mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Merge branch '2280-check-dname-handling-when-qtype-is-cname-any' into 'main'

Browse Source 
Resolve "Check DNAME handling when QTYPE is CNAME/ANY"

Closes #2280

See merge request isc-projects/bind9!4393
This commit is contained in:
Mark Andrews
2020-11-18 23:48:30 +00:00
parent ff2bc7891e e980affba0
commit 3065d54142
5 changed files with 68 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
5534. [bug] The synthesised CNAME from a DNAME was incorrectly
followed when the QTYPE was CNAME or ANY. [GL #2280]
5533. [func] Add "stale-refresh-time" option, a time window that 5533. [func] Add "stale-refresh-time" option, a time window that
starts after a failed lookup, during which stale rrset starts after a failed lookup, during which stale rrset
will be served directly from cache before a new will be served directly from cache before a new

1
bin/tests/system/auth/ns1/example.com.db
View File

@@ -20,3 +20,4 @@ ns A 10.53.0.1
www CNAME server.example.net. www CNAME server.example.net.
inzone CNAME a.example.com. inzone CNAME a.example.com.
a A 10.53.0.1 a A 10.53.0.1
dname DNAME @

48
bin/tests/system/auth/tests.sh
View File

@@ -127,6 +127,54 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
[ $ret -eq 0 ] || echo_i "failed" [ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret` status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that in-zone CNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 -t cname inzone.example.com > dig.out.test$n || ret=1
grep 'ANSWER: 1,' dig.out.test$n > /dev/null || ret=1
grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that in-zone CNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 -t any inzone.example.com > dig.out.test$n || ret=1
grep 'ANSWER: 1,' dig.out.test$n > /dev/null || ret=1
grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that in-zone DNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 -t cname inzone.dname.example.com > dig.out.test$n || ret=1
grep 'ANSWER: 2,' dig.out.test$n > /dev/null || ret=1
grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that in-zone DNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.2 -t any inzone.dname.example.com > dig.out.test$n || ret=1
grep 'ANSWER: 2,' dig.out.test$n > /dev/null || ret=1
grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n > /dev/null || ret=1
grep 'inzone\.example\.com.*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
grep 'a\.example\.com.*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret`
n=`expr $n + 1` n=`expr $n + 1`
echo_i "check that CHAOS addresses are compared correctly ($n)" echo_i "check that CHAOS addresses are compared correctly ($n)"
ret=0 ret=0

3
doc/notes/notes-current.rst
View File

@@ -65,3 +65,6 @@ Bug Fixes
- ``named`` could crash with an assertion failure if a TCP connection is closed - ``named`` could crash with an assertion failure if a TCP connection is closed
while the request is still processing. [GL #2227] while the request is still processing. [GL #2227]
- The synthesised CNAME from a DNAME was incorrectly followed when the QTYPE
was CNAME or ANY. [GL #2280]

7
lib/ns/query.c
View File

@@ -9896,6 +9896,12 @@ query_dname(query_ctx_t *qctx) {
return (ns_query_done(qctx)); return (ns_query_done(qctx));
} }
/*
* If the original query was not for a CNAME or ANY then follow the
* CNAME.
*/
if (qctx->qtype != dns_rdatatype_cname &&
qctx->qtype != dns_rdatatype_any) {
/* /*
* Switch to the new qname and restart. * Switch to the new qname and restart.
*/ */
@@ -9905,6 +9911,7 @@ query_dname(query_ctx_t *qctx) {
if (!WANTRECURSION(qctx->client)) { if (!WANTRECURSION(qctx->client)) {
qctx->options |= DNS_GETDB_NOLOG; qctx->options |= DNS_GETDB_NOLOG;
} }
}
query_addauth(qctx); query_addauth(qctx);