From: Evan Hunt Date: Mon, 4 May 2026 05:00:39 +0000 (-0700) Subject: Clear dns64_aaaaok immediately after use X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d42b3e7b91015ccfb455e27de20adf985ab14ec6;p=thirdparty%2Fbind9.git Clear dns64_aaaaok immediately after use The DNS64 state information stored in client->query.dns64_aaaaok could cause an assertion failure in query_respond() if the server was configured in such a way as to trigger a new recursion before the query had been reset - for example, by using the filter-aaaa plugin, which may need to recurse to find out whether an A record exists. This has been addressed by clearing DNS64 state information immediately after the call to query_filter64(). (cherry picked from commit 7213b038f0beb2f4750b858113af1f9e18ae0520) --- diff --git a/bin/tests/system/filters/ns1/unsigned.db b/bin/tests/system/filters/ns1/unsigned.db index 2fc656e0ec5..a7968e1cb64 100644 --- a/bin/tests/system/filters/ns1/unsigned.db +++ b/bin/tests/system/filters/ns1/unsigned.db @@ -23,3 +23,8 @@ dual A 1.0.0.6 dual AAAA 2001:db8::6 mx A 1.0.0.3 mx AAAA 2001:db8::3 + +; one of these AAAA addresses is excluded in named.conf +excludeone A 1.0.0.6 +excludeone AAAA ::1 +excludeone AAAA 2001:db8::6 diff --git a/bin/tests/system/filters/ns4/unsigned.db b/bin/tests/system/filters/ns4/unsigned.db index d2aced2f2a4..ef38ced877c 100644 --- a/bin/tests/system/filters/ns4/unsigned.db +++ b/bin/tests/system/filters/ns4/unsigned.db @@ -23,3 +23,8 @@ dual A 1.0.0.6 dual AAAA 2001:db8::6 mx A 1.0.0.3 mx AAAA 2001:db8::3 + +; one of these AAAA addresses is excluded in named.conf +excludeone A 1.0.0.6 +excludeone AAAA ::1 +excludeone AAAA 2001:db8::6 diff --git a/bin/tests/system/filters/ns5/named.conf.j2 b/bin/tests/system/filters/ns5/named.conf.j2 index 36380cd3215..37cb8d3fbbe 100644 --- a/bin/tests/system/filters/ns5/named.conf.j2 +++ b/bin/tests/system/filters/ns5/named.conf.j2 @@ -23,9 +23,9 @@ options { dnssec-validation no; notify yes; dns64 64:ff9b::/96 { - clients { any; }; - exclude { any; }; - mapped { any; }; + clients { any; }; + exclude { ::1/128; }; + mapped { any; }; }; minimal-responses no; }; diff --git a/bin/tests/system/filters/tests_filter_dns64.py b/bin/tests/system/filters/tests_filter_dns64.py index dfa71b76c1d..2f5409ddfd3 100644 --- a/bin/tests/system/filters/tests_filter_dns64.py +++ b/bin/tests/system/filters/tests_filter_dns64.py @@ -25,3 +25,7 @@ def test_filter_dns64(): msg = isctest.query.create("aaaa-only.unsigned", "aaaa") res = isctest.query.tcp(msg, "10.53.0.5") isctest.check.noerror(res) + + msg = isctest.query.create("excludeone.unsigned", "aaaa") + res = isctest.query.tcp(msg, "10.53.0.5") + isctest.check.noerror(res) diff --git a/lib/ns/query.c b/lib/ns/query.c index 39306d1dc4a..231ad9f8478 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -8250,6 +8250,10 @@ query_addanswer(query_ctx_t *qctx) { } else if (qctx->client->query.dns64_aaaaok != NULL) { query_filter64(qctx); ns_client_putrdataset(qctx->client, &qctx->rdataset); + isc_mem_cput(qctx->client->manager->mctx, + qctx->client->query.dns64_aaaaok, + qctx->client->query.dns64_aaaaoklen, sizeof(bool)); + qctx->client->query.dns64_aaaaoklen = 0; } else { if (!qctx->is_zone && RECURSIONOK(qctx->client)) { query_prefetch(qctx->client, qctx->fname,