mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-03 16:15:27 +00:00
Code Issues Releases Wiki Activity

3904. [func] Add the RPZ SOA to the additional section. [RT36507]

Browse Source
This commit is contained in:
Mark Andrews
2014-07-31 10:51:48 +10:00
parent a04588e781
commit 3a55d43527
4 changed files with 40 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@@ -1,3 +1,5 @@
3904. [func] Add the RPZ SOA to the additional section. [RT36507]
3903. [bug] Improve the accuracy of DiG's reported round trip 3903. [bug] Improve the accuracy of DiG's reported round trip
time. [RT 36611] time. [RT 36611]

56
bin/named/query.c
View File

@@ -2551,11 +2551,12 @@ query_addrrset(ns_client_t *client, dns_name_t **namep,
if (result == ISC_R_SUCCESS) { if (result == ISC_R_SUCCESS) {
/* /*
* We've already got an RRset of the given name and type. * We've already got an RRset of the given name and type.
* There's nothing else to do;
*/ */
CTRACE("query_addrrset: dns_message_findname succeeded: done"); CTRACE("query_addrrset: dns_message_findname succeeded: done");
if (dbuf != NULL) if (dbuf != NULL)
query_releasename(client, namep); query_releasename(client, namep);
if ((rdataset->attributes & DNS_RDATASETATTR_REQUIRED) != 0)
mrdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
return; return;
} else if (result == DNS_R_NXDOMAIN) { } else if (result == DNS_R_NXDOMAIN) {
/* /*
@@ -2595,7 +2596,8 @@ query_addrrset(ns_client_t *client, dns_name_t **namep,
static inline isc_result_t static inline isc_result_t
query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version, query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
unsigned int override_ttl, isc_boolean_t isassociated) unsigned int override_ttl, isc_boolean_t isassociated,
dns_section_t section)
{ {
dns_name_t *name; dns_name_t *name;
dns_dbnode_t *node; dns_dbnode_t *node;
@@ -2702,8 +2704,11 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
sigrdatasetp = &sigrdataset; sigrdatasetp = &sigrdataset;
else else
sigrdatasetp = NULL; sigrdatasetp = NULL;
if (section == DNS_SECTION_ADDITIONAL)
rdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
query_addrrset(client, &name, &rdataset, sigrdatasetp, NULL, query_addrrset(client, &name, &rdataset, sigrdatasetp, NULL,
DNS_SECTION_AUTHORITY); section);
} }
cleanup: cleanup:
@@ -5637,7 +5642,7 @@ answer_in_glue(ns_client_t *client, dns_rdatatype_t qtype) {
ISC_LIST_PREPEND(msg->sections[section], name, link); ISC_LIST_PREPEND(msg->sections[section], name, link);
ISC_LIST_UNLINK(name->list, rdataset, link); ISC_LIST_UNLINK(name->list, rdataset, link);
ISC_LIST_PREPEND(name->list, rdataset, link); ISC_LIST_PREPEND(name->list, rdataset, link);
rdataset->attributes |= DNS_RDATASETATTR_REQUIREDGLUE; rdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
} }
} }
@@ -6104,6 +6109,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
isc_boolean_t nxrewrite = ISC_FALSE; isc_boolean_t nxrewrite = ISC_FALSE;
dns_clientinfomethods_t cm; dns_clientinfomethods_t cm;
dns_clientinfo_t ci; dns_clientinfo_t ci;
isc_boolean_t associated;
dns_section_t section;
dns_ttl_t ttl;
CTRACE("query_find"); CTRACE("query_find");
@@ -7159,17 +7167,18 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
} }
/* /*
* Add SOA if NXRRSET was not generated by RPZ rewrite * Add SOA to the additional section if generated by a RPZ
* rewrite.
*/ */
if (!nxrewrite) { associated = dns_rdataset_isassociated(rdataset);
isc_boolean_t associated = section = nxrewrite ? DNS_SECTION_ADDITIONAL :
dns_rdataset_isassociated(rdataset); DNS_SECTION_AUTHORITY;
result = query_addsoa(client, db, version,
ISC_UINT32_MAX, associated); result = query_addsoa(client, db, version, ISC_UINT32_MAX,
if (result != ISC_R_SUCCESS) { associated, section);
QUERY_ERROR(result); if (result != ISC_R_SUCCESS) {
goto cleanup; QUERY_ERROR(result);
} goto cleanup;
} }
/* /*
@@ -7210,21 +7219,23 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
} }
/* /*
* Add SOA if NXDOMAIN was not generated by RPZ rewrite. * Add SOA to the additional section if generated by a
* RPZ rewrite.
* *
* If the query was for a SOA record force the * If the query was for a SOA record force the
* ttl to zero so that it is possible for clients to find * ttl to zero so that it is possible for clients to find
* the containing zone of an arbitrary name with a stub * the containing zone of an arbitrary name with a stub
* resolver and not have it cached. * resolver and not have it cached.
*/ */
associated = dns_rdataset_isassociated(rdataset);
section = nxrewrite ? DNS_SECTION_ADDITIONAL :
DNS_SECTION_AUTHORITY;
ttl = ISC_UINT32_MAX;
if (!nxrewrite && qtype == dns_rdatatype_soa && if (!nxrewrite && qtype == dns_rdatatype_soa &&
zone != NULL && dns_zone_getzeronosoattl(zone)) zone != NULL && dns_zone_getzeronosoattl(zone))
result = query_addsoa(client, db, version, 0, ttl = 0;
dns_rdataset_isassociated(rdataset)); result = query_addsoa(client, db, version, ttl, associated,
else if (!nxrewrite) section);
result = query_addsoa(client, db, version,
ISC_UINT32_MAX,
dns_rdataset_isassociated(rdataset));
if (result != ISC_R_SUCCESS) { if (result != ISC_R_SUCCESS) {
QUERY_ERROR(result); QUERY_ERROR(result);
goto cleanup; goto cleanup;
@@ -7942,7 +7953,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
* Add a fake SOA record. * Add a fake SOA record.
*/ */
(void)query_addsoa(client, db, version, (void)query_addsoa(client, db, version,
600, ISC_FALSE); 600, ISC_FALSE,
DNS_SECTION_AUTHORITY);
goto cleanup; goto cleanup;
} }
#endif #endif

