From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Wed, 3 Jun 2020 14:31:57 +0000 (+0200)
Subject: More sophisticated cname loop detection.
X-Git-Tag: dnsdist-1.5.0-rc3~17^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e7b2f95d4d8429c3f5008ccc6d857232291f7e66;p=thirdparty%2Fpdns.git

More sophisticated cname loop detection.
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 333c0d8c21..b6a3bf9d85 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1331,9 +1331,20 @@ bool SyncRes::doCNAMECacheCheck(const DNSName &qname, const QType &qtype, vector
       }
 
       if (qname == newTarget) {
-        LOG(prefix<<qname<<": Got a CNAME referral (from cache) to self, returning SERVFAIL"<<endl);
-        res = RCode::ServFail;
-        return true;
+        string msg = "got a CNAME referral (from cache) to self";
+        LOG(prefix<<qname<<": "<<msg<<endl);
+        throw ImmediateServFailException(msg);
+      }
+
+      // Check to see if we already have seen the new target as a previous target
+      for (const auto &rec: ret) {
+        if (rec.d_type == QType::CNAME && rec.d_place == DNSResourceRecord::ANSWER) {
+          if (newTarget == rec.d_name) {
+            string msg = "got a CNAME referral (from cache) that causes a loop";
+            LOG(prefix<<qname<<": status="<<msg<<endl);
+            throw ImmediateServFailException(msg);
+          }
+        }
       }
 
       set<GetBestNSAnswer>beenthere;
@@ -3379,6 +3390,17 @@ bool SyncRes::processAnswer(unsigned int depth, LWResult& lwr, const DNSName& qn
       return true;
     }
 
+    // Check to see if we already have seen the new target as a previous target
+    for (const auto &record: ret) {
+      if (record.d_type == QType::CNAME && record.d_place == DNSResourceRecord::ANSWER) {
+        if (newtarget == record.d_name) {
+          LOG(prefix<<qname<<": status=got a CNAME referral that causes a loop, returning SERVFAIL"<<endl);
+          *rcode = RCode::ServFail;
+          return true;
+        }
+      }
+    }
+
     if (qtype == QType::DS) {
       LOG(prefix<<qname<<": status=got a CNAME referral, but we are looking for a DS"<<endl);