Implement -T cookiealwaysvalid

When -T cookiealwaysvalid is passed to named, DNS cookie checks for
the incoming queries always pass, given they are structurally correct.

(cherry picked from commit 807ef8545d2e06c77826f3b2ac3f1cb7a7413dad)

diff --git a/bin/named/main.c b/bin/named/main.c
index 074936bbb46979d5cd482a74d2c63b50c56283eb..c35521ec2d62d0f2fdd94bd4cf1ca8dfb2ccccd3 100644 (file)
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -141,6 +141,7 @@ static int maxudp = 0;
 /*
  * -T options:
  */
+static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -781,7 +782,9 @@ parse_T_opt(char *option) {
         * dscp=x:     check that dscp values are as
         *             expected and assert otherwise.
         */
-       if (!strcmp(option, "dropedns")) {
+       if (!strcmp(option, "cookiealwaysvalid")) {
+               cookiealwaysvalid = true;
+       } else if (!strcmp(option, "dropedns")) {
                dropedns = true;
        } else if (!strncmp(option, "dscp=", 5)) {
                isc_dscp_check_value = atoi(option + 5);
@@ -1442,6 +1445,9 @@ setup(void) {
        /*
         * Modify server context according to command line options
         */
+       if (cookiealwaysvalid) {
+               ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
+       }
        if (disable4) {
                ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
        }

diff --git a/bin/tests/system/start.pl b/bin/tests/system/start.pl
index d593eb9fba00e72e7f5d10a47c0dede343760a3b..b013cdc1b2b9abf19f3fb313b2c2bffd845c4ff3 100755 (executable)
--- a/bin/tests/system/start.pl
+++ b/bin/tests/system/start.pl
@@ -264,7 +264,8 @@ sub construct_ns_command {
 
                foreach my $t_option(
                        "dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
-                       "noaa", "noedns", "nosoa", "maxudp512", "maxudp1460",
+                       "cookiealwaysvalid", "noaa", "noedns", "nosoa",
+                       "maxudp512", "maxudp1460",
                    ) {
                        if (-e "$testdir/$server/named.$t_option") {
                                $command .= "-T $t_option "

diff --git a/lib/ns/client.c b/lib/ns/client.c
index 2679a5e8d94363e967a9a49be2c6faa1f15ef08e..5f958fdf341480c1a60dc7a5a4bd899cbf71b716 100644 (file)
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1210,6 +1210,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
        uint32_t when;
        uint32_t nonce;
        isc_buffer_t db;
+       bool alwaysvalid;
 
        /*
         * If we have already seen a cookie option skip this cookie option.
@@ -1253,14 +1254,25 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
        when = isc_buffer_getuint32(buf);
        isc_buffer_forward(buf, 8);
 
+       /*
+        * For '-T cookiealwaysvalid' still process everything to not skew any
+        * performance tests involving cookies, but make sure that the cookie
+        * check passes in the end, given the cookie was structurally correct.
+        */
+       alwaysvalid = ns_server_getoption(client->manager->sctx,
+                                         NS_SERVER_COOKIEALWAYSVALID);
+
        /*
         * Allow for a 5 minute clock skew between servers sharing a secret.
         * Only accept COOKIE if we have talked to the client in the last hour.
         */
        isc_stdtime_get(&now);
-       if (isc_serial_gt(when, (now + 300)) || /* In the future. */
-           isc_serial_lt(when, (now - 3600)))
-       { /* In the past. */
+       if (alwaysvalid) {
+               now = when;
+       }
+       if (isc_serial_gt(when, (now + 300)) /* In the future. */ ||
+           isc_serial_lt(when, (now - 3600)) /* In the past. */)
+       {
                ns_stats_increment(client->sctx->nsstats,
                                   ns_statscounter_cookiebadtime);
                return;
@@ -1269,7 +1281,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
        isc_buffer_init(&db, dbuf, sizeof(dbuf));
        compute_cookie(client, when, nonce, client->sctx->secret, &db);
 
-       if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
+       if (isc_safe_memequal(old, dbuf, COOKIE_SIZE) || alwaysvalid) {
                ns_stats_increment(client->sctx->nsstats,
                                   ns_statscounter_cookiematch);
                client->attributes |= NS_CLIENTATTR_HAVECOOKIE;

diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
index e9bf93994c7ff7567c59444585631d9c09a9f057..f7b06c44c1eae50dbce8c580820a31eb0622b333 100644 (file)
--- a/lib/ns/include/ns/server.h
+++ b/lib/ns/include/ns/server.h
@@ -34,20 +34,21 @@
 
 #define NS_EVENT_CLIENTCONTROL (ISC_EVENTCLASS_NS + 0)
 
-#define NS_SERVER_LOGQUERIES   0x00000001U /*%< log queries */
-#define NS_SERVER_NOAA        0x00000002U /*%< -T noaa */
-#define NS_SERVER_NOSOA               0x00000004U /*%< -T nosoa */
-#define NS_SERVER_NONEAREST    0x00000008U /*%< -T nonearest */
-#define NS_SERVER_NOEDNS       0x00000020U /*%< -T noedns */
-#define NS_SERVER_DROPEDNS     0x00000040U /*%< -T dropedns */
-#define NS_SERVER_NOTCP               0x00000080U /*%< -T notcp */
-#define NS_SERVER_DISABLE4     0x00000100U /*%< -6 */
-#define NS_SERVER_DISABLE6     0x00000200U /*%< -4 */
-#define NS_SERVER_FIXEDLOCAL   0x00000400U /*%< -T fixedlocal */
-#define NS_SERVER_SIGVALINSECS 0x00000800U /*%< -T sigvalinsecs */
-#define NS_SERVER_EDNSFORMERR  0x00001000U /*%< -T ednsformerr (STD13) */
-#define NS_SERVER_EDNSNOTIMP   0x00002000U /*%< -T ednsnotimp */
-#define NS_SERVER_EDNSREFUSED  0x00004000U /*%< -T ednsrefused */
+#define NS_SERVER_LOGQUERIES       0x00000001U /*%< log queries */
+#define NS_SERVER_NOAA             0x00000002U /*%< -T noaa */
+#define NS_SERVER_NOSOA                    0x00000004U /*%< -T nosoa */
+#define NS_SERVER_NONEAREST        0x00000008U /*%< -T nonearest */
+#define NS_SERVER_NOEDNS           0x00000020U /*%< -T noedns */
+#define NS_SERVER_DROPEDNS         0x00000040U /*%< -T dropedns */
+#define NS_SERVER_NOTCP                    0x00000080U /*%< -T notcp */
+#define NS_SERVER_DISABLE4         0x00000100U /*%< -6 */
+#define NS_SERVER_DISABLE6         0x00000200U /*%< -4 */
+#define NS_SERVER_FIXEDLOCAL       0x00000400U /*%< -T fixedlocal */
+#define NS_SERVER_SIGVALINSECS     0x00000800U /*%< -T sigvalinsecs */
+#define NS_SERVER_EDNSFORMERR      0x00001000U /*%< -T ednsformerr (STD13) */
+#define NS_SERVER_EDNSNOTIMP       0x00002000U /*%< -T ednsnotimp */
+#define NS_SERVER_EDNSREFUSED      0x00004000U /*%< -T ednsrefused */
+#define NS_SERVER_COOKIEALWAYSVALID 0x00080000U /*%< -T cookiealwaysvalid */
 
 /*%
  * Type for callback function to get hostname.