3
lib/dns/include/dns/rdataset.h
View File

@@ -199,7 +199,8 @@ struct dns_rdataset {
#define DNS_RDATASETATTR_NXDOMAIN 0x00002000 #define DNS_RDATASETATTR_NXDOMAIN 0x00002000
#define DNS_RDATASETATTR_NOQNAME 0x00004000 #define DNS_RDATASETATTR_NOQNAME 0x00004000
#define DNS_RDATASETATTR_CHECKNAMES 0x00008000 /*%< Used by resolver. */ #define DNS_RDATASETATTR_CHECKNAMES 0x00008000 /*%< Used by resolver. */
#define DNS_RDATASETATTR_REQUIREDGLUE 0x00010000 #define DNS_RDATASETATTR_REQUIRED 0x00010000
#define DNS_RDATASETATTR_REQUIREDGLUE DNS_RDATASETATTR_REQUIRED
#define DNS_RDATASETATTR_LOADORDER 0x00020000 #define DNS_RDATASETATTR_LOADORDER 0x00020000
#define DNS_RDATASETATTR_RESIGN 0x00040000 #define DNS_RDATASETATTR_RESIGN 0x00040000
#define DNS_RDATASETATTR_CLOSEST 0x00080000 #define DNS_RDATASETATTR_CLOSEST 0x00080000

3
lib/dns/resolver.c
View File

@@ -5996,7 +5996,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
"unrelated %s %s in " "unrelated %s %s in "
"%s authority section", "%s authority section",
tbuf, qbuf, nbuf); tbuf, qbuf, nbuf);
return (DNS_R_FORMERR); goto nextname;
} }
if (type == dns_rdatatype_ns) { if (type == dns_rdatatype_ns) {
/* /*
@@ -6059,6 +6059,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
} }
} }
} }
nextname:
result = dns_message_nextname(message, section); result = dns_message_nextname(message, section);
if (result == ISC_R_NOMORE) if (result == ISC_R_NOMORE)
break; break;