WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-12 04:47:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix validation for CNAME loops. When it detects a cname loop,

Browse Source 
by finding the cname, cname in the existing list, it returns
  the partial result with the validation result up to then.


git-svn-id: file:///svn/unbound/trunk@4547 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards
2018-02-21 14:04:02 +00:00
parent 075f470778
commit 6905e41b57
7 changed files with 70 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Changelog
+3
View File
@@ -1,6 +1,9 @@
21 February 2018: Wouter
- Fix #3512: unbound incorrectly reports SERVFAIL for CAA query
when there is a CNAME loop.
- Fix validation for CNAME loops. When it detects a cname loop,
by finding the cname, cname in the existing list, it returns
the partial result with the validation result up to then.
19 February 2018: Wouter
- Fix #3505: Documentation for default local zones references
iterator/iterator.c
+1
View File
@@ -1257,6 +1257,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
msg->rep->ns_numrrsets = 0;
msg->rep->ar_numrrsets = 0;
msg->rep->rrset_count = 0;
iq->response = msg;
iq->dp = NULL;
iq->refetch_glue = 0;
iq->query_restart_count++;
testdata/iter_dname_insec.rpl
Vendored
+7 -1
View File
@@ -776,12 +776,18 @@ ENTRY_END
; Expected result is defined by RFC 1034 section 3.6.2:
; CNAME chains should be followed and CNAME loops signalled as an error
; but bug#3512: return partial contentes with NOERROR.
STEP 221002 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA DO SERVFAIL
REPLY QR RD RA DO NOERROR
SECTION QUESTION
cyc2.example.com. IN A
SECTION ANSWER
example.com. 0 IN DNAME cyc2.example.net.
cyc2.example.com. 0 IN CNAME cyc2.cyc2.example.net.
cyc2.example.net. 0 IN DNAME example.com.
cyc2.cyc2.example.net. 0 IN CNAME cyc2.example.com.
ENTRY_END
; ns1.example.com.
testdata/val_cname_loop1.rpl
Vendored
+27 -1
View File
@@ -5,6 +5,7 @@ server:
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
trust-anchor-signaling: no
stub-zone:
name: "."
@@ -86,6 +87,17 @@ ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns.example.com. IN AAAA
SECTION AUTHORITY
ns.example.com. IN NSEC www.example.com. A RRSIG NSEC
ns.example.com. 3600 IN RRSIG NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AE+zfHodyVCTnni/bur8IiUhTUtdac6ip/znrYYN0l1nqll1fon2+kQ=
ENTRY_END
; response to DNSKEY priming query
ENTRY_BEGIN
MATCH opcode qtype qname
@@ -104,6 +116,18 @@ ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
ENTRY_END
; response to DNSKEY priming query
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
www.example.com. IN DS
SECTION AUTHORITY
www.example.com. IN NSEC z.example.com. CNAME RRSIG NSEC
www.example.com. 3600 IN RRSIG NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AJ8hqdeoKtvR094y+0KjO6LkCe1SCs6z5YhuY2YZCmzvUiYHP9wiMTw=
ENTRY_END
; response to query of interest
ENTRY_BEGIN
MATCH opcode qtype qname
@@ -134,10 +158,12 @@ ENTRY_END
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA DO SERVFAIL
REPLY QR RD RA DO AD NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. 3600 IN CNAME www.example.com.
www.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFH0SwLHe7u56TshoVciFRHEl1KqbAhQ3zBOZMlL8bt1DqoDoM5ni8U/1UA== ;{id = 2854}
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
testdata/val_cname_loop2.rpl
Vendored
+8 -3
View File
@@ -5,6 +5,7 @@ server:
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
trust-anchor-signaling: no
stub-zone:
name: "."
