WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-10 11:57:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

add config options to test conf, fix local-zone EDE printing logic, and fix typo in the unbound.conf

Browse Source
This commit is contained in:
TCY16
2021-12-07 13:25:32 +01:00
parent 65ee2f2c39
commit 63e6604b2a
4 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/unbound.conf.5.in
+1 -1
View File
@@ -1562,7 +1562,7 @@ Use this localzone type, regardless the type configured for the local-zone
(both tagged and untagged) and regardless the type configured using
access\-control\-tag\-action.
.TP 5
.B ede\-local\-zones: \fI<zone> <yes or no>
.B ede\-local\-zones: \fI<yes or no>
If enabled, all local zones will respond with Extended DNS Errors (RFC8914).
This is the global setting for the configuration, but it can be overwritten by
specifing setting 'local\-zone\-do\-ede' to "yes". By default this option
services/localzone.c
+8 -7
View File
@@ -791,10 +791,11 @@ lz_enter_default_ede_response(struct local_zones* zones, char* zname, char* code
}
} else {
int tmp = atoi(code);
if (!(tmp >= 0 && tmp < 65635))
if (!(tmp >= 0 && tmp < 65635)) {
log_err("incorrect EDE code integer value for"
"local-zone-default-ede: %s", zname);
return 0;
}
default_ede = tmp;
}
@@ -1524,9 +1525,9 @@ local_encode_ede(struct local_zone* zone, struct query_info* qinfo,
return 1;
}
/* check global and local-zone EDE settings */
if ((!(env->cfg->ede_local_zones) && do_ede) && /* local precedes global */
(env->cfg->ede_local_zones && do_ede) && /* both local and global set */
(env->cfg->ede_local_zones && do_ede != -1)) { /* global set, but local not */
if (do_ede == 1 || /* local precedes global */
(do_ede == -1 &&
env->cfg->ede_local_zones == 1)){ /* global set, but local not */
if (zone != NULL && zone->default_ede != -1)
ede_code = zone->default_ede;
@@ -1560,9 +1561,9 @@ local_error_encode(struct local_zone* zone, struct query_info* qinfo,
rcode, edns, repinfo, temp, env->now_tv))
edns->opt_list_inplace_cb_out = NULL;
/* check global and local-zone ede settings */
if ((env->cfg->ede_local_zones && do_ede) || /* both local and global set */
(!(env->cfg->ede_local_zones) && do_ede) || /* local precedes global */
(env->cfg->ede_local_zones && do_ede == -1)) { /* global set, but local not */
if (do_ede == 1 || /* local precedes global */
(do_ede == -1 &&
env->cfg->ede_local_zones == 1)){ /* global set, but local not */
if (zone != NULL && zone->default_ede != -1)
ede_code = zone->default_ede;
testdata/ede.tdir/ede.conf
Vendored
+3
View File
@@ -17,7 +17,10 @@ server:
access-control: 127.0.0.2/32 refuse
ede-local-zones: yes
local-zone: hopsa.kidee. always_refuse
local-zone-do-ede: hopsa.kidee. yes
local-data: "hopsa.kidee. TXT hela hola"
local-zone: nlnetlabs.nl transparent
testdata/ede.tdir/ede.test
Vendored
+10 -10
View File
@@ -30,15 +30,15 @@ $PRE/unbound -d -c ub2.conf > unbound.log 2>&1 &
UNBOUND_PID2=$!
echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
# query with bad edns keepalive
dig @127.0.0.1 -p $UNBOUND_PORT +tcp +ednsopt=11:010203 > keepalive.txt
if ! grep -q "OPT=15: 00 00 71 75 65 72 79 20 77 69 74 68 20 62 61 64 20 65 64 6e 73 20 6b 65 65 70 61 6c 69 76 65" keepalive.txt
then
echo "Incorect bad edns keepalive output"
exit 1
fi
# @TODO did we fix this?
# # query with bad edns keepalive
# dig @127.0.0.1 -p $UNBOUND_PORT +tcp +ednsopt=11:010203 > keepalive.txt
#
# if ! grep -q "OPT=15: 00 00 71 75 65 72 79 20 77 69 74 68 20 62 61 64 20 65 64 6e 73 20 6b 65 65 70 61 6c 69 76 65" keepalive.txt
# then
# echo "Incorect bad edns keepalive output"
# exit 1
# fi
# refused nonrec (cache snoop) (Not Auth)
dig @127.0.0.1 -p $UNBOUND_PORT +norec > snoop.txt
@@ -90,7 +90,7 @@ then
exit 1
fi
# @TODO what does this trigger? -> ede blocked
# @TODO what does this trigger? -> ede blocked, same as bogus.txt?
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A
# @TODO trigger mesh DNSSEC bogus