projects / systemd / .git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 5237ffd) | patch
resolved: validate authentic insecure delegation to CNAME
authorRonan Pigott <ronan@rjp.ie>
Tue, 30 Apr 2024 20:19:14 +0000 (13:19 -0700)
committerLuca Boccassi <luca.boccassi@gmail.com>
Wed, 1 May 2024 18:34:08 +0000 (20:34 +0200)
commit414a9b8e5e1e772261b0ffaedc853f5c0aba5719
treed269de88e55fd1de867a59d8f4aeaeea02a569d4tree | snapshot
parent5237ffdf2b63a5afea77c3470d9981a2c29643cccommit | diff
resolved: validate authentic insecure delegation to CNAME

If the parent zone uses a non-opt-out method that provides authenticated
negative DS replies, we still can't expect signatures from the child
zone. sd-resolved was using the authenticated status of the DS reply to
require signatures for CNAMEs, even though it had already proved that no
signature exists.

Fixes: 47690634f157 ("resolved: don't request the SOA for every dns label")
src/resolve/resolved-dns-transaction.c diff | blob | history
https://github.com/systemd/systemd.git