@@ -113,7 +114,7 @@ SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN CNAME foo.example.com.
www.example.com. 3600 IN RRSIG CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFH0SwLHe7u56TshoVciFRHEl1KqbAhQ3zBOZMlL8bt1DqoDoM5ni8U/1UA== ;{id = 2854}
www.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AD50yy1elnzRmjGCd7FBiWEkYlhQYXaZu0g1JoJMr/ONiXVnV2yiONg=
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
@@ -126,7 +127,7 @@ SECTION QUESTION
foo.example.com. IN A
SECTION ANSWER
foo.example.com. IN CNAME www.example.com.
foo.example.com. 3600 IN RRSIG CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC7kcWPsMnGbjvzj5UNnxQzM0YvnAhUAgxIKgs1huJHvcAP2Xt3p8Adpy/c= ;{id = 2854}
foo.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AEEIVUwbtfcn2RP41l0PDO+Sk4YdJ0HyRVsgq20fJnrDDC6eFXFGqUg=
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
@@ -143,10 +144,14 @@ ENTRY_END
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA DO SERVFAIL
REPLY QR RD RA DO AD NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. 3600 IN CNAME foo.example.com.
www.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AD50yy1elnzRmjGCd7FBiWEkYlhQYXaZu0g1JoJMr/ONiXVnV2yiONg= ;{id = 2854}
foo.example.com. 3600 IN CNAME www.example.com.
foo.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AEEIVUwbtfcn2RP41l0PDO+Sk4YdJ0HyRVsgq20fJnrDDC6eFXFGqUg= ;{id = 2854}
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
testdata/val_cname_loop3.rpl
Vendored
+8 -4
View File
@@ -5,6 +5,7 @@ server:
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
trust-anchor-signaling: no
stub-zone:
name: "."
@@ -113,7 +114,7 @@ SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN CNAME foo.example.com.
www.example.com. 3600 IN RRSIG CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFH0SwLHe7u56TshoVciFRHEl1KqbAhQ3zBOZMlL8bt1DqoDoM5ni8U/1UA== ;{id = 2854}
www.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AD50yy1elnzRmjGCd7FBiWEkYlhQYXaZu0g1JoJMr/ONiXVnV2yiONg=
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
@@ -126,7 +127,7 @@ SECTION QUESTION
foo.example.com. IN A
SECTION ANSWER
foo.example.com. IN CNAME bar.example.com.
foo.example.com. 3600 IN RRSIG CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFFMlXuWrNL/8aYOl9U9WYjgif8gAAhUAqsC/xOXakHP1SYxMSLANziOik94= ;{id = 2854}
foo.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AILRq+NAK+k+qCNJAmByoTAkGNveSHT+au0u360OeUa56b8zU7gi6+I=
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
@@ -139,7 +140,7 @@ SECTION QUESTION
bar.example.com. IN A
SECTION ANSWER
bar.example.com. IN CNAME www.example.com.
bar.example.com. 3600 IN RRSIG CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFAsalUJJSV86uPlfiGS3kKDc0JB7AhQ+qmHqagY/r36Re/J3Q1OfvcA1dA== ;{id = 2854}
bar.example.com. 3600 IN RRSIG CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AKA7eO4DAGPB8vg/OdBLk41/2txpklOJrszT8Gvp+UOVSLYtddNGz+k=
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
@@ -156,10 +157,13 @@ ENTRY_END
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA SERVFAIL
REPLY QR RD RA NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. 3600 IN CNAME foo.example.com.
foo.example.com. 3600 IN CNAME bar.example.com.
bar.example.com. 3600 IN CNAME www.example.com.
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
validator/validator.c
+16
View File
@@ -1529,6 +1529,22 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
if(verbosity >= VERB_ALGO)
log_dns_msg("chased extract", &vq->qchase,
vq->chase_reply);
/* we skipped cnames, and now the reply is empty, is this
* a CNAME loop? */
if(vq->rrset_skip > 0 && vq->chase_reply->rrset_count == 0) {
if(reply_find_rrset_section_an(vq->orig_msg->rep,
lookup_name, lookup_len, LDNS_RR_TYPE_CNAME,
vq->qchase.qclass)) {
if(anchor) {
lock_basic_unlock(&anchor->lock);
}
verbose(VERB_ALGO, "validator: encountered "
"CNAME loop - terminating");
vq->chase_reply->security = vq->orig_msg->rep->security;
vq->state = VAL_FINISHED_STATE;
return 1;
}
}
}
vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,