From 5fa9008a2dd507cc6f9bfde77cffc93d665043b0 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Tue, 3 Jun 2025 21:00:58 +0200 Subject: [PATCH 1/2] Handle CNAME and DNAME in resume_min in a special way When authoritative zone is loaded when query minimization query for the same zone is already pending, it might receive unexpected result codes. Normally DNS_R_CNAME would follow to query_cname after processing sent events, but dns_view_findzonecut does not fill CNAME target into event->foundevent. Usual lookup via query_lookup would always have that filled. Ideally we would restart the query with unmodified search name, if unexpected change from recursing to local zone cut were detected. Until dns_view_findzonecut is modified to export zone/cache source of the cut, at least fail queries which went into unexpected state. (cherry picked from commit 2fd3da54f92526e9e38a32591a493d4c26d16be1) --- lib/dns/resolver.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index eacd2dbebf..225fa747f1 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -4270,8 +4270,14 @@ resume_qmin(void *arg) { * DNS_R_NXDOMAIN here means we have not loaded the root zone * mirror yet - but DNS_R_NXDOMAIN is not a valid return value * when doing recursion, we need to patch it. + * + * CNAME or DNAME means zone were added with that record + * after the start of a recursion. It means we do not have + * initialized correct hevent->foundname and have to fail. */ - if (result == DNS_R_NXDOMAIN) { + if (result == DNS_R_NXDOMAIN || result == DNS_R_CNAME || + result == DNS_R_DNAME) + { result = DNS_R_SERVFAIL; } From c2f37f5da47bd8ce334ef3ad37cd78c8d8d480ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 10 Jun 2025 14:35:03 +0200 Subject: [PATCH 2/2] Add few extra WANT_QUERYTRACE logs into resume_qmin Print optionally a bit more details not passed to event in case dns_view_findzonecut returns unexpected result. Result would be visible later in foundevent, but found fname would be lost. Print it into the log. (cherry picked from commit d2c69662320601d8d20cce132920b4f75217c56f) --- lib/dns/resolver.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 225fa747f1..bcac380e8f 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -107,6 +107,14 @@ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ "fctx %p(%s): %s %s%u", fctx, fctx->info, (m1), (m2), \ (v)) +#define FCTXTRACEN(m1, name, res) \ + do { \ + if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) { \ + char dbuf[DNS_NAME_FORMATSIZE]; \ + dns_name_format((name), dbuf, sizeof(dbuf)); \ + FCTXTRACE4((m1), dbuf, (res)); \ + } \ + } while (0) #define FTRACE(m) \ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \ @@ -158,6 +166,7 @@ UNUSED(m2); \ UNUSED(v); \ } while (0) +#define FCTXTRACEN(m1, name, res) FCTXTRACE4(m1, name, res) #define FTRACE(m) \ do { \ UNUSED(m); \ @@ -4265,6 +4274,7 @@ resume_qmin(void *arg) { result = dns_view_findzonecut(res->view, fctx->name, fname, dcname, fctx->now, findoptions, true, true, &fctx->nameservers, NULL); + FCTXTRACEN("resume_qmin findzonecut", fname, result); /* * DNS_R_NXDOMAIN here means we have not loaded the root zone @@ -5010,6 +5020,8 @@ clone_results(fetchctx_t *fctx) { /* This is the head resp; keep a pointer and move on */ if (hresp == NULL) { hresp = ISC_LIST_HEAD(fctx->resps); + FCTXTRACEN("clone_results", hresp->foundname, + hresp->result); continue; }