mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

Allow "black lies" to be cached

Browse Source 
"black lies" differ from "white lies" in that the owner name of the
NSEC record matches the QNAME and the intent is to return NODATA
instead of NXDOMAIN for all types.  Caching this NSEC does not lead
to unexpected behaviour on synthesis when the QNAME matches the
NSEC owner which it does for the the general "white lie" response.

"black lie" QNAME NSEC \000.QNAME NSEC RRSIG

"white lie" QNAME- NSEC QNAME+ NSEC RRSIG

where QNAME- is a name that is close to QNAME but sorts before QNAME
and QNAME+ is a that is close to QNAME but sorts after QNAME.

Black lies are safe to cache as they don't bring into existence
names that are not intended to exist.  "Black lies" intentional change
NXDOMAIN to NODATA. "White lies" bring QNAME- into existence and named
would synthesis NODATA for QNAME+ if it is queried for that name
instead of discovering the, presumable, NXDOMAIN response.

Note rejection NSEC RRsets with NEXT names starting with the label
'\000' renders this change ineffective (see reject-000-label).
This commit is contained in:
Mark Andrews
2021-10-20 09:22:50 +11:00
committed by Petr Špaček
parent 0d75ec9ee3
commit c8a7f92b9e
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/dns/resolver.c
View File

@@ -5571,8 +5571,15 @@ answer_response:
sigrdataset->trust != dns_trust_secure) {
continue;
}
/*
* Don't cache "white lies" but do cache
* "black lies".
*/
if (rdataset->type == dns_rdatatype_nsec &&
is_minimal_nsec(rdataset)) {
!dns_name_equal(fctx->name, name) &&
is_minimal_nsec(rdataset))
{
continue;
}
result = dns_db_findnode(fctx->cache, name, true,