mirror of
https://github.com/isc-projects/bind9.git
synced 2026-07-01 00:03:51 -04:00
Merge branch '392-send-upstream-tat-queries-for-locally-served-zones-v9_11' into 'v9_11'
[v9_11] Trust anchor telemetry queries are not sent for locally served zones See merge request isc-projects/bind9!517
This commit is contained in:
Michał Kępień
commit
bcdb6c2846
2 changed files with 104 additions and 33 deletions
3
CHANGES
3
CHANGES
|
|
@ -1,3 +1,6 @@
|
|||
4994. [bug] Trust anchor telemetry queries were not being sent
|
||||
upstream for locally served zones. [GL #392]
|
||||
|
||||
4992. [bug] The wrong address was being logged for trust anchor
|
||||
telemetry queries. [GL #379]
|
||||
|
||||
|
|
|
|||
|
|
@ -6089,35 +6089,34 @@ struct dotat_arg {
|
|||
isc_task_t *task;
|
||||
};
|
||||
|
||||
static void
|
||||
dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
|
||||
isc_result_t result;
|
||||
/*%
|
||||
* Prepare the QNAME for the TAT query to be sent by processing the trust
|
||||
* anchors present at 'keynode' of 'keytable'. Store the result in 'dst' and
|
||||
* the domain name which 'keynode' is associated with in 'origin'.
|
||||
*
|
||||
* A maximum of 12 key IDs can be reported in a single TAT query due to the
|
||||
* 63-octet length limit for any single label in a domain name. If there are
|
||||
* more than 12 keys configured at 'keynode', only the first 12 will be
|
||||
* reported in the TAT query.
|
||||
*/
|
||||
static isc_result_t
|
||||
get_tat_qname(dns_name_t *dst, dns_name_t **origin, dns_keytable_t *keytable,
|
||||
dns_keynode_t *keynode)
|
||||
{
|
||||
dns_keynode_t *firstnode = keynode;
|
||||
dns_keynode_t *nextnode;
|
||||
unsigned int i, n = 0;
|
||||
char label[64], namebuf[DNS_NAME_FORMATSIZE];
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *tatname;
|
||||
isc_uint16_t ids[12]; /* Only 12 id's will fit in a label. */
|
||||
int m;
|
||||
ns_tat_t *tat;
|
||||
dns_name_t *name = NULL;
|
||||
struct dotat_arg *dotat_arg = arg;
|
||||
dns_view_t *view;
|
||||
isc_task_t *task;
|
||||
isc_uint16_t ids[12];
|
||||
isc_textregion_t r;
|
||||
char label[64];
|
||||
int m;
|
||||
|
||||
REQUIRE(keytable != NULL);
|
||||
REQUIRE(keynode != NULL);
|
||||
REQUIRE(arg != NULL);
|
||||
|
||||
view = dotat_arg->view;
|
||||
task = dotat_arg->task;
|
||||
REQUIRE(origin != NULL && *origin == NULL);
|
||||
|
||||
do {
|
||||
dst_key_t *key = dns_keynode_key(keynode);
|
||||
if (key != NULL) {
|
||||
name = dst_key_name(key);
|
||||
*origin = dst_key_name(key);
|
||||
if (n < (sizeof(ids)/sizeof(ids[0]))) {
|
||||
ids[n] = dst_key_id(key);
|
||||
n++;
|
||||
|
|
@ -6130,8 +6129,9 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
|
|||
keynode = nextnode;
|
||||
} while (keynode != NULL);
|
||||
|
||||
if (n == 0)
|
||||
return;
|
||||
if (n == 0) {
|
||||
return (DNS_R_EMPTYNAME);
|
||||
}
|
||||
|
||||
if (n > 1)
|
||||
qsort(ids, n, sizeof(ids[0]), cid);
|
||||
|
|
@ -6144,19 +6144,46 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
|
|||
r.base = label;
|
||||
r.length = sizeof(label);;
|
||||
m = snprintf(r.base, r.length, "_ta");
|
||||
if (m < 0 || (unsigned)m > r.length)
|
||||
return;
|
||||
if (m < 0 || (unsigned)m > r.length) {
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
isc_textregion_consume(&r, m);
|
||||
for (i = 0; i < n; i++) {
|
||||
m = snprintf(r.base, r.length, "-%04x", ids[i]);
|
||||
if (m < 0 || (unsigned)m > r.length)
|
||||
return;
|
||||
if (m < 0 || (unsigned)m > r.length) {
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
isc_textregion_consume(&r, m);
|
||||
}
|
||||
|
||||
return (dns_name_fromstring2(dst, label, *origin, 0, NULL));
|
||||
}
|
||||
|
||||
static void
|
||||
dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
|
||||
struct dotat_arg *dotat_arg = arg;
|
||||
char namebuf[DNS_NAME_FORMATSIZE];
|
||||
dns_fixedname_t fixed, fdomain;
|
||||
dns_name_t *tatname, *domain;
|
||||
dns_rdataset_t nameservers;
|
||||
dns_name_t *origin = NULL;
|
||||
isc_result_t result;
|
||||
dns_view_t *view;
|
||||
isc_task_t *task;
|
||||
ns_tat_t *tat;
|
||||
|
||||
REQUIRE(keytable != NULL);
|
||||
REQUIRE(keynode != NULL);
|
||||
REQUIRE(arg != NULL);
|
||||
|
||||
view = dotat_arg->view;
|
||||
task = dotat_arg->task;
|
||||
|
||||
tatname = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring2(tatname, label, name, 0, NULL);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
result = get_tat_qname(tatname, &origin, keytable, keynode);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return;
|
||||
}
|
||||
|
||||
dns_name_format(tatname, namebuf, sizeof(namebuf));
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
|
||||
|
|
@ -6176,12 +6203,53 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
|
|||
isc_mem_attach(dotat_arg->view->mctx, &tat->mctx);
|
||||
isc_task_attach(task, &tat->task);
|
||||
|
||||
result = dns_resolver_createfetch(view->resolver, tatname,
|
||||
dns_rdatatype_null, NULL, NULL,
|
||||
NULL, 0, tat->task, tat_done, tat,
|
||||
&tat->rdataset, &tat->sigrdataset,
|
||||
&tat->fetch);
|
||||
/*
|
||||
* TAT queries should be sent to the authoritative servers for a given
|
||||
* zone. If this function is called for a keytable node corresponding
|
||||
* to a locally served zone, calling dns_resolver_createfetch() with
|
||||
* NULL 'domain' and 'nameservers' arguments will cause 'tatname' to be
|
||||
* resolved locally, without sending any TAT queries upstream.
|
||||
*
|
||||
* Work around this issue by calling dns_view_findzonecut() first. If
|
||||
* the zone is served locally, the NS RRset for the given domain name
|
||||
* will be retrieved from local data; if it is not, the deepest zone
|
||||
* cut we have for it will be retrieved from cache. In either case,
|
||||
* passing the results to dns_resolver_createfetch() will prevent it
|
||||
* from returning NXDOMAIN for 'tatname' while still allowing it to
|
||||
* chase down any potential delegations returned by upstream servers in
|
||||
* order to eventually find the destination host to send the TAT query
|
||||
* to.
|
||||
*
|
||||
* 'origin' holds the domain name at 'keynode', i.e. the domain name
|
||||
* for which the trust anchors to be reported by this TAT query are
|
||||
* defined.
|
||||
*
|
||||
* After the dns_view_findzonecut() call, 'domain' will hold the
|
||||
* deepest zone cut we can find for 'origin' while 'nameservers' will
|
||||
* hold the NS RRset at that zone cut.
|
||||
*/
|
||||
domain = dns_fixedname_initname(&fdomain);
|
||||
dns_rdataset_init(&nameservers);
|
||||
result = dns_view_findzonecut(view, origin, domain, 0, 0, ISC_TRUE,
|
||||
&nameservers, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto done;
|
||||
}
|
||||
|
||||
result = dns_resolver_createfetch(view->resolver, tatname,
|
||||
dns_rdatatype_null, domain,
|
||||
&nameservers, NULL, 0, tat->task,
|
||||
tat_done, tat, &tat->rdataset,
|
||||
&tat->sigrdataset, &tat->fetch);
|
||||
|
||||
/*
|
||||
* dns_resolver_createfetch() creates its own copies of 'domain' and
|
||||
* 'nameservers'; clean up the latter (the former points into a
|
||||
* dst_key_t structure and thus must not be freed).
|
||||
*/
|
||||
dns_rdataset_disassociate(&nameservers);
|
||||
|
||||
done:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isc_task_detach(&tat->task);
|
||||
isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
|
||||
|
|
|
|||
Loading…
Reference in a new issue