From: Mark Andrews Date: Sun, 5 Jul 2015 23:44:24 +0000 (+1000) Subject: 4152. [func] Implement DNS COOKIE option. This replaces the X-Git-Tag: v9.11.0a1~687 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ce67023ae3ad39a77da5361d0187ab6f3f0219cb;p=thirdparty%2Fbind9.git 4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928] --- diff --git a/CHANGES b/CHANGES index 8d0760ac51b..1756f1b3265 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,10 @@ +4152. [func] Implement DNS COOKIE option. This replaces the + experimental SIT option of BIND 9.10. The following + named.conf directives are avaliable: send-cookie, + cookie-secret, cookie-algorithm and nocookie-udp-size. + The following dig options are available: + +[no]cookie[=value] and +[no]badcookie. [RT #39928] + 4151. [bug] 'rndc flush' could cause a deadlock. [RT #39835] 4150. [bug] win32: listen-on-v6 { any; }; was not working. Apply diff --git a/bin/dig/dig.c b/bin/dig/dig.c index dbf84ddc48b..6cd7cd7f317 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -35,6 +35,7 @@ #include #include #include +#include #include #include #include @@ -61,9 +62,7 @@ static char *argv0; static int addresscount = 0; static char domainopt[DNS_NAME_MAXTEXT]; -#ifdef ISC_PLATFORM_USESIT -static char sitvalue[256]; -#endif +static char hexcookie[81]; static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE, ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE, @@ -92,43 +91,21 @@ static const char * const opcodetext[] = { "RESERVED15" }; -/*% return code text */ -static const char * const rcodetext[] = { - "NOERROR", - "FORMERR", - "SERVFAIL", - "NXDOMAIN", - "NOTIMP", - "REFUSED", - "YXDOMAIN", - "YXRRSET", - "NXRRSET", - "NOTAUTH", - "NOTZONE", - "RESERVED11", - "RESERVED12", - "RESERVED13", - "RESERVED14", - "RESERVED15", - "BADVERS" -}; +static const char * +rcode_totext(dns_rcode_t rcode) { + static char buf[64]; + isc_buffer_t b; + isc_result_t result; -/*% safe rcodetext[] */ -static char * -rcode_totext(dns_rcode_t rcode) -{ - static char buf[sizeof("?65535")]; - union { - const char *consttext; - char *deconsttext; - } totext; - - if (rcode >= (sizeof(rcodetext)/sizeof(rcodetext[0]))) { - snprintf(buf, sizeof(buf), "?%u", rcode); - totext.deconsttext = buf; - } else - totext.consttext = rcodetext[rcode]; - return totext.deconsttext; + memset(buf, 0, sizeof(buf)); + isc_buffer_init(&b, buf + 1, sizeof(buf) - 2); + result = dns_rcode_totext(rcode, &b); + RUNTIME_CHECK(result == ISC_R_SUCCESS); + if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) { + buf[0] = '?'; + return(buf); + } + return (buf + 1); } /*% print usage */ @@ -233,9 +210,8 @@ help(void) { " +[no]expire (Request time to expire)\n" " +[no]nsid (Request Name Server ID)\n" " +[no]header-only (Send query without a question section)\n" -#ifdef ISC_PLATFORM_USESIT -" +[no]sit (Request a Source Identity Token)\n" -#endif +" +[no]badcookie (Retry BADCOOKIE responses)\n" +" +[no]cookie (Add a COOKIE option to the request)\n" #ifdef DIG_SIGCHASE " +[no]sigchase (Chase DNSSEC signatures)\n" " +trusted-key=#### (Trusted Key when chasing DNSSEC sigs)\n" @@ -767,9 +743,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, char *cmd, *value, *ptr, *code; isc_uint32_t num; isc_boolean_t state = ISC_TRUE; -#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT) size_t n; -#endif strncpy(option_store, option, sizeof(option_store)); option_store[sizeof(option_store)-1]=0; @@ -846,6 +820,10 @@ plus_option(char *option, isc_boolean_t is_batchfile, break; case 'b': switch (cmd[1]) { + case 'a':/* badcookie */ + FULLCHECK("badcookie"); + lookup->besteffort = state; + break; case 'e':/* besteffort */ FULLCHECK("besteffort"); lookup->besteffort = state; @@ -889,10 +867,30 @@ plus_option(char *option, isc_boolean_t is_batchfile, printcmd = state; break; case 'o': /* comments */ - FULLCHECK("comments"); - lookup->comments = state; - if (lookup == default_lookup) - pluscomm = state; + switch (cmd[2]) { + case 'm': + FULLCHECK("comments"); + lookup->comments = state; + if (lookup == default_lookup) + pluscomm = state; + break; + case 'o': /* cookie */ + FULLCHECK("cookie"); + if (state && lookup->edns == -1) + lookup->edns = 0; + lookup->sendcookie = state; + if (value != NULL) { + n = strlcpy(hexcookie, value, + sizeof(hexcookie)); + if (n >= sizeof(hexcookie)) + fatal("COOKIE data too large"); + lookup->cookie = hexcookie; + } else + lookup->cookie = NULL; + break; + default: + goto invalid_option; + } break; case 'r': FULLCHECK("crypto"); @@ -1222,36 +1220,12 @@ plus_option(char *option, isc_boolean_t is_batchfile, goto invalid_option; } break; -#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT) - case 'i': - switch (cmd[2]) { #ifdef DIG_SIGCHASE - case 'g': /* sigchase */ - FULLCHECK("sigchase"); - lookup->sigchase = state; - if (lookup->sigchase) - lookup->dnssec = ISC_TRUE; - break; -#endif -#ifdef ISC_PLATFORM_USESIT - case 't': /* sit */ - FULLCHECK("sit"); - if (state && lookup->edns == -1) - lookup->edns = 0; - lookup->sit = state; - if (value != NULL) { - n = strlcpy(sitvalue, value, - sizeof(sitvalue)); - if (n >= sizeof(sitvalue)) - fatal("SIT data too large"); - lookup->sitvalue = sitvalue; - } else - lookup->sitvalue = NULL; - break; -#endif - default: - goto invalid_option; - } + case 'i': /* sigchase */ + FULLCHECK("sigchase"); + lookup->sigchase = state; + if (lookup->sigchase) + lookup->dnssec = ISC_TRUE; break; #endif case 'p': /* split */ @@ -1353,6 +1327,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->section_authority = ISC_TRUE; lookup->section_question = ISC_FALSE; lookup->dnssec = ISC_TRUE; + lookup->sendcookie = ISC_TRUE; usesearch = ISC_FALSE; } break; @@ -1789,6 +1764,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, default_lookup = make_empty_lookup(); default_lookup->adflag = ISC_TRUE; default_lookup->edns = 0; + default_lookup->sendcookie = ISC_TRUE; #ifndef NOPOSIX /* diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index 91a179d9e43..502802cd1d9 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -219,49 +219,49 @@ - -4 - + -4 + Use IPv4 only. - + - -6 - + -6 + Use IPv6 only. - + - -b address#port - + -b address#port + Set the source IP address of the query. The address must be a valid address on one of the host's network interfaces, or "0.0.0.0" or "::". An optional port may be specified by appending "#<port>" - + - -c class - + -c class + Set the query class. The default class is IN; other classes are HS for Hesiod records or CH for Chaosnet records. - + - -f file - + -f file + Batch mode: dig reads a list of lookup requests to process from the @@ -270,23 +270,23 @@ presented as queries to dig using the command-line interface. - + - -i - + -i + Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT domain, which is no longer in use. Obsolete bit string label queries (RFC2874) are not attempted. - + - -k keyfile - + -k keyfile + Sign queries using TSIG using a key read from the given file. Key files can be generated using @@ -300,45 +300,45 @@ and server statements in named.conf. - + - -m - + -m + Enable memory usage debugging. - + - -p port - + -p port + Send the query to a non-standard port on the server, instead of the defaut port 53. This option would be used to test a name server that has been configured to listen for queries on a non-standard port number. - + - -q name - + -q name + The domain name to query. This is useful to distinguish the name from other arguments. - + - -t type - + -t type + The resource record type to query. It can be any valid query type which is @@ -352,21 +352,21 @@ record was N. - + - -v - + -v + Print the version number and exit. - + - -x addr - + -x addr + Simplified reverse lookups, for mapping addresses to names. The addr is an IPv4 address @@ -383,12 +383,12 @@ IP6.ARPA domain (but see also the option). - + - -y hmac:keyname:secret - + -y hmac:keyname:secret + Sign queries using TSIG with the given authentication key. keyname is the name of the key, and @@ -407,11 +407,11 @@ a command line argument in clear text. This may be visible in the output from - ps1 + ps1 or in a history file maintained by the user's shell. - + @@ -517,6 +517,16 @@ + + + + + Retry lookup with the new server cookie if a + BADCOOKIE response is received. + + + + @@ -585,6 +595,23 @@ + + + + + Send a COOKIE EDNS option, with optional + value. Replaying a COOKIE from a previous response will + allow the server to identify a previous client. The + default is . + + + +cookie is also set when +trace + is set to better emulate the default queries from a + nameserver. + + + + @@ -952,19 +979,6 @@ - - - - - Send a Source Identity Token EDNS option, with optional - value. Replaying a SIT from a previous response will - allow the server to identify a previous client. The - default is . Currently using - experimental value 65001 for the option code. - - - - diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 88ed663924e..0336dcb90d6 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -149,9 +149,7 @@ int ndots = -1; int tries = 3; int lookup_counter = 0; -#ifdef ISC_PLATFORM_USESIT -static char sitvalue[256]; -#endif +static char servercookie[256]; #ifdef WITH_IDN static void initialize_idn(void); @@ -792,9 +790,9 @@ make_empty_lookup(void) { looknew->expire = ISC_FALSE; looknew->nsid = ISC_FALSE; looknew->header_only = ISC_FALSE; -#ifdef ISC_PLATFORM_USESIT - looknew->sit = ISC_FALSE; -#endif + looknew->sendcookie = ISC_FALSE; + looknew->seenbadcookie = ISC_FALSE; + looknew->badcookie = ISC_TRUE; #ifdef DIG_SIGCHASE looknew->sigchase = ISC_FALSE; #if DIG_SIGCHASE_TD @@ -833,9 +831,7 @@ make_empty_lookup(void) { looknew->done_as_is = ISC_FALSE; looknew->need_search = ISC_FALSE; looknew->ecs_addr = NULL; -#ifdef ISC_PLATFORM_USESIT - looknew->sitvalue = NULL; -#endif + looknew->cookie = NULL; looknew->ednsopts = NULL; looknew->ednsoptscnt = 0; looknew->ednsneg = ISC_TRUE; @@ -891,10 +887,10 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->expire = lookold->expire; looknew->nsid = lookold->nsid; looknew->header_only = lookold->header_only; -#ifdef ISC_PLATFORM_USESIT - looknew->sit = lookold->sit; - looknew->sitvalue = lookold->sitvalue; -#endif + looknew->sendcookie = lookold->sendcookie; + looknew->seenbadcookie = lookold->seenbadcookie; + looknew->badcookie = lookold->badcookie; + looknew->cookie = lookold->cookie; looknew->ednsopts = lookold->ednsopts; looknew->ednsoptscnt = lookold->ednsoptscnt; looknew->ednsneg = lookold->ednsneg; @@ -1575,7 +1571,7 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) { /*% * Add EDNS0 option record to a message. Currently, the only supported * options are UDP buffer size, the DO bit, and EDNS options - * (e.g., NSID, SIT, client-subnet) + * (e.g., NSID, COOKIE, client-subnet) */ static void add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns, @@ -2174,14 +2170,12 @@ insert_soa(dig_lookup_t *lookup) { dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY); } -#ifdef ISC_PLATFORM_USESIT static void compute_cookie(unsigned char *clientcookie, size_t len) { /* XXXMPA need to fix, should be per server. */ INSIST(len >= 8U); memmove(clientcookie, cookie_secret, 8); } -#endif /*% * Setup the supplied lookup structure, making it ready to start sending @@ -2200,9 +2194,7 @@ setup_lookup(dig_lookup_t *lookup) { dns_compress_t cctx; char store[MXNAME]; char ecsbuf[20]; -#ifdef ISC_PLATFORM_USESIT - char sitbuf[256]; -#endif + char cookiebuf[256]; #ifdef WITH_IDN idn_result_t mr; char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME]; @@ -2534,13 +2526,13 @@ setup_lookup(dig_lookup_t *lookup) { i++; } -#ifdef ISC_PLATFORM_USESIT - if (lookup->sit) { + if (lookup->sendcookie) { INSIST(i < DNS_EDNSOPTIONS); - opts[i].code = DNS_OPT_SIT; - if (lookup->sitvalue != NULL) { - isc_buffer_init(&b, sitbuf, sizeof(sitbuf)); - result = isc_hex_decodestring(lookup->sitvalue, + opts[i].code = DNS_OPT_COOKIE; + if (lookup->cookie != NULL) { + isc_buffer_init(&b, cookiebuf, + sizeof(cookiebuf)); + result = isc_hex_decodestring(lookup->cookie, &b); check_result(result, "isc_hex_decodestring"); opts[i].value = isc_buffer_base(&b); @@ -2552,7 +2544,6 @@ setup_lookup(dig_lookup_t *lookup) { } i++; } -#endif if (lookup->expire) { INSIST(i < DNS_EDNSOPTIONS); @@ -3411,56 +3402,53 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg, return (ISC_TRUE); } -#ifdef ISC_PLATFORM_USESIT static void -process_sit(dig_lookup_t *l, dns_message_t *msg, - isc_buffer_t *optbuf, size_t optlen) +process_cookie(dig_lookup_t *l, dns_message_t *msg, + isc_buffer_t *optbuf, size_t optlen) { char bb[256]; isc_buffer_t hexbuf; size_t len; - const unsigned char *sit; - isc_boolean_t copysit; + const unsigned char *sent; + isc_boolean_t copy = ISC_TRUE; isc_result_t result; - if (l->sitvalue != NULL) { + if (l->cookie != NULL) { isc_buffer_init(&hexbuf, bb, sizeof(bb)); - result = isc_hex_decodestring(l->sitvalue, &hexbuf); + result = isc_hex_decodestring(l->cookie, &hexbuf); check_result(result, "isc_hex_decodestring"); - sit = isc_buffer_base(&hexbuf); + sent = isc_buffer_base(&hexbuf); len = isc_buffer_usedlength(&hexbuf); - copysit = ISC_FALSE; } else { - sit = cookie; + sent = cookie; len = sizeof(cookie); - copysit = ISC_TRUE; } - INSIST(msg->sitok == 0 && msg->sitbad == 0); + INSIST(msg->cc_ok == 0 && msg->cc_bad == 0); if (optlen >= len && optlen >= 8U) { - if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) { - msg->sitok = 1; + if (memcmp(isc_buffer_current(optbuf), sent, 8) == 0) { + msg->cc_ok = 1; } else { - printf(";; Warning: SIT client cookie mismatch\n"); - msg->sitbad = 1; - copysit = ISC_FALSE; + printf(";; Warning: Client COOKIE mismatch\n"); + msg->cc_bad = 1; + copy = ISC_FALSE; } } else { - printf(";; Warning: SIT bad token (too short)\n"); - msg->sitbad = 1; - copysit = ISC_FALSE; + printf(";; Warning: COOKIE bad token (too short)\n"); + msg->cc_bad = 1; + copy = ISC_FALSE; } - if (copysit) { + if (copy) { isc_region_t r; r.base = isc_buffer_current(optbuf); r.length = (unsigned int)optlen; - isc_buffer_init(&hexbuf, sitvalue, sizeof(sitvalue)); + isc_buffer_init(&hexbuf, servercookie, sizeof(servercookie)); result = isc_hex_totext(&r, 2, "", &hexbuf); check_result(result, "isc_hex_totext"); if (isc_buffer_availablelength(&hexbuf) > 0) { isc_buffer_putuint8(&hexbuf, 0); - l->sitvalue = sitvalue; + l->cookie = servercookie; } } isc_buffer_forward(optbuf, (unsigned int)optlen); @@ -3484,8 +3472,8 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) { optcode = isc_buffer_getuint16(&optbuf); optlen = isc_buffer_getuint16(&optbuf); switch (optcode) { - case DNS_OPT_SIT: - process_sit(l, msg, &optbuf, optlen); + case DNS_OPT_COOKIE: + process_cookie(l, msg, &optbuf, optlen); break; default: isc_buffer_forward(&optbuf, optlen); @@ -3494,7 +3482,6 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) { } } } -#endif static int ednsvers(dns_rdataset_t *opt) { @@ -3782,10 +3769,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { } if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 && !l->ignore && !l->tcp_mode) { -#ifdef ISC_PLATFORM_USESIT - if (l->sitvalue == NULL && l->sit && msg->opt != NULL) + if (l->cookie == NULL && l->sendcookie && msg->opt != NULL) process_opt(l, msg); -#endif if (l->comments) printf(";; Truncated, retrying in TCP mode.