diff --git a/CHANGES b/CHANGES index ff9ecac4f2..c7fb5aff7c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +3914. [bug] Allow the URI target and CAA value fields to + be zero length. [RT #36737] + 3913. [bug] Address race issue in dispatch. [RT #36731] 3912. [bug] Address some unrecoverable lookup failures. [RT #36330] diff --git a/bin/tests/system/acl/clean.sh b/bin/tests/system/acl/clean.sh index a791698a12..356c8bc0c2 100644 --- a/bin/tests/system/acl/clean.sh +++ b/bin/tests/system/acl/clean.sh @@ -20,6 +20,6 @@ # Clean up after zone transfer tests. # -rm -f dig.out +rm -f dig.out.* rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl ns2/named.conf rm -f */named.memstats diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh index 7207c5a1d3..c10e0e7856 100644 --- a/bin/tests/system/acl/tests.sh +++ b/bin/tests/system/acl/tests.sh @@ -28,14 +28,15 @@ echo "I:testing basic ACL processing" # key "one" should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + # any other key should be fine t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } cp -f ns2/named2.conf ns2/named.conf $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /' @@ -44,19 +45,19 @@ sleep 5 # prefix 10/8 should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } # any other address should work, as long as it sends key "one" t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } echo "I:testing nested ACL processing" # all combinations of 10.53.0.{1|2} with key {one|two}, should succeed @@ -67,43 +68,43 @@ sleep 5 # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # but only one or the other should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $tt failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $tt failed" ; status=1; } # and other values? right out t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two cp -f ns2/named4.conf ns2/named.conf @@ -113,32 +114,32 @@ sleep 5 # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # should succeed t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; } # should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } # should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } # should fail t=`expr $t + 1` $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out -grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t} +grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } echo "I:testing allow-query-on ACL processing" cp -f ns2/named5.conf ns2/named.conf @@ -146,8 +147,8 @@ $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 / sleep 5 t=`expr $t + 1` $DIG +tcp soa example. \ - @10.53.0.2 -b 10.53.0.3 -p 5300 > dig.out -grep "status: NOERROR" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.3 -p 5300 > dig.out.${t} +grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; } echo "I:exit status: $status" exit $status diff --git a/bin/tests/system/genzone.sh b/bin/tests/system/genzone.sh index 41eec21425..1957aaa2eb 100644 --- a/bin/tests/system/genzone.sh +++ b/bin/tests/system/genzone.sh @@ -304,10 +304,12 @@ eui64 EUI64 01-23-45-67-89-ab-cd-ef ; type 256 uri01 URI 10 20 "https://www.isc.org/" uri02 URI 30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/" +uri03 URI 30 40 "" ; type 257 caa01 CAA 0 issue "ca.example.net; policy=ev" caa02 CAA 128 tbs "Unknown" +caa03 CAA 128 tbs "" ; keydata (internal type used for managed-keys) keydata TYPE65533 \# 0 diff --git a/bin/tests/system/xfer/dig1.good b/bin/tests/system/xfer/dig1.good index 73092cda72..15842ab4d6 100644 --- a/bin/tests/system/xfer/dig1.good +++ b/bin/tests/system/xfer/dig1.good @@ -11,6 +11,7 @@ afsdb01.example. 3600 IN AFSDB 0 hostname.example. afsdb02.example. 3600 IN AFSDB 65535 . caa01.example. 3600 IN CAA 0 issue "ca.example.net\; policy=ev" caa02.example. 3600 IN CAA 128 tbs "Unknown" +caa03.example. 3600 IN CAA 128 tbs "" cdnskey01.example. 3600 IN CDNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= cds01.example. 3600 IN CDS 30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9 cert01.example. 3600 IN CERT 65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= @@ -91,6 +92,7 @@ txt11.example. 3600 IN TXT "\"foo\"" txt12.example. 3600 IN TXT "\"foo\"" uri01.example. 3600 IN URI 10 20 "https://www.isc.org/" uri02.example. 3600 IN URI 30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/" +uri03.example. 3600 IN URI 30 40 "" wks01.example. 3600 IN WKS 10.0.0.1 6 0 1 2 21 23 wks02.example. 3600 IN WKS 10.0.0.1 17 0 1 2 53 wks03.example. 