KEY_RESERVED2 0x2000 /* Security is *mandatory* if bit=0 */
> -#define NS_KEY_EXTENDED_FLAGS 0x1000 /*%< reserved - must be zero */
> -#define NS_KEY_RESERVED4 0x0800 /*%< reserved - must be zero */
> -#define NS_KEY_RESERVED5 0x0400 /*%< reserved - must be zero */
> -#define NS_KEY_NAME_TYPE 0x0300 /*%< these bits determine the type */
> -#define NS_KEY_NAME_USER 0x0000 /*%< key is assoc. with user */
> -#define NS_KEY_NAME_ENTITY 0x0200 /*%< key is assoc. with entity eg host */
> -#define NS_KEY_NAME_ZONE 0x0100 /*%< key is zone key */
> -#define NS_KEY_NAME_RESERVED 0x0300 /*%< reserved meaning */
> -#define NS_KEY_RESERVED8 0x0080 /*%< reserved - must be zero */
> -#define NS_KEY_RESERVED9 0x0040 /*%< reserved - must be zero */
> -#define NS_KEY_RESERVED10 0x0020 /*%< reserved - must be zero */
> -#define NS_KEY_RESERVED11 0x0010 /*%< reserved - must be zero */
> -#define NS_KEY_SIGNATORYMASK 0x000F /*%< key can sign RR's of same name */
> -#define NS_KEY_RESERVED_BITMASK ( NS_KEY_RESERVED2 | \
> - NS_KEY_RESERVED4 | \
> - NS_KEY_RESERVED5 | \
> - NS_KEY_RESERVED8 | \
> - NS_KEY_RESERVED9 | \
> - NS_KEY_RESERVED10 | \
> - NS_KEY_RESERVED11 )
> -#define NS_KEY_RESERVED_BITMASK2 0xFFFF /*%< no bits defined here */
> -/* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
> -#define NS_ALG_MD5RSA 1 /*%< MD5 with RSA */
> -#define NS_ALG_DH 2 /*%< Diffie Hellman KEY */
> -#define NS_ALG_DSA 3 /*%< DSA KEY */
> -#define NS_ALG_DSS NS_ALG_DSA
> -#define NS_ALG_EXPIRE_ONLY 253 /*%< No alg, no security */
> -#define NS_ALG_PRIVATE_OID 254 /*%< Key begins with OID giving alg */
> -/* Protocol values */
> -/* value 0 is reserved */
> -#define NS_KEY_PROT_TLS 1
> -#define NS_KEY_PROT_EMAIL 2
> -#define NS_KEY_PROT_DNSSEC 3
> -#define NS_KEY_PROT_IPSEC 4
> -#define NS_KEY_PROT_ANY 255
> -
> -/* Signatures */
> -#define NS_MD5RSA_MIN_BITS 512 /*%< Size of a mod or exp in bits */
> -#define NS_MD5RSA_MAX_BITS 4096
> - /* Total of binary mod and exp */
> -#define NS_MD5RSA_MAX_BYTES ((NS_MD5RSA_MAX_BITS+7/8)*2+3)
> - /* Max length of text sig block */
> -#define NS_MD5RSA_MAX_BASE64 (((NS_MD5RSA_MAX_BYTES+2)/3)*4)
> -#define NS_MD5RSA_MIN_SIZE ((NS_MD5RSA_MIN_BITS+7)/8)
> -#define NS_MD5RSA_MAX_SIZE ((NS_MD5RSA_MAX_BITS+7)/8)
> -
> -#define NS_DSA_SIG_SIZE 41
> -#define NS_DSA_MIN_SIZE 213
> -#define NS_DSA_MAX_BYTES 405
> -
> -/* Offsets into SIG record rdata to find various values */
> -#define NS_SIG_TYPE 0 /*%< Type flags */
> -#define NS_SIG_ALG 2 /*%< Algorithm */
> -#define NS_SIG_LABELS 3 /*%< How many labels in name */
> -#define NS_SIG_OTTL 4 /*%< Original TTL */
> -#define NS_SIG_EXPIR 8 /*%< Expiration time */
> -#define NS_SIG_SIGNED 12 /*%< Signature time */
> -#define NS_SIG_FOOT 16 /*%< Key footprint */
> -#define NS_SIG_SIGNER 18 /*%< Domain name of who signed it */
> -/* How RR types are represented as bit-flags in NXT records */
> -#define NS_NXT_BITS 8
> -#define NS_NXT_BIT_SET( n,p) (p[(n)/NS_NXT_BITS] |= (0x80>>((n)%NS_NXT_BITS)))
> -#define NS_NXT_BIT_CLEAR(n,p) (p[(n)/NS_NXT_BITS] &= ~(0x80>>((n)%NS_NXT_BITS)))
> -#define NS_NXT_BIT_ISSET(n,p) (p[(n)/NS_NXT_BITS] & (0x80>>((n)%NS_NXT_BITS)))
> -#define NS_NXT_MAX 127
> -
> /*%
> * EDNS0 extended flags and option codes, host order.
