mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-03 16:15:27 +00:00
Code Issues Releases Wiki Activity

Implement -T cookiealwaysvalid

Browse Source 
When -T cookiealwaysvalid is passed to named, DNS cookie checks for
the incoming queries always pass, given they are structurally correct.
This commit is contained in:
Aram Sargsyan
2025-03-11 14:03:56 +00:00
parent 06427720f7
commit 807ef8545d
4 changed files with 41 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
bin/named/main.c
View File

@@ -129,6 +129,7 @@ static int maxudp = 0;
/*
* -T options:
*/
static bool cookiealwaysvalid = false;
static bool dropedns = false;
static bool ednsformerr = false;
static bool ednsnotimp = false;
@@ -652,7 +653,9 @@ parse_T_opt(char *option) {
* force the server to behave (or misbehave) in
* specified ways for testing purposes.
*/
if (!strcmp(option, "dropedns")) {
if (!strcmp(option, "cookiealwaysvalid")) {
cookiealwaysvalid = true;
} else if (!strcmp(option, "dropedns")) {
dropedns = true;
} else if (!strcmp(option, "ednsformerr")) {
ednsformerr = true;
@@ -1220,6 +1223,9 @@ setup(void) {
/*
* Modify server context according to command line options
*/
if (cookiealwaysvalid) {
ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
}
if (disable4) {
ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
}

3
bin/tests/system/start.pl
View File

@@ -264,7 +264,8 @@ sub construct_ns_command {
foreach my $t_option(
"dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
"noaa", "noedns", "nosoa", "maxudp512", "maxudp1460",
"cookiealwaysvalid", "noaa", "noedns", "nosoa",
"maxudp512", "maxudp1460",
) {
if (-e "$testdir/$server/named.$t_option") {
$command .= "-T $t_option "

14
lib/ns/client.c
View File

@@ -1290,6 +1290,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
isc_stdtime_t now;
uint32_t when;
isc_buffer_t db;
bool alwaysvalid;
/*
* If we have already seen a cookie option skip this cookie option.
@@ -1335,11 +1336,22 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
when = isc_buffer_getuint32(buf);
isc_buffer_forward(buf, 8);
/*
* For '-T cookiealwaysvalid' still process everything to not skew any
* performance tests involving cookies, but make sure that the cookie
* check passes in the end, given the cookie was structurally correct.
*/
alwaysvalid = ns_server_getoption(client->manager->sctx,
NS_SERVER_COOKIEALWAYSVALID);
/*
* Allow for a 5 minute clock skew between servers sharing a secret.
* Only accept COOKIE if we have talked to the client in the last hour.
*/
now = isc_stdtime_now();
if (alwaysvalid) {
now = when;
}
if (isc_serial_gt(when, (now + 300)) /* In the future. */ ||
isc_serial_lt(when, (now - 3600)) /* In the past. */)
{
@@ -1352,7 +1364,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
isc_buffer_init(&db, dbuf, sizeof(dbuf));
compute_cookie(client, when, client->manager->sctx->secret, &db);
if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
if (isc_safe_memequal(old, dbuf, COOKIE_SIZE) || alwaysvalid) {
ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_cookiematch);
client->attributes |= NS_CLIENTATTR_HAVECOOKIE;

1
lib/ns/include/ns/server.h
View File

@@ -50,6 +50,7 @@
#define NS_SERVER_TRANSFERSLOWLY 0x00010000U /*%< -T transferslowly */
#define NS_SERVER_TRANSFERSTUCK 0x00020000U /*%< -T transferstuck */
#define NS_SERVER_LOGRESPONSES 0x00040000U /*%< log responses */
#define NS_SERVER_COOKIEALWAYSVALID 0x00080000U /*%< -T cookiealwaysvalid */
/*%
* Type for callback function to get hostname.