From: W.C.A. Wijngaards Date: Fri, 24 Jul 2026 13:31:06 +0000 (+0200) Subject: - Fix to use tls-port after referral if tls-upstream is set. X-Git-Tag: release-1.26.0rc1~4 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=9bd8df01492726e1b21577b2b3c0b9e24cedf9cb;p=thirdparty%2Funbound.git - Fix to use tls-port after referral if tls-upstream is set. --- diff --git a/doc/Changelog b/doc/Changelog index 995040ef3..9f75cbdca 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -24,6 +24,7 @@ - Fix to guard access to shared ports interface array during set up, for analyzer. - Fix sign of comparison warning in shared ports setup. + - Fix to use tls-port after referral if tls-upstream is set. 23 July 2026: Wouter - Updated credits for Xuanchao Xie in 22 july changelog. diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c index 6ba12c443..f0f94cadd 100644 --- a/iterator/iter_delegpt.c +++ b/iterator/iter_delegpt.c @@ -412,7 +412,7 @@ find_NS(struct reply_info* rep, size_t from, size_t to, uint16_t qclass) } struct delegpt* -delegpt_from_message(struct dns_msg* msg, struct regional* region) +delegpt_from_message(struct dns_msg* msg, struct regional* region, int port) { struct ub_packed_rrset_key* ns_rrset = NULL; struct delegpt* dp; @@ -441,7 +441,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region) dp->has_parent_side_NS = 1; /* created from message */ if(!delegpt_set_name(dp, region, ns_rrset->rk.dname)) return NULL; - if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0)) + if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0, port)) return NULL; /* add glue, A and AAAA in answer and additional section */ @@ -467,7 +467,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region) int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region, - struct ub_packed_rrset_key* ns_rrset, uint8_t lame) + struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port) { struct packed_rrset_data* nsdata = (struct packed_rrset_data*) ns_rrset->entry.data; @@ -482,7 +482,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region, continue; /* bad format */ /* add rdata of NS (= wirefmt dname), skip rdatalen bytes */ if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame, - NULL, UNBOUND_DNS_PORT)) + NULL, (port==-1?UNBOUND_DNS_PORT:port))) return 0; } return 1; @@ -541,7 +541,7 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region, if(!rrset) return 1; if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS) - return delegpt_rrset_add_ns(dp, region, rrset, lame); + return delegpt_rrset_add_ns(dp, region, rrset, lame, -1); else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A) return delegpt_add_rrset_A(dp, region, rrset, lame, additions); else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA) diff --git a/iterator/iter_delegpt.h b/iterator/iter_delegpt.h index 287bf9213..db15277fc 100644 --- a/iterator/iter_delegpt.h +++ b/iterator/iter_delegpt.h @@ -221,10 +221,11 @@ int delegpt_add_ns(struct delegpt* dp, struct regional* regional, * @param regional: where to allocate the info. * @param ns_rrset: NS rrset. * @param lame: rrset is lame, disprefer it. + * @param port: port or -1 if not set. * @return 0 on alloc error. */ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional, - struct ub_packed_rrset_key* ns_rrset, uint8_t lame); + struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port); /** * Add target address to the delegation point. @@ -365,11 +366,12 @@ size_t delegpt_count_targets(struct delegpt* dp); * * @param msg: the dns message, referral. * @param regional: where to allocate delegation point. + * @param port: if not -1 specifies a port number. * @return new delegation point or NULL on alloc error, or if the * message was not appropriate. */ struct delegpt* delegpt_from_message(struct dns_msg* msg, - struct regional* regional); + struct regional* regional, int port); /** * Mark negative return in delegation point for specific nameserver. diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c index cc09fa524..e848e83ba 100644 --- a/iterator/iter_utils.c +++ b/iterator/iter_utils.c @@ -1313,7 +1313,8 @@ iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp, log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey); dp->has_parent_side_NS = 1; /* and mark the new names as lame */ - if(!delegpt_rrset_add_ns(dp, region, akey, 1)) { + if(!delegpt_rrset_add_ns(dp, region, akey, 1, + deleg_port_number(env))) { lock_rw_unlock(&akey->entry.lock); return 0; } @@ -1703,3 +1704,11 @@ iter_make_minimal(struct reply_info* rep) rep->ar_numrrsets = 0; rep->rrset_count -= rem; } + +int +deleg_port_number(struct module_env* env) +{ + if(env->cfg->ssl_upstream) + return env->cfg->ssl_port; + return -1; +} diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h index f7f374742..9fb361ab5 100644 --- a/iterator/iter_utils.h +++ b/iterator/iter_utils.h @@ -483,4 +483,7 @@ void limit_nsec_ttl(struct dns_msg* msg); */ void iter_make_minimal(struct reply_info* rep); +/** See if we need a different port number */ +int deleg_port_number(struct module_env* env); + #endif /* ITERATOR_ITER_UTILS_H */ diff --git a/iterator/iterator.c b/iterator/iterator.c index 1f95039c8..cadb95ebd 100644 --- a/iterator/iterator.c +++ b/iterator/iterator.c @@ -3147,7 +3147,6 @@ find_NS(struct reply_info* rep, size_t from, size_t to) return NULL; } - /** * Process the query response. All queries end up at this state first. This * process generally consists of analyzing the response and routing the @@ -3474,7 +3473,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, infra_ratelimit_dec(qstate->env->infra_cache, old_dp->name, old_dp->namelen, *qstate->env->now); - iq->dp = delegpt_from_message(iq->response, qstate->region); + iq->dp = delegpt_from_message(iq->response, qstate->region, + deleg_port_number(qstate->env)); if (qstate->env->cfg->qname_minimisation) iq->minimisation_state = INIT_MINIMISE_STATE; if(!iq->dp) { @@ -3751,7 +3751,8 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq) log_assert(qstate->is_priming || foriq->wait_priming_stub); log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR); /* Convert our response to a delegation point */ - dp = delegpt_from_message(qstate->return_msg, forq->region); + dp = delegpt_from_message(qstate->return_msg, forq->region, + deleg_port_number(forq->env)); if(!dp) { /* if there is no convertible delegation point, then * the ANSWER type was (presumably) a negative answer. */ @@ -3967,7 +3968,8 @@ processDSNSResponse(struct module_qstate* qstate, int id, /* else, store as DP and continue at querytargets */ foriq->state = QUERYTARGETS_STATE; - foriq->dp = delegpt_from_message(qstate->return_msg, forq->region); + foriq->dp = delegpt_from_message(qstate->return_msg, forq->region, + deleg_port_number(forq->env)); if(!foriq->dp) { log_err("out of memory in dsns dp alloc"); errinf(qstate, "malloc failure, in DS search"); diff --git a/services/cache/dns.c b/services/cache/dns.c index 7100b1ce8..04d5ae2d6 100644 --- a/services/cache/dns.c +++ b/services/cache/dns.c @@ -43,6 +43,7 @@ #include "iterator/iter_utils.h" #include "validator/val_nsec.h" #include "validator/val_utils.h" +#include "iterator/iter_utils.h" #include "services/cache/dns.h" #include "services/cache/rrset.h" #include "util/data/msgparse.h" @@ -586,7 +587,8 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname, return NULL; } } - if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) { + if(!delegpt_rrset_add_ns(dp, region, nskey, 0, + deleg_port_number(env))) { lock_rw_unlock(&nskey->entry.lock); log_err("find_delegation: addns out of memory"); return NULL;