a CNAME won't necessarily cause a loop for an at-parent type (e.g. DS)

- deadlock detection is now relaxed for at-parent types
- added a test for this scenario

diff --git a/CHANGES b/CHANGES
index 85d4d32c185de8dc5161a1aa3e74e2f7534df7ac..8930536663c73a57e1e2a277be690cc0a867e69d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4904.  [bug]           Validation could fail for unsigned domains if there
+                       was a CNAME at the domain apex. [GL #124]
+
 4903.  [bug]           "check-mx fail;" did not prevent MX records containing
                        IP addresses from being added to a zone by a dynamic
                        update. [GL #112]

diff --git a/bin/tests/system/dnssec/ans8/ans.pl b/bin/tests/system/dnssec/ans8/ans.pl
new file mode 100644 (file)
index 0000000..589a2be
--- /dev/null
+++ b/bin/tests/system/dnssec/ans8/ans.pl
@@ -0,0 +1,68 @@
+#!/usr/bin/perl
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+use IO::File;
+use IO::Socket;
+use Net::DNS;
+use Net::DNS::Packet;
+
+my $localport = int($ENV{'PORT'});
+if (!$localport) { $localport = 5300; }
+
+my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.8",
+   LocalPort => $localport, Proto => "udp") or die "$!";
+
+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+print $pidf "$$\n" or die "cannot write pid file: $!";
+$pidf->close or die "cannot close pid file: $!";
+sub rmpid { unlink "ans.pid"; exit 1; };
+
+$SIG{INT} = \&rmpid;
+$SIG{TERM} = \&rmpid;
+
+for (;;) {
+       $sock->recv($buf, 512);
+
+       print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
+
+       my $packet;
+
+       if ($Net::DNS::VERSION > 0.68) {
+               $packet = new Net::DNS::Packet(\$buf, 0);
+               $@ and die $@;
+       } else {
+               my $err;
+               ($packet, $err) = new Net::DNS::Packet(\$buf, 0);
+               $err and die $err;
+       }
+
+       print "REQUEST:\n";
+       $packet->print;
+
+       $packet->header->qr(1);
+       $packet->header->aa(1);
+
+       my @questions = $packet->question;
+       my $qname = $questions[0]->qname;
+
+       if ($qname eq "x.y.z.sub.apex-cname") {
+               $packet->push("answer", new Net::DNS::RR("$qname 300 A 1.2.3.4"));
+       } else {
+               $packet->push("answer",
+                             new Net::DNS::RR("$qname 300 CNAME x.y.z.sub.apex-cname"));
+       }
+
+       $sock->send($packet->data);
+
+       print "RESPONSE:\n";
+       $packet->print;
+       print "\n";
+}

diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index 6a97a0b46635700228c5fb255eadb7cb2140816c..a042fd2bf95653450ef87a5be1bba551c8f41917 100644 (file)
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -7,15 +7,13 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-; $Id: root.db.in,v 1.12 2010/11/17 23:47:08 tbox Exp $
-
 $TTL 300
-.                      IN SOA  gson.nominum.com. a.root.servers.nil. (
-                               2000042100      ; serial
-                               600             ; refresh
-                               600             ; retry
-                               1200            ; expire
-                               600             ; minimum
+.                      IN SOA  gson.nominum.com. a.root.servers.nil. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               600             ; minimum
                                )
 .                      NS      a.root-servers.nil.
 a.root-servers.nil.    A       10.53.0.1
@@ -29,3 +27,5 @@ ns2.algroll.          A       10.53.0.2
 optout-tld             NS      ns6.optout-tld.
 ns6.optout-tld.                A       10.53.0.6
 in-addr.arpa.          NS      ns2.example.
+apex-cname.            NS      ns8.apex-cname.
+ns8.apex-cname.                A       10.53.0.8

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 7a628c9650a0c9f1947ebd369aeb06db9a3adaf6..fd3fe02d71feebe820817d9ea8194ca4c8949538 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -3404,5 +3404,13 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "check that apex CNAME in an insecure zone does not abort validation ($n)"
+ret=0
+$DIG $DIGOPTS apex-cname a @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep SERVFAIL dig.out.ns4.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index dae01a0442f839acbb3f4e861bc81be35b53a278..daa4875dcc9ee927f3fb585962de0c1d9e9bc3f1 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -157,6 +157,12 @@
          <command>dnstap</command> log file. [RT #46942]
        </para>
       </listitem>
+      <listitem>
+       <para>
+         Validation could fail for unsigned domains if there was a
+         CNAME at the domain apex. [GL #124]
+       </para>
+      </listitem>
     </itemizedlist>
   </section>
 

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 212524e9af71f1b1ebdb3b85bb083d0d7c42616a..b6e0f1eb4d07ee744ed1c9419d91cbe0e4207465 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1104,7 +1104,8 @@ check_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
        for (parent = val; parent != NULL; parent = parent->parent) {
                if (parent->event != NULL &&
                    (parent->event->type == type ||
-                    parent->event->type == dns_rdatatype_cname) &&
+                    (parent->event->type == dns_rdatatype_cname &&
+                     !dns_rdatatype_atparent(type))) &&
                    dns_name_equal(parent->event->name, name) &&
                    /*
                     * As NSEC3 records are meta data you sometimes