WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-30 21:54:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC signed zones.

Browse Source 
git-svn-id: file:///svn/unbound/trunk@3722 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Ralph Dolmans
2016-05-20 14:04:27 +00:00
parent 36dc04734e
commit f39692acc7
2 changed files with 31 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Changelog
+4
View File
@@ -1,3 +1,7 @@
20 May 2016: Ralph
- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC
signed zones.
19 May 2016: Wouter
- Fix #766: dns64 should synthesize results on timeout/errors.
iterator/iterator.c
+27 -18
View File
@@ -2262,28 +2262,37 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
/* Best effort qname-minimisation.
* Stop minimising and send full query when RCODE
* is not NOERROR */
* is not NOERROR. */
if(FLAGS_GET_RCODE(iq->response->rep->flags) !=
LDNS_RCODE_NOERROR)
iq->minimisation_state = DONOT_MINIMISE_STATE;
/* Make subrequest to validate intermediate NXDOMAIN if
* harden-below-nxdomain is enabled. */
if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
LDNS_RCODE_NXDOMAIN &&
qstate->env->cfg->harden_below_nxdomain) {
struct module_qstate* subq = NULL;
log_query_info(VERB_QUERY,
"schedule NXDOMAIN validation:",
&iq->response->qinfo);
if(!generate_sub_request(
iq->response->qinfo.qname,
iq->response->qinfo.qname_len,
iq->response->qinfo.qtype,
iq->response->qinfo.qclass,
qstate, id, iq, INIT_REQUEST_STATE,
FINISHED_STATE, &subq, 1)) {
verbose(VERB_ALGO,
"could not validate NXDOMAIN response");
LDNS_RCODE_NXDOMAIN) {
/* Stop resolving when NXDOMAIN is DNSSEC
* signed. Based on assumption that namservers
* serving signed zones do not return NXDOMAIN
* for empty-non-terminals. */
if(iq->dnssec_expected)
return final_state(iq);
/* Make subrequest to validate intermediate
* NXDOMAIN if harden-below-nxdomain is
* enabled. */
if(qstate->env->cfg->harden_below_nxdomain) {
struct module_qstate* subq = NULL;
log_query_info(VERB_QUERY,
"schedule NXDOMAIN validation:",
&iq->response->qinfo);
if(!generate_sub_request(
iq->response->qinfo.qname,
iq->response->qinfo.qname_len,
iq->response->qinfo.qtype,
iq->response->qinfo.qclass,
qstate, id, iq,
INIT_REQUEST_STATE,
FINISHED_STATE, &subq, 1))
verbose(VERB_ALGO,
"could not validate NXDOMAIN "
"response");
}
}
return next_state(iq, QUERYTARGETS_STATE);