Enable qname minimization by default.

To be able to do that, make sure that qnames that are forwarded or
in and authzone are handled without QM.  Also, some tests are dependent
on specific queries or responses, disable QM for them.

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 5e1d79432475867ec8fd0f19b5037a3e83ab2b05..d36625e4d9d6686cbbb96e3cc0a20d4e82117a7d 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -4706,7 +4706,8 @@ int main(int argc, char **argv)
     ::arg().set("rng", "Specify random number generator to use. Valid values are auto,sodium,openssl,getrandom,arc4random,urandom.")="auto";
     ::arg().set("public-suffix-list-file", "Path to the Public Suffix List file, if any")="";
     ::arg().set("distribution-load-factor", "The load factor used when PowerDNS is distributing queries to worker threads")="0.0";
-    ::arg().setSwitch("qname-minimization", "Use Query Name Minimization")="no";
+
+    ::arg().setSwitch("qname-minimization", "Use Query Name Minimization")="yes";
     ::arg().setSwitch("nothing-below-nxdomain", "When an NXDOMAIN exists in cache for a name with fewer labels than the qname, send NXDOMAIN without doing a lookup (see RFC 8020)")="dnssec";
     ::arg().set("max-generate-steps", "Maximum number of $GENERATE steps when loading a zone from a file")="0";
 

diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst
index aa7ee739c8a90ba3b73739dbda1c4fc1df93adb2..ab66bf0fbb30f9c7c0c348072d2d5b771a869588 100644 (file)
--- a/pdns/recursordist/docs/settings.rst
+++ b/pdns/recursordist/docs/settings.rst
@@ -1239,7 +1239,7 @@ Path to the Public Suffix List file, if any. If set, PowerDNS will try to load t
 .. versionadded:: 4.3.0
 
 -  Boolean
--  Default: no
+-  Default: yes
 
 Enable Query Name Minimization. This is a experimental feature, implementing a relaxed form of Query Name Mimimization as
 described in :rfc:`7816`.

diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc
index 8223bdca0962822e4ea3fff01c7fc6f01faedd8e..2c0b68273a7c8d1c44d6696297e7f5bbdd33fa7e 100644 (file)
--- a/pdns/recursordist/test-syncres_cc.cc
+++ b/pdns/recursordist/test-syncres_cc.cc
@@ -170,7 +170,7 @@ void initSR(bool debug)
   ::arg().set("version-string", "string reported on version.pdns or version.bind")="PowerDNS Unit Tests";
   ::arg().set("rng")="auto";
   ::arg().set("entropy-source")="/dev/urandom";
-  ::arg().setSwitch("qname-minimization", "Use Query Name Minimization") = "no";
+  ::arg().setSwitch("qname-minimization", "Use Query Name Minimization") = "yes";
 }
 
 void initSR(std::unique_ptr<SyncRes>& sr, bool dnssec, bool debug, time_t fakeNow)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 3ffeae0dbaa331784dedb614f802b9148a4a946a..8bd1a6861da38c6b0fb9887057fe59f0c99fae14 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -404,6 +404,12 @@ bool SyncRes::doOOBResolve(const DNSName &qname, const QType &qtype, vector<DNSR
   return doOOBResolve(iter->second, qname, qtype, ret, res);
 }
 
+bool SyncRes::isForwardOrAuth(const DNSName &qname) const {
+  DNSName authname(qname);
+  domainmap_t::const_iterator iter = getBestAuthZone(&authname);
+  return iter != t_sstorage.domainmap->end();
+}
+
 uint64_t SyncRes::doEDNSDump(int fd)
 {
   auto fp = std::unique_ptr<FILE, int(*)(FILE*)>(fdopen(dup(fd), "w"), fclose);
@@ -587,7 +593,7 @@ int SyncRes::asyncresolveWrapper(const ComboAddress& ip, bool ednsMANDATORY, con
 
 int SyncRes::doResolve(const DNSName &qname, const QType &qtype, vector<DNSRecord>&ret, unsigned int depth, set<GetBestNSAnswer>& beenthere, vState& state) {
 
