[3/5] resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf (CVE-2026-5435)
Checks
| Context |
Check |
Description |
| redhat-pt-bot/TryBot-apply_patch |
success
|
Patch applied to master at the time it was sent
|
Commit Message
TSIG handling was incomplete before. Given that this is an obsolete
interface, it does not seem worthwhile to complete the implementation.
This fixes bug 34033.
---
resolv/ns_print.c | 10 ----------
1 file changed, 10 deletions(-)
Comments
On 30/04/26 07:52, Florian Weimer wrote:
> TSIG handling was incomplete before. Given that this is an obsolete
> interface, it does not seem worthwhile to complete the implementation.
Wouldn't be better to make it fall for the default handler instead
("unknown RR type %d") instead?
>
> This fixes bug 34033.
> ---
> resolv/ns_print.c | 10 ----------
> 1 file changed, 10 deletions(-)
>
> diff --git a/resolv/ns_print.c b/resolv/ns_print.c
> index 5701e3d0c5..9c9e810781 100644
> --- a/resolv/ns_print.c
> +++ b/resolv/ns_print.c
> @@ -513,17 +513,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
>
> case ns_t_tsig: {
> /* BEW - need to complete this */
> - int n;
> -
> T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
> - T(addstr(" ", 1, &buf, &buflen));
> - rdata += 8; /*%< time */
> - n = ns_get16(rdata); rdata += INT16SZ;
> - rdata += n; /*%< sig */
> - n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
> - sprintf(buf, "%d", ns_get16(rdata));
> - rdata += INT16SZ;
> - addlen(strlen(buf), &buf, &buflen);
> break;
> }
>
* Adhemerval Zanella Netto:
> On 30/04/26 07:52, Florian Weimer wrote:
>> TSIG handling was incomplete before. Given that this is an obsolete
>> interface, it does not seem worthwhile to complete the implementation.
>
> Wouldn't be better to make it fall for the default handler instead
> ("unknown RR type %d") instead?
I probably should make the unknown type RR handling RFC-compliant (see
RFC 3597). For TSIG, there wouldn't be data loss because the embedded
domain name must not use label compression. (With compression, you
wouldn't be able to recover the original name just from the hexdump.)
Thanks,
Florian
@@ -513,17 +513,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
case ns_t_tsig: {
/* BEW - need to complete this */
- int n;
-
T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
- T(addstr(" ", 1, &buf, &buflen));
- rdata += 8; /*%< time */
- n = ns_get16(rdata); rdata += INT16SZ;
- rdata += n; /*%< sig */
- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
- sprintf(buf, "%d", ns_get16(rdata));
- rdata += INT16SZ;
- addlen(strlen(buf), &buf, &buflen);
break;
}