[master] correct dispatch address/port check

3690.	[bug]		Iterative responses could be missed when the source
			port for an upstream query was the same as the
			listener port (53). [RT #34925]

diff --git a/CHANGES b/CHANGES
index eea882c858ec6c00e428ee76ca6738af09be44cb..75828ade810bc1e9a66e4342cf9ede0ab1f8beb0 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3690.  [bug]           Iterative responses could be missed when the source
+                       port for an upstream query was the same as the
+                       listener port (53). [RT #34925]
+
 3689.  [bug]           Fixed a bug causing an insecure delegation from one
                        static-stub zone to another to fail with a broken
                        trust chain. [RT #35081]

diff --git a/bin/tests/system/resolver/clean.sh b/bin/tests/system/resolver/clean.sh
index e6f37f956d56492e227f9d9661cf297a7278f255..5317120864227b56ab9c803946484ea493304c16 100644 (file)
--- a/bin/tests/system/resolver/clean.sh
+++ b/bin/tests/system/resolver/clean.sh
@@ -29,6 +29,6 @@ rm -f ns6/K*
 rm -f ns6/example.net.db.signed ns6/example.net.db
 rm -f ns6/dsset-example.net. ns6/example.net.db.signed.jnl
 rm -f ns6/to-be-removed.tld.db ns6/to-be-removed.tld.db.jnl
-rm -f ns7/server.db ns7/server.db.jnl
+rm -f ns7/server.db ns7/server.db.jnl ns7/named.conf
 rm -f random.data
 rm -f resolve.out

diff --git a/bin/tests/system/resolver/ns7/named.conf b/bin/tests/system/resolver/ns7/named1.conf
similarity index 89%
rename from bin/tests/system/resolver/ns7/named.conf
rename to bin/tests/system/resolver/ns7/named1.conf
index f858105cd51758aab2e60b3491d4d5ca08513abd..aa04023d46dd2076473fafe5c22444331854b8cd 100644 (file)
--- a/bin/tests/system/resolver/ns7/named.conf
+++ b/bin/tests/system/resolver/ns7/named1.conf
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.5 2011/07/28 03:18:17 each Exp $ */
-
 // NS4
 
 controls { /* empty */ };
@@ -33,6 +31,15 @@ options {
        disable-empty-zone 20.172.in-addr.arpa;
 };
 
+key rndc_key {
+       secret "1234abcd8765";
+       algorithm hmac-sha256;
+};
+
+controls {
+        inet 10.53.0.7 port 9953 allow { any; } keys { rndc_key; };
+};
+
 zone "." {
        type hint;
        file "root.hint";

diff --git a/bin/tests/system/resolver/ns7/named2.conf b/bin/tests/system/resolver/ns7/named2.conf
new file mode 100644 (file)
index 0000000..bc1d5f2
--- /dev/null
+++ b/bin/tests/system/resolver/ns7/named2.conf
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+       query-source address 10.53.0.7 port 5300 dscp 13;
+       notify-source 10.53.0.7 dscp 14;
+       transfer-source 10.53.0.7 dscp 15;
+       port 5300;
+       pid-file "named.pid";
+       listen-on { 10.53.0.7; };
+       listen-on-v6 { none; };
+       recursion yes;
+       empty-zones-enable yes;
+       disable-empty-zone 20.172.in-addr.arpa;
+};
+
+key rndc_key {
+       secret "1234abcd8765";
+       algorithm hmac-sha256;
+};
+
+controls {
+        inet 10.53.0.7 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+       type hint;
+       file "root.hint";
+};
+
+zone "server" {
+       type master;
+       file "server.db";
+       allow-update { any; };
+};

diff --git a/bin/tests/system/resolver/setup.sh b/bin/tests/system/resolver/setup.sh
index b1493a001901a0f265a3be8fa9b5c5eb577634a7..eb34ee5538419c44dbf800a95061bdf4fe236bcb 100644 (file)
--- a/bin/tests/system/resolver/setup.sh
+++ b/bin/tests/system/resolver/setup.sh
@@ -21,4 +21,5 @@
 cp ns4/tld1.db ns4/tld.db
 cp ns6/to-be-removed.tld.db.in ns6/to-be-removed.tld.db
 cp ns7/server.db.in ns7/server.db
+cp ns7/named1.conf ns7/named.conf
 (cd ns6 && sh keygen.sh)

diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index 189173f893dbdd26af732d69d1c952999127f52d..7f3e6c92fca449cfa7a15c93dc90bdaf2dd0bbd0 100755 (executable)
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -395,13 +395,27 @@ done
 [ $ret = 0 ] && ret=$foo; 
 if [ $ret != 0 ]; then echo "I:failed"; status=1; fi
 
-echo "I:check for improved error message with SOA mismatch"
+n=`expr $n + 1`
+echo "I:check for improved error message with SOA mismatch ($n)"
 ret=0
 $DIG @10.53.0.1 -p 5300 www.sub.broken aaaa > dig.out.${n} || ret=1
 grep "not subdomain of zone" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I:exit status: $status"
+#HERE <<<
+cp ns7/named2.conf ns7/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.7 -p 9953 reconfig 2>&1 | sed 's/^/I:ns7 /'
 
+n=`expr $n + 1`
+echo "I:check resolution on the listening port ($n)"
+ret=0
+$DIG +tcp +tries=2 +time=5 mx example.net @10.53.0.7 -p 5300 > dig.ns7.out.${n} || ret=2
+grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
+grep "ANSWER: 1" dig.ns7.out.${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+#HERE >>>
+
+echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index b87e022b6787647f2e79f813a857a9ba94ba0b6e..c2e04ef42de40f49e69e58fee54729475b79753b 100644 (file)
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -1397,8 +1397,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
                }
 
                /*
-                * If both dispatches are bound to an address then fail as
-                * the addresses can't be equal (enforced by the IP stack).
+                * If each dispatch is bound to a different address
+                * then fail.
                 *
                 * Note under Linux a packet can be sent out via IPv4 socket
                 * and the response be received via a IPv6 socket.
@@ -1413,7 +1413,8 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
                }
                isc_sockaddr_anyofpf(&a1, isc_sockaddr_pf(&resp->disp->local));
                isc_sockaddr_anyofpf(&a2, isc_sockaddr_pf(&disp->local));
-               if (!isc_sockaddr_eqaddr(&a1, &resp->disp->local) &&
+               if (!isc_sockaddr_eqaddr(&disp->local, &resp->disp->local) &&
+                   !isc_sockaddr_eqaddr(&a1, &resp->disp->local) &&
                    !isc_sockaddr_eqaddr(&a2, &disp->local)) {
                        free_buffer(disp, ev->region.base, ev->region.length);
                        goto unlock;