supply on-wire error code for NSEC3 iteration limit

https://www.rfc-editor.org/rfc/rfc9276.html#section-6

$ kdig rezervujstul.cz NULL
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 17221
;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 4; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR
;; EDE: 27 (Unsupported NSEC3 Iterations Value): '5JBS'
[...]

diff --git a/NEWS b/NEWS
index dca74386432170a166679bbddf2a2b888ab8cc3f..1c57aa75089f283cb17494e17ab2679da450bfc2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ Knot Resolver 5.7.3 (2024-0m-dd)
 Improvements
 ------------
 - stats: add separate metrics for IPv6 and IPv4 (!1544)
+- supply on-wire error code for NSEC3 iteration limit (!1547)
+
 
 Knot Resolver 5.7.2 (2024-03-27)
 ================================

diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index af20b2e45871d51c613c17ab6d70a5ac7d9675bc..660b9171b22dc544b54faf5cecef46cc216db3c2 100644 (file)
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -141,6 +141,7 @@ do_downgrade: // we do this deep inside calls because of having signer name avai
        qry->flags.DNSSEC_INSECURE = true;
        rank_records(qry, true, KR_RANK_INSECURE, vctx->zone_name);
        mark_insecure_parents(qry);
+       kr_request_set_extended_error(qry->request, KNOT_EDNS_EDE_NSEC3_ITERS, "5JBS");
        return true;
 }
 

diff --git a/lib/resolve.c b/lib/resolve.c
index d8198c34b2873fb9a1a318ee93ed1b24ce6ba383..cda1d684e8a058f112e2c226af8951fc158980dd 100644 (file)
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -1687,6 +1687,7 @@ static int ede_priority(int info_code)
        case KNOT_EDNS_EDE_NREACH_AUTH:
        case KNOT_EDNS_EDE_NETWORK:
        case KNOT_EDNS_EDE_INV_DATA:
+       case KNOT_EDNS_EDE_NSEC3_ITERS:
                return 200;  /* Assorted codes */
        case KNOT_EDNS_EDE_OTHER:
                return 100;  /* Most generic catch-all error */

diff --git a/lib/resolve.h b/lib/resolve.h
index a2d5ec9dbd3b599f55141e538b198ccf9712bb19..28b719de8e96d0ee399cc7372839dc26766d3cd4 100644 (file)
--- a/lib/resolve.h
+++ b/lib/resolve.h
@@ -410,6 +410,10 @@ knot_mm_t *kr_resolve_pool(struct kr_request *request);
 KR_EXPORT
 int kr_request_set_extended_error(struct kr_request *request, int info_code, const char *extra_text);
 
+#if KNOT_VERSION_HEX < 0x030200
+       enum { KNOT_EDNS_EDE_NSEC3_ITERS = 27 };
+#endif
+
 static inline void kr_query_inform_timeout(struct kr_request *req, const struct kr_query *qry)
 {
        kr_request_set_extended_error(req, KNOT_EDNS_EDE_NREACH_AUTH, "RRPF");