-  if (!getQNameMinimization()) {
+  if (!getQNameMinimization() || isForwardOrAuth(qname)) {
     return doResolveNoQNameMinimization(qname, qtype, ret, depth, beenthere, state);
   }
 

diff --git a/pdns/syncres.hh b/pdns/syncres.hh
index 77af72ba6bc23478efe9cd54143f6df2aaeea63b..3ce2bf04c0b28563f4db6731797b495b7bb09853 100644 (file)
--- a/pdns/syncres.hh
+++ b/pdns/syncres.hh
@@ -803,6 +803,7 @@ private:
   int doResolveNoQNameMinimization(const DNSName &qname, const QType &qtype, vector<DNSRecord>&ret, unsigned int depth, set<GetBestNSAnswer>& beenthere, vState& state, bool* fromCache = NULL, StopAtDelegation* stopAtDelegation = NULL);
   bool doOOBResolve(const AuthDomain& domain, const DNSName &qname, const QType &qtype, vector<DNSRecord>&ret, int& res);
   bool doOOBResolve(const DNSName &qname, const QType &qtype, vector<DNSRecord>&ret, unsigned int depth, int &res);
+  bool isForwardOrAuth(const DNSName &qname) const;
   domainmap_t::const_iterator getBestAuthZone(DNSName* qname) const;
   bool doCNAMECacheCheck(const DNSName &qname, const QType &qtype, vector<DNSRecord>&ret, unsigned int depth, int &res, vState& state, bool wasAuthZone, bool wasForwardRecurse);
   bool doCacheCheck(const DNSName &qname, const DNSName& authname, bool wasForwardedOrAuthZone, bool wasAuthZone, bool wasForwardRecurse, const QType &qtype, vector<DNSRecord>&ret, unsigned int depth, int &res, vState& state);

diff --git a/regression-tests.recursor-dnssec/test_EDNSBufferSize.py b/regression-tests.recursor-dnssec/test_EDNSBufferSize.py
index 8ff69a10b929a83d11865101f3d194610e7fe03e..b4c96316123ec631181c2fd7a686d18535f112c8 100644 (file)
--- a/regression-tests.recursor-dnssec/test_EDNSBufferSize.py
+++ b/regression-tests.recursor-dnssec/test_EDNSBufferSize.py
@@ -47,6 +47,7 @@ class EDNSBufferTest(RecursorTest):
     _qnameSuffix = '.edns-tests.example.'
 
     _config_template = """
+qname-minimization=no
 forward-zones=edns-tests.example=%s.22
 udp-truncation-threshold=%d
 edns-outgoing-bufsize=%d
@@ -173,6 +174,7 @@ class EDNSBufferTest16801681(EDNSBufferTest):
     _qnameSuffix = '.edns-tests.example.'
 
     _config_template = """
+qname-minimization=no
 forward-zones=edns-tests.example=%s.22
 udp-truncation-threshold=%d
 edns-outgoing-bufsize=%d
@@ -196,6 +198,7 @@ class EDNSBufferTest16801679(EDNSBufferTest):
     _qnameSuffix = '.edns-tests.example.'
 
     _config_template = """
+qname-minimization=no
 forward-zones=edns-tests.example=%s.22
 udp-truncation-threshold=%d
 edns-outgoing-bufsize=%d

diff --git a/regression-tests.recursor-dnssec/test_Protobuf.py b/regression-tests.recursor-dnssec/test_Protobuf.py
index 5aa77ed7e08eed6cc52869edee6d8876c12207eb..8bc65007f3ac21507b8efd161568c610be777aa7 100644 (file)
--- a/regression-tests.recursor-dnssec/test_Protobuf.py
+++ b/regression-tests.recursor-dnssec/test_Protobuf.py
@@ -129,7 +129,7 @@ class TestRecursorProtobuf(RecursorTest):
         self.assertEquals(msg.id, query.id)
         self.assertTrue(msg.HasField('inBytes'))
         if normalQueryResponse:
-            # compare inBytes with length of query/response
+            # compare inBytes with length off query/response
             # Note that for responses, the size we received might differ
             # because dnspython might compress labels differently from
             # the recursor
@@ -158,7 +158,7 @@ class TestRecursorProtobuf(RecursorTest):
         if length is not None:
           self.assertEquals(msg.inBytes, length)
         else:
-          # compare inBytes with length of query/response
+          # compare inBytes with length off query/response
           self.assertEquals(msg.inBytes, len(query.to_wire()))
 
     def checkProtobufQuery(self, msg, protocol, query, qclass, qtype, qname, initiator='127.0.0.1'):
@@ -351,7 +351,10 @@ class OutgoingProtobufDefaultTest(TestRecursorProtobuf):
 