> */
> @@ -498,25 +414,6 @@ int ns_name_compress (const char *, u_char *, size_t,
> int ns_name_skip (const u_char **, const u_char *) __THROW;
> void ns_name_rollback (const u_char *, const u_char **,
> const u_char **) __THROW;
> -int ns_sign (u_char *, int *, int, int, void *,
> - const u_char *, int, u_char *, int *, time_t) __THROW;
> -int ns_sign2 (u_char *, int *, int, int, void *,
> - const u_char *, int, u_char *, int *, time_t,
> - u_char **, u_char **) __THROW;
> -int ns_sign_tcp (u_char *, int *, int, int,
> - ns_tcp_tsig_state *, int) __THROW;
> -int ns_sign_tcp2 (u_char *, int *, int, int,
> - ns_tcp_tsig_state *, int,
> - u_char **, u_char **) __THROW;
> -int ns_sign_tcp_init (void *, const u_char *, int,
> - ns_tcp_tsig_state *) __THROW;
> -u_char *ns_find_tsig (u_char *, u_char *) __THROW;
> -int ns_verify (u_char *, int *, void *, const u_char *, int,
> - u_char *, int *, time_t *, int) __THROW;
> -int ns_verify_tcp (u_char *, int *, ns_tcp_tsig_state *, int)
> - __THROW;
> -int ns_verify_tcp_init (void *, const u_char *, int,
> - ns_tcp_tsig_state *) __THROW;
> int ns_samedomain (const char *, const char *) __THROW;
> int ns_subdomain (const char *, const char *) __THROW;
> int ns_makecanon (const char *, char *, size_t) __THROW;
> diff --git a/resolv/ns_print.c b/resolv/ns_print.c
> index 7a0e7d5..f55680c 100644
> --- a/resolv/ns_print.c
> +++ b/resolv/ns_print.c
> @@ -47,8 +47,6 @@ static int addstr(const char *src, size_t len,
> static int addtab(size_t len, size_t target, int spaced,
> char **buf, size_t *buflen);
>
> -static u_int16_t dst_s_dns_key_id(const u_char *, const int);
> -
> /* Macros. */
>
> #define T(x) \
> @@ -436,124 +434,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
> break;
> }
>
> - case ns_t_key: {
> - char base64_key[NS_MD5RSA_MAX_BASE64];
> - u_int keyflags, protocol, algorithm, key_id;
> - const char *leader;
> - int n;
> -
> - if (rdlen < 0U + NS_INT16SZ + NS_INT8SZ + NS_INT8SZ)
> - goto formerr;
> -
> - /* Key flags, Protocol, Algorithm. */
> - key_id = dst_s_dns_key_id(rdata, edata-rdata);
> - keyflags = ns_get16(rdata); rdata += NS_INT16SZ;
> - protocol = *rdata++;
> - algorithm = *rdata++;
> - len = SPRINTF((tmp, "0x%04x %u %u",
> - keyflags, protocol, algorithm));
> - T(addstr(tmp, len, &buf, &buflen));
> -
> - /* Public key data. */
> - len = b64_ntop(rdata, edata - rdata,
> - base64_key, sizeof base64_key);
> - if (len < 0)
> - goto formerr;
> - if (len > 15) {
> - T(addstr(" (", 2, &buf, &buflen));
> - leader = "\n\t\t";
> - spaced = 0;
> - } else
> - leader = " ";
> - for (n = 0; n < len; n += 48) {
> - T(addstr(leader, strlen(leader), &buf, &buflen));