\n"); n = requeue_lookup(l, ISC_TRUE); @@ -3799,6 +3784,27 @@ recv_done(isc_task_t *task, isc_event_t *event) { UNLOCK_LOOKUP; return; } + if (msg->rcode == dns_rcode_badcookie && !l->tcp_mode && + l->sendcookie && l->badcookie) { + process_opt(l, msg); + if (msg->cc_ok) { + if (l->comments) + printf(";; BADCOOKIE, retrying%s.\n", + l->seenbadcookie ? " in TCP mode" : ""); + n = requeue_lookup(l, ISC_TRUE); + if (l->seenbadcookie) + n->tcp_mode = ISC_TRUE; + n->seenbadcookie = ISC_TRUE; + n->origin = query->lookup->origin; + dns_message_destroy(&msg); + isc_event_free(&event); + clear_query(query); + cancel_lookup(l); + check_next_lookup(l); + UNLOCK_LOOKUP; + return; + } + } if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) || (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse)) { @@ -3887,16 +3893,13 @@ recv_done(isc_task_t *task, isc_event_t *event) { } } -#ifdef ISC_PLATFORM_USESIT - if (l->sitvalue != NULL) { + if (l->cookie != NULL) { if (msg->opt == NULL) printf(";; expected opt record in response\n"); else process_opt(l, msg); - } else if (l->sit && msg->opt != NULL) + } else if (l->sendcookie && msg->opt != NULL) process_opt(l, msg); -#endif - if (!l->doing_xfr || l->xfr_q == query) { if (msg->rcode == dns_rcode_nxdomain && (l->origin != NULL || l->need_search)) { diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index c464d8fe7ae..a2984a50276 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -131,9 +131,9 @@ struct dig_lookup { besteffort, dnssec, expire, -#ifdef ISC_PLATFORM_USESIT - sit, -#endif + sendcookie, + seenbadcookie, + badcookie, nsid, /*% Name Server ID (RFC 5001) */ header_only, ednsneg; @@ -191,9 +191,7 @@ isc_boolean_t sigchase; isc_uint32_t msgcounter; dns_fixedname_t fdomain; isc_sockaddr_t *ecs_addr; -#ifdef ISC_PLATFORM_USESIT - char *sitvalue; -#endif + char *cookie; dns_ednsopt_t *ednsopts; unsigned int ednsoptscnt; isc_dscp_t dscp; diff --git a/bin/named/client.c b/bin/named/client.c index 0e79d7cc1d4..fc327ca11e1 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -17,7 +17,9 @@ #include +#include #include +#include #include #include #include @@ -32,12 +34,6 @@ #include #include -#ifdef AES_SIT -#include -#else -#include -#endif - #include #include #include @@ -121,7 +117,7 @@ */ #endif -#define SIT_SIZE 24U /* 8 + 4 + 4 + 8 */ +#define COOKIE_SIZE 24U /* 8 + 4 + 4 + 8 */ #define ECS_SIZE 20U /* 2 + 1 + 1 + [0..16] */ /*% nameserver client manager structure */ @@ -249,10 +245,8 @@ static isc_result_t get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, static inline isc_boolean_t allowed(isc_netaddr_t *addr, dns_name_t *signer, isc_netaddr_t *ecs_addr, isc_uint8_t ecs_addrlen, isc_uint8_t *ecs_scope, dns_acl_t *acl); -#ifdef ISC_PLATFORM_USESIT -static void compute_sit(ns_client_t *client, isc_uint32_t when, - isc_uint32_t nonce, isc_buffer_t *buf); -#endif +static void compute_cookie(ns_client_t *client, isc_uint32_t when, + isc_uint32_t nonce, isc_buffer_t *buf); void ns_client_recursing(ns_client_t *client) { @@ -838,10 +832,9 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer, } } else { data = sendbuf; -#ifdef ISC_PLATFORM_USESIT - if ((client->attributes & NS_CLIENTATTR_HAVESIT) == 0) { + if ((client->attributes & NS_CLIENTATTR_HAVECOOKIE) == 0) { if (client->view != NULL) - bufsize = client->view->situdp; + bufsize = client->view->nocookieudp; else bufsize = 512; } else @@ -850,12 +843,6 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer, bufsize = client->udpsize; if (bufsize > SEND_BUFFER_SIZE) bufsize = SEND_BUFFER_SIZE; -#else - if (client->udpsize < SEND_BUFFER_SIZE) - bufsize = client->udpsize; - else - bufsize = SEND_BUFFER_SIZE; -#endif if (length > bufsize) { result = ISC_R_NOSPACE; goto done; @@ -1432,9 +1419,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message, { unsigned char ecs[ECS_SIZE]; char nsid[BUFSIZ], *nsidp; -#ifdef ISC_PLATFORM_USESIT - unsigned char sit[SIT_SIZE]; -#endif + unsigned char cookie[COOKIE_SIZE]; isc_result_t result; dns_view_t *view; dns_resolver_t *resolver; @@ -1477,25 +1462,23 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message, count++; } no_nsid: -#ifdef ISC_PLATFORM_USESIT - if ((client->attributes & NS_CLIENTATTR_WANTSIT) != 0) { + if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) { isc_buffer_t buf; isc_stdtime_t now; isc_uint32_t nonce; - isc_buffer_init(&buf, sit, sizeof(sit)); + isc_buffer_init(&buf, cookie, sizeof(cookie)); isc_stdtime_get(&now); isc_random_get(&nonce); - compute_sit(client, now, nonce, &buf); + compute_cookie(client, now, nonce, &buf); INSIST(count < DNS_EDNSOPTIONS); - ednsopts[count].code = DNS_OPT_SIT; - ednsopts[count].length = SIT_SIZE; - ednsopts[count].value = sit; + ednsopts[count].code = DNS_OPT_COOKIE; + ednsopts[count].length = COOKIE_SIZE; + ednsopts[count].value = cookie; count++; } -#endif if ((client->attributes & NS_CLIENTATTR_HAVEEXPIRE) != 0) { isc_buffer_t buf; @@ -1629,141 +1612,166 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey, return (ISC_TF(view == myview)); } -#ifdef ISC_PLATFORM_USESIT static void -compute_sit(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce, - isc_buffer_t *buf) +compute_cookie(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce, + isc_buffer_t *buf) { -#ifdef AES_SIT - unsigned char digest[ISC_AES_BLOCK_LENGTH]; - unsigned char input[4 + 4 + 16]; - isc_netaddr_t netaddr; - unsigned char *cp; - unsigned int i; - - memset(input, 0, sizeof(input)); - cp = isc_buffer_used(buf); - isc_buffer_putmem(buf, client->cookie, 8); - isc_buffer_putuint32(buf, nonce); - isc_buffer_putuint32(buf, when); - memmove(input, cp, 16); - isc_aes128_crypt(ns_g_server->secret, input, digest); - for (i = 0; i < 8; i++) - input[i] = digest[i] ^ digest[i + 8]; - isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); - switch (netaddr.family) { - case AF_INET: - memmove(input + 8, (unsigned char *)&netaddr.type.in, 4); - memset(input + 12, 0, 4); - isc_aes128_crypt(ns_g_server->secret, input, digest); - break; - case AF_INET6: - memmove(input + 8, (unsigned char *)&netaddr.type.in6, 16); + switch (ns_g_server->cookiealg) { + case ns_cookiealg_aes: { + unsigned char digest[ISC_AES_BLOCK_LENGTH]; + unsigned char input[4 + 4 + 16]; + isc_netaddr_t netaddr; + unsigned char *cp; + unsigned int i; + + memset(input, 0, sizeof(input)); + cp = isc_buffer_used(buf); + isc_buffer_putmem(buf, client->cookie, 8); + isc_buffer_putuint32(buf, nonce); + isc_buffer_putuint32(buf, when); + memmove(input, cp, 16); isc_aes128_crypt(ns_g_server->secret, input, digest); for (i = 0; i < 8; i++) - input[i + 8] = digest[i] ^ digest[i + 8]; - isc_aes128_crypt(ns_g_server->secret, input + 8, digest); + input[i] = digest[i] ^ digest[i + 8]; + isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); + switch (netaddr.family) { + case AF_INET: + cp = (unsigned char *)&netaddr.type.in; + memmove(input + 8, cp, 4); + memset(input + 12, 0, 4); + isc_aes128_crypt(ns_g_server->secret, input, digest); + break; + case AF_INET6: + cp = (unsigned char *)&netaddr.type.in6; + memmove(input + 8, cp, 16); + isc_aes128_crypt(ns_g_server->secret, input, digest); + for (i = 0; i < 8; i++) + input[i + 8] = digest[i] ^ digest[i + 8]; + isc_aes128_crypt(ns_g_server->secret, input + 8, + digest); + break; + } + for (i = 0; i < 8; i++) + digest[i] ^= digest[i + 8]; + isc_buffer_putmem(buf, digest, 8); break; } - for (i = 0; i < 8; i++) - digest[i] ^= digest[i + 8]; - isc_buffer_putmem(buf, digest, 8); -#endif -#ifdef HMAC_SHA1_SIT - unsigned char digest[ISC_SHA1_DIGESTLENGTH]; - isc_netaddr_t netaddr; - unsigned char *cp; - isc_hmacsha1_t hmacsha1; - - cp = isc_buffer_used(buf); - isc_buffer_putmem(buf, client->cookie, 8); - isc_buffer_putuint32(buf, nonce); - isc_buffer_putuint32(buf, when); - - isc_hmacsha1_init(&hmacsha1, - ns_g_server->secret, - ISC_SHA1_DIGESTLENGTH); - isc_hmacsha1_update(&hmacsha1, cp, 16); - isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); - switch (netaddr.family) { - case AF_INET: - isc_hmacsha1_update(&hmacsha1, - (unsigned char *)&netaddr.type.in, 4); - break; - case AF_INET6: - isc_hmacsha1_update(&hmacsha1, - (unsigned char *)&netaddr.type.in6, 16); + + case ns_cookiealg_sha1: { + unsigned char digest[ISC_SHA1_DIGESTLENGTH]; + isc_netaddr_t netaddr; + unsigned char *cp; + isc_hmacsha1_t hmacsha1; + size_t length; + + cp = isc_buffer_used(buf); + isc_buffer_putmem(buf, client->cookie, 8); + isc_buffer_putuint32(buf, nonce); + isc_buffer_putuint32(buf, when); + + isc_hmacsha1_init(&hmacsha1, + ns_g_server->secret, + ISC_SHA1_DIGESTLENGTH); + isc_hmacsha1_update(&hmacsha1, cp, 16); + isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); + switch (netaddr.family) { + case AF_INET: + cp = (unsigned char *)&netaddr.type.in; + length = 4; + break; + case AF_INET6: + cp = (unsigned char *)&netaddr.type.in6; + length = 4; + break; + default: + INSIST(0); + } + isc_hmacsha1_update(&hmacsha1, cp, length); + isc_hmacsha1_update(&hmacsha1, client->cookie, + sizeof(client->cookie)); + isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest)); + isc_buffer_putmem(buf, digest, 8); + isc_hmacsha1_invalidate(&hmacsha1); break; } - isc_hmacsha1_update(&hmacsha1, client->cookie, sizeof(client->cookie)); - isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest)); - isc_buffer_putmem(buf, digest, 8); - isc_hmacsha1_invalidate(&hmacsha1); -#endif -#ifdef HMAC_SHA256_SIT - unsigned char digest[ISC_SHA256_DIGESTLENGTH]; - isc_netaddr_t netaddr; - unsigned char *cp; - isc_hmacsha256_t hmacsha256; - - cp = isc_buffer_used(buf); - isc_buffer_putmem(buf, client->cookie, 8); - isc_buffer_putuint32(buf, nonce); - isc_buffer_putuint32(buf, when); - - isc_hmacsha256_init(&hmacsha256, - ns_g_server->secret, - ISC_SHA256_DIGESTLENGTH); - isc_hmacsha256_update(&hmacsha256, cp, 16); - isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); - switch (netaddr.family) { - case AF_INET: - isc_hmacsha256_update(&hmacsha256, - (unsigned char *)&netaddr.type.in, 4); - break; - case AF_INET6: - isc_hmacsha256_update(&hmacsha256, - (unsigned char *)&netaddr.type.in6, 16); + + case ns_cookiealg_sha256: { + unsigned char digest[ISC_SHA256_DIGESTLENGTH]; + isc_netaddr_t netaddr; + unsigned char *cp; + isc_hmacsha256_t hmacsha256; + size_t length; + + cp = isc_buffer_used(buf); + isc_buffer_putmem(buf, client->cookie, 8); + isc_buffer_putuint32(buf, nonce); + isc_buffer_putuint32(buf, when); + + isc_hmacsha256_init(&hmacsha256, + ns_g_server->secret, + ISC_SHA256_DIGESTLENGTH); + isc_hmacsha256_update(&hmacsha256, cp, 16); + isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); + switch (netaddr.family) { + case AF_INET: + cp = (unsigned char *)&netaddr.type.in; + length = 4; + break; + case AF_INET6: + cp = (unsigned char *)&netaddr.type.in6; + length = 4; + break; + default: + INSIST(0); + } + isc_hmacsha256_update(&hmacsha256, cp, length); + isc_hmacsha256_update(&hmacsha256, client->cookie, + sizeof(client->cookie)); + isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest)); + isc_buffer_putmem(buf, digest, 8); + isc_hmacsha256_invalidate(&hmacsha256); break; } - isc_hmacsha256_update(&hmacsha256, client->cookie, - sizeof(client->cookie)); - isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest)); - isc_buffer_putmem(buf, digest, 8); - isc_hmacsha256_invalidate(&hmacsha256); -#endif + default: + INSIST(0); + } } static void -process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) { - unsigned char dbuf[SIT_SIZE]; +process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) { + unsigned char dbuf[COOKIE_SIZE]; unsigned char *old; isc_stdtime_t now; isc_uint32_t when; isc_uint32_t nonce; isc_buffer_t db; - client->attributes |= NS_CLIENTATTR_WANTSIT; + /* + * If we have already seen a cookie option skip this cookie option. + */ + if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) { + isc_buffer_forward(buf, (unsigned int)optlen); + return; + } - isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitopt); + client->attributes |= NS_CLIENTATTR_WANTCOOKIE; + + isc_stats_increment(ns_g_server->nsstats, dns_nsstatscounter_cookiein); - if (optlen != SIT_SIZE) { + if (optlen != COOKIE_SIZE) { /* * Not our token. */ - if (optlen >= 8U) - memmove(client->cookie, isc_buffer_current(buf), 8); - else - memset(client->cookie, 0, 8); + INSIST(optlen >= 8U); + memmove(client->cookie, isc_buffer_current(buf), 8); isc_buffer_forward(buf, (unsigned int)optlen); if (optlen == 8U) isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitnew); + dns_nsstatscounter_cookienew); else isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitbadsize); + dns_nsstatscounter_cookiebadsize); return; } @@ -1779,30 +1787,29 @@ process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) { /* * Allow for a 5 minute clock skew between servers sharing a secret. - * Only accept SIT if we have talked to the client in the last hour. + * Only accept COOKIE if we have talked to the client in the last hour. */ isc_stdtime_get(&now); if (isc_serial_gt(when, (now + 300)) || /* In the future. */ isc_serial_lt(when, (now - 3600))) { /* In the past. */ isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitbadtime); + dns_nsstatscounter_cookiebadtime); return; } isc_buffer_init(&db, dbuf, sizeof(dbuf)); - compute_sit(client, when, nonce, &db); + compute_cookie(client, when, nonce, &db); - if (memcmp(old, dbuf, SIT_SIZE) != 0) { + if (memcmp(old, dbuf, COOKIE_SIZE) != 0) { isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitnomatch); + dns_nsstatscounter_cookienomatch); return; } - isc_stats_increment(ns_g_server->nsstats, - dns_nsstatscounter_sitmatch); - client->attributes |= NS_CLIENTATTR_HAVESIT; + isc_stats_increment(ns_g_server->nsstats, + dns_nsstatscounter_cookiematch); + client->attributes |= NS_CLIENTATTR_HAVECOOKIE; } -#endif static isc_result_t process_ecs(ns_client_t *client, isc_buffer_t *buf, size_t optlen) { @@ -1938,11 +1945,9 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) { client->attributes |= NS_CLIENTATTR_WANTNSID; isc_buffer_forward(&optbuf, optlen); break; -#ifdef ISC_PLATFORM_USESIT - case DNS_OPT_SIT: - process_sit(client, &optbuf, optlen); + case DNS_OPT_COOKIE: + process_cookie(client, &optbuf, optlen); break; -#endif case DNS_OPT_EXPIRE: isc_stats_increment(ns_g_server->nsstats, dns_nsstatscounter_expireopt); @@ -2172,6 +2177,9 @@ client_request(isc_task_t *task, isc_event_t *event) { * Parsing the request failed. Send a response * (typically FORMERR or SERVFAIL). */ + if (result == DNS_R_OPTERR) + (void)ns_client_addopt(client, client->message, + &client->opt); ns_client_error(client, result); goto cleanup; } @@ -2239,6 +2247,17 @@ client_request(isc_task_t *task, isc_event_t *event) { } if (client->message->rdclass == 0) { + if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 || + (client->message->opcode == dns_opcode_query && + client->message->counts[DNS_SECTION_QUESTION] == 0U)) { + result = dns_message_reply(client->message, ISC_TRUE); + if (result != ISC_R_SUCCESS) { + ns_client_error(client, result); + return; + } + ns_client_send(client); + return; + } ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1), "message class could not be determined"); diff --git a/bin/named/config.c b/bin/named/config.c index d0f2b745ada..576ce0771ef 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -53,6 +53,11 @@ options {\n\ automatic-interface-scan yes;\n\ bindkeys-file \"" NS_SYSCONFDIR "/bind.keys\";\n\ # blackhole {none;};\n" +#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES) +" cookie-algorithm aes;\n" +#else +" cookie-algorithm sha256;\n" +#endif #ifndef WIN32 " coresize default;\n\ datasize default;\n\ @@ -116,14 +121,8 @@ options {\n\ use-ixfr true;\n\ edns-udp-size 4096;\n\ max-udp-size 4096;\n\ -" -#ifdef ISC_PLATFORM_USESIT -"\ - nosit-udp-size 4096;\n\ - request-sit true;\n\ -" -#endif -"\ + nocookie-udp-size 4096;\n\ + send-cookie true;\n\ request-nsid false;\n\ reserved-sockets 512;\n\ \n\ diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h index 961a156aff0..60d5a6be053 100644 --- a/bin/named/include/named/client.h +++ b/bin/named/include/named/client.h @@ -190,8 +190,8 @@ typedef ISC_LIST(ns_client_t) client_list_t; #define NS_CLIENTATTR_FILTER_AAAA_RC 0x0080 /*%< recursing for A against AAAA */ #endif #define NS_CLIENTATTR_WANTAD 0x0100 /*%< want AD in response if possible */ -#define NS_CLIENTATTR_WANTSIT 0x0200 /*%< include SIT */ -#define NS_CLIENTATTR_HAVESIT 0x0400 /*%< has a valid SIT */ +#define NS_CLIENTATTR_WANTCOOKIE 0x0200 /*%< return a COOKIE */ +#define NS_CLIENTATTR_HAVECOOKIE 0x0400 /*%< has a valid COOKIE */ #define NS_CLIENTATTR_WANTEXPIRE 0x0800 /*%< return seconds to expire */ #define NS_CLIENTATTR_HAVEEXPIRE 0x1000 /*%< return seconds to expire */ #define NS_CLIENTATTR_WANTOPT 0x2000 /*%< add opt to reply */ diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h index 8d9c9bab4c3..d6c5dd013ee 100644 --- a/bin/named/include/named/server.h +++ b/bin/named/include/named/server.h @@ -116,7 +116,8 @@ struct ns_server { unsigned int session_keyalg; isc_uint16_t session_keybits; isc_boolean_t interface_auto; - unsigned char secret[32]; /*%< Source Identity Token */ + unsigned char secret[32]; /*%< Server Cookie Secret */ + ns_cookiealg_t cookiealg; char * lockfile; }; @@ -190,18 +191,15 @@ enum { dns_nsstatscounter_nxdomainredirect = 47, dns_nsstatscounter_nxdomainredirect_rlookup = 48, -#ifdef ISC_PLATFORM_USESIT - dns_nsstatscounter_sitopt = 49, - dns_nsstatscounter_sitbadsize = 50, - dns_nsstatscounter_sitbadtime = 51, - dns_nsstatscounter_sitnomatch = 52, - dns_nsstatscounter_sitmatch = 53, - dns_nsstatscounter_sitnew = 54, - - dns_nsstatscounter_max = 55 -#else - dns_nsstatscounter_max = 49 -#endif + dns_nsstatscounter_cookiein = 49, + dns_nsstatscounter_cookiebadsize = 50, + dns_nsstatscounter_cookiebadtime = 51, + dns_nsstatscounter_cookienomatch = 52, + dns_nsstatscounter_cookiematch = 53, + dns_nsstatscounter_cookienew = 54, + dns_nsstatscounter_badcookie = 55, + + dns_nsstatscounter_max = 56 }; void diff --git a/bin/named/include/named/types.h b/bin/named/include/named/types.h index 7a7886e2b63..2b722d7eb26 100644 --- a/bin/named/include/named/types.h +++ b/bin/named/include/named/types.h @@ -45,4 +45,11 @@ typedef struct ns_dispatch ns_dispatch_t; typedef ISC_LIST(ns_dispatch_t) ns_dispatchlist_t; typedef struct ns_statschannel ns_statschannel_t; typedef ISC_LIST(ns_statschannel_t) ns_statschannellist_t; + +typedef enum { + ns_cookiealg_aes, + ns_cookiealg_sha1, + ns_cookiealg_sha256 +} ns_cookiealg_t; + #endif /* NAMED_TYPES_H */ diff --git a/bin/named/query.c b/bin/named/query.c index a8266a194bb..a375e10354e 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -93,20 +93,20 @@ /*% Want Recursion? */ #define WANTRECURSION(c) (((c)->query.attributes & \ NS_QUERYATTR_WANTRECURSION) != 0) +/*% Is TCP? */ +#define TCP(c) (((c)->attributes & NS_CLIENTATTR_TCP) != 0) /*% Want DNSSEC? */ #define WANTDNSSEC(c) (((c)->attributes & \ NS_CLIENTATTR_WANTDNSSEC) != 0) /*% Want WANTAD? */ #define WANTAD(c) (((c)->attributes & \ NS_CLIENTATTR_WANTAD) != 0) -#ifdef ISC_PLATFORM_USESIT -/*% Client presented a valid Source Identity Token. */ -#define HAVESIT(c) (((c)->attributes & \ - NS_CLIENTATTR_HAVESIT) != 0) -#else -#define HAVESIT(c) (0) -#endif - +/*% Client presented a valid COOKIE. */ +#define HAVECOOKIE(c) (((c)->attributes & \ + NS_CLIENTATTR_HAVECOOKIE) != 0) +/*% Client presented a COOKIE. */ +#define WANTCOOKIE(c) (((c)->attributes & \ + NS_CLIENTATTR_WANTCOOKIE) != 0) /*% No authority? */ #define NOAUTHORITY(c) (((c)->query.attributes & \ NS_QUERYATTR_NOAUTHORITY) != 0) @@ -251,8 +251,10 @@ query_send(ns_client_t *client) { counter = dns_nsstatscounter_nxrrset; } else counter = dns_nsstatscounter_success; - } else if (client->message->rcode == dns_rcode_nxdomain) + } else if (client->message->rcode == dns_rcode_nxdomain) counter = dns_nsstatscounter_nxdomain; + else if (client->message->rcode == dns_rcode_badcookie) + counter = dns_nsstatscounter_badcookie; else /* We end up here in case of YXDOMAIN, and maybe others */ counter = dns_nsstatscounter_failure; @@ -3937,7 +3939,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname, tmprdataset = query_newrdataset(client); if (tmprdataset == NULL) return; - if ((client->attributes & NS_CLIENTATTR_TCP) == 0) + if (!TCP(client)) peeraddr = &client->peeraddr; else peeraddr = NULL; @@ -4023,7 +4025,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname, ns_client_killoldestquery(client); } if (result == ISC_R_SUCCESS && !client->mortal && - (client->attributes & NS_CLIENTATTR_TCP) == 0) { + !TCP(client)) { result = ns_client_replace(client); if (result != ISC_R_SUCCESS) { ns_client_log(client, NS_LOGCATEGORY_CLIENT, @@ -4061,7 +4063,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname, if (client->query.timerset == ISC_FALSE) ns_client_settimeout(client, 60); - if ((client->attributes & NS_CLIENTATTR_TCP) == 0) + if (!TCP(client)) peeraddr = &client->peeraddr; else peeraddr = NULL; @@ -6779,7 +6781,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) client->query.authdbset = ISC_TRUE; /* Track TCP vs UDP stats per zone */ - if ((client->attributes & NS_CLIENTATTR_TCP) != 0) + if (TCP(client)) inc_stats(client, dns_nsstatscounter_tcp); else inc_stats(client, dns_nsstatscounter_udp); @@ -6838,7 +6840,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) * Don't mess with responses rewritten by RPZ * Count each response at most once. */ - if (client->view->rrl != NULL && !HAVESIT(client) && + if (client->view->rrl != NULL && !HAVECOOKIE(client) && ((fname != NULL && dns_name_isabsolute(fname)) || (result == ISC_R_NOTFOUND && !RECURSIONOK(client))) && !(result == DNS_R_DELEGATION && !is_zone && RECURSIONOK(client)) && @@ -6904,10 +6906,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) resp_result = ISC_R_SUCCESS; } rrl_result = dns_rrl(client->view, &client->peeraddr, - ISC_TF((client->attributes - & NS_CLIENTATTR_TCP) != 0), - client->message->rdclass, qtype, tname, - resp_result, client->now, + TCP(client), client->message->rdclass, + qtype, tname, resp_result, client->now, wouldlog, log_buf, sizeof(log_buf)); if (rrl_result != DNS_RRL_RESULT_OK) { /* @@ -6942,11 +6942,19 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) */ inc_stats(client, dns_nsstatscounter_rateslipped); - client->message->flags |= - DNS_MESSAGEFLAG_TC; - if (resp_result == DNS_R_NXDOMAIN) + if (WANTCOOKIE(client)) { + client->message->flags &= + ~DNS_MESSAGEFLAG_AD; client->message->rcode = - dns_rcode_nxdomain; + dns_rcode_badcookie; + } else { + client->message->flags |= + DNS_MESSAGEFLAG_TC; + if (resp_result == + DNS_R_NXDOMAIN) + client->message->rcode = + dns_rcode_nxdomain; + } } goto cleanup; } @@ -6998,7 +7006,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) if (rpz_st->m.policy != DNS_RPZ_POLICY_MISS && rpz_st->m.policy != DNS_RPZ_POLICY_PASSTHRU && (rpz_st->m.policy != DNS_RPZ_POLICY_TCP_ONLY || - (client->attributes & NS_CLIENTATTR_TCP) == 0) && + !TCP(client)) && rpz_st->m.policy != DNS_RPZ_POLICY_ERROR) { /* @@ -8723,13 +8731,13 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) { client->ednsversion); ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY, - level, "query: %s %s %s %s%s%s%s%s%s (%s)", namebuf, + level, "query: %s %s %s %s%s%s%s%s%s%s (%s)", namebuf, classname, typename, WANTRECURSION(client) ? "+" : "-", (client->signer != NULL) ? "S" : "", ednsbuf, - ((client->attributes & NS_CLIENTATTR_TCP) != 0) ? - "T" : "", + TCP(client) ? "T" : "", ((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "", ((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "", + HAVECOOKIE(client) ? "V" : WANTCOOKIE(client) ? "K" : "", onbuf); } @@ -8790,7 +8798,7 @@ ns_query_start(ns_client_t *client) { /* * Test only. */ - if (ns_g_clienttest && (client->attributes & NS_CLIENTATTR_TCP) == 0) + if (ns_g_clienttest && !TCP(client)) RUNTIME_CHECK(ns_client_replace(client) == ISC_R_SUCCESS); /* @@ -8917,8 +8925,7 @@ ns_query_start(ns_client_t *client) { /* * Turn on minimal responses for EDNS/UDP bufsize 512 queries. */ - if (client->ednsversion >= 0 && client->udpsize <= 512U && - (client->attributes & NS_CLIENTATTR_TCP) == 0) + if (client->ednsversion >= 0 && client->udpsize <= 512U && !TCP(client)) client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY | NS_QUERYATTR_NOADDITIONAL); diff --git a/bin/named/server.c b/bin/named/server.c index 55982c6ff36..93276724a27 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -26,6 +26,7 @@ #include #include +#include #include #include #include @@ -33,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -52,12 +54,6 @@ #include #include -#ifdef AES_SIT -#include -#else -#include -#endif - #include #include @@ -1215,12 +1211,10 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) { if (obj != NULL) CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj))); -#ifdef ISC_PLATFORM_USESIT obj = NULL; - (void)cfg_map_get(cpeer, "request-sit", &obj); + (void)cfg_map_get(cpeer, "send-cookie", &obj); if (obj != NULL) - CHECK(dns_peer_setrequestsit(peer, cfg_obj_asboolean(obj))); -#endif + CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj))); obj = NULL; (void)cfg_map_get(cpeer, "edns", &obj); @@ -3092,20 +3086,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, udpsize = 4096; view->maxudp = udpsize; -#ifdef ISC_PLATFORM_USESIT /* - * Set the maximum UDP when a SIT is not provided. + * Set the maximum UDP when a COOKIE is not provided. */ obj = NULL; - result = ns_config_get(maps, "nosit-udp-size", &obj); + result = ns_config_get(maps, "nocookie-udp-size", &obj); INSIST(result == ISC_R_SUCCESS); udpsize = cfg_obj_asuint32(obj); if (udpsize < 128) udpsize = 128; if (udpsize > view->maxudp) udpsize = view->maxudp; - view->situdp = udpsize; -#endif + view->nocookieudp = udpsize; /* * Set the maximum rsa exponent bits. @@ -3477,12 +3469,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, INSIST(result == ISC_R_SUCCESS); view->requestnsid = cfg_obj_asboolean(obj); -#ifdef ISC_PLATFORM_USESIT obj = NULL; - result = ns_config_get(maps, "request-sit", &obj); + result = ns_config_get(maps, "send-cookie", &obj); INSIST(result == ISC_R_SUCCESS); - view->requestsit = cfg_obj_asboolean(obj); -#endif + view->sendcookie = cfg_obj_asboolean(obj); obj = NULL; result = ns_config_get(maps, "max-clients-per-query", &obj); @@ -6417,32 +6407,48 @@ load_configuration(const char *filename, ns_server_t *server, server->flushonshutdown = ISC_FALSE; } -#ifdef ISC_PLATFORM_USESIT obj = NULL; - result = ns_config_get(maps, "sit-secret", &obj); + result = ns_config_get(maps, "cookie-algorithm", &obj); + INSIST(result == ISC_R_SUCCESS); + if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) + server->cookiealg = ns_cookiealg_aes; + else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) + server->cookiealg = ns_cookiealg_sha1; + else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0) + server->cookiealg = ns_cookiealg_sha256; + else + INSIST(0); + + obj = NULL; + result = ns_config_get(maps, "cookie-secret", &obj); if (result == ISC_R_SUCCESS) { isc_buffer_t b; + unsigned int usedlength; memset(server->secret, 0, sizeof(server->secret)); isc_buffer_init(&b, server->secret, sizeof(server->secret)); result = isc_hex_decodestring(cfg_obj_asstring(obj), &b); if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE) goto cleanup; -#ifdef AES_SIT - if (isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH) - CHECKM(ISC_R_RANGE, - "AES sit-secret must be on 128 bits"); -#endif -#ifdef HMAC_SHA1_SIT - if (isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH) - CHECKM(ISC_R_RANGE, - "SHA1 sit-secret must be on 160 bits"); -#endif -#ifdef HMAC_SHA256_SIT - if (isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH) - CHECKM(ISC_R_RANGE, - "SHA256 sit-secret must be on 256 bits"); -#endif + + usedlength = isc_buffer_usedlength(&b); + switch (server->cookiealg) { + case ns_cookiealg_aes: + if (usedlength != ISC_AES128_KEYLENGTH) + CHECKM(ISC_R_RANGE, + "AES cookie-secret must be 128 bits"); + break; + case ns_cookiealg_sha1: + if (usedlength != ISC_SHA1_DIGESTLENGTH) + CHECKM(ISC_R_RANGE, + "SHA1 cookie-secret must be 160 bits"); + break; + case ns_cookiealg_sha256: + if (usedlength != ISC_SHA256_DIGESTLENGTH) + CHECKM(ISC_R_RANGE, + "SHA256 cookie-secret must be 256 bits"); + break; + } } else { result = isc_entropy_getdata(ns_g_entropy, server->secret, @@ -6452,7 +6458,6 @@ load_configuration(const char *filename, ns_server_t *server, if (result != ISC_R_SUCCESS) goto cleanup; } -#endif result = ISC_R_SUCCESS; diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c index ccbc1b1d12b..ece02f0566a 100644 --- a/bin/named/statschannel.c +++ b/bin/named/statschannel.c @@ -224,19 +224,12 @@ init_desc(void) { SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt"); SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt"); SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt"); -#ifdef ISC_PLATFORM_USESIT - SET_NSSTATDESC(sitopt, "source identity token option received", - "SitOpt"); - SET_NSSTATDESC(sitnew, "new source identity token requested", - "SitNew"); - SET_NSSTATDESC(sitbadsize, "source identity token - bad size", - "SitBadSize"); - SET_NSSTATDESC(sitbadtime, "source identity token - bad time", - "SitBadTime"); - SET_NSSTATDESC(sitnomatch, "source identity token - no match", - "SitNoMatch"); - SET_NSSTATDESC(sitmatch, "source identity token - match", "SitMatch"); -#endif + SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn"); + SET_NSSTATDESC(cookienew, "COOKIE - client only", "CookieNew"); + SET_NSSTATDESC(cookiebadsize, "COOKIE - bad size", "CookieBadSize"); + SET_NSSTATDESC(cookiebadtime, "COOKIE - bad time", "CookieBadTime"); + SET_NSSTATDESC(cookienomatch, "COOKIE - no match", "CookieNoMatch"); + SET_NSSTATDESC(cookiematch, "COOKIE - match", "CookieMatch"); SET_NSSTATDESC(ecsopt, "EDNS client subnet option recieved", "ECSOpt"); SET_NSSTATDESC(nxdomainredirect, "queries resulted in NXDOMAIN that were redirected", @@ -245,6 +238,7 @@ init_desc(void) { "queries resulted in NXDOMAIN that were redirected and " "resulted in a successful remote lookup", "QryNXRedirRLookup"); + SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE"); INSIST(i == dns_nsstatscounter_max); /* Initialize resolver statistics */ @@ -320,15 +314,14 @@ init_desc(void) { SET_RESSTATDESC(nfetch, "active fetches", "NumFetch"); SET_RESSTATDESC(buckets, "bucket size", "BucketSize"); SET_RESSTATDESC(refused, "REFUSED received", "REFUSED"); -#ifdef ISC_PLATFORM_USESIT - SET_RESSTATDESC(sitcc, "SIT sent client cookie only", - "SitClientOut"); - SET_RESSTATDESC(sitout, "SIT sent with client and server cookie", - "SitOut"); - SET_RESSTATDESC(sitin, "SIT replies received", "SitIn"); - SET_RESSTATDESC(sitok, "SIT client cookie ok", "SitClientOk"); -#endif + SET_RESSTATDESC(cookienew, "COOKIE send with client cookie only", + "ClientCookieOut"); + SET_RESSTATDESC(cookieout, "COOKIE sent with client and server cookie", + "ServerCookieOut"); + SET_RESSTATDESC(cookiein, "COOKIE replies received", "CookieIn"); + SET_RESSTATDESC(cookieok, "COOKIE client ok", "CookieClientOk"); SET_RESSTATDESC(badvers, "bad EDNS version", "BadEDNSVersion"); + SET_RESSTATDESC(badcookie, "bad cookie rcode", "BadCookieRcode"); INSIST(i == dns_resstatscounter_max); diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in index cf07d0cb3e2..78c4f749025 100644 --- a/bin/tests/system/conf.sh.in +++ b/bin/tests/system/conf.sh.in @@ -66,17 +66,16 @@ RANDFILE=$TOP/bin/tests/system/random.data # v6synth SUBDIRS="acl additional allow_query addzone autosign builtin cacheclean case checkconf @CHECKDS@ checknames checkzone - @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal dname - dns64 dnssec dsdigest dscp ecdsa ednscompliance emptyzones - filter-aaaa formerr forward geoip glue gost ixfr inline - legacy limits logfileconfig lwresd - masterfile masterformat metadata mkeys - notify nslookup nsupdate pending pipelined @PKCS11_TEST@ - reclimit redirect resolver rndc rpz rpzrecurse - rrl rrchecker rrsetorder rsabigexponent runtime - sit sfcache smartsign sortlist spf - staticstub statistics stub tcp tkey tsig tsiggss unknown - upforwd verify views wildcard xfer xferquota zero zonechecks" + cookie @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal + dname dns64 dnssec dsdigest dscp ecdsa ednscompliance + emptyzones filter-aaaa formerr forward geoip glue gost + ixfr inline legacy limits logfileconfig lwresd masterfile + masterformat metadata mkeys notify nslookup nsupdate pending + pipelined @PKCS11_TEST@ reclimit redirect resolver rndc + rpz rpzrecurse rrl rrchecker rrsetorder rsabigexponent + runtime sfcache smartsign sortlist spf staticstub statistics + stub tcp tkey tsig tsiggss unknown upforwd verify views + wildcard xfer xferquota zero zonechecks" # Use the CONFIG_SHELL detected by configure for tests SHELL=@SHELL@ diff --git a/bin/tests/system/sit/.gitignore b/bin/tests/system/cookie/.gitignore similarity index 100% rename from bin/tests/system/sit/.gitignore rename to bin/tests/system/cookie/.gitignore diff --git a/bin/tests/system/sit/bad-sit-badhex.conf b/bin/tests/system/cookie/bad-cookie-badhex.conf similarity index 90% rename from bin/tests/system/sit/bad-sit-badhex.conf rename to bin/tests/system/cookie/bad-cookie-badhex.conf index f61ea93fd49..0ae59924384 100644 --- a/bin/tests/system/sit/bad-sit-badhex.conf +++ b/bin/tests/system/cookie/bad-cookie-badhex.conf @@ -15,5 +15,5 @@ */ options { - sit-secret "012345678901234567890123456789012345678901234567890123456789012"; + cookie-secret "012345678901234567890123456789012345678901234567890123456789012"; }; diff --git a/bin/tests/system/sit/bad-sit-toolong.conf b/bin/tests/system/cookie/bad-cookie-toolong.conf similarity index 89% rename from bin/tests/system/sit/bad-sit-toolong.conf rename to bin/tests/system/cookie/bad-cookie-toolong.conf index 812f9d808e5..dcb3c9cb5b4 100644 --- a/bin/tests/system/sit/bad-sit-toolong.conf +++ b/bin/tests/system/cookie/bad-cookie-toolong.conf @@ -15,5 +15,5 @@ */ options { - sit-secret "01234567890123456789012345678901234567890123456789012345678901234567890"; + cookie-secret "01234567890123456789012345678901234567890123456789012345678901234567890"; }; diff --git a/bin/tests/system/sit/clean.sh b/bin/tests/system/cookie/clean.sh similarity index 100% rename from bin/tests/system/sit/clean.sh rename to bin/tests/system/cookie/clean.sh diff --git a/bin/tests/system/sit/ns1/example.db b/bin/tests/system/cookie/ns1/example.db similarity index 100% rename from bin/tests/system/sit/ns1/example.db rename to bin/tests/system/cookie/ns1/example.db diff --git a/bin/tests/system/sit/ns1/named.conf b/bin/tests/system/cookie/ns1/named.conf similarity index 97% rename from bin/tests/system/sit/ns1/named.conf rename to bin/tests/system/cookie/ns1/named.conf index 7987858d1b4..50ed5af712b 100644 --- a/bin/tests/system/sit/ns1/named.conf +++ b/bin/tests/system/cookie/ns1/named.conf @@ -39,8 +39,8 @@ options { except-from { "goodcname.example.net"; "gooddname.example.net"; }; allow-query {!10.53.0.8; any; }; - request-sit yes; - nosit-udp-size 512; + send-cookie yes; + nocookie-udp-size 512; }; zone "." { diff --git a/bin/tests/system/sit/ns1/root.hint b/bin/tests/system/cookie/ns1/root.hint similarity index 100% rename from bin/tests/system/sit/ns1/root.hint rename to bin/tests/system/cookie/ns1/root.hint diff --git a/bin/tests/system/sit/ns2/named.conf b/bin/tests/system/cookie/ns2/named.conf similarity index 96% rename from bin/tests/system/sit/ns2/named.conf rename to bin/tests/system/cookie/ns2/named.conf index 04da91b2774..3df5a92b3fb 100644 --- a/bin/tests/system/sit/ns2/named.conf +++ b/bin/tests/system/cookie/ns2/named.conf @@ -26,8 +26,8 @@ options { listen-on-v6 { none; }; recursion no; acache-enable yes; - request-sit yes; - nosit-udp-size 512; + send-cookie yes; + nocookie-udp-size 512; }; zone "." { diff --git a/bin/tests/system/sit/ns2/root.db b/bin/tests/system/cookie/ns2/root.db similarity index 100% rename from bin/tests/system/sit/ns2/root.db rename to bin/tests/system/cookie/ns2/root.db diff --git a/bin/tests/system/sit/tests.sh b/bin/tests/system/cookie/tests.sh similarity index 64% rename from bin/tests/system/sit/tests.sh rename to bin/tests/system/cookie/tests.sh index 5f619e68630..66a09ff42a1 100755 --- a/bin/tests/system/sit/tests.sh +++ b/bin/tests/system/cookie/tests.sh @@ -22,13 +22,13 @@ SYSTEMTESTTOP=.. status=0 n=0 -getsit() { - awk '$2 == "SIT:" { +getcookie() { + awk '$2 == "COOKIE:" { print $3; }' < $1 } -fullsit() { +fullcookie() { awk 'BEGIN { n = 0 } // { v[n++] = length(); } END { print (v[1] == v[2]); }' @@ -48,16 +48,16 @@ do done n=`expr $n + 1` -echo "I:checking SIT token returned to empty SIT option ($n)" +echo "I:checking COOKIE token returned to empty COOKIE option ($n)" ret=0 -$DIG +qr +sit version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n -grep SIT: dig.out.test$n > /dev/null || ret=1 +$DIG +qr +cookie version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n +grep COOKIE: dig.out.test$n > /dev/null || ret=1 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking response size without SIT ($n)" +echo "I:checking response size without COOKIE ($n)" ret=0 $DIG large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n havetc dig.out.test$n || ret=1 @@ -65,51 +65,51 @@ if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking response size without valid SIT ($n)" +echo "I:checking response size without valid COOKIE ($n)" ret=0 -$DIG +sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n +$DIG +cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n havetc dig.out.test$n || ret=1 -grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1 +grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking response size with SIT ($n)" +echo "I:checking response size with COOKIE ($n)" ret=0 -$DIG +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l -sit=`getsit dig.out.test$n.l` -$DIG +qr +sit=$sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n +$DIG +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l +cookie=`getcookie dig.out.test$n.l` +$DIG +qr +cookie=$cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n havetc dig.out.test$n && ret=1 -grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1 +grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking response size with SIT recursive ($n)" +echo "I:checking response size with COOKIE recursive ($n)" ret=0 -$DIG +qr +sit=$sit large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n +$DIG +qr +cookie=$cookie large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n havetc dig.out.test$n && ret=1 -grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1 +grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking SIT is learnt for TCP retry ($n)" +echo "I:checking COOKIE is learnt for TCP retry ($n)" ret=0 -$DIG +qr +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n -linecount=`getsit dig.out.test$n | wc -l` +$DIG +qr +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n +linecount=`getcookie dig.out.test$n | wc -l` if [ $linecount != 3 ]; then ret=1; fi -checkfull=`getsit dig.out.test$n | fullsit` +checkfull=`getcookie dig.out.test$n | fullcookie` if [ $checkfull != 1 ]; then ret=1; fi if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` n=`expr $n + 1` -echo "I:checking for SIT value in adb ($n)" +echo "I:checking for COOKIE value in adb ($n)" ret=0 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 dumpdb sleep 1 -grep "10.53.0.2.*\[sit=" ns1/named_dump.db > /dev/null|| ret=1 +grep "10.53.0.2.*\[cookie=" ns1/named_dump.db > /dev/null|| ret=1 if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` diff --git a/bin/tests/system/formerr/tests.sh b/bin/tests/system/formerr/tests.sh index ea6aca53eda..14d57974594 100644 --- a/bin/tests/system/formerr/tests.sh +++ b/bin/tests/system/formerr/tests.sh @@ -35,11 +35,11 @@ then echo "I:failed"; status=`expr $status + 1`; fi -# this one arguable could be NOERORR. +# this one is now NOERROR echo "I:no questions" $PERL formerr.pl -a 10.53.0.1 -p 5300 noquestions > noquestions.out ans=`grep got: noquestions.out` -if [ "${ans}" != "got: 000080010000000000000000" ]; +if [ "${ans}" != "got: 000080000000000000000000" ]; then echo "I:failed"; status=`expr $status + 1`; fi diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh index 1402f31fe36..a8a770ccd90 100755 --- a/bin/tests/system/resolver/tests.sh +++ b/bin/tests/system/resolver/tests.sh @@ -541,6 +541,7 @@ echo "I:check that unexpected opcodes are handled correctly (${n})" ret=0 $DIG soa all-cnames @10.53.0.5 -p 5300 +opcode=status > dig.out.ns5.test${n} || ret=1 grep "status: NOTIMP" dig.out.ns5.test${n} > /dev/null || ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` echo "I:exit status: $status" diff --git a/bin/tests/system/sit/prereq.sh.in b/bin/tests/system/sit/prereq.sh.in deleted file mode 100644 index 7003a0ddf0b..00000000000 --- a/bin/tests/system/sit/prereq.sh.in +++ /dev/null @@ -1,16 +0,0 @@ -# Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -test "@HAVE_SIT@" = "" && exit 255 -exit 0 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c index 2df6c2aaabb..b3f49949da0 100644 --- a/bin/tools/mdig.c +++ b/bin/tools/mdig.c @@ -116,9 +116,7 @@ static in_port_t port = 53; static isc_dscp_t dscp = -1; static unsigned char cookie_secret[33]; static int onfly = 0; -#ifdef ISC_PLATFORM_USESIT -static char sitvalue[256]; -#endif +static char hexcookie[81]; struct query { char textname[MXNAME]; /*% Name we're going to be looking up */ @@ -130,10 +128,8 @@ struct query { isc_boolean_t have_zflag; isc_boolean_t dnssec; isc_boolean_t expire; -#ifdef ISC_PLATFORM_USESIT - isc_boolean_t sit; - char *sitvalue; -#endif + isc_boolean_t send_cookie; + char *cookie; isc_boolean_t nsid; dns_rdatatype_t rdtype; dns_rdataclass_t rdclass; @@ -488,7 +484,7 @@ cleanup: /*% * Add EDNS0 option record to a message. Currently, the only supported * options are UDP buffer size, the DO bit, and EDNS options - * (e.g., NSID, SIT, client-subnet) + * (e.g., NSID, COOKIE, client-subnet) */ static void add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns, @@ -504,14 +500,12 @@ add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns, CHECK("dns_message_setopt", result); } -#ifdef ISC_PLATFORM_USESIT static void compute_cookie(unsigned char *cookie, size_t len) { /* XXXMPA need to fix, should be per server. */ INSIST(len >= 8U); memmove(cookie, cookie_secret, 8); } -#endif static isc_result_t sendquery(struct query *query, isc_task_t *task) @@ -574,10 +568,7 @@ sendquery(struct query *query, isc_task_t *task) unsigned int flags; int i = 0; char ecsbuf[20]; -#ifdef ISC_PLATFORM_USESIT - unsigned char cookie[8]; - char sitbuf[256]; -#endif + unsigned char cookie[40]; if (query->udpsize == 0) query->udpsize = 4096; @@ -633,27 +624,25 @@ sendquery(struct query *query, isc_task_t *task) i++; } -#ifdef ISC_PLATFORM_USESIT - if (query->sit) { + if (query->send_cookie) { INSIST(i < DNS_EDNSOPTIONS); - opts[i].code = DNS_OPT_SIT; - if (query->sitvalue != NULL) { + opts[i].code = DNS_OPT_COOKIE; + if (query->cookie != NULL) { isc_buffer_t b; - isc_buffer_init(&b, sitbuf, sizeof(sitbuf)); - result = isc_hex_decodestring(query->sitvalue, + isc_buffer_init(&b, cookie, sizeof(cookie)); + result = isc_hex_decodestring(query->cookie, &b); CHECK("isc_hex_decodestring", result); opts[i].value = isc_buffer_base(&b); opts[i].length = isc_buffer_usedlength(&b); } else { - compute_cookie(cookie, sizeof(cookie)); + compute_cookie(cookie, 8); opts[i].length = 8; opts[i].value = cookie; } i++; } -#endif if (query->expire) { INSIST(i < DNS_EDNSOPTIONS); @@ -784,9 +773,7 @@ help(void) { " +[no]zflag (Set Z flag in query)\n" " +[no]dnssec (Request DNSSEC records)\n" " +[no]expire (Request time to expire)\n" -#ifdef ISC_PLATFORM_USESIT -" +[no]sit[=###] (Request a Source Identity Token)\n" -#endif +" +[no]cookie[=###] (Send a COOKIE option)\n" " +[no]nsid (Request Name Server ID)\n", stdout); } @@ -1034,9 +1021,7 @@ plus_option(char *option, struct query *query, isc_boolean_t global) char *cmd, *value, *ptr, *code; isc_uint32_t num; isc_boolean_t state = ISC_TRUE; -#ifdef ISC_PLATFORM_USESIT size_t n; -#endif strncpy(option_store, option, sizeof(option_store)); option_store[sizeof(option_store) - 1] = 0; @@ -1158,9 +1143,29 @@ plus_option(char *option, struct query *query, isc_boolean_t global) display_class = state; break; case 'o': /* comments */ - FULLCHECK("comments"); - GLOBAL(); - display_comments = state; + switch (cmd[2]) { + case 'm': + FULLCHECK("comments"); + GLOBAL(); + display_comments = state; + break; + case 'o': + FULLCHECK("cookie"); + if (state && query->edns == -1) + query->edns = 0; + query->send_cookie = state; + if (value != NULL) { + n = strlcpy(hexcookie, value, + sizeof(hexcookie)); + if (n >= sizeof(hexcookie)) + fatal("COOKIE data too large"); + query->cookie = hexcookie; + } else + query->cookie = NULL; + break; + default: + goto invalid_option; + } break; case 'r': FULLCHECK("crypto"); @@ -1338,21 +1343,6 @@ plus_option(char *option, struct query *query, isc_boolean_t global) display_rrcomments = ISC_FALSE; } break; -#ifdef ISC_PLATFORM_USESIT - case 'i': - FULLCHECK("sit"); - if (state && query->edns == -1) - query->edns = 0; - query->sit = state; - if (value != NULL) { - n = strlcpy(sitvalue, value, sizeof(sitvalue)); - if (n >= sizeof(sitvalue)) - fatal("SIT data too large"); - query->sitvalue = sitvalue; - } else - query->sitvalue = NULL; - break; -#endif case 'p': /* split */ FULLCHECK("split"); GLOBAL(); @@ -1704,10 +1694,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) default_query.have_zflag = ISC_FALSE; default_query.dnssec = ISC_FALSE; default_query.expire = ISC_FALSE; -#ifdef ISC_PLATFORM_USESIT - default_query.sit = ISC_FALSE; - default_query.sitvalue = NULL; -#endif + default_query.send_cookie = ISC_FALSE; + default_query.cookie = NULL; default_query.nsid = ISC_FALSE; default_query.rdtype = dns_rdatatype_a; default_query.rdclass = dns_rdataclass_in; diff --git a/bin/tools/mdig.docbook b/bin/tools/mdig.docbook index 6eee76dc88d..6f8e3107d9d 100644 --- a/bin/tools/mdig.docbook +++ b/bin/tools/mdig.docbook @@ -484,6 +484,18 @@ + + + + + Send a COOKIE EDNS option, with optional value. + Replaying a COOKIE from a previous response will allow + the server to identify a previous client. The default + is . + + + + @@ -575,19 +587,6 @@ - - - - - Send a Source Identity Token EDNS option, with optional - value. Replaying a SIT from a previous response will - allow the server to identify a previous client. The - default is . Currently using - experimental value 65001 for the option code. - - - - diff --git a/config.h.in b/config.h.in index 594518851cf..531fa447da0 100644 --- a/config.h.in +++ b/config.h.in @@ -150,8 +150,8 @@ int sigwait(const unsigned int *set, int *sig); /* Define if building universal (internal helper macro) */ #undef AC_APPLE_UNIVERSAL_BUILD -/* Use AES for Source Identity Token generation */ -#undef AES_SIT +/* Use AES for Client Cookie generation */ +#undef AES_CC /* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options. */ @@ -458,11 +458,11 @@ int sigwait(const unsigned int *set, int *sig); /* HMAC_*() return ints */ #undef HMAC_RETURN_INT -/* Use HMAC-SHA1 for Source Identity Token generation */ -#undef HMAC_SHA1_SIT +/* Use HMAC-SHA1 for Client Cookie generation */ +#undef HMAC_SHA1_CC -/* Use HMAC-SHA256 for Source Identity Token generation */ -#undef HMAC_SHA256_SIT +/* Use HMAC-SHA256 for Client Cookie generation */ +#undef HMAC_SHA256_CC /* return type of gai_strerror */ #undef IRS_GAISTRERROR_RETURN_T diff --git a/configure b/configure index 2e43a91b6cc..133a25611c2 100755 --- a/configure +++ b/configure @@ -834,8 +834,6 @@ OPENSSLLINKOBJS OPENSSLGOSTLINKSRCS OPENSSLGOSTLINKOBJS DST_OPENSSL_INC -HAVE_SIT -ISC_PLATFORM_USESIT INSTALL_LIBRARY ISC_THREAD_DIR THREADOPTSRCS @@ -1000,8 +998,7 @@ with_ecdsa with_gost with_aes enable_openssl_hash -enable_sit -with_sit_alg +with_cc_alg enable_openssl_version_check with_libxml2 with_libjson @@ -1684,7 +1681,6 @@ Optional Features: --enable-threads enable multithreading --enable-native-pkcs11 use native PKCS11 for all crypto [default=no] --enable-openssl-hash use OpenSSL for hash functions [default=no] - --enable-sit enable source identity token [default=no] --enable-openssl-version-check check OpenSSL version [default=yes] --enable-largefile 64-bit file support @@ -1726,7 +1722,7 @@ Optional Packages: --with-ecdsa Crypto ECDSA --with-gost Crypto GOST yes|no|raw|asn1. --with-aes Crypto AES - --with-sit-alg=ALG choose the algorithm for SIT [aes|sha1|sha256] + --with-cc-alg=ALG choose the algorithm for Client Cookie [aes|sha1|sha256] --with-libxml2=PATH build with libxml2 library yes|no|path --with-libjson=PATH build with libjson0 library yes|no|path --with-purify=PATH use Rational purify @@ -11444,7 +11440,6 @@ yes) test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes test "${enable_symtable+set}" = set || enable_symtable=all - test "${enable_sit+set}" = set || enable_sit=yes test "${enable_warn_error+set}" = set || enable_warn_error=yes test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes ;; @@ -15459,7 +15454,7 @@ fi if test "${with_aes+set}" = set; then : withval=$with_aes; with_aes="$withval" else - with_aes="checksit" + with_aes="checkcc" fi @@ -15470,80 +15465,44 @@ fi if test "${enable_openssl_hash+set}" = set; then : enableval=$enable_openssl_hash; want_openssl_hash="$enableval" else - want_openssl_hash="checksit" + want_openssl_hash="checkcc" fi # -# Enable Source Identity Token support +# Client Cookie algorithm choice # -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Source Identity Token support" >&5 -$as_echo_n "checking for Source Identity Token support... " >&6; } -# Check whether --enable-sit was given. -if test "${enable_sit+set}" = set; then : - enableval=$enable_sit; enable_sit="$enableval" -else - enable_sit="no" -fi - -HAVE_SIT= -ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT" - -case "$enable_sit" in -yes) - { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 -$as_echo "yes" >&6; } - ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1" - HAVE_SIT=1 - ;; -no) - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } - ;; -*) - as_fn_error $? "\"enable-sit requires yes or no\"" "$LINENO" 5 - ;; -esac - - -# -# Source Identity Token algorithm choice -# - -# Check whether --with-sit-alg was given. -if test "${with_sit_alg+set}" = set; then : - withval=$with_sit_alg; with_sit_alg="$withval" +# Check whether --with-cc-alg was given. +if test "${with_cc_alg+set}" = set; then : + withval=$with_cc_alg; with_cc_alg="$withval" else - with_sit_alg="auto" + with_cc_alg="auto" fi -if test "$enable_sit" = "yes" -then - case $with_sit_alg in - *1) - with_sit_alg="sha1" - ;; - *2*) - with_sit_alg="sha256" - ;; - auto) - if test "$with_aes" != "no" - then - with_aes="yes" - fi - ;; - *) - with_sit_alg="aes" - if test "$with_aes" != "no" - then - with_aes="yes" - fi - ;; - esac -fi -if test "with_aes" = "checksit" +case $with_cc_alg in + *1) + with_cc_alg="sha1" + ;; + *2*) + with_cc_alg="sha256" + ;; + auto) + if test "$with_aes" != "no" + then + with_aes="yes" + fi + ;; + *) + with_cc_alg="aes" + if test "$with_aes" != "no" + then + with_aes="yes" + fi + ;; +esac +if test "with_aes" = "checkcc" then with_aes="no" fi @@ -16107,77 +16066,62 @@ fi # -# Choose SIT algorithm +# Choose Client Cookie algorithm # -if test "$enable_sit" = "yes" +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for Client Cookie" >&5 +$as_echo_n "checking for the Algorithm for Client Cookie... " >&6; } +if test "$with_cc_alg" = "auto" then - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for SIT" >&5 -$as_echo_n "checking for the Algorithm for SIT... " >&6; } - if test "$with_sit_alg" = "auto" + if test "$with_aes" = "yes" then - if test "$with_aes" = "yes" - then - with_sit_alg="aes" - else - with_sit_alg="sha256" - fi + with_cc_alg="aes" + else + with_cc_alg="sha256" fi fi -case $with_sit_alg in +case $with_cc_alg in sha1) - if test "$enable_sit" != "yes" - then - as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5; - fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: sha1" >&5 $as_echo "sha1" >&6; } if test "$CRYPTO" = "-DOPENSSL" then - if test "$want_openssl_hash" = "checksit" + if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="yes" fi fi -$as_echo "#define HMAC_SHA1_SIT 1" >>confdefs.h +$as_echo "#define HMAC_SHA1_CC 1" >>confdefs.h ;; sha256) - if test "$enable_sit" != "yes" - then - as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5; - fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: sha256" >&5 $as_echo "sha256" >&6; } if test "$CRYPTO" = "-DOPENSSL" then - if test "$want_openssl_hash" = "checksit" + if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="yes" fi fi -$as_echo "#define HMAC_SHA256_SIT 1" >>confdefs.h +$as_echo "#define HMAC_SHA256_CC 1" >>confdefs.h ;; aes) - if test "$enable_sit" != "yes" - then - as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5; - fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: aes" >&5 $as_echo "aes" >&6; } if test "$with_aes" != "yes" then - as_fn_error $? "\"SIT wants to use unavailable AES\"" "$LINENO" 5; + as_fn_error $? "\"Client Cookie wants to use unavailable AES\"" "$LINENO" 5; fi -$as_echo "#define AES_SIT 1" >>confdefs.h +$as_echo "#define AES_CC 1" >>confdefs.h ;; esac -if test "$want_openssl_hash" = "checksit" +if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="no" fi @@ -22069,7 +22013,7 @@ ac_config_commands="$ac_config_commands chmod" # elsewhere if there's a good reason for doing so. # -ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/sit/prereq.sh bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh" +ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh" # @@ -23126,7 +23070,6 @@ do "bin/tests/system/rndc/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rndc/Makefile" ;; "bin/tests/system/rpz/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rpz/Makefile" ;; "bin/tests/system/rsabigexponent/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rsabigexponent/Makefile" ;; - "bin/tests/system/sit/prereq.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/sit/prereq.sh" ;; "bin/tests/system/tkey/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tkey/Makefile" ;; "bin/tests/system/tsiggss/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tsiggss/Makefile" ;; "bin/tests/tasks/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/tasks/Makefile" ;; @@ -24514,11 +24457,8 @@ fi test "$use_tuning" = "large" && echo " Large-system tuning (--with-tuning)" test "$use_geoip" = "no" || echo " GeoIP access control (--with-geoip)" test "$use_gssapi" = "no" || echo " GSS-API (--with-gssapi)" -if test "$enable_sit" != "no"; then - echo " Source Identity Token support (--enable-sit)" - if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then - echo " Algorithm: $with_sit_alg" - fi +if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then + echo " Algorithm: $with_cc_alg" fi # these lines are only printed if run with --enable-full-report @@ -24588,7 +24528,6 @@ test "$use_tuning" = "large" || echo " Large-system tuning (--with-tuning)" test "$use_geoip" = "no" && echo " GeoIP access control (--with-geoip)" test "$use_gssapi" = "no" && echo " GSS-API (--with-gssapi)" -test "$enable_sit" = "no" && echo " Source Identity Token support (--enable-sit)" test "$enable_fixed" = "yes" || \ echo " Allow 'fixed' rrset-order (--enable-fixed-rrset)" diff --git a/configure.in b/configure.in index afe0708b547..f9f11d82511 100644 --- a/configure.in +++ b/configure.in @@ -91,7 +91,6 @@ yes) test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes test "${enable_symtable+set}" = set || enable_symtable=all - test "${enable_sit+set}" = set || enable_sit=yes test "${enable_warn_error+set}" = set || enable_warn_error=yes test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes ;; @@ -1314,73 +1313,44 @@ AC_ARG_WITH(ecdsa, [ --with-ecdsa Crypto ECDSA], AC_ARG_WITH(gost, [ --with-gost Crypto GOST [yes|no|raw|asn1].], with_gost="$withval", with_gost="auto") AC_ARG_WITH(aes, [ --with-aes Crypto AES], - with_aes="$withval", with_aes="checksit") + with_aes="$withval", with_aes="checkcc") # # was --enable-openssl-hash specified? # AC_ARG_ENABLE(openssl-hash, [ --enable-openssl-hash use OpenSSL for hash functions [[default=no]]], - want_openssl_hash="$enableval", want_openssl_hash="checksit") + want_openssl_hash="$enableval", want_openssl_hash="checkcc") # -# Enable Source Identity Token support +# Client Cookie algorithm choice # -AC_MSG_CHECKING(for Source Identity Token support) -AC_ARG_ENABLE(sit, - [ --enable-sit enable source identity token [[default=no]]], - enable_sit="$enableval", enable_sit="no") -HAVE_SIT= -ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT" +AC_ARG_WITH(cc-alg, + [ --with-cc-alg=ALG choose the algorithm for Client Cookie [[aes|sha1|sha256]]], + with_cc_alg="$withval", with_cc_alg="auto") -case "$enable_sit" in -yes) - AC_MSG_RESULT(yes) - ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1" - HAVE_SIT=1 - ;; -no) - AC_MSG_RESULT(no) - ;; -*) - AC_MSG_ERROR("enable-sit requires yes or no") - ;; +case $with_cc_alg in + *1) + with_cc_alg="sha1" + ;; + *2*) + with_cc_alg="sha256" + ;; + auto) + if test "$with_aes" != "no" + then + with_aes="yes" + fi + ;; + *) + with_cc_alg="aes" + if test "$with_aes" != "no" + then + with_aes="yes" + fi + ;; esac -AC_SUBST(ISC_PLATFORM_USESIT) -AC_SUBST(HAVE_SIT) - -# -# Source Identity Token algorithm choice -# -AC_ARG_WITH(sit-alg, - [ --with-sit-alg=ALG choose the algorithm for SIT [[aes|sha1|sha256]]], - with_sit_alg="$withval", with_sit_alg="auto") - -if test "$enable_sit" = "yes" -then - case $with_sit_alg in - *1) - with_sit_alg="sha1" - ;; - *2*) - with_sit_alg="sha256" - ;; - auto) - if test "$with_aes" != "no" - then - with_aes="yes" - fi - ;; - *) - with_sit_alg="aes" - if test "$with_aes" != "no" - then - with_aes="yes" - fi - ;; - esac -fi -if test "with_aes" = "checksit" +if test "with_aes" = "checkcc" then with_aes="no" fi @@ -1802,70 +1772,55 @@ fi AC_SUBST(ISC_PLATFORM_WANTAES) # -# Choose SIT algorithm +# Choose Client Cookie algorithm # -if test "$enable_sit" = "yes" +AC_MSG_CHECKING(for the Algorithm for Client Cookie) +if test "$with_cc_alg" = "auto" then - AC_MSG_CHECKING(for the Algorithm for SIT) - if test "$with_sit_alg" = "auto" + if test "$with_aes" = "yes" then - if test "$with_aes" = "yes" - then - with_sit_alg="aes" - else - with_sit_alg="sha256" - fi + with_cc_alg="aes" + else + with_cc_alg="sha256" fi fi -case $with_sit_alg in +case $with_cc_alg in sha1) - if test "$enable_sit" != "yes" - then - AC_MSG_ERROR("with-sit-alg requires enable-sit"); - fi AC_MSG_RESULT(sha1) if test "$CRYPTO" = "-DOPENSSL" then - if test "$want_openssl_hash" = "checksit" + if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="yes" fi fi - AC_DEFINE(HMAC_SHA1_SIT, 1, - [Use HMAC-SHA1 for Source Identity Token generation]) + AC_DEFINE(HMAC_SHA1_CC, 1, + [Use HMAC-SHA1 for Client Cookie generation]) ;; sha256) - if test "$enable_sit" != "yes" - then - AC_MSG_ERROR("with-sit-alg requires enable-sit"); - fi AC_MSG_RESULT(sha256) if test "$CRYPTO" = "-DOPENSSL" then - if test "$want_openssl_hash" = "checksit" + if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="yes" fi fi - AC_DEFINE(HMAC_SHA256_SIT, 1, - [Use HMAC-SHA256 for Source Identity Token generation]) + AC_DEFINE(HMAC_SHA256_CC, 1, + [Use HMAC-SHA256 for Client Cookie generation]) ;; aes) - if test "$enable_sit" != "yes" - then - AC_MSG_ERROR("with-sit-alg requires enable-sit"); - fi AC_MSG_RESULT(aes) if test "$with_aes" != "yes" then - AC_MSG_ERROR("SIT wants to use unavailable AES"); + AC_MSG_ERROR("Client Cookie wants to use unavailable AES"); fi - AC_DEFINE(AES_SIT, 1, - [Use AES for Source Identity Token generation]) + AC_DEFINE(AES_CC, 1, + [Use AES for Client Cookie generation]) ;; esac -if test "$want_openssl_hash" = "checksit" +if test "$want_openssl_hash" = "checkcc" then want_openssl_hash="no" fi @@ -4700,7 +4655,6 @@ AC_CONFIG_FILES([ bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile - bin/tests/system/sit/prereq.sh bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile @@ -4815,11 +4769,8 @@ fi test "$use_tuning" = "large" && echo " Large-system tuning (--with-tuning)" test "$use_geoip" = "no" || echo " GeoIP access control (--with-geoip)" test "$use_gssapi" = "no" || echo " GSS-API (--with-gssapi)" -if