- Fix authority zone answers for obscured DNAMEs and delegations.

diff --git a/doc/Changelog b/doc/Changelog
index fb955f5a32a146cd00e7e44317488d2b4b70c22c..fef0a4c7c5efa38fce6e56e7f6ca618b38f9ce39 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+14 September 2023: Wouter
+       - Fix authority zone answers for obscured DNAMEs and delegations.
+
 8 September 2023: Wouter
        - Fix send of udp retries when ENOBUFS is returned. It stops looping
          and also waits for the condition to go away. Reported by Florian

diff --git a/services/authzone.c b/services/authzone.c
index cd3ef8dbbf3ddf4c1997ecdc9a9728c805a5abf6..a1b3d22787d22e01a21dcaa0465bde541a70678e 100644 (file)
--- a/services/authzone.c
+++ b/services/authzone.c
@@ -2475,6 +2475,7 @@ az_find_ce(struct auth_zone* z, struct query_info* qinfo,
        struct auth_rrset** rrset)
 {
        struct auth_data* n = node;
+       struct auth_rrset* lookrrset;
        *ce = NULL;
        *rrset = NULL;
        if(!node_exact) {
@@ -2497,21 +2498,23 @@ az_find_ce(struct auth_zone* z, struct query_info* qinfo,
                /* see if the current candidate has issues */
                /* not zone apex and has type NS */
                if(n->namelen != z->namelen &&
-                       (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) &&
+                       (lookrrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) &&
                        /* delegate here, but DS at exact the dp has notype */
                        (qinfo->qtype != LDNS_RR_TYPE_DS || 
                        n->namelen != qinfo->qname_len)) {
                        /* referral */
                        /* this is ce and the lowernode is nonexisting */
                        *ce = n;
-                       return 0;
+                       *rrset = lookrrset;
+                       node_exact = 0;
                }
                /* not equal to qname and has type DNAME */
                if(n->namelen != qinfo->qname_len &&
-                       (*rrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) {
+                       (lookrrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) {
                        /* this is ce and the lowernode is nonexisting */
                        *ce = n;
-                       return 0;
+                       *rrset = lookrrset;
+                       node_exact = 0;
                }
 
                if(*ce == NULL && !domain_has_only_nsec3(n)) {

diff --git a/testcode/unitauth.c b/testcode/unitauth.c
index d193526b8c281679670043b110e688bf89652e2b..11eeb43b21637b6207609fc50c5dcee76cf292b5 100644 (file)
--- a/testcode/unitauth.c
+++ b/testcode/unitauth.c
@@ -76,10 +76,18 @@ static const char* zone_example_com =
 "out.example.com.      3600    IN      CNAME   www.example.com.\n"
 "plan.example.com.     3600    IN      CNAME   nonexist.example.com.\n"
 "redir.example.com.    3600    IN      DNAME   redir.example.org.\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"obscured.redir2.example.com.  3600    IN      A       10.0.0.12\n"
+"under2.redir2.example.com.    3600    IN      DNAME   redir3.example.net.\n"
+"doubleobscured.under2.redir2.example.com.     3600    IN      A       10.0.0.13\n"
 "sub.example.com.      3600    IN      NS      ns1.sub.example.com.\n"
 "sub.example.com.      3600    IN      NS      ns2.sub.example.com.\n"
 "ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
 "ns2.sub.example.com.  3600    IN      AAAA    2001::7\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+"obscured.sub2.example.com.    3600    IN      A       10.0.0.10\n"
+"under.sub2.example.com.       3600    IN      NS      ns.under.sub2.example.com.\n"
+"doubleobscured.under.sub2.example.com.        3600    IN      A       10.0.0.11\n"
 "*.wild.example.com.   3600    IN      A       10.0.0.8\n"
 "*.wild2.example.com.  3600    IN      CNAME   www.example.com.\n"
 "*.wild3.example.com.  3600    IN      A       10.0.0.8\n"
@@ -281,6 +289,54 @@ static struct q_ans example_com_queries[] = {
 "foo.abc.redir.example.com.    0       IN      CNAME   foo.abc.redir.example.org.\n"
        },
 
+       { "example.com", "redir2.example.com. DNAME", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+       },
+
+       { "example.com", "abc.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"abc.redir2.example.com.       0       IN      CNAME   abc.redir2.example.org.\n"
+       },
+
+       { "example.com", "obscured.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"obscured.redir2.example.com.  0       IN      CNAME   obscured.redir2.example.org.\n"
+       },
+
+       { "example.com", "under2.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"under2.redir2.example.com.    0       IN      CNAME   under2.redir2.example.org.\n"
+       },
+
+       { "example.com", "doubleobscured.under2.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"doubleobscured.under2.redir2.example.com.     0       IN      CNAME   doubleobscured.under2.redir2.example.org.\n"
+       },
+
+       { "example.com", "foo.doubleobscured.under2.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"foo.doubleobscured.under2.redir2.example.com. 0       IN      CNAME   foo.doubleobscured.under2.redir2.example.org.\n"
+       },
+
+       { "example.com", "foo.under2.redir2.example.com. A", "",
+";flags QR AA rcode NOERROR\n"
+";answer section\n"
+"redir2.example.com.   3600    IN      DNAME   redir2.example.org.\n"
+"foo.under2.redir2.example.com.        0       IN      CNAME   foo.under2.redir2.example.org.\n"
+       },
+
        { "example.com", "sub.example.com. NS", "",
 ";flags QR rcode NOERROR\n"
 ";authority section\n"
@@ -357,6 +413,78 @@ static struct q_ans example_com_queries[] = {
 "ns2.sub.example.com.  3600    IN      AAAA    2001::7\n"
        },
 
+       { "example.com", "sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "sub2.example.com. NS", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "obscured.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "abc.obscured.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "under.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "under.sub2.example.com. NS", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "abc.under.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "doubleobscured.under.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
+       { "example.com", "abc.doubleobscured.under.sub2.example.com. A", "",
+";flags QR rcode NOERROR\n"
+";authority section\n"
+"sub2.example.com.     3600    IN      NS      ns1.sub.example.com.\n"
+";additional section\n"
+"ns1.sub.example.com.  3600    IN      A       10.0.0.6\n"
+       },
+
        { "example.com", "wild.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";authority section\n"