Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-RT-Original-Encoding: utf-8
Content-Length: 7818

<div dir="ltr">If dig +sigchase encounters a RRSIG with inception in the future it will enter a tight endless loop.<div><br></div><div>This is probably a DoS minor security vulnerability.</div><div><br></div><div>It might be worth to check if the same verification code is used in other products that might be affected.</div><div><br></div><div>====================================</div><div><br></div><div><div>;; RRset to chase:</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>DNSKEY<span class="" style="white-space:pre">	</span>256 3 13 dNbV354UDSbhpZ2n9Uw8I/A3Q5qFtdLCn4gIB5xXKnS1x2+b3OikUoBi zxoiWXTyug/4aAYewumvX8Yd0AoAaw==</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>DNSKEY<span class="" style="white-space:pre">	</span>257 3 13 /l6y5G5M/wjknrmVmFHE4JIuzVWpypsSvPyEcSGr5LyVFYtG7HnlyjRr mrxdaqqN/9F5jYUbXw9fgY0UZ8mw3w==</div><div><br></div><div><br></div><div>;; RRSIG of the RRset to chase:</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>RRSIG<span class="" style="white-space:pre">	</span>DNSKEY 13 2 3600 20150317125525 20150317125525 14032 <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. It0X7ij2R5uV+Ida9m6eO+NVkqbYGLoj82IVqn6yOO9+xm0WA72tALgt qgRH4qpxB7DUcKvrcmLmRoBqcRfG3Q==</div><div><br></div><div><br></div><div>;; DNSKEYset that signs the RRset to chase:</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>DNSKEY<span class="" style="white-space:pre">	</span>256 3 13 dNbV354UDSbhpZ2n9Uw8I/A3Q5qFtdLCn4gIB5xXKnS1x2+b3OikUoBi zxoiWXTyug/4aAYewumvX8Yd0AoAaw==</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>DNSKEY<span class="" style="white-space:pre">	</span>257 3 13 /l6y5G5M/wjknrmVmFHE4JIuzVWpypsSvPyEcSGr5LyVFYtG7HnlyjRr mrxdaqqN/9F5jYUbXw9fgY0UZ8mw3w==</div><div><br></div><div><br></div><div>;; RRSIG of the DNSKEYset that signs the RRset to chase:</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>30<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>RRSIG<span class="" style="white-space:pre">	</span>DNSKEY 13 2 3600 20150317125525 20150317125525 14032 <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. It0X7ij2R5uV+Ida9m6eO+NVkqbYGLoj82IVqn6yOO9+xm0WA72tALgt qgRH4qpxB7DUcKvrcmLmRoBqcRfG3Q==</div><div><br></div><div><br></div><div><br></div><div>Launch a query to find a RRset of type DS for zone: <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.</div><div><br></div><div>;; DSset of the DNSKEYset</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>21599<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>DS<span class="" style="white-space:pre">	</span>14032 13 2 5FF2E12C473B42291E23A851E75681B2AEA7155A92D2839A586C41A2 88E3729A</div><div><br></div><div><br></div><div>;; RRSIG of the DSset of the DNSKEYset</div><div><a href="http://cloudflare-secure.net">cloudflare-secure.net</a>.<span class="" style="white-space:pre">	</span>21599<span class="" style="white-space:pre">	</span>IN<span class="" style="white-space:pre">	</span>RRSIG<span class="" style="white-space:pre">	</span>DS 8 2 86400 20140924175426 20140917164426 32507 net. h+3WQUdF7eT9q/ghf080Dek61lDWHxl4zOnefRMYOK06xKASDA87OR6y RH+T2wc3DHaq2+f+75euPh+DQhpJG1NblrtEr3HNf7MnqiSzSBJceQRg MTTs3MAXRVH9nUUSaDIrOyGc0Py481XKV1kDrWvUV0wm+cfKsiy0+nSW Fa0=</div><div><br></div><div><br></div><div><br></div><div><br></div><div>;; WE HAVE MATERIAL, WE NOW DO VALIDATION</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div><div>;; VERIFYING DNSKEY RRset for <a href="http://cloudflare-secure.net">cloudflare-secure.net</a>. with DNSKEY:14032: RRSIG validity period has not begun</div></div><div>[...]</div></div>