- Validate QNAME minimised NXDOMAIN responses.

 - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
   harden-below-nxdomain.

git-svn-id: file:///svn/unbound/trunk@3682 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 3834d9d7556d18431a624ceebd5cbc49ce6aa7bf..f73c37133f7029aa5abf1ae8b5a8e4a4860c2e4d 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+18 March 2016: Ralph
+       - Validate QNAME minimised NXDOMAIN responses.
+       - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
+         harden-below-nxdomain.
+
 17 March 2016: Ralph
        - Limit number of QNAME minimisation iterations.
 

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 38f79699a3462fe7082cb1df668a444a76bf5c16..421ddf5b141eb854ef23ccbef59a282135e79ec8 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -2265,6 +2265,26 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                        if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
                                LDNS_RCODE_NOERROR)
                                iq->minimisation_state = DONOT_MINIMISE_STATE;
+                       /* Make subrequest to validate intermediate NXDOMAIN if
+                        * harden-below-nxdomain is enabled. */
+                       if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
+                               LDNS_RCODE_NXDOMAIN &&
+                               qstate->env->cfg->harden_below_nxdomain) {
+                               struct module_qstate* subq = NULL;
+                               log_query_info(VERB_QUERY,
+                                       "schedule NXDOMAIN validation:",
+                                       &iq->response->qinfo);
+                               if(!generate_sub_request(
+                                       iq->response->qinfo.qname,
+                                       iq->response->qinfo.qname_len,
+                                       iq->response->qinfo.qtype,
+                                       iq->response->qinfo.qclass,
+                                       qstate, id, iq, INIT_REQUEST_STATE,
+                                       FINISHED_STATE, &subq, 1)) {
+                                       verbose(VERB_ALGO,
+                                       "could not validate NXDOMAIN response");
+                               }
+                       }
                        return next_state(iq, QUERYTARGETS_STATE);
                }
                return final_state(iq);

diff --git a/services/cache/dns.c b/services/cache/dns.c
index e14e636dbfd05ccae95e6c9eb8e28022c751abf0..84db7a77884ce42774b67f24b282b0a89d16f501 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -795,6 +795,12 @@ dns_cache_lookup(struct module_env* env,
                dname_remove_label(&k.qname, &k.qname_len);
                h = query_info_hash(&k, flags);
                e = slabhash_lookup(env->msg_cache, h, &k, 0);
+               if(!e && k.qtype != LDNS_RR_TYPE_NS &&
+                       env->cfg->qname_minimisation) {
+                       k.qtype = LDNS_RR_TYPE_NS;
+                       h = query_info_hash(&k, flags);
+                       e = slabhash_lookup(env->msg_cache, h, &k, 0);
+               }
                if(e) {
                        struct reply_info* data = (struct reply_info*)e->data;
                        struct dns_msg* msg;
@@ -810,6 +816,7 @@ dns_cache_lookup(struct module_env* env,
                        }
                        lock_rw_unlock(&e->lock);
                }
+               k.qtype = qtype;
        }
 
        /* fill common RR types for ANY response to avoid requery */