SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolved: replace assert() with error return in DNSSEC verify functions

Browse Source 
dnssec_rsa_verify_raw() asserts that RSA_size(key) matches the RRSIG
signature size, and dnssec_ecdsa_verify_raw() asserts that
EC_KEY_check_key() succeeds. Both conditions depend on parsed DNS
record content. Replace with proper error returns.

The actual crypto verify calls (EVP_PKEY_verify / ECDSA_do_verify)
handle mismatches fine on their own, so the asserts were also redundant.

While at it, fix the misleading "EC_POINT_bn2point failed" log message
that actually refers to an EC_KEY_set_public_key() failure.

Fixes: https://github.com/systemd/systemd/issues/41569
This commit is contained in:
Milan Kyselica
2026-04-10 10:29:37 +01:00
committed by Luca Boccassi
parent a65ebc3ff9
commit dd80e5a348
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/resolve/resolved-dns-dnssec.c
+6 -3
View File
@@ -100,7 +100,8 @@ static int dnssec_rsa_verify_raw(
return -EIO;
e = m = NULL;
assert((size_t) RSA_size(rpubkey) == signature_size);
if ((size_t) RSA_size(rpubkey) != signature_size)
return -EINVAL;
epubkey = EVP_PKEY_new();
if (!epubkey)
@@ -230,9 +231,11 @@ static int dnssec_ecdsa_verify_raw(
if (EC_KEY_set_public_key(eckey, p) <= 0)
return log_debug_errno(SYNTHETIC_ERRNO(EIO),
"EC_POINT_bn2point failed: 0x%lx", ERR_get_error());
"EC_KEY_set_public_key failed: 0x%lx", ERR_get_error());
assert(EC_KEY_check_key(eckey) == 1);
if (EC_KEY_check_key(eckey) != 1)
return log_debug_errno(SYNTHETIC_ERRNO(EIO),
"EC_KEY_check_key failed: 0x%lx", ERR_get_error());
r = BN_bin2bn(signature_r, signature_r_size, NULL);
if (!r)