Clear dns64_aaaaok immediately after use

The DNS64 state information stored in client->query.dns64_aaaaok
could cause an assertion failure in query_respond() if the server
was configured in such a way as to trigger a new recursion before
the query had been reset - for example, by using the filter-aaaa
plugin, which may need to recurse to find out whether an A record
exists.

This has been addressed by clearing DNS64 state information
immediately after the call to query_filter64().

(cherry picked from commit 7213b038f0beb2f4750b858113af1f9e18ae0520)

diff --git a/bin/tests/system/filters/ns1/unsigned.db b/bin/tests/system/filters/ns1/unsigned.db
index 2fc656e0ec5194576379296ab004a01c0598c007..a7968e1cb64ad2d0d7e2b3b13e5363e24c17381d 100644 (file)
--- a/bin/tests/system/filters/ns1/unsigned.db
+++ b/bin/tests/system/filters/ns1/unsigned.db
@@ -23,3 +23,8 @@ dual          A       1.0.0.6
 dual           AAAA    2001:db8::6
 mx             A       1.0.0.3
 mx             AAAA    2001:db8::3
+
+; one of these AAAA addresses is excluded in named.conf
+excludeone     A       1.0.0.6
+excludeone     AAAA    ::1
+excludeone     AAAA    2001:db8::6

diff --git a/bin/tests/system/filters/ns4/unsigned.db b/bin/tests/system/filters/ns4/unsigned.db
index d2aced2f2a453da7fb35fe8f4516124b2299a1ca..ef38ced877c6f52b22e3c81662e246028de3c91b 100644 (file)
--- a/bin/tests/system/filters/ns4/unsigned.db
+++ b/bin/tests/system/filters/ns4/unsigned.db
@@ -23,3 +23,8 @@ dual          A       1.0.0.6
 dual           AAAA    2001:db8::6
 mx             A       1.0.0.3
 mx             AAAA    2001:db8::3
+
+; one of these AAAA addresses is excluded in named.conf
+excludeone     A       1.0.0.6
+excludeone     AAAA    ::1
+excludeone     AAAA    2001:db8::6

diff --git a/bin/tests/system/filters/ns5/named.conf.j2 b/bin/tests/system/filters/ns5/named.conf.j2
index 36380cd3215b9cb3d7ccd132a0dc9bf387f22b77..37cb8d3fbbea494c5b986a309f7a58d338a31fae 100644 (file)
--- a/bin/tests/system/filters/ns5/named.conf.j2
+++ b/bin/tests/system/filters/ns5/named.conf.j2
@@ -23,9 +23,9 @@ options {
        dnssec-validation no;
        notify yes;
        dns64 64:ff9b::/96 {
-                           clients { any; };
-                           exclude { any; };
-                           mapped { any; };
+               clients { any; };
+               exclude { ::1/128; };
+               mapped { any; };
        };
        minimal-responses no;
 };

diff --git a/bin/tests/system/filters/tests_filter_dns64.py b/bin/tests/system/filters/tests_filter_dns64.py
index dfa71b76c1d3b93398ac4b60fc029a979d7b712e..2f5409ddfd312bea1d0cbf800fa849879b73768e 100644 (file)
--- a/bin/tests/system/filters/tests_filter_dns64.py
+++ b/bin/tests/system/filters/tests_filter_dns64.py
@@ -25,3 +25,7 @@ def test_filter_dns64():
     msg = isctest.query.create("aaaa-only.unsigned", "aaaa")
     res = isctest.query.tcp(msg, "10.53.0.5")
     isctest.check.noerror(res)
+
+    msg = isctest.query.create("excludeone.unsigned", "aaaa")
+    res = isctest.query.tcp(msg, "10.53.0.5")
+    isctest.check.noerror(res)

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 39306d1dc4aa4402e2364f669ead4416a46b9b58..231ad9f8478a39b6b73e8674bbd244668a5571d2 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -8250,6 +8250,10 @@ query_addanswer(query_ctx_t *qctx) {
        } else if (qctx->client->query.dns64_aaaaok != NULL) {
                query_filter64(qctx);
                ns_client_putrdataset(qctx->client, &qctx->rdataset);
+               isc_mem_cput(qctx->client->manager->mctx,
+                            qctx->client->query.dns64_aaaaok,
+                            qctx->client->query.dns64_aaaaoklen, sizeof(bool));
+               qctx->client->query.dns64_aaaaoklen = 0;
        } else {
                if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
                        query_prefetch(qctx->client, qctx->fname,