     _confdir = 'OutgoingProtobufDefault'
     _config_template = """
-auth-zones=example=configs/%s/example.zone""" % _confdir
+    # Switch of QName Minimization, it generates much more protobuf messages
+    # (or make the test much more smart!)
+    qname-minimization=no
+    auth-zones=example=configs/%s/example.zone""" % _confdir
     _lua_config_file = """
     outgoingProtobufServer({"127.0.0.1:%d", "127.0.0.1:%d"})
     """ % (protobufServersParameters[0].port, protobufServersParameters[1].port)
@@ -380,7 +383,10 @@ class OutgoingProtobufNoQueriesTest(TestRecursorProtobuf):
 
     _confdir = 'OutgoingProtobufNoQueries'
     _config_template = """
-auth-zones=example=configs/%s/example.zone""" % _confdir
+    # Switch of QName Minimization, it generates much more protobuf messages
+    # (or make the test much more smart!)
+    qname-minimization=no
+    auth-zones=example=configs/%s/example.zone""" % _confdir
     _lua_config_file = """
     outgoingProtobufServer({"127.0.0.1:%d", "127.0.0.1:%d"}, { logQueries=false, logResponses=true })
     """ % (protobufServersParameters[0].port, protobufServersParameters[1].port)

diff --git a/regression-tests.recursor-dnssec/test_RootNXTrust.py b/regression-tests.recursor-dnssec/test_RootNXTrust.py
index d4bdd77251c46fc87ff4ecc22179cb13a701c459..afaf221fd125b966469dea3e1b62f36e7e46ce9b 100644 (file)
--- a/regression-tests.recursor-dnssec/test_RootNXTrust.py
+++ b/regression-tests.recursor-dnssec/test_RootNXTrust.py
@@ -28,6 +28,7 @@ class testRootNXTrustDisabled(RootNXTrustRecursorTest):
 
     _config_template = """
 root-nx-trust=no
+qname-minimization=no
 webserver=yes
 webserver-port=%d
 webserver-address=127.0.0.1

diff --git a/regression-tests.recursor/config.sh b/regression-tests.recursor/config.sh
index da2b47276e5fb1699c293618aa0a4c64e5cce8f1..074b2159f9c2d3c59644d135c8d1e0bc2aca890c 100755 (executable)
--- a/regression-tests.recursor/config.sh
+++ b/regression-tests.recursor/config.sh
@@ -289,8 +289,8 @@ if not newDN then
 end
 function prequery ( dnspacket )
     qname, qtype = dnspacket:getQuestion()
-    if (string.sub(tostring(qname), -21) == ".1.ghost.example.net." and posix.stat('drop-1')) or
-       (string.sub(tostring(qname), -21) == ".2.ghost.example.net." and posix.stat('drop-2'))
+    if (string.sub(tostring(qname), -20) == "1.ghost.example.net." and posix.stat('drop-1')) or
+       (string.sub(tostring(qname), -20) == "2.ghost.example.net." and posix.stat('drop-2'))
     then
         dnspacket:setRcode(pdns.NXDOMAIN)
         ret = {}
@@ -322,7 +322,7 @@ end
 function prequery ( dnspacket )
     i = i + 1
     qname, qtype = dnspacket:getQuestion()
-    if qtype == pdns.A and string.sub(tostring(qname), -25) == ".www.1.ghost.example.net."
+    if qtype == pdns.A and string.sub(tostring(qname), -24) == "www.1.ghost.example.net."
     then
         dnspacket:setRcode(pdns.NOERROR)
         ret = {}