Add additional name checks when using a forwarder

When using a forwarder, check that the owner name of response
records are within the bailiwick of the forwarded name space.

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 96e8a0cf992f9b99a46536f917085bd7e4415811..4abed04905df70050cfc377af081febaa58eb66a 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -370,6 +370,8 @@ struct fetchctx {
        dns_rdataset_t qminrrset;
        dns_fixedname_t qmindcfname;
        dns_name_t *qmindcname;
+       dns_fixedname_t fwdfname;
+       dns_name_t *fwdname;
 
        /*%
         * The number of events we're waiting for.
@@ -3552,6 +3554,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
                if (result == ISC_R_SUCCESS) {
                        fwd = ISC_LIST_HEAD(forwarders->fwdrs);
                        fctx->fwdpolicy = forwarders->fwdpolicy;
+                       dns_name_copy(domain, fctx->fwdname);
                        if (fctx->fwdpolicy == dns_fwdpolicy_only &&
                            isstrictsubdomain(domain, fctx->domain))
                        {
@@ -4728,6 +4731,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
        fctx->domain = dns_fixedname_initname(&fctx->dfname);
        fctx->qminname = dns_fixedname_initname(&fctx->qminfname);
        fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname);
+       fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
 
        dns_name_copy(name, fctx->name);
        dns_name_copy(name, fctx->qminname);
@@ -4772,6 +4776,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
                                           fname, &forwarders);
                if (result == ISC_R_SUCCESS) {
                        fctx->fwdpolicy = forwarders->fwdpolicy;
+                       dns_name_copy(fname, fctx->fwdname);
                }
 
                if (fctx->fwdpolicy != dns_fwdpolicy_only) {
@@ -6757,6 +6762,15 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
        }
 }
 
+static inline bool
+name_external(const dns_name_t *name, fetchctx_t *fctx) {
+       if (ISFORWARDER(fctx->addrinfo)) {
+               return (!dns_name_issubdomain(name, fctx->fwdname));
+       }
+
+       return (!dns_name_issubdomain(name, fctx->domain));
+}
+
 static isc_result_t
 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
              dns_rdataset_t *found, dns_section_t section) {
@@ -6783,7 +6797,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
        result = dns_message_findname(rctx->query->rmessage, section, addname,
                                      dns_rdatatype_any, 0, &name, NULL);
        if (result == ISC_R_SUCCESS) {
-               external = !dns_name_issubdomain(name, fctx->domain);
+               external = name_external(name, fctx);
                if (type == dns_rdatatype_a) {
                        for (rdataset = ISC_LIST_HEAD(name->list);
                             rdataset != NULL;
@@ -8450,6 +8464,13 @@ rctx_answer_scan(respctx_t *rctx) {
                        break;
 
                case dns_namereln_subdomain:
+                       /*
+                        * Don't accept DNAME from parent namespace.
+                        */
+                       if (name_external(name, fctx)) {
+                               continue;
+                       }
+
                        /*
                         * In-scope DNAME records must have at least
                         * as many labels as the domain being queried.
@@ -8765,13 +8786,11 @@ rctx_authority_positive(respctx_t *rctx) {
                                       DNS_SECTION_AUTHORITY);
        while (!done && result == ISC_R_SUCCESS) {
                dns_name_t *name = NULL;
-               bool external;
 
                dns_message_currentname(rctx->query->rmessage,
                                        DNS_SECTION_AUTHORITY, &name);
-               external = !dns_name_issubdomain(name, fctx->domain);
 
-               if (!external) {
+               if (!name_external(name, fctx)) {
                        dns_rdataset_t *rdataset = NULL;
 
                        /*
@@ -9158,8 +9177,10 @@ rctx_authority_dnssec(respctx_t *rctx) {
                }
 
                if (!dns_name_issubdomain(name, fctx->domain)) {
-                       /* Invalid name found; preserve it for logging
-                        * later */
+                       /*
+                        * Invalid name found; preserve it for logging
+                        * later.
+                        */
                        rctx->found_name = name;
                        rctx->found_type = ISC_LIST_HEAD(name->list)->type;
                        continue;