upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 13:29:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

4530. [bug] Change 4489 broke the handling of CNAME -> DNAME

Browse source 
in responses resulting in SERVFAIL being returned.
                        [RT #43779]

(cherry picked from commit 60cb462c56)
This commit is contained in:
Mark Andrews 2016-12-09 12:50:18 +11:00
parent 881739ee87
commit 2c74ad28ef
4 changed files with 48 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
4530. [bug] Change 4489 broke the handling of CNAME -> DNAME
in responses resulting in SERVFAIL being returned.
[RT #43779]
4528. [bug] Only set the flag bits for the i/o we are waiting
for on EPOLLERR or EPOLLHUP. [RT #43617]

4
bin/tests/system/dname/ns2/example.db
View file

@ -29,4 +29,6 @@ a.short A 10.0.0.1
short-dname DNAME short
a.longlonglonglonglonglonglonglonglonglonglonglonglong A 10.0.0.2
long-dname DNAME longlonglonglonglonglonglonglonglonglonglonglonglong
;
cname CNAME a.cnamedname
cnamedname DNAME target
a.target A 10.0.0.3

18
bin/tests/system/dname/tests.sh
View file

@ -63,6 +63,24 @@ grep "status: YXDOMAIN" dig.out.ns4.toolong > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:checking cname to dname from authoritative"
ret=0
$DIG cname.example @10.53.0.2 a -p 5300 > dig.out.ns2.cname
grep "status: NOERROR" dig.out.ns2.cname > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:checking cname to dname from recursive"
ret=0
$DIG cname.example @10.53.0.4 a -p 5300 > dig.out.ns4.cname
grep "status: NOERROR" dig.out.ns4.cname > /dev/null || ret=1
grep '^cname.example.' dig.out.ns4.cname > /dev/null || ret=1
grep '^cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
grep '^a.cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
grep '^a.target.example.' dig.out.ns4.cname > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1

37
lib/dns/resolver.c
View file

@ -6469,7 +6469,7 @@ static isc_result_t
answer_response(fetchctx_t *fctx) {
isc_result_t result;
dns_message_t *message;
dns_name_t *name, *dname = NULL, *qname, *dqname, tname, *ns_name;
dns_name_t *name, *dname = NULL, *qname, tname, *ns_name;
dns_name_t *cname = NULL;
dns_rdataset_t *rdataset, *ns_rdataset;
isc_boolean_t done, external, chaining, aa, found, want_chaining;
@ -6477,7 +6477,7 @@ answer_response(fetchctx_t *fctx) {
isc_boolean_t wanted_chaining;
unsigned int aflag;
dns_rdatatype_t type;
dns_fixedname_t fdname, fqname, fqdname;
dns_fixedname_t fdname, fqname;
dns_view_t *view;
FCTXTRACE("answer_response");
@ -6501,13 +6501,12 @@ answer_response(fetchctx_t *fctx) {
aa = ISC_TRUE;
else
aa = ISC_FALSE;
dqname = qname = &fctx->name;
qname = &fctx->name;
type = fctx->type;
view = fctx->res->view;
dns_fixedname_init(&fqdname);
result = dns_message_firstname(message, DNS_SECTION_ANSWER);
while (!done && result == ISC_R_SUCCESS) {
dns_namereln_t namereln, dnamereln;
dns_namereln_t namereln;
int order;
unsigned int nlabels;
@ -6515,8 +6514,6 @@ answer_response(fetchctx_t *fctx) {
dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
namereln = dns_name_fullcompare(qname, name, &order, &nlabels);
dnamereln = dns_name_fullcompare(dqname, name, &order,
&nlabels);
if (namereln == dns_namereln_equal) {
wanted_chaining = ISC_FALSE;
for (rdataset = ISC_LIST_HEAD(name->list);
@ -6746,11 +6743,24 @@ answer_response(fetchctx_t *fctx) {
return (DNS_R_FORMERR);
}
if (dnamereln != dns_namereln_subdomain) {
/*
* If DNAME + synthetic CNAME then the
* namereln is dns_namereln_subdomain.
*
* If synthetic CNAME + DNAME then the
* namereln is dns_namereln_commonancestor
* and the number of label must match the
* DNAME. This order is not RFC compliant.
*/
if (namereln != dns_namereln_subdomain &&
(namereln != dns_namereln_commonancestor ||
nlabels != dns_name_countlabels(name)))
{
char qbuf[DNS_NAME_FORMATSIZE];
char obuf[DNS_NAME_FORMATSIZE];
dns_name_format(dqname, qbuf,
dns_name_format(qname, qbuf,
sizeof(qbuf));
dns_name_format(name, obuf,
sizeof(obuf));
@ -6765,7 +6775,7 @@ answer_response(fetchctx_t *fctx) {
want_chaining = ISC_TRUE;
POST(want_chaining);
aflag = DNS_RDATASETATTR_ANSWER;
result = dname_target(rdataset, dqname,
result = dname_target(rdataset, qname,
nlabels, &fdname);
if (result == ISC_R_NOSPACE) {
/*
@ -6782,13 +6792,11 @@ answer_response(fetchctx_t *fctx) {
dname = dns_fixedname_name(&fdname);
if (!is_answertarget_allowed(view,
dqname, rdataset->type,
qname, rdataset->type,
dname, &fctx->domain))
{
return (DNS_R_SERVFAIL);
}
dqname = dns_fixedname_name(&fqdname);
dns_name_copy(dname, dqname, NULL);
} else {
/*
* We've found a signature that
@ -6934,7 +6942,8 @@ answer_response(fetchctx_t *fctx) {
rdataset->trust =
dns_trust_additional;
if (rdataset->type == dns_rdatatype_ns) {
if (rdataset->type == dns_rdatatype_ns)
{
ns_name = name;
ns_rdataset = rdataset;
}