Michał Kępień 1a79aeab44 Stop resolving invalid names in resume_dslookup() ... Commit 7b2ea97e46 introduced a logic bug in resume_dslookup(): that function now only conditionally checks whether DS chasing can still make progress. Specifically, that check is only performed when the previous resume_dslookup() call invokes dns_resolver_createfetch() with the 'nameservers' argument set to something else than NULL, which may not always be the case. Failing to perform that check may trigger assertion failures as a result of dns_resolver_createfetch() attempting to resolve an invalid name. Example scenario that leads to such outcome: 1. A validating resolver is configured to forward all queries to another resolver. The latter returns broken DS responses that trigger DS chasing. 2. rctx_chaseds() calls dns_resolver_createfetch() with the 'nameservers' argument set to NULL. 3. The fetch fails, so resume_dslookup() is called. Due to fevent->result being set to e.g. DNS_R_SERVFAIL, the default branch is taken in the switch statement. 4. Since 'nameservers' was set to NULL for the fetch which caused the resume_dslookup() callback to be invoked (fctx->nsfetch->private->nameservers), resume_dslookup() chops off one label off fctx->nsname and calls dns_resolver_createfetch() again, for a name containing one label less than before. 5. Steps 3-4 are repeated (i.e. all attempts to find the name servers authoritative for the DS RRset being chased fail) until fctx->nsname becomes stripped down the the root name. 6. Since resume_dslookup() does not check whether DS chasing can still make progress, it strips off a label off the root name and continues its attempts at finding the name servers authoritative for the DS RRset being chased, passing an invalid name to dns_resolver_createfetch(). Fix by ensuring resume_dslookup() always checks whether DS chasing can still make progress when a name server fetch fails. Update code comments to ensure the purpose of the relevant dns_name_equal() check is clear.		2022-07-13 10:31:16 +02:00
..
bind9	prevent a possible buffer overflow in configuration check	2022-05-13 19:59:58 -07:00
dns	Stop resolving invalid names in resume_dslookup()	2022-07-13 10:31:16 +02:00
irs	Move all the unit tests to /tests/<libname>/	2022-05-28 14:53:02 -07:00
isc	TLS: do not ignore accept callback result	2022-07-12 14:40:22 +03:00
isccc	Update clang to version 14	2022-06-16 17:21:11 +02:00
isccfg	Obsolete the "glue-cache" option	2022-06-30 15:24:08 +02:00
ns	log the reason for falling back to AXFR from IXFR at level info	2022-07-12 16:02:54 -07:00
.gitignore	The isc/platform.h header has been completely removed	2021-07-06 05:33:48 +00:00
Makefile.am	move samples/resolve.c to bin/tests/system	2021-04-16 14:29:43 +02:00