> - T(addstr(base64_key + n, MIN(len - n, 48),
> - &buf, &buflen));
> - }
> - if (len > 15)
> - T(addstr(" )", 2, &buf, &buflen));
> - n = SPRINTF((tmp, " ; key_tag= %u", key_id));
> - T(addstr(tmp, n, &buf, &buflen));
> -
> - break;
> - }
> -
> - case ns_t_sig: {
> - char base64_key[NS_MD5RSA_MAX_BASE64];
> - u_int type, algorithm, labels, footprint;
> - const char *leader;
> - u_long t;
> - int n;
> -
> - if (rdlen < 22U)
> - goto formerr;
> -
> - /* Type covered, Algorithm, Label count, Original TTL. */
> - type = ns_get16(rdata); rdata += NS_INT16SZ;
> - algorithm = *rdata++;
> - labels = *rdata++;
> - t = ns_get32(rdata); rdata += NS_INT32SZ;
> - len = SPRINTF((tmp, "%s %d %d %lu ",
> - p_type(type), algorithm, labels, t));
> - T(addstr(tmp, len, &buf, &buflen));
> - if (labels > (u_int)dn_count_labels(name))
> - goto formerr;
> -
> - /* Signature expiry. */
> - t = ns_get32(rdata); rdata += NS_INT32SZ;
> - len = SPRINTF((tmp, "%s ", p_secstodate(t)));
> - T(addstr(tmp, len, &buf, &buflen));
> -
> - /* Time signed. */
> - t = ns_get32(rdata); rdata += NS_INT32SZ;
> - len = SPRINTF((tmp, "%s ", p_secstodate(t)));
> - T(addstr(tmp, len, &buf, &buflen));
> -
> - /* Signature Footprint. */
> - footprint = ns_get16(rdata); rdata += NS_INT16SZ;
> - len = SPRINTF((tmp, "%u ", footprint));
> - T(addstr(tmp, len, &buf, &buflen));
> -
> - /* Signer's name. */
> - T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
> -
> - /* Signature. */
> - len = b64_ntop(rdata, edata - rdata,
> - base64_key, sizeof base64_key);
> - if (len > 15) {
> - T(addstr(" (", 2, &buf, &buflen));
> - leader = "\n\t\t";
> - spaced = 0;
> - } else
> - leader = " ";
> - if (len < 0)
> - goto formerr;
> - for (n = 0; n < len; n += 48) {
> - T(addstr(leader, strlen(leader), &buf, &buflen));
> - T(addstr(base64_key + n, MIN(len - n, 48),
> - &buf, &buflen));
> - }
> - if (len > 15)
> - T(addstr(" )", 2, &buf, &buflen));
> - break;
> - }
> -
> - case ns_t_nxt: {
> - int n, c;
> -
> - /* Next domain name. */
> - T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
> -
> - /* Type bit map. */
> - n = edata - rdata;
> - for (c = 0; c < n*8; c++)
> - if (NS_NXT_BIT_ISSET(c, rdata)) {
> - len = SPRINTF((tmp, " %s", p_type(c)));
> - T(addstr(tmp, len, &buf, &buflen));
> - }
> - break;
> - }
> -
> case ns_t_cert: {
> u_int c_type, key_tag, alg;
> int n;
> @@ -887,81 +767,3 @@ addtab(size_t len, size_t target, int spaced, char **buf, size_t *buflen) {
> }
> return (spaced);
> }
> -
> -/* DST algorithm codes */
> -#define KEY_RSA 1
> -#define KEY_HMAC_MD5 157
> -
> -/*%
> - * calculates a checksum used in dst for an id.
