upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-22 07:41:16 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.

Browse source 
git-svn-id: file:///svn/unbound/trunk@2345 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2010-11-17 10:02:34 +00:00
parent 8c5b3d3c8f
commit 289f13bc25
3 changed files with 106 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
doc/Changelog
View file

@ -1,3 +1,6 @@
17 November 2010: Wouter
- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
15 November 2010: Wouter 15 November 2010: Wouter
- silence 'tcp connect: broken pipe' and 'net down' at low verbosity. - silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
- iana portlist updated. - iana portlist updated.

32
services/cache/dns.c vendored
View file

@ -417,14 +417,14 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
/** generate dns_msg from cached message */ /** generate dns_msg from cached message */
static struct dns_msg* static struct dns_msg*
tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r, tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
struct regional* region, uint32_t now, struct regional* scratch) struct regional* region, uint32_t now, struct regional* scratch)
{ {
struct dns_msg* msg; struct dns_msg* msg;
size_t i; size_t i;
if(now > r->ttl) if(now > r->ttl)
return NULL; return NULL;
msg = gen_dns_msg(region, &e->key, r->rrset_count); msg = gen_dns_msg(region, q, r->rrset_count);
if(!msg) if(!msg)
return NULL; return NULL;
msg->rep->flags = r->flags; msg->rep->flags = r->flags;
@ -606,7 +606,7 @@ dns_cache_lookup(struct module_env* env,
if(e) { if(e) {
struct msgreply_entry* key = (struct msgreply_entry*)e->key; struct msgreply_entry* key = (struct msgreply_entry*)e->key;
struct reply_info* data = (struct reply_info*)e->data; struct reply_info* data = (struct reply_info*)e->data;
struct dns_msg* msg = tomsg(env, key, data, region, now, struct dns_msg* msg = tomsg(env, &key->key, data, region, now,
scratch); scratch);
if(msg) { if(msg) {
lock_rw_unlock(&e->lock); lock_rw_unlock(&e->lock);
@ -670,6 +670,32 @@ dns_cache_lookup(struct module_env* env,
} }
lock_rw_unlock(&rrset->entry.lock); lock_rw_unlock(&rrset->entry.lock);
} }
/* stop downwards cache search on NXDOMAIN.
* Empty nonterminals are NOERROR, so an NXDOMAIN for foo
* means bla.foo also does not exist. The DNSSEC proofs are
* the same. We search upwards for NXDOMAINs. */
while(!dname_is_root(k.qname)) {
dname_remove_label(&k.qname, &k.qname_len);
h = query_info_hash(&k);
e = slabhash_lookup(env->msg_cache, h, &k, 0);
if(e) {
struct reply_info* data = (struct reply_info*)e->data;
struct dns_msg* msg;
if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
&& data->security != sec_status_bogus
&& (msg=tomsg(env, &k, data, region, now, scratch))){
lock_rw_unlock(&e->lock);
msg->qinfo.qname=qname;
msg->qinfo.qname_len=qnamelen;
/* check that DNSSEC really works out */
msg->rep->security = sec_status_unchecked;
return msg;
}
lock_rw_unlock(&e->lock);
}
}
return NULL; return NULL;
} }

74
testdata/stop_nxdomain.rpl vendored Normal file
View file

@ -0,0 +1,74 @@
; config options
server:
target-fetch-policy: "0 0 0 0 0"
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
CONFIG_END
SCENARIO_BEGIN Test stop cache search on nxdomain
; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NXDOMAIN
SECTION QUESTION
example.local. IN A
SECTION AUTHORITY
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2010111601 1800 900 604800 86400
ENTRY_END
RANGE_END
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
example.local. IN A
ENTRY_END
; recursion happens here.
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN
SECTION QUESTION
example.local. IN A
SECTION AUTHORITY
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2010111601 1800 900 604800 86400
ENTRY_END
STEP 20 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
foo.example.local. IN A
ENTRY_END
; this query does not get sent to K-ROOT.
STEP 30 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN
SECTION QUESTION
foo.example.local. IN A
SECTION AUTHORITY
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2010111601 1800 900 604800 86400
ENTRY_END
SCENARIO_END