upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-24 02:10:30 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/lib/dns
History
Michał Kępień 1a79aeab44 Stop resolving invalid names in resume_dslookup() 
Commit 7b2ea97e46 introduced a logic bug
in resume_dslookup(): that function now only conditionally checks
whether DS chasing can still make progress.  Specifically, that check is
only performed when the previous resume_dslookup() call invokes
dns_resolver_createfetch() with the 'nameservers' argument set to
something else than NULL, which may not always be the case.  Failing to
perform that check may trigger assertion failures as a result of
dns_resolver_createfetch() attempting to resolve an invalid name.

Example scenario that leads to such outcome:

 1. A validating resolver is configured to forward all queries to
    another resolver.  The latter returns broken DS responses that
    trigger DS chasing.

 2. rctx_chaseds() calls dns_resolver_createfetch() with the
    'nameservers' argument set to NULL.

 3. The fetch fails, so resume_dslookup() is called.  Due to
    fevent->result being set to e.g. DNS_R_SERVFAIL, the default branch
    is taken in the switch statement.

 4. Since 'nameservers' was set to NULL for the fetch which caused the
    resume_dslookup() callback to be invoked
    (fctx->nsfetch->private->nameservers), resume_dslookup() chops off
    one label off fctx->nsname and calls dns_resolver_createfetch()
    again, for a name containing one label less than before.

 5. Steps 3-4 are repeated (i.e. all attempts to find the name servers
    authoritative for the DS RRset being chased fail) until fctx->nsname
    becomes stripped down the the root name.

 6. Since resume_dslookup() does not check whether DS chasing can still
    make progress, it strips off a label off the root name and continues
    its attempts at finding the name servers authoritