4530. [bug] Change 4489 broke the handling of CNAME -> DNAME

                        in responses resulting in SERVFAIL being returned.
                        [RT #43779]

(cherry picked from commit 60cb462c56536f307fac4db8bdebf1247e2b5f66)

diff --git a/CHANGES b/CHANGES
index 7505e7bf6c513a12a05226653191499f43c4c5d3..7e6e1615ed8fb7fd0c8076620206cebba4f55eb6 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,9 @@
        --- 9.11.0-P2 released ---
 
+4530.  [bug]           Change 4489 broke the handling of CNAME -> DNAME
+                       in responses resulting in SERVFAIL being returned.
+                       [RT #43779]
+
 4528.  [bug]           Only set the flag bits for the i/o we are waiting
                        for on EPOLLERR or EPOLLHUP. [RT #43617]
 

diff --git a/bin/tests/system/dname/ns2/example.db b/bin/tests/system/dname/ns2/example.db
index 3366123b73b497201ea2636e9f1ac47101729822..e54218b1745560121d74bb56210efccf7316c66a 100644 (file)
--- a/bin/tests/system/dname/ns2/example.db
+++ b/bin/tests/system/dname/ns2/example.db
@@ -21,4 +21,6 @@ a.short                       A       10.0.0.1
 short-dname            DNAME   short
 a.longlonglonglonglonglonglonglonglonglonglonglonglong A 10.0.0.2
 long-dname             DNAME   longlonglonglonglonglonglonglonglonglonglonglonglong
-;
+cname                  CNAME   a.cnamedname
+cnamedname             DNAME   target
+a.target               A       10.0.0.3

diff --git a/bin/tests/system/dname/tests.sh b/bin/tests/system/dname/tests.sh
index 871a9d780847d7cf8049707422f908f1c5fe051d..d97da66b81690a85767bfc049b0fc36e083ba385 100644 (file)
--- a/bin/tests/system/dname/tests.sh
+++ b/bin/tests/system/dname/tests.sh
@@ -55,6 +55,24 @@ grep "status: YXDOMAIN" dig.out.ns4.toolong > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking cname to dname from authoritative"
+ret=0
+$DIG cname.example @10.53.0.2 a -p 5300 > dig.out.ns2.cname
+grep "status: NOERROR" dig.out.ns2.cname > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking cname to dname from recursive"
+ret=0
+$DIG cname.example @10.53.0.4 a -p 5300 > dig.out.ns4.cname
+grep "status: NOERROR" dig.out.ns4.cname > /dev/null || ret=1
+grep '^cname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^a.cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^a.target.example.' dig.out.ns4.cname > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 
 [ $status -eq 0 ] || exit 1

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 9a6dd936dac8d0bf3603fc77358ed751d0aafd00..699c805d0f4cfb6dfe6b368edc02b31b68dd416d 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6802,7 +6802,7 @@ static isc_result_t
 answer_response(fetchctx_t *fctx) {
        isc_result_t result;
        dns_message_t *message;
-       dns_name_t *name, *dname = NULL, *qname, *dqname, tname, *ns_name;
+       dns_name_t *name, *dname = NULL, *qname, tname, *ns_name;
        dns_name_t *cname = NULL;
        dns_rdataset_t *rdataset, *ns_rdataset;
        isc_boolean_t done, external, chaining, aa, found, want_chaining;
@@ -6810,7 +6810,7 @@ answer_response(fetchctx_t *fctx) {
        isc_boolean_t wanted_chaining;
        unsigned int aflag;
        dns_rdatatype_t type;
-       dns_fixedname_t fdname, fqname, fqdname;
+       dns_fixedname_t fdname, fqname;
        dns_view_t *view;
 
        FCTXTRACE("answer_response");
@@ -6834,13 +6834,12 @@ answer_response(fetchctx_t *fctx) {
                aa = ISC_TRUE;
        else
                aa = ISC_FALSE;
-       dqname = qname = &fctx->name;
+       qname = &fctx->name;
        type = fctx->type;
        view = fctx->res->view;
-       dns_fixedname_init(&fqdname);
        result = dns_message_firstname(message, DNS_SECTION_ANSWER);
        while (!done && result == ISC_R_SUCCESS) {
-               dns_namereln_t namereln, dnamereln;
+               dns_namereln_t namereln;
                int order;
                unsigned int nlabels;
 
@@ -6848,8 +6847,6 @@ answer_response(fetchctx_t *fctx) {
                dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
                external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
                namereln = dns_name_fullcompare(qname, name, &order, &nlabels);
-               dnamereln = dns_name_fullcompare(dqname, name, &order,
-                                                &nlabels);
                if (namereln == dns_namereln_equal) {
                        wanted_chaining = ISC_FALSE;
                        for (rdataset = ISC_LIST_HEAD(name->list);
@@ -7102,11 +7099,24 @@ answer_response(fetchctx_t *fctx) {
                                        return (DNS_R_FORMERR);
                                }
 
-                               if (dnamereln != dns_namereln_subdomain) {
+                               /*
+                                * If DNAME + synthetic CNAME then the
+                                * namereln is dns_namereln_subdomain.
+                                *
+                                * If synthetic CNAME + DNAME then the
+                                * namereln is dns_namereln_commonancestor
+                                * and the number of label must match the
+                                * DNAME.  This order is not RFC compliant.
+                                */
+
+                               if (namereln != dns_namereln_subdomain &&
+                                   (namereln != dns_namereln_commonancestor ||
+                                    nlabels != dns_name_countlabels(name)))
+                               {
                                        char qbuf[DNS_NAME_FORMATSIZE];
                                        char obuf[DNS_NAME_FORMATSIZE];
 
-                                       dns_name_format(dqname, qbuf,
+                                       dns_name_format(qname, qbuf,
                                                        sizeof(qbuf));
                                        dns_name_format(name, obuf,
                                                        sizeof(obuf));
@@ -7121,7 +7131,7 @@ answer_response(fetchctx_t *fctx) {
                                        want_chaining = ISC_TRUE;
                                        POST(want_chaining);
                                        aflag = DNS_RDATASETATTR_ANSWER;
-                                       result = dname_target(rdataset, dqname,
+                                       result = dname_target(rdataset, qname,
                                                              nlabels, &fdname);
                                        if (result == ISC_R_NOSPACE) {
                                                /*
@@ -7138,13 +7148,11 @@ answer_response(fetchctx_t *fctx) {
 
                                        dname = dns_fixedname_name(&fdname);
                                        if (!is_answertarget_allowed(view,
-                                                    dqname, rdataset->type,
+                                                    qname, rdataset->type,
                                                     dname, &fctx->domain))
                                        {
                                                return (DNS_R_SERVFAIL);
                                        }
-                                       dqname = dns_fixedname_name(&fqdname);
-                                       dns_name_copy(dname, dqname, NULL);
                                } else {
                                        /*
                                         * We've found a signature that
@@ -7290,7 +7298,8 @@ answer_response(fetchctx_t *fctx) {
                                                rdataset->trust =
                                                    dns_trust_additional;
 
-                                       if (rdataset->type == dns_rdatatype_ns) {
+                                       if (rdataset->type == dns_rdatatype_ns)
+                                       {
                                                ns_name = name;
                                                ns_rdataset = rdataset;
                                        }