From 0e11cd160de60726b0ee5007784781b68ec047df Mon Sep 17 00:00:00 2001 From: Wouter Wijngaards Date: Tue, 4 Sep 2007 12:44:43 +0000 Subject: [PATCH] DNAME synthesis and validation fixups. git-svn-id: file:///svn/unbound/trunk@584 be551aaa-1e26-0410-a405-d3ace91eadb9 --- doc/Changelog | 3 + services/cache/dns.c | 13 ++- testdata/03-testbound.tpkg | Bin 708 -> 833 bytes testdata/val_cnametopos.rpl | 177 ++++++++++++++++++++++++++++++ testdata/val_cnametoposnowc.rpl | 179 ++++++++++++++++++++++++++++++ testdata/val_cnametoposwc.rpl | 180 +++++++++++++++++++++++++++++++ testdata/val_cnamewctoposwc.rpl | 185 ++++++++++++++++++++++++++++++++ testdata/val_dnametopos.rpl | 181 +++++++++++++++++++++++++++++++ testdata/val_dnametoposwc.rpl | 183 +++++++++++++++++++++++++++++++ validator/val_utils.c | 13 ++- validator/validator.c | 3 + 11 files changed, 1112 insertions(+), 5 deletions(-) create mode 100644 testdata/val_cnametopos.rpl create mode 100644 testdata/val_cnametoposnowc.rpl create mode 100644 testdata/val_cnametoposwc.rpl create mode 100644 testdata/val_cnamewctoposwc.rpl create mode 100644 testdata/val_dnametopos.rpl create mode 100644 testdata/val_dnametoposwc.rpl diff --git a/doc/Changelog b/doc/Changelog index 3ca8db008..b639f60be 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -4,6 +4,9 @@ - testbound removes config file from /tmp on failed exit. - fixup for referral cleanup of the additional section. - tests for cname, referral validation. + - neater testbound tpkg output. + - DNAMEs no longer match their apex when synthesized from the cache. + - find correct signer name for DNAME responses. 3 September 2007: Wouter - Fixed error in iterator that would cause assertion failure in diff --git a/services/cache/dns.c b/services/cache/dns.c index 6f8f998a6..5d0c8cf4b 100644 --- a/services/cache/dns.c +++ b/services/cache/dns.c @@ -139,11 +139,18 @@ copy_rrset(struct ub_packed_rrset_key* key, struct region* region, /** find closest NS or DNAME and returns the rrset (locked) */ static struct ub_packed_rrset_key* find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, - uint16_t qclass, uint32_t now, uint16_t searchtype) + uint16_t qclass, uint32_t now, uint16_t searchtype, int stripfront) { struct ub_packed_rrset_key *rrset; uint8_t lablen; + if(stripfront) { + /* strip off so that DNAMEs have strict subdomain match */ + lablen = *qname; + qname += lablen + 1; + qnamelen -= lablen + 1; + } + /* snip off front part of qname until the type is found */ while(qnamelen > 0) { if((rrset = rrset_cache_lookup(env->rrset_cache, qname, @@ -324,7 +331,7 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname, struct delegpt* dp; nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, - LDNS_RR_TYPE_NS); + LDNS_RR_TYPE_NS, 0); if(!nskey) /* hope the caller has hints to prime or something */ return NULL; nsdata = (struct packed_rrset_data*)nskey->entry.data; @@ -560,7 +567,7 @@ dns_cache_lookup(struct module_env* env, * are more important, the CNAME is resynthesized and thus * consistent with the DNAME */ if( (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, - LDNS_RR_TYPE_DNAME))) { + LDNS_RR_TYPE_DNAME, 1))) { /* synthesize a DNAME+CNAME message based on this */ struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k); if(msg) { diff --git a/testdata/03-testbound.tpkg b/testdata/03-testbound.tpkg index f4dd01ea1ddc86623af36a9f5985127e91047826..55083daa38d8fcdc57547d73a0ce3850ede09640 100644 GIT binary patch literal 833 zc-jF$1HSwpiwFSpP2ENS1MQVj)`~k9P^6vgT9!a?!D@T=2(jtlMNJyvl^teR7 z->cq!cjvvL=DEJ#Z+HE^->$h{r`L09(EAtWa*smgTmsZ?(;`Rtu-&)D|EIY7_22DK z;ZtZ3ez*Hz{kv_S>fiIbRQ7JWL-qH&zE=bH3ADe-PhS65T;VxiU;tkip8bYWi8Kko zvt4$ADwHD2%Z|$;fsGyD5|bPxW--456=K4rNR`b-61lcN;W>rADiBU_0$v9^Kj`>@ z_X~{1SJ0+?z}|6@Fp3byUod3H0i$;@7P{0RpK>p=f7PAY|>kxh3gKTRcw>Y~w-f=@^?qhl(P z*-C2HVMk?Wh_Q>y@t~ol?FM@{d^;X2_zf~Kr5r>!hnfBhFP#XNPEy1%v|k>0M>?$p zO7qg-h|*@y!U$Rv4vwIuhqgE2bB3QpzU1-1rHnon0`ozm0eK2#^d-tks*tfNv8>2- zdODP&Lqt61&I?;+@exERtIv@~C@1FXna1rJbVAwtMTizb7)oWpFtae&O%(ra*y;XK`jSUEP-@$OWPj~nDiEA(vBU)}dswsziMujkc@ zv3k9fXaKx_3jnRHcmS;`uLi4QOpCELJsqC?IzD;Gw7yB9b zHl;7lI@mVPjkC^|o`^nq<^F=!%IGKhLKzGOgTY`h7z_r3!C){L3r$9aoC#i>+XTPY!dB%Ojlf3q$VoG1{b_oFCFZH3_0`j7 z%*vQuNTiQKk>3?1yI!4Zp4f49b0#u0F&A7ZOk;M&MOK-}f8CY0<2hQaNV}6%gM+kH+K>76LxlfZ}fznR4PT5v9SV$1{L1QEZACP28V=D5|LTWu= zO=Zo**u~}P;g*qhx7hjdm(#;3pCA)MszD@U7@1c%YNt4B=T(+L=V-_8nX+=2yU!hZ zR5sg9QrM>Lpaan_numrrsets; i++) { if(query_dname_compare(qinf->qname, @@ -211,6 +210,16 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf, } *signer_name = NULL; *signer_len = 0; + } else if(subtype == VAL_CLASS_CNAME) { + /* check for the first signed cname/dname rrset */ + for(i=skip; ian_numrrsets; i++) { + val_find_rrset_signer(rep->rrsets[i], + signer_name, signer_len); + if(signer_name) + return; + } + *signer_name = NULL; + *signer_len = 0; } else if(subtype == VAL_CLASS_NAMEERROR || subtype == VAL_CLASS_NODATA) { /*Check to see if the AUTH section NSEC record(s) have rrsigs*/ diff --git a/validator/validator.c b/validator/validator.c index 452c3130d..c10e18c7f 100644 --- a/validator/validator.c +++ b/validator/validator.c @@ -927,9 +927,12 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq, if(vq->signer_name == NULL) { lookup_name = vq->qchase.qname; lookup_len = vq->qchase.qname_len; + log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name, + 0, 0); } else { lookup_name = vq->signer_name; lookup_len = vq->signer_len; + log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0); } if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME || -- 2.47.2