upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix harden-referral-path so it does not generate lookup failures.

Browse source 
git-svn-id: file:///svn/unbound/trunk@2101 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2010-04-27 14:15:19 +00:00
parent 12e20eb5f4
commit a29b2ad908
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
doc/Changelog
View file

@ -2,6 +2,9 @@
- unbound-control get_option domain-insecure shows config file items. - unbound-control get_option domain-insecure shows config file items.
- fix retry sequence if prime hints are recursion-lame. - fix retry sequence if prime hints are recursion-lame.
- autotrust anchor file can be initialized with a ZSK key as well. - autotrust anchor file can be initialized with a ZSK key as well.
- harden-referral-path does not result in failures due to max-depth.
You can increase the max-depth by adding numbers (' 0') after the
target-fetch-policy, this increases the depth to which is checked.
26 April 2010: Wouter 26 April 2010: Wouter
- Compile fix using Sun Studio 12 compiler on Solaris 5.9, use - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use

2
doc/unbound.conf.5.in
View file

@ -456,6 +456,8 @@ path to the answer.
Default off, because it burdens the authority servers, and it is Default off, because it burdens the authority servers, and it is
not RFC standard, and could lead to performance problems because of the not RFC standard, and could lead to performance problems because of the
extra query load that is generated. Experimental option. extra query load that is generated. Experimental option.
If you enable it consider adding more numbers after the target\-fetch\-policy
to increase the max depth that is checked to.
.TP .TP
.B use\-caps\-for\-id: \fI<yes or no> .B use\-caps\-for\-id: \fI<yes or no>
Use 0x20\-encoded random bits in the query to foil spoof attempts. Use 0x20\-encoded random bits in the query to foil spoof attempts.

6
iterator/iterator.c
View file

@ -695,12 +695,15 @@ static void
generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
int id) int id)
{ {
struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
struct module_qstate* subq; struct module_qstate* subq;
size_t i; size_t i;
struct reply_info* rep = iq->response->rep; struct reply_info* rep = iq->response->rep;
struct ub_packed_rrset_key* s; struct ub_packed_rrset_key* s;
log_assert(iq->dp); log_assert(iq->dp);
if(iq->depth == ie->max_dependency_depth)
return;
/* walk through additional, and check if in-zone, /* walk through additional, and check if in-zone,
* only relevant A, AAAA are left after scrub anyway */ * only relevant A, AAAA are left after scrub anyway */
for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
@ -746,9 +749,12 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
static void static void
generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id) generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
{ {
struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
struct module_qstate* subq; struct module_qstate* subq;
log_assert(iq->dp); log_assert(iq->dp);
if(iq->depth == ie->max_dependency_depth)
return;
/* is this query the same as the nscheck? */ /* is this query the same as the nscheck? */
if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS && if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS &&
query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 && query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&