> - * takes an array of bytes and a length.
> - * returns a 16 bit checksum.
> - */
> -static u_int16_t
> -dst_s_id_calc(const u_char *key, const int keysize)
> -{
> - u_int32_t ac;
> - const u_char *kp = key;
> - int size = keysize;
> -
> - if (!key || (keysize <= 0))
> - return (0xffffU);
> -
> - for (ac = 0; size > 1; size -= 2, kp += 2)
> - ac += ((*kp) << 8) + *(kp + 1);
> -
> - if (size > 0)
> - ac += ((*kp) << 8);
> - ac += (ac >> 16) & 0xffff;
> -
> - return (ac & 0xffff);
> -}
> -
> -/*%
> - * dst_s_get_int16
> - * This routine extracts a 16 bit integer from a two byte character
> - * string. The character string is assumed to be in network byte
> - * order and may be unaligned. The number returned is in host order.
> - * Parameter
> - * buf A two byte character string.
> - * Return
> - * The converted integer value.
> - */
> -
> -static u_int16_t
> -dst_s_get_int16(const u_char *buf)
> -{
> - u_int16_t a = 0;
> - a = ((u_int16_t)(buf[0] << 8)) | ((u_int16_t)(buf[1]));
> - return (a);
> -}
> -
> -/*%
> - * dst_s_dns_key_id() Function to calculate DNSSEC footprint from KEY record
> - * rdata
> - * Input:
> - * dns_key_rdata: the raw data in wire format
> - * rdata_len: the size of the input data
> - * Output:
> - * the key footprint/id calculated from the key data
> - */
> -static u_int16_t
> -dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
> -{
> - if (!dns_key_rdata)
> - return 0;
> -
> - /* compute id */
> - if (dns_key_rdata[3] == KEY_RSA) /*%< Algorithm RSA */
> - return dst_s_get_int16((const u_char *)
> - &dns_key_rdata[rdata_len - 3]);
> - else if (dns_key_rdata[3] == KEY_HMAC_MD5)
> - /* compatibility */
> - return 0;
> - else
> - /* compute a checksum on the key part of the key rr */
> - return dst_s_id_calc(dns_key_rdata, rdata_len);
> -}
> -
> -
> -/*! \file */
> diff --git a/resolv/res_debug.c b/resolv/res_debug.c
> index bd95590..9b33e19 100644
> --- a/resolv/res_debug.c
> +++ b/resolv/res_debug.c
> @@ -371,24 +371,6 @@ const struct res_sym __p_update_section_syms[] attribute_hidden = {
> {0, (char *)0}
> };
>
> -const struct res_sym __p_key_syms[] attribute_hidden = {
> - {NS_ALG_MD5RSA, "RSA", "RSA KEY with MD5 hash"},
> - {NS_ALG_DH, "DH", "Diffie Hellman"},
> - {NS_ALG_DSA, "DSA", "Digital Signature Algorithm"},
> - {NS_ALG_EXPIRE_ONLY, "EXPIREONLY", "No algorithm"},
> - {NS_ALG_PRIVATE_OID, "PRIVATE", "Algorithm obtained from OID"},
> - {0, NULL, NULL}
> -};
> -
> -const struct res_sym __p_cert_syms[] attribute_hidden = {
> - {cert_t_pkix, "PKIX", "PKIX (X.509v3) Certificate"},
> - {cert_t_spki, "SPKI", "SPKI certificate"},
> - {cert_t_pgp, "PGP", "PGP certificate"},
> - {cert_t_url, "URL", "URL Private"},
> - {cert_t_oid, "OID", "OID Private"},
> - {0, NULL, NULL}
> -};
> -
> /*
> * Names of RR types and qtypes. Types and qtypes are the same, except
> * that T_ANY is a qtype but not a type. (You can ask for records of type
It makes sense to me (but I did not thoroughly review the code).
--
Petr Spacek @ Red Hat
More information about the Libc-alpha
mailing list