From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Wed, 3 Jun 2020 14:31:57 +0000 (+0200)
Subject: More sophisticated cname loop detection.
X-Git-Tag: rec-4.3.2~7^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c23163c1b4bd4128bb9a64912977f8ea62eb6582;p=thirdparty%2Fpdns.git

More sophisticated cname loop detection.
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index adbdb72bc0..1c9e3a6ed7 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1325,9 +1325,20 @@ bool SyncRes::doCNAMECacheCheck(const DNSName &qname, const QType &qtype, vector
       }
 
       if (qname == newTarget) {
-        LOG(prefix<<qname<<": Got a CNAME referral (from cache) to self, returning SERVFAIL"<<endl);
-        res = RCode::ServFail;
-        return true;
+        string msg = "got a CNAME referral (from cache) to self";
+        LOG(prefix<<qname<<": "<<msg<<endl);
+        throw ImmediateServFailException(msg);
+      }
+
+      // Check to see if we already have seen the new target as a previous target
+      for (const auto &rec: ret) {
+        if (rec.d_type == QType::CNAME && rec.d_place == DNSResourceRecord::ANSWER) {
+          if (newTarget == rec.d_name) {
+            string msg = "got a CNAME referral (from cache) that causes a loop";
+            LOG(prefix<<qname<<": status="<<msg<<endl);
+            throw ImmediateServFailException(msg);
+          }
+        }
       }
 
       set<GetBestNSAnswer>beenthere;
@@ -3364,6 +3375,17 @@ bool SyncRes::processAnswer(unsigned int depth, LWResult& lwr, const DNSName& qn
       return true;
     }
 
+    // Check to see if we already have seen the new target as a previous target
+    for (const auto &record: ret) {
+      if (record.d_type == QType::CNAME && record.d_place == DNSResourceRecord::ANSWER) {
+        if (newtarget == record.d_name) {
+          LOG(prefix<<qname<<": status=got a CNAME referral that causes a loop, returning SERVFAIL"<<endl);
+          *rcode = RCode::ServFail;
+          return true;
+        }
+      }
+    }
+
     if (qtype == QType::DS) {
       LOG(prefix<<qname<<": status=got a CNAME referral, but we are looking for a DS"<<endl);