test "$enable_sit" != "no"; then - echo " Source Identity Token support (--enable-sit)" - if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then - echo " Algorithm: $with_sit_alg" - fi +if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then + echo " Algorithm: $with_cc_alg" fi # these lines are only printed if run with --enable-full-report @@ -4889,7 +4840,6 @@ test "$use_tuning" = "large" || echo " Large-system tuning (--with-tuning)" test "$use_geoip" = "no" && echo " GeoIP access control (--with-geoip)" test "$use_gssapi" = "no" && echo " GSS-API (--with-gssapi)" -test "$enable_sit" = "no" && echo " Source Identity Token support (--enable-sit)" test "$enable_fixed" = "yes" || \ echo " Allow 'fixed' rrset-order (--enable-fixed-rrset)" diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 70739187997..5df08865652 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -4241,10 +4241,12 @@ category notify { null; }; if not set), if the query was signed (S), EDNS was in used along with the EDNS version number (E(#)), if TCP was used (T), if DO - (DNSSEC Ok) was set (D), or if CD (Checking - Disabled) was set (C). After this the - destination address the query was sent to is - reported. + (DNSSEC Ok) was set (D), if CD (Checking + Disabled) was set (C), if a valid DNS Server + COOKIE was recieved (V), or if a DNS COOKIE + option without a valid Server COOKIE was + present (K). After this the destination + address the query was sent to is reported. @@ -4804,8 +4806,9 @@ badresp:1,adberr:0,findfail:0,valfail:0] multiple-cnames yes_or_no; notify yes_or_no | explicit | master-only; recursion yes_or_no; - request-sit yes_or_no; - sit-secret secret_string; + send-cookie yes_or_no; + cookie-algorithm secret_string; + cookie-secret secret_string; request-nsid yes_or_no; rfc2308-type1 yes_or_no; use-id-pool yes_or_no; @@ -6457,30 +6460,58 @@ options { - request-sit + request-nsid + + This experimental option is obsolete. + + + + + send-cookie - If yes, then a SIT (Source - Identity Token) EDNS option is sent along with - the query. If the resolver has previously talked - to the server, the SIT returned in the previous - transaction is sent. This is used by the server - to determine whether the resolver has talked to - it before. A resolver sending the correct SIT is - assumed not to be an off-path attacker sending a - spoofed-source query; the query is therefore - unlikely to be part of a reflection/amplification - attack, so resolvers sending a correct SIT option - are not subject to response rate limiting (RRL). - Resolvers which do not send a correct SIT option - may be limited to receiving smaller responses via - the nosit-udp-size option. + If yes, then a COOKIE EDNS + option is sent along with the query. If the + resolver has previously talked to the server, the + COOKIE returned in the previous transaction is sent. + This is used by the server to determine whether + the resolver has talked to it before. A resolver + sending the correct COOKIE is assumed not to be an + off-path attacker sending a spoofed-source query; + the query is therefore unlikely to be part of a + reflection/amplification attack, so resolvers + sending a correct COOKIE option are not subject to + response rate limiting (RRL). Resolvers which + do not send a correct COOKIE option may be limited + to receiving smaller responses via the + nocookie-udp-size option. sit-secret + + + This experimental option is obsolete. + + + + + + cookie-algorithm + + + Set the algorithm to be used when generating the + server cookie. One of "aes", "sha1" or "sha256". + The default is "aes" if supported by the cryptographic + library or otherwise "sha256". + + + + + + cookie-secret If set, this is a shared secret used for generating @@ -10572,11 +10603,11 @@ example.com CNAME rpz-tcp-only. request-ixfr yes_or_no ; request-expire yes_or_no ; request-nsid yes_or_no ; - request-sit yes_or_no ; + send-cookie yes_or_no ; edns yes_or_no ; edns-udp-size number ; edns-version number ; - nosit-udp-size number ; + nocookie-udp-size number ; max-udp-size number ; tcp-only yes_or_no ; transfers number ; @@ -10742,9 +10773,9 @@ example.com CNAME rpz-tcp-only. - The nosit-udp-size option sets the + The nocookie-udp-size option sets the maximum size of UDP responses that will be sent to - queries without a valid source identity token. The command + queries without a valid server COOKIE. The command max-udp-size option may further limit the response size. @@ -10845,13 +10876,13 @@ example.com CNAME rpz-tcp-only. - The request-sit clause determines - whether the local server will add a SIT EDNS option + The send-cookie clause determines + whether the local server will add a COOKIE EDNS option to requests sent to the server. This overrides - request-sit set at the view or + send-cookie set at the view or option level. The named server may - determine that SIT is not supported by the remote server - and not add a SIT EDNS option to requests. + determine that COOKIE is not supported by the remote server + and not add a COOKIE EDNS option to requests. diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 559a0e60939..afc29285637 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -485,10 +485,22 @@ - When retrying a query via TCP due to the first answer being - truncated, dig will now correctly send - the SIT (server identity token) value returned by the server - in the prior response. [RT #39047] + The experimental SIT option (code point 65001) of BIND + 9.10.0 through BIND 9.10.2 has be replace the COOKIE + option (code point 10) and is no longer experimental and + is sent by default. + + + The SIT related named.conf options have been marked as + obsolete and are otherwise ignored. + + + + + When retrying a query via TCP due to the first answer + being truncated, dig will now correctly + send the Server COOKIE returned by the server in the prior + response. [RT #39047] diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 45cb484be1c..217f4e32288 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -21,6 +21,7 @@ #include +#include #include #include #include @@ -32,23 +33,13 @@ #include #include #include +#include +#include #include #include #include #include -#ifdef ISC_PLATFORM_USESIT -#ifdef AES_SIT -#include -#endif -#ifdef HMAC_SHA1_SIT -#include -#endif -#ifdef HMAC_SHA256_SIT -#include -#endif -#endif - #include #include #include @@ -805,10 +796,13 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, dns_fixedname_t fixed; const char *str; dns_name_t *name; -#ifdef ISC_PLATFORM_USESIT isc_buffer_t b; -#endif isc_uint32_t lifetime = 3600; +#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES) + const char *ccalg = "aes"; +#else + const char *ccalg = "sha256"; +#endif static intervaltable intervals[] = { { "cleaning-interval", 60, 28 * 24 * 60 }, /* 28 days */ @@ -1183,9 +1177,18 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, "(%d seconds)", recheck, lifetime); } -#ifdef ISC_PLATFORM_USESIT obj = NULL; - (void) cfg_map_get(options, "sit-secret", &obj); + (void) cfg_map_get(options, "cookie-algorithm,", &obj); + if (obj != NULL) + ccalg = cfg_obj_asstring(obj); +#if !defined(HAVE_OPENSSL_AES) && !defined(HAVE_OPENSSL_EVP_AES) + if (strcasecmp(ccalg, "aes") == 0) + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "cookie-algorithm: '%s' not supported", ccalg); +#endif + + obj = NULL; + (void) cfg_map_get(options, "cookie-secret", &obj); if (obj != NULL) { unsigned char secret[32]; @@ -1194,39 +1197,36 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, tresult = isc_hex_decodestring(cfg_obj_asstring(obj), &b); if (tresult == ISC_R_NOSPACE) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "sit-secret: too long"); + "cookie-secret: too long"); } else if (tresult != ISC_R_SUCCESS) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "sit-secret: invalid hex string"); + "cookie-secret: invalid hex string"); } if (tresult != ISC_R_SUCCESS) result = tresult; -#ifdef AES_SIT + if (tresult == ISC_R_SUCCESS && + strcasecmp(ccalg, "aes") != 0 && isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "AES sit-secret must be on 128 bits"); + "AES cookie-secret must be on 128 bits"); result = ISC_R_RANGE; } -#endif -#ifdef HMAC_SHA1_SIT if (tresult == ISC_R_SUCCESS && + strcasecmp(ccalg, "sha1") != 0 && isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "SHA1 sit-secret must be on 160 bits"); + "SHA1 cookie-secret must be on 160 bits"); result = ISC_R_RANGE; } -#endif -#ifdef HMAC_SHA256_SIT if (tresult == ISC_R_SUCCESS && + strcasecmp(ccalg, "sha256") != 0 && isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "SHA256 sit-secret must be on 256 bits"); + "SHA256 cookie-secret must be on 256 bits"); result = ISC_R_RANGE; } -#endif } -#endif return (result); } @@ -3142,7 +3142,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx, result = ISC_R_FAILURE; /* - * Use case insensitve comparision as not all file systems are + * Use case insensitive comparision as not all file systems are * case sensitive. This will prevent people using FOO.DB and foo.db * on case sensitive file systems but that shouldn't be a major issue. */ diff --git a/lib/dns/adb.c b/lib/dns/adb.c index bbf38a36e76..46e20d278b1 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -256,8 +256,8 @@ struct dns_adbentry { unsigned char to1232; /* IPv6 nofrag */ unsigned char to512; /* plain DNS */ isc_sockaddr_t sockaddr; - unsigned char * sit; - isc_uint16_t sitlen; + unsigned char * cookie; + isc_uint16_t cookielen; isc_stdtime_t expires; isc_stdtime_t lastage; @@ -1817,8 +1817,8 @@ new_adbentry(dns_adb_t *adb) { e->to1432 = 0; e->to1232 = 0; e->to512 = 0; - e->sit = NULL; - e->sitlen = 0; + e->cookie = NULL; + e->cookielen = 0; isc_random_get(&r); e->srtt = (r & 0x1f) + 1; e->lastage = 0; @@ -1856,8 +1856,8 @@ free_adbentry(dns_adb_t *adb, dns_adbentry_t **entry) { e->magic = 0; - if (e->sit != NULL) - isc_mem_put(adb->mctx, e->sit, e->sitlen); + if (e->cookie != NULL) + isc_mem_put(adb->mctx, e->cookie, e->cookielen); li = ISC_LIST_HEAD(e->lameinfo); while (li != NULL) { @@ -3482,16 +3482,13 @@ dump_entry(FILE *f, dns_adbentry_t *entry, isc_boolean_t debug, entry->to512, entry->plain, entry->plainto); if (entry->udpsize != 0U) fprintf(f, " [udpsize %u]", entry->udpsize); -#ifdef ISC_PLATFORM_USESIT - if (entry->sit != NULL) { + if (entry->cookie != NULL) { unsigned int i; - fprintf(f, " [sit="); - for (i = 0; i < entry->sitlen; i++) - fprintf(f, "%02x", entry->sit[i]); + fprintf(f, " [cookie="); + for (i = 0; i < entry->cookielen; i++) + fprintf(f, "%02x", entry->cookie[i]); fprintf(f, "]"); } -#endif - if (entry->expires != 0) fprintf(f, " [ttl %d]", entry->expires - now); fprintf(f, "\n"); @@ -4359,8 +4356,8 @@ dns_adb_probesize2(dns_adb_t *adb, dns_adbaddrinfo_t *addr, int lookups) { } void -dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, - const unsigned char *sit, size_t len) +dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr, + const unsigned char *cookie, size_t len) { int bucket; @@ -4370,27 +4367,28 @@ dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bucket = addr->entry->lock_bucket; LOCK(&adb->entrylocks[bucket]); - if (addr->entry->sit != NULL && - (sit == NULL || len != addr->entry->sitlen)) { - isc_mem_put(adb->mctx, addr->entry->sit, addr->entry->sitlen); - addr->entry->sit = NULL; - addr->entry->sitlen = 0; + if (addr->entry->cookie != NULL && + (cookie == NULL || len != addr->entry->cookielen)) { + isc_mem_put(adb->mctx, addr->entry->cookie, + addr->entry->cookielen); + addr->entry->cookie = NULL; + addr->entry->cookielen = 0; } - if (addr->entry->sit == NULL && sit != NULL && len != 0U) { - addr->entry->sit = isc_mem_get(adb->mctx, len); - if (addr->entry->sit != NULL) - addr->entry->sitlen = (isc_uint16_t)len; + if (addr->entry->cookie == NULL && cookie != NULL && len != 0U) { + addr->entry->cookie = isc_mem_get(adb->mctx, len); + if (addr->entry->cookie != NULL) + addr->entry->cookielen = (isc_uint16_t)len; } - if (addr->entry->sit != NULL) - memmove(addr->entry->sit, sit, len); + if (addr->entry->cookie != NULL) + memmove(addr->entry->cookie, cookie, len); UNLOCK(&adb->entrylocks[bucket]); } size_t -dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, - unsigned char *sit, size_t len) +dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr, + unsigned char *cookie, size_t len) { int bucket; @@ -4399,11 +4397,11 @@ dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bucket = addr->entry->lock_bucket; LOCK(&adb->entrylocks[bucket]); - if (sit != NULL && addr->entry->sit != NULL && - len >= addr->entry->sitlen) + if (cookie != NULL && addr->entry->cookie != NULL && + len >= addr->entry->cookielen) { - memmove(sit, addr->entry->sit, addr->entry->sitlen); - len = addr->entry->sitlen; + memmove(cookie, addr->entry->cookie, addr->entry->cookielen); + len = addr->entry->cookielen; } else len = 0; UNLOCK(&adb->entrylocks[bucket]); diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h index b7e4fafa065..6a1a918cee7 100644 --- a/lib/dns/include/dns/adb.h +++ b/lib/dns/include/dns/adb.h @@ -750,11 +750,11 @@ dns_adb_flushnames(dns_adb_t *adb, dns_name_t *name); */ void -dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, - const unsigned char *sit, size_t len); +dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr, + const unsigned char *cookie, size_t len); /*%< - * Record the Source Identity Token (SIT) associated with this addresss. If - * sit is NULL or len is zero. The recorded SIT is cleared. + * Record the COOKIE associated with this addresss. If + * cookie is NULL or len is zero the recorded COOKIE is cleared. * * Requires: *\li 'adb' is valid. @@ -762,17 +762,18 @@ dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, */ size_t -dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr, - unsigned char *sit, size_t len); +dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr, + unsigned char *cookie, size_t len); /* - * Retieve the saved SIT value and store it in 'sit' which has size 'len'. + * Retieve the saved COOKIE value and store it in 'cookie' which has + * size 'len'. * * Requires: *\li 'adb' is valid. *\li 'addr' is valid. * * Returns: - * The size of the sit token or zero if it doesn't fit in the buffer + * The size of the cookie or zero if it doesn't fit in the buffer * or it doesn't exist. */ diff --git a/lib/dns/include/dns/edns.h b/lib/dns/include/dns/edns.h index f02402fcb4f..8e5a5df6986 100644 --- a/lib/dns/include/dns/edns.h +++ b/lib/dns/include/dns/edns.h @@ -24,7 +24,7 @@ #ifdef DRAFT_ANDREWS_EDNS1 #undef DNS_EDNS_VERSION /* - * Warning: this currently disables sending SIT requests in resolver.c + * Warning: this currently disables sending COOKIE requests in resolver.c */ #define DNS_EDNS_VERSION 1 /* draft-andrews-edns1 */ #endif diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h index ed09bd2c759..27e387c7a6c 100644 --- a/lib/dns/include/dns/message.h +++ b/lib/dns/include/dns/message.h @@ -107,9 +107,9 @@ #define DNS_OPT_NSID 0x0003 /*%< NSID opt code */ #define DNS_OPT_CLIENT_SUBNET 0x0008 /*%< client subnet opt code */ #define DNS_OPT_EXPIRE 0x0009 /*%< EXPIRE opt code */ +#define DNS_OPT_COOKIE 0x000a /*%< COOKIE opt code */ /*%< Experimental options [65001...65534] as per RFC6891 */ -#define DNS_OPT_SIT 65001 /*%< SIT opt code */ /*%< The number of EDNS options we know about. */ #define DNS_EDNSOPTIONS 5 @@ -219,8 +219,8 @@ struct dns_message { unsigned int verify_attempted : 1; unsigned int free_query : 1; unsigned int free_saved : 1; - unsigned int sitok : 1; - unsigned int sitbad : 1; + unsigned int cc_ok : 1; + unsigned int cc_bad : 1; unsigned int opt_reserved; unsigned int sig_reserved; diff --git a/lib/dns/include/dns/peer.h b/lib/dns/include/dns/peer.h index 6ad7db5579a..a470c11425e 100644 --- a/lib/dns/include/dns/peer.h +++ b/lib/dns/include/dns/peer.h @@ -74,7 +74,7 @@ struct dns_peer { isc_boolean_t request_ixfr; isc_boolean_t support_edns; isc_boolean_t request_nsid; - isc_boolean_t request_sit; + isc_boolean_t send_cookie; isc_boolean_t request_expire; isc_boolean_t force_tcp; dns_name_t *key; @@ -164,10 +164,10 @@ isc_result_t dns_peer_getrequestnsid(dns_peer_t *peer, isc_boolean_t *retval); isc_result_t -dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval); +dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval); isc_result_t -dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval); +dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval); isc_result_t dns_peer_setrequestexpire(dns_peer_t *peer, isc_boolean_t newval); diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h index d10c7f3c089..3027f047aba 100644 --- a/lib/dns/include/dns/result.h +++ b/lib/dns/include/dns/result.h @@ -156,8 +156,9 @@ #define DNS_R_NTACOVERED (ISC_RESULTCLASS_DNS + 110) #define DNS_R_BADCDS (ISC_RESULTCLASS_DNS + 111) #define DNS_R_BADCDNSKEY (ISC_RESULTCLASS_DNS + 112) +#define DNS_R_OPTERR (ISC_RESULTCLASS_DNS + 113) -#define DNS_R_NRESULTS 113 /*%< Number of results */ +#define DNS_R_NRESULTS 114 /*%< Number of results */ /* * DNS wire format rcodes. diff --git a/lib/dns/include/dns/stats.h b/lib/dns/include/dns/stats.h index 534da4df4f8..138e3baed4f 100644 --- a/lib/dns/include/dns/stats.h +++ b/lib/dns/include/dns/stats.h @@ -66,18 +66,13 @@ enum { dns_resstatscounter_dispreqtcp = 32, dns_resstatscounter_buckets = 33, dns_resstatscounter_refused = 34, -#ifdef ISC_PLATFORM_USESIT - dns_resstatscounter_sitcc = 35, - dns_resstatscounter_sitout = 36, - dns_resstatscounter_sitin = 37, - dns_resstatscounter_sitok = 38, - + dns_resstatscounter_cookienew = 35, + dns_resstatscounter_cookieout = 36, + dns_resstatscounter_cookiein = 37, + dns_resstatscounter_cookieok = 38, dns_resstatscounter_badvers = 39, - dns_resstatscounter_max = 40, -#else - dns_resstatscounter_badvers = 35, - dns_resstatscounter_max = 36, -#endif + dns_resstatscounter_badcookie = 40, + dns_resstatscounter_max = 41, /* * DNSSEC stats. diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h index e53d22cb1fa..3481bf9e629 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h @@ -244,8 +244,11 @@ enum { /* * Extended rcodes. */ - dns_rcode_badvers = 16 + dns_rcode_badvers = 16, #define dns_rcode_badvers ((dns_rcode_t)dns_rcode_badvers) + /* Private space [3841..4095] */ + dns_rcode_badcookie = 3860 +#define dns_rcode_badcookie ((dns_rcode_t)dns_rcode_badcookie) }; /*% diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h index e5d2396f067..4003eae1fea 100644 --- a/lib/dns/include/dns/view.h +++ b/lib/dns/include/dns/view.h @@ -147,7 +147,7 @@ struct dns_view { dns_rrl_t * rrl; isc_boolean_t provideixfr; isc_boolean_t requestnsid; - isc_boolean_t requestsit; + isc_boolean_t sendcookie; dns_ttl_t maxcachettl; dns_ttl_t maxncachettl; isc_uint32_t nta_lifetime; @@ -166,7 +166,7 @@ struct dns_view { dns_name_t * dlv; dns_fixedname_t dlv_fixed; isc_uint16_t maxudp; - isc_uint16_t situdp; + isc_uint16_t nocookieudp; unsigned int maxbits; dns_aaaa_t v4_aaaa; dns_aaaa_t v6_aaaa; diff --git a/lib/dns/message.c b/lib/dns/message.c index 5a09059075e..9575cd5bd25 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -444,8 +444,8 @@ msginit(dns_message_t *m) { m->saved.base = NULL; m->saved.length = 0; m->free_saved = 0; - m->sitok = 0; - m->sitbad = 0; + m->cc_ok = 0; + m->cc_bad = 0; m->querytsig = NULL; } @@ -494,8 +494,8 @@ msgresetopt(dns_message_t *msg) dns_rdataset_disassociate(msg->opt); isc_mempool_put(msg->rdspool, msg->opt); msg->opt = NULL; - msg->sitok = 0; - msg->sitbad = 0; + msg->cc_ok = 0; + msg->cc_bad = 0; } } @@ -3323,8 +3323,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg, if (optcode == DNS_OPT_NSID) { ADD_STRING(target, "; NSID"); - } else if (optcode == DNS_OPT_SIT) { - ADD_STRING(target, "; SIT"); + } else if (optcode == DNS_OPT_COOKIE) { + ADD_STRING(target, "; COOKIE"); } else if (optcode == DNS_OPT_CLIENT_SUBNET) { ADD_STRING(target, "; CLIENT-SUBNET: "); render_ecs(&optbuf, target); @@ -3357,7 +3357,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg, for (i = 0; i < optlen; i++) { const char *sep; switch (optcode) { - case DNS_OPT_SIT: + case DNS_OPT_COOKIE: sep = ""; break; default: @@ -3371,17 +3371,17 @@ dns_message_pseudosectiontotext(dns_message_t *msg, isc_buffer_forward(&optbuf, optlen); - if (optcode == DNS_OPT_SIT) { - if (msg->sitok) + if (optcode == DNS_OPT_COOKIE) { + if (msg->cc_ok) ADD_STRING(target, " (good)"); - if (msg->sitbad) + if (msg->cc_bad) ADD_STRING(target, " (bad)"); ADD_STRING(target, "\n"); continue; } /* - * For non-SIT options, add a printable + * For non-COOKIE options, add a printable * version */ ADD_STRING(target, "(\""); diff --git a/lib/dns/peer.c b/lib/dns/peer.c index 728a533f162..c444b3a27ed 100644 --- a/lib/dns/peer.c +++ b/lib/dns/peer.c @@ -43,7 +43,7 @@ #define SERVER_UDPSIZE_BIT 6 #define SERVER_MAXUDP_BIT 7 #define REQUEST_NSID_BIT 8 -#define REQUEST_SIT_BIT 9 +#define SEND_COOKIE_BIT 9 #define NOTIFY_DSCP_BIT 10 #define TRANSFER_DSCP_BIT 11 #define QUERY_DSCP_BIT 12 @@ -455,26 +455,26 @@ dns_peer_getrequestnsid(dns_peer_t *peer, isc_boolean_t *retval) { } isc_result_t -dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval) { +dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval) { isc_boolean_t existed; REQUIRE(DNS_PEER_VALID(peer)); - existed = DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags); + existed = DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags); - peer->request_sit = newval; - DNS_BIT_SET(REQUEST_SIT_BIT, &peer->bitflags); + peer->send_cookie = newval; + DNS_BIT_SET(SEND_COOKIE_BIT, &peer->bitflags); return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS); } isc_result_t -dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval) { +dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval) { REQUIRE(DNS_PEER_VALID(peer)); REQUIRE(retval != NULL); - if (DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags)) { - *retval = peer->request_sit; + if (DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags)) { + *retval = peer->send_cookie; return (ISC_R_SUCCESS); } else return (ISC_R_NOTFOUND); diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c index 0b74744d966..1d09a13ad92 100644 --- a/lib/dns/rcode.c +++ b/lib/dns/rcode.c @@ -68,6 +68,7 @@ #define ERCODENAMES \ /* extended rcodes */ \ { dns_rcode_badvers, "BADVERS", 0}, \ + { dns_rcode_badcookie, "BADCOOKIE", 0}, \ { 0, NULL, 0 } #define TSIGRCODENAMES \ diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c index ba3fef001a1..7ae5e865bb6 100644 --- a/lib/dns/rdata/generic/opt_41.c +++ b/lib/dns/rdata/generic/opt_41.c @@ -128,7 +128,7 @@ fromwire_opt(ARGS_FROMWIRE) { isc_uint8_t addrbytes; if (length < 4) - return (DNS_R_FORMERR); + return (DNS_R_OPTERR); family = uint16_fromregion(&sregion); isc_region_consume(&sregion, 2); addrlen = uint8_fromregion(&sregion); @@ -138,16 +138,18 @@ fromwire_opt(ARGS_FROMWIRE) { switch (family) { case 1: if (addrlen > 32U || scope > 32U) - return (DNS_R_FORMERR); + return (DNS_R_OPTERR); break; case 2: if (addrlen > 128U || scope > 128U) - return (DNS_R_FORMERR); + return (DNS_R_OPTERR); break; + default: + return (DNS_R_OPTERR); } addrbytes = (addrlen + 7) / 8; if (addrbytes + 4 != length) - return (DNS_R_FORMERR); + return (DNS_R_OPTERR); isc_region_consume(&sregion, addrbytes); break; } @@ -156,6 +158,11 @@ fromwire_opt(ARGS_FROMWIRE) { * Request has zero length. Response is 32 bits. */ if (length != 0 && length != 4) + return (DNS_R_OPTERR); + isc_region_consume(&sregion, length); + break; + case DNS_OPT_COOKIE: + if (length != 8 && (length < 16 || length > 40)) return (DNS_R_FORMERR); isc_region_consume(&sregion, length); break; diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index e6dde5cbafa..648ccb4a1df 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -32,7 +32,7 @@ #include #include -#ifdef AES_SIT +#ifdef AES_CC #include #else #include @@ -488,11 +488,12 @@ struct dns_resolver { * Private addrinfo flags. These must not conflict with DNS_FETCHOPT_NOEDNS0 * (0x008) which we also use as an addrinfo flag. */ -#define FCTX_ADDRINFO_MARK 0x0001 -#define FCTX_ADDRINFO_FORWARDER 0x1000 -#define FCTX_ADDRINFO_TRIED 0x2000 -#define FCTX_ADDRINFO_EDNSOK 0x4000 -#define FCTX_ADDRINFO_NOSIT 0x8000 +#define FCTX_ADDRINFO_MARK 0x00001 +#define FCTX_ADDRINFO_FORWARDER 0x01000 +#define FCTX_ADDRINFO_TRIED 0x02000 +#define FCTX_ADDRINFO_EDNSOK 0x04000 +#define FCTX_ADDRINFO_NOCOOKIE 0x08000 +#define FCTX_ADDRINFO_BADCOOKIE 0x10000 #define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) \ == 0) @@ -500,10 +501,12 @@ struct dns_resolver { FCTX_ADDRINFO_FORWARDER) != 0) #define TRIED(a) (((a)->flags & \ FCTX_ADDRINFO_TRIED) != 0) -#define NOSIT(a) (((a)->flags & \ - FCTX_ADDRINFO_NOSIT) != 0) +#define NOCOOKIE(a) (((a)->flags & \ + FCTX_ADDRINFO_NOCOOKIE) != 0) #define EDNSOK(a) (((a)->flags & \ FCTX_ADDRINFO_EDNSOK) != 0) +#define BADCOOKIE(a) (((a)->flags & \ + FCTX_ADDRINFO_BADCOOKIE) != 0) #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) @@ -1798,10 +1801,9 @@ add_triededns512(fetchctx_t *fctx, isc_sockaddr_t *address) { ISC_LIST_INITANDAPPEND(fctx->edns512, tried, link); } -#ifdef ISC_PLATFORM_USESIT static void -compute_cc(resquery_t *query, unsigned char *sit, size_t len) { -#ifdef AES_SIT +compute_cc(resquery_t *query, unsigned char *cookie, size_t len) { +#ifdef AES_CC unsigned char digest[ISC_AES_BLOCK_LENGTH]; unsigned char input[16]; isc_netaddr_t netaddr; @@ -1822,9 +1824,9 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) { isc_aes128_crypt(query->fctx->res->view->secret, input, digest); for (i = 0; i < 8; i++) digest[i] ^= digest[i + 8]; - memmove(sit, digest, 8); + memmove(cookie, digest, 8); #endif -#ifdef HMAC_SHA1_SIT +#ifdef HMAC_SHA1_CC unsigned char digest[ISC_SHA1_DIGESTLENGTH]; isc_netaddr_t netaddr; isc_hmacsha1_t hmacsha1; @@ -1845,10 +1847,10 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) { break; } isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest)); - memmove(sit, digest, 8); + memmove(cookie, digest, 8); isc_hmacsha1_invalidate(&hmacsha1); #endif -#ifdef HMAC_SHA256_SIT +#ifdef HMAC_SHA256_CC unsigned char digest[ISC_SHA256_DIGESTLENGTH]; isc_netaddr_t netaddr; isc_hmacsha256_t hmacsha256; @@ -1869,11 +1871,10 @@ compute_cc(resquery_t *query, unsigned char *sit, size_t len) { break; } isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest)); - memmove(sit, digest, 8); + memmove(cookie, digest, 8); isc_hmacsha256_invalidate(&hmacsha256); #endif } -#endif static isc_result_t issecuredomain(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, @@ -2119,10 +2120,8 @@ resquery_send(resquery_t *query) { unsigned int version = DNS_EDNS_VERSION; unsigned int flags = query->addrinfo->flags; isc_boolean_t reqnsid = res->view->requestnsid; -#ifdef ISC_PLATFORM_USESIT - isc_boolean_t reqsit = res->view->requestsit; - unsigned char sit[64]; -#endif + isc_boolean_t sendcookie = res->view->sendcookie; + unsigned char cookie[64]; if ((flags & FCTX_ADDRINFO_EDNSOK) != 0 && (query->options & DNS_FETCHOPT_EDNS512) == 0) { @@ -2163,23 +2162,20 @@ resquery_send(resquery_t *query) { version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT; } - /* Request NSID/SIT/VERSION for current peer? */ + /* Request NSID/COOKIE/VERSION for current peer? */ if (peer != NULL) { isc_uint8_t ednsversion; (void) dns_peer_getrequestnsid(peer, &reqnsid); -#ifdef ISC_PLATFORM_USESIT - (void) dns_peer_getrequestsit(peer, &reqsit); -#endif + (void) dns_peer_getsendcookie(peer, + &sendcookie); result = dns_peer_getednsversion(peer, &ednsversion); if (result == ISC_R_SUCCESS && ednsversion < version) version = ednsversion; } -#ifdef ISC_PLATFORM_USESIT - if (NOSIT(query->addrinfo)) - reqsit = ISC_FALSE; -#endif + if (NOCOOKIE(query->addrinfo)) + sendcookie = ISC_FALSE; if (reqnsid) { INSIST(ednsopt < DNS_EDNSOPTIONS); ednsopts[ednsopt].code = DNS_OPT_NSID; @@ -2187,37 +2183,36 @@ resquery_send(resquery_t *query) { ednsopts[ednsopt].value = NULL; ednsopt++; } -#ifdef ISC_PLATFORM_USESIT #if DNS_EDNS_VERSION > 0 /* * Some EDNS(0) servers don't ignore unknown options * as it was not a explict requirement of RFC 2671. - * Only send SIT to EDNS(1) servers. + * Only send COOKIE to EDNS(1) servers. */ if (version < 1) - reqsit = ISC_FALSE; + sendcookie = ISC_FALSE; #endif - if (reqsit) { + if (sendcookie) { INSIST(ednsopt < DNS_EDNSOPTIONS); - ednsopts[ednsopt].code = DNS_OPT_SIT; + ednsopts[ednsopt].code = DNS_OPT_COOKIE; ednsopts[ednsopt].length = (isc_uint16_t) - dns_adb_getsit(fctx->adb, - query->addrinfo, - sit, sizeof(sit)); + dns_adb_getcookie(fctx->adb, + query->addrinfo, + cookie, + sizeof(cookie)); if (ednsopts[ednsopt].length != 0) { - ednsopts[ednsopt].value = sit; + ednsopts[ednsopt].value = cookie; inc_stats(fctx->res, - dns_resstatscounter_sitout); + dns_resstatscounter_cookieout); } else { - compute_cc(query, sit, sizeof(sit)); - ednsopts[ednsopt].value = sit; + compute_cc(query, cookie, 8); + ednsopts[ednsopt].value = cookie; ednsopts[ednsopt].length = 8; inc_stats(fctx->res, - dns_resstatscounter_sitcc); + dns_resstatscounter_cookienew); } ednsopt++; } -#endif query->ednsversion = version; result = fctx_addopt(fctx->qmessage, version, udpsize, ednsopts, ednsopt); @@ -7282,11 +7277,9 @@ process_opt(resquery_t *query, dns_rdataset_t *opt) { isc_result_t result; isc_uint16_t optcode; isc_uint16_t optlen; -#ifdef ISC_PLATFORM_USESIT - unsigned char *sit; + unsigned char *optvalue; dns_adbaddrinfo_t *addrinfo; unsigned char cookie[8]; -#endif result = dns_rdataset_first(opt); if (result == ISC_R_SUCCESS) { @@ -7306,27 +7299,26 @@ process_opt(resquery_t *query, dns_rdataset_t *opt) { query->fctx->res->mctx); isc_buffer_forward(&optbuf, optlen); break; -#ifdef ISC_PLATFORM_USESIT - case DNS_OPT_SIT: - sit = isc_buffer_current(&optbuf); + case DNS_OPT_COOKIE: + optvalue = isc_buffer_current(&optbuf); compute_cc(query, cookie, sizeof(cookie)); - INSIST(query->fctx->rmessage->sitbad == 0 && - query->fctx->rmessage->sitok == 0); + INSIST(query->fctx->rmessage->cc_bad == 0 && + query->fctx->rmessage->cc_ok == 0); if (optlen >= 8U && - memcmp(cookie, sit, 8) == 0) { - query->fctx->rmessage->sitok = 1; + memcmp(cookie, optvalue, 8) == 0) { + query->fctx->rmessage->cc_ok = 1; inc_stats(query->fctx->res, - dns_resstatscounter_sitok); + dns_resstatscounter_cookieok); addrinfo = query->addrinfo; - dns_adb_setsit(query->fctx->adb, - addrinfo, sit, optlen); + dns_adb_setcookie(query->fctx->adb, + addrinfo, optvalue, + optlen); } else - query->fctx->rmessage->sitbad = 1; + query->fctx->rmessage->cc_bad = 1; isc_buffer_forward(&optbuf, optlen); inc_stats(query->fctx->res, - dns_resstatscounter_sitin); + dns_resstatscounter_cookiein); break; -#endif default: isc_buffer_forward(&optbuf, optlen); break; @@ -7551,17 +7543,15 @@ resquery_response(isc_task_t *task, isc_event_t *event) { process_opt(query, opt); #ifdef notyet -#ifdef ISC_PLATFORM_USESIT - if (message->sitbad) { + if (message->cc_bad) { /* - * If the SIT is bad assume it is a attack and retry. + * If the COOKIE is bad assume it is a attack and retry. */ resend = ISC_TRUE; /* XXXMPA log it */ - FCTXTRACE("bad sit"); + FCTXTRACE("bad cookie"); goto done; } -#endif #endif /* @@ -7700,6 +7690,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) { case dns_rcode_badvers: inc_stats(fctx->res, dns_resstatscounter_badvers); break; + case dns_rcode_badcookie: + inc_stats(fctx->res, dns_resstatscounter_badcookie); + break; default: inc_stats(fctx->res, dns_resstatscounter_othererror); break; @@ -7713,29 +7706,26 @@ resquery_response(isc_task_t *task, isc_event_t *event) { message->rcode != dns_rcode_nxdomain) { isc_buffer_t b; char code[64]; -#ifdef ISC_PLATFORM_USESIT - unsigned char sit[64]; + unsigned char cookie[64]; /* * Some servers do not ignore unknown EDNS options. */ - if (!NOSIT(query->addrinfo) && + if (!NOCOOKIE(query->addrinfo) && (message->rcode == dns_rcode_formerr || message->rcode == dns_rcode_notimp || message->rcode == dns_rcode_refused) && - dns_adb_getsit(fctx->adb, query->addrinfo, - sit, sizeof(sit)) == 0U) { + dns_adb_getcookie(fctx->adb, query->addrinfo, + cookie, sizeof(cookie)) == 0U) { dns_adb_changeflags(fctx->adb, query->addrinfo, - FCTX_ADDRINFO_NOSIT, - FCTX_ADDRINFO_NOSIT); + FCTX_ADDRINFO_NOCOOKIE, + FCTX_ADDRINFO_NOCOOKIE); resend = ISC_TRUE; - } else -#endif - if (((message->rcode == dns_rcode_formerr || - message->rcode == dns_rcode_notimp) || - (message->rcode == dns_rcode_servfail && - dns_message_getopt(message) == NULL)) && - (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { + } else if ((message->rcode == dns_rcode_formerr || + message->rcode == dns_rcode_notimp || + (message->rcode == dns_rcode_servfail && + dns_message_getopt(message) == NULL)) && + (query->options & DNS_FETCHOPT_NOEDNS0) == 0) { /* * It's very likely they don't like EDNS0. * If the response code is SERVFAIL, also check if the @@ -7784,21 +7774,20 @@ resquery_response(isc_task_t *task, isc_event_t *event) { } else if (message->rcode == dns_rcode_badvers) { unsigned int flags, mask; unsigned int version; -#if defined(ISC_PLATFORM_USESIT) && DNS_EDNS_VERSION == 0 + /* * Some servers return BADVERS to unknown * EDNS options. This cannot be long term - * strategy. Do not disable SIT if we have - * already have received a SIT from this + * strategy. Do not disable COOKIE if we have + * already have received a COOKIE from this * server. */ - if (dns_adb_getsit(fctx->adb, query->addrinfo, - sit, sizeof(sit)) == 0U) { + if (dns_adb_getcookie(fctx->adb, query->addrinfo, + cookie, sizeof(cookie)) == 0U) { dns_adb_changeflags(fctx->adb, query->addrinfo, - FCTX_ADDRINFO_NOSIT, - FCTX_ADDRINFO_NOSIT); + FCTX_ADDRINFO_NOCOOKIE, + FCTX_ADDRINFO_NOCOOKIE); } -#endif resend = ISC_TRUE; INSIST(opt != NULL); @@ -7824,7 +7813,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * RFC 6891 is clear that that they should be ignored. * If we are supporting EDNS > 0 then perform strict * version checking of badvers responses. We won't - * be sending SIT etc. in that case. + * be sending COOKIE etc. in that case. */ #if DNS_EDNS_VERSION == 0 /* Avoids a compiler warning with < 0 */ @@ -7839,6 +7828,15 @@ resquery_response(isc_task_t *task, isc_event_t *event) { broken_server = DNS_R_BADVERS; keep_trying = ISC_TRUE; } + } else if (message->rcode == dns_rcode_badcookie && + message->cc_ok) { + /* + * We have recorded the new cookie. + */ + if (BADCOOKIE(query->addrinfo)) + query->options |= DNS_FETCHOPT_TCP; + query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE; + resend = ISC_TRUE; } else { /* * XXXRTH log. diff --git a/lib/dns/result.c b/lib/dns/result.c index d4a87339a9c..981356b9a39 100644 --- a/lib/dns/result.c +++ b/lib/dns/result.c @@ -162,9 +162,10 @@ static const char *text[DNS_R_NRESULTS] = { "not dynamic", /*%< 108 DNS_R_NOTDYNAMIC */ "bad EUI", /*%< 109 DNS_R_BADEUI */ - "covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */ + "covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */ "bad CDS", /*%< 111 DNS_R_BADCSD */ - "bad CDNSKEY" /*%< 112 DNS_R_BADCDNSKEY */ + "bad CDNSKEY", /*%< 112 DNS_R_BADCDNSKEY */ + "malformed OPT option" /*%< 113 DNS_R_OPTERR */ }; static const char *ids[DNS_R_NRESULTS] = { @@ -389,6 +390,7 @@ dns_result_torcode(isc_result_t result) { */ return ((dns_rcode_t)((result) & 0xFFF)); } + /* * Try to supply an appropriate rcode. */ @@ -418,6 +420,7 @@ dns_result_torcode(isc_result_t result) { case DNS_R_TSIGERRORSET: case DNS_R_UNKNOWN: case DNS_R_NAMETOOLONG: + case DNS_R_OPTERR: rcode = dns_rcode_formerr; break; case DNS_R_DISALLOWED: diff --git a/lib/dns/tests/rdata_test.c b/lib/dns/tests/rdata_test.c index 1c866de4a7a..9c73cc30463 100644 --- a/lib/dns/tests/rdata_test.c +++ b/lib/dns/tests/rdata_test.c @@ -96,7 +96,7 @@ ATF_TC_BODY(edns_client_subnet, tc) { 0x00, 0x08, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00 }, - 8, ISC_TRUE + 8, ISC_FALSE }, { /* Option code family 1 (ipv4), source 0, scope 0 */ diff --git a/lib/dns/view.c b/lib/dns/view.c index 9e48b53a92a..8b821d50515 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -221,7 +221,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, view->flush = ISC_FALSE; view->dlv = NULL; view->maxudp = 0; - view->situdp = 0; + view->nocookieudp = 0; view->maxbits = 0; view->v4_aaaa = dns_aaaa_ok; view->v6_aaaa = dns_aaaa_ok; @@ -233,7 +233,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, view->redirectzone = NULL; dns_fixedname_init(&view->redirectfixed); view->requestnsid = ISC_FALSE; - view->requestsit = ISC_TRUE; + view->sendcookie = ISC_TRUE; view->new_zone_file = NULL; view->new_zone_config = NULL; view->cfg_destroy = NULL; diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in index f110e54f0df..d4d74ec9493 100644 --- a/lib/dns/win32/libdns.def.in +++ b/lib/dns/win32/libdns.def.in @@ -52,16 +52,16 @@ dns_adb_flush dns_adb_flushname dns_adb_flushnames dns_adb_freeaddrinfo +dns_adb_getcookie dns_adb_getudpsize -dns_adb_getsit dns_adb_marklame dns_adb_noedns dns_adb_plainresponse dns_adb_probesize dns_adb_probesize2 dns_adb_setadbsize +dns_adb_setcookie dns_adb_setudpsize -dns_adb_setsit dns_adb_shutdown dns_adb_timeout dns_adb_whenshutdown @@ -452,10 +452,10 @@ dns_message_gettemprdataset dns_message_gettimeadjust dns_message_gettsig dns_message_gettsigkey -dns_message_logpacket -dns_message_logpacket2 dns_message_logfmtpacket dns_message_logfmtpacket2 +dns_message_logpacket +dns_message_logpacket2 dns_message_movename dns_message_nextname dns_message_parse @@ -566,8 +566,8 @@ dns_nsec_build dns_nsec_buildrdata dns_nsec_compressbitmap dns_nsec_isset -dns_nsec_nseconly dns_nsec_noexistnodata +dns_nsec_nseconly dns_nsec_setbit dns_nsec_typepresent dns_ntatable_add @@ -603,7 +603,7 @@ dns_peer_getquerysource dns_peer_getrequestexpire dns_peer_getrequestixfr dns_peer_getrequestnsid -dns_peer_getrequestsit +dns_peer_getsendcookie dns_peer_getsupportedns dns_peer_gettransferdscp dns_peer_gettransferformat @@ -626,7 +626,7 @@ dns_peer_setquerysource dns_peer_setrequestexpire dns_peer_setrequestixfr dns_peer_setrequestnsid -dns_peer_setrequestsit +dns_peer_setsendcookie dns_peer_setsupportedns dns_peer_settransferdscp dns_peer_settransferformat @@ -662,9 +662,9 @@ dns_rbt_fullnamefromnode dns_rbt_hashsize dns_rbt_namefromnode dns_rbt_nodecount -dns_rbt_printtext dns_rbt_printdot dns_rbt_printnodeinfo +dns_rbt_printtext dns_rbt_root dns_rbt_serialize_align dns_rbt_serialize_tree @@ -844,9 +844,9 @@ dns_resolver_reset_ds_digests dns_resolver_resetmustbesecure dns_resolver_setclientsperquery dns_resolver_setlamettl -dns_resolver_setmustbesecure dns_resolver_setmaxdepth dns_resolver_setmaxqueries +dns_resolver_setmustbesecure dns_resolver_setquerydscp4 dns_resolver_setquerydscp6 dns_resolver_settimeout @@ -1151,8 +1151,8 @@ dns_zone_log dns_zone_logc dns_zone_maintenance dns_zone_markdirty -dns_zone_mkey_hour dns_zone_mkey_day +dns_zone_mkey_hour dns_zone_mkey_month dns_zone_name dns_zone_nameonly diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in index 650d770dbfc..3431712c44b 100644 --- a/lib/isc/include/isc/platform.h.in +++ b/lib/isc/include/isc/platform.h.in @@ -335,11 +335,6 @@ @ISC_PLATFORM_NORETURN_PRE@ @ISC_PLATFORM_NORETURN_POST@ -/* - * Defined if we are enabling SIT (Source Identity Token). - */ -@ISC_PLATFORM_USESIT@ - /*** *** Windows dll support. ***/ diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c index 7639501ff2f..a3c016b944f 100644 --- a/lib/isc/pk11.c +++ b/lib/isc/pk11.c @@ -321,7 +321,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) { result = PK11_R_NODIGESTSERVICE; goto unlock; } -#if defined(ISC_PLATFORM_USESIT) && defined(AES_SIT) +#if defined(AES_SIT) if (aes_token == NULL) { result = PK11_R_NOAESSERVICE; goto unlock; diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in index e86a6863533..2fce769fe88 100644 --- a/lib/isc/win32/include/isc/platform.h.in +++ b/lib/isc/win32/include/isc/platform.h.in @@ -115,11 +115,6 @@ */ @ISC_PLATFORM_NEEDSTRCASESTR@ -/* - * Defined if we are enabling SIT (Source Identity Token). - */ -@ISC_PLATFORM_USESIT@ - /* * Set up a macro for importing and exporting from the DLL */ diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 6ddba4da7d7..a0acf0ae80e 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -884,6 +884,11 @@ static cfg_type_t cfg_type_bracketed_portlist = { &cfg_rep_list, &cfg_type_portrange }; +static const char *cookiealg_enums[] = { "aes", "sha1", "sha256", NULL }; +static cfg_type_t cfg_type_cookiealg = { + "cookiealg", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, + &cfg_rep_string, &cookiealg_enums }; + /*% * Clauses that can be found within the top level of the named.conf * file only. @@ -937,6 +942,8 @@ options_clauses[] = { { "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "bindkeys-file", &cfg_type_qstring, 0 }, { "blackhole", &cfg_type_bracketed_aml, 0 }, + { "cookie-secret", &cfg_type_sstring, 0 }, + { "cookie-algorithm", &cfg_type_cookiealg, 0 }, { "coresize", &cfg_type_size, 0 }, { "datasize", &cfg_type_size, 0 }, { "session-keyfile", &cfg_type_qstringornone, 0 }, @@ -968,11 +975,7 @@ options_clauses[] = { { "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI }, { "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI }, { "lock-file", &cfg_type_qstringornone, 0 }, -#ifdef ISC_PLATFORM_USESIT - { "sit-secret", &cfg_type_sstring, 0 }, -#else - { "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_NOTCONFIGURED }, -#endif + { "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_OBSOLETE }, { "managed-keys-directory", &cfg_type_qstring, 0 }, { "match-mapped-addresses", &cfg_type_boolean, 0 }, { "max-rsa-exponent-size", &cfg_type_uint32, 0 }, @@ -1513,11 +1516,8 @@ view_clauses[] = { { "fetch-glue", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 }, { "lame-ttl", &cfg_type_ttlval, 0 }, -#ifdef ISC_PLATFORM_USESIT - { "nosit-udp-size", &cfg_type_uint32, 0 }, -#else - { "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED }, -#endif + { "nocookie-udp-size", &cfg_type_uint32, 0 }, + { "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_OBSOLETE }, { "max-acache-size", &cfg_type_sizenodefault, 0 }, { "max-cache-size", &cfg_type_sizenodefault, 0 }, { "max-cache-ttl", &cfg_type_uint32, 0 }, @@ -1545,16 +1545,13 @@ view_clauses[] = { { "queryport-pool-updateinterval", &cfg_type_uint32, CFG_CLAUSEFLAG_OBSOLETE }, { "recursion", &cfg_type_boolean, 0 }, -#ifdef ISC_PLATFORM_USESIT - { "request-sit", &cfg_type_boolean, 0 }, -#else - { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED }, -#endif + { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "request-nsid", &cfg_type_boolean, 0 }, { "resolver-query-timeout", &cfg_type_uint32, 0 }, { "rfc2308-type1", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI }, { "root-delegation-only", &cfg_type_optional_exclude, 0 }, { "rrset-order", &cfg_type_rrsetorder, 0 }, + { "send-cookie", &cfg_type_boolean, 0 }, { "servfail-ttl", &cfg_type_ttlval, 0 }, { "sortlist", &cfg_type_bracketed_aml, 0 }, { "suppress-initial-notify", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI }, @@ -1827,11 +1824,8 @@ server_clauses[] = { { "request-expire", &cfg_type_boolean, 0 }, { "request-ixfr", &cfg_type_boolean, 0 }, { "request-nsid", &cfg_type_boolean, 0 }, -#ifdef ISC_PLATFORM_USESIT - { "request-sit", &cfg_type_boolean, 0 }, -#else - { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED }, -#endif + { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, + { "send-cookie", &cfg_type_boolean, 0 }, { "support-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "transfer-format", &cfg_type_transferformat, 0 }, { "transfer-source", &cfg_type_sockaddr4wild, 0 }, diff --git a/util/copyrights b/util/copyrights index 9c8ab677ea3..4de0bfe1305 100644 --- a/util/copyrights +++ b/util/copyrights @@ -988,6 +988,17 @@ ./bin/tests/system/common/rndc.key CONF-C 2011,2013 ./bin/tests/system/common/root.hint ZONE 2000,2001,2004,2007 ./bin/tests/system/conf.sh.in SH 2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015 +./bin/tests/system/cookie/.gitignore X 2014 +./bin/tests/system/cookie/bad-sit-badhex.conf CONF-C 2014 +./bin/tests/system/cookie/bad-sit-toolong.conf CONF-C 2014 +./bin/tests/system/cookie/clean.sh SH 2014 +./bin/tests/system/cookie/ns1/example.db ZONE 2014 +./bin/tests/system/cookie/ns1/named.conf CONF-C 2014 +./bin/tests/system/cookie/ns1/root.hint ZONE 2014 +./bin/tests/system/cookie/ns2/named.conf CONF-C 2014 +./bin/tests/system/cookie/ns2/root.db ZONE 2014 +./bin/tests/system/cookie/prereq.sh.in SH 2014 +./bin/tests/system/cookie/tests.sh SH 2014,2015 ./bin/tests/system/coverage/01-ksk-inactive/README X 2013 ./bin/tests/system/coverage/01-ksk-inactive/expect X 2013 ./bin/tests/system/coverage/02-zsk-inactive/README X 2013 @@ -1894,17 +1905,6 @@ ./bin/tests/system/sfcache/prereq.sh SH 2014 ./bin/tests/system/sfcache/setup.sh SH 2014 ./bin/tests/system/sfcache/tests.sh SH 2014 -./bin/tests/system/sit/.gitignore X 2014 -./bin/tests/system/sit/bad-sit-badhex.conf CONF-C 2014 -./bin/tests/system/sit/bad-sit-toolong.conf CONF-C 2014 -./bin/tests/system/sit/clean.sh SH 2014 -./bin/tests/system/sit/ns1/example.db ZONE 2014 -./bin/tests/system/sit/ns1/named.conf CONF-C 2014 -./bin/tests/system/sit/ns1/root.hint ZONE 2014 -./bin/tests/system/sit/ns2/named.conf CONF-C 2014 -./bin/tests/system/sit/ns2/root.db ZONE 2014 -./bin/tests/system/sit/prereq.sh.in SH 2014 -./bin/tests/system/sit/tests.sh SH 2014,2015 ./bin/tests/system/smartsign/child.db ZONE 2010 ./bin/tests/system/smartsign/clean.sh SH 2010,2012,2014 ./bin/tests/system/smartsign/parent.db ZONE 2010