Remove IDNA2003 fallback from dig

Certain characters, like symbols, are allowed by IDNA2003, but not by
IDNA2008.  Make dig reject such symbols when IDN input processing is
enabled to ensure BIND only supports IDNA2008.  Update the "idna" system
test so that it uses one of such symbols rather than one which is
disallowed by both IDNA2003 and IDNA2008.

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 3d59b4a80fe2df90d1f8b6625dacd19419189b17..6d0c9b86e2ee7f030843a416883730b5e2795084 100644 (file)
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -4258,10 +4258,6 @@ idn_locale_to_ace(const char *from, char *to, size_t tolen) {
        char *tmp_str = NULL;
 
        res = idn2_to_ascii_lz(from, &tmp_str, IDN2_NONTRANSITIONAL|IDN2_NFC_INPUT);
-       if (res == IDN2_DISALLOWED) {
-               res = idn2_to_ascii_lz(from, &tmp_str, IDN2_TRANSITIONAL|IDN2_NFC_INPUT);
-       }
-
        if (res == IDN2_OK) {
                /*
                 * idn2_to_ascii_lz() normalizes all strings to lowerl case,
@@ -4291,7 +4287,7 @@ idn_locale_to_ace(const char *from, char *to, size_t tolen) {
                return ISC_R_SUCCESS;
        }
 
-       fatal("'%s' is not a legal IDN name (%s), use +noidnin", from, idn2_strerror(res));
+       fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin", from, idn2_strerror(res));
        return ISC_R_FAILURE;
 }
 
@@ -4316,7 +4312,7 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
                return ISC_R_SUCCESS;
        }
 
-       fatal("'%s' is not a legal IDN name (%s), use +noidnout", from, idn2_strerror(res));
+       fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnout", from, idn2_strerror(res));
        return ISC_R_FAILURE;
 }
 #endif /* HAVE_LIBIDN2 */

diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
index 3a9b91b4422ef0d6af62a933782505c646482cfa..d7a968306a4b31542f57783206db6b7e81f6b364 100644 (file)
--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
@@ -339,7 +339,8 @@ idna_enabled_test() {
 
     # Tests of a valid unicode string but an invalid U-label
     #
-    # Symbols are not valid IDNA names.
+    # Symbols are not valid IDNA2008 names.  Check whether dig rejects them to
+    # ensure no IDNA2003 fallbacks are in place.
     #
     # +noidnin: "dig" should send unicode octets to the server and display the
     #           returned qname in the same form.
@@ -348,11 +349,11 @@ idna_enabled_test() {
     # The +[no]idnout options should not have any effect on the test.
 
     text="Checking invalid U-label"
-    idna_fail "$text" ""                   "🧦.com"
-    idna_test "$text" "+noidnin +noidnout" "🧦.com" "\240\159\167\166.com."
-    idna_test "$text" "+noidnin +idnout"   "🧦.com" "\240\159\167\166.com."
-    idna_fail "$text" "+idnin   +noidnout" "🧦.com"
-    idna_fail "$text" "+idnin   +idnout"   "🧦.com"
+    idna_fail "$text" ""                   "√.com"
+    idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
+    idna_test "$text" "+noidnin +idnout"   "√.com" "\226\136\154.com."
+    idna_fail "$text" "+idnin   +noidnout" "√.com"
+    idna_fail "$text" "+idnin   +idnout"   "√.com"
 }