mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

Merge branch '1059-prevent-query-loops-for-misbehaving-servers' into 'master'

Browse Source 
Prevent query loops for misbehaving servers

See merge request isc-projects/bind9!2500
This commit is contained in:
Michał Kępień
2019-10-31 04:45:50 -04:00
parent 9fd89c0587 6cd115994e
commit 7346e6d3b5
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
bin/tests/system/legacy/tests.sh
View File

@@ -230,6 +230,17 @@ resolution_fails edns512-notcp. || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret` status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking recursive lookup to edns 512 + no tcp server does not cause query loops ($n)"
ret=0
sent=`grep -c -F "sending packet to 10.53.0.7" ns1/named.run`
if [ $sent -ge 10 ]; then
echo_i "ns1 sent $sent queries to ns7, expected less than 10"
ret=1
fi
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
$PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} legacy ns1 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} legacy ns1
copy_setports ns1/named2.conf.in ns1/named.conf copy_setports ns1/named2.conf.in ns1/named.conf
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} legacy ns1 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} legacy ns1

13
lib/dns/resolver.c
View File

@@ -2956,6 +2956,19 @@ resquery_connected(isc_task_t *task, isc_event_t *event) {
* No route to remote. * No route to remote.
*/ */
isc_socket_detach(&query->tcpsocket); isc_socket_detach(&query->tcpsocket);
/*
* Do not query this server again in this fetch context
* if we already tried reducing the advertised EDNS UDP
* payload size to 512 bytes and the server is
* unavailable over TCP. This prevents query loops
* lasting until the fetch context restart limit is
* reached when attempting to get answers whose size
* exceeds 512 bytes from broken servers.
*/
if ((query->options & DNS_FETCHOPT_EDNS512) != 0) {
add_bad(fctx, query->addrinfo, sevent->result,
badns_unreachable);
}
fctx_cancelquery(&query, NULL, NULL, fctx_cancelquery(&query, NULL, NULL,
true, false); true, false);
retry = true; retry = true;