3600 IN WKS 10.0.0.2 6 65535 diff --git a/bin/tests/system/xfer/dig2.good b/bin/tests/system/xfer/dig2.good index f5eed453d6..2586c9acdc 100644 --- a/bin/tests/system/xfer/dig2.good +++ b/bin/tests/system/xfer/dig2.good @@ -11,6 +11,7 @@ afsdb01.example. 3600 IN AFSDB 0 hostname.example. afsdb02.example. 3600 IN AFSDB 65535 . caa01.example. 3600 IN CAA 0 issue "ca.example.net\; policy=ev" caa02.example. 3600 IN CAA 128 tbs "Unknown" +caa03.example. 3600 IN CAA 128 tbs "" cdnskey01.example. 3600 IN CDNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= cds01.example. 3600 IN CDS 30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9 cert01.example. 3600 IN CERT 65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= @@ -91,6 +92,7 @@ txt11.example. 3600 IN TXT "\"foo\"" txt12.example. 3600 IN TXT "\"foo\"" uri01.example. 3600 IN URI 10 20 "https://www.isc.org/" uri02.example. 3600 IN URI 30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/" +uri03.example. 3600 IN URI 30 40 "" wks01.example. 3600 IN WKS 10.0.0.1 6 0 1 2 21 23 wks02.example. 3600 IN WKS 10.0.0.1 17 0 1 2 53 wks03.example. 3600 IN WKS 10.0.0.2 6 65535 diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c index 9a687cffcb..5c53656d27 100644 --- a/lib/dns/rdata.c +++ b/lib/dns/rdata.c @@ -131,9 +131,6 @@ multitxt_totext(isc_region_t *source, isc_buffer_t *target); static isc_result_t multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target); -static isc_result_t -multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target); - static isc_boolean_t name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target); @@ -1407,35 +1404,6 @@ multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) { return (ISC_R_SUCCESS); } -static isc_result_t -multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) { - unsigned int n; - isc_region_t sregion; - isc_region_t tregion; - - isc_buffer_activeregion(source, &sregion); - if (sregion.length == 0) - return(ISC_R_UNEXPECTEDEND); - n = 256U; - do { - if (n != 256U) - return (DNS_R_SYNTAX); - - n = sregion.length; - - isc_buffer_availableregion(target, &tregion); - if (n > tregion.length) - return (ISC_R_NOSPACE); - - if (tregion.base != sregion.base) - memmove(tregion.base, sregion.base, n); - isc_buffer_forward(source, n); - isc_buffer_add(target, n); - isc_buffer_activeregion(source, &sregion); - } while (sregion.length != 0); - return (ISC_R_SUCCESS); -} - static isc_boolean_t name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target) { int l1, l2; diff --git a/lib/dns/rdata/generic/caa_257.c b/lib/dns/rdata/generic/caa_257.c index 8ca43de28b..993e3267e6 100644 --- a/lib/dns/rdata/generic/caa_257.c +++ b/lib/dns/rdata/generic/caa_257.c @@ -152,20 +152,15 @@ fromwire_caa(ARGS_FROMWIRE) { if (sr.length < len || len == 0) RETERR(DNS_R_FORMERR); - /* Tag */ + /* Check the Tag's value */ for (i = 0; i < len; i++) if (!alphanumeric[sr.base[i]]) RETERR(DNS_R_FORMERR); - RETERR(mem_tobuffer(target, sr.base, len)); - isc_region_consume(&sr, len); - isc_buffer_forward(source, len); - /* - * Value + * Tag + Value */ - RETERR(multitxt_fromwire(source, target)); - - return (ISC_R_SUCCESS); + isc_buffer_forward(source, sr.length); + return (mem_tobuffer(target, sr.base, sr.length)); } static inline isc_result_t diff --git a/lib/dns/rdata/generic/uri_256.c b/lib/dns/rdata/generic/uri_256.c index 8e9c908288..3ddd790847 100644 --- a/lib/dns/rdata/generic/uri_256.c +++ b/lib/dns/rdata/generic/uri_256.c @@ -115,15 +115,12 @@ fromwire_uri(ARGS_FROMWIRE) { isc_buffer_activeregion(source, ®ion); if (region.length < 4) return (ISC_R_UNEXPECTEDEND); - RETERR(mem_tobuffer(target, region.base, 4)); - isc_buffer_forward(source, 4); /* - * Target URI + * Priority, weight and target URI */ - RETERR(multitxt_fromwire(source, target)); - - return (ISC_R_SUCCESS); + isc_buffer_forward(source, region.length); + return (mem_tobuffer(target, region.base, region.length)); } static inline isc_result_t @@ -178,8 +175,6 @@ compare_uri(ARGS_COMPARE) { static inline isc_result_t fromstruct_uri(ARGS_FROMSTRUCT) { dns_rdata_uri_t *uri = source; - isc_region_t region; - isc_uint8_t len; REQUIRE(type == 256); REQUIRE(source != NULL); @@ -203,18 +198,6 @@ fromstruct_uri(ARGS_FROMSTRUCT) { /* * Target URI */ - len = 255U; - region.base = uri->target; - region.length = uri->tgt_len; - while (region.length > 0) { - REQUIRE(len == 255U); - len = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - if (region.length < len) - return (ISC_R_UNEXPECTEDEND); - isc_region_consume(®ion, len); - } - return (mem_tobuffer(target, uri->target, uri->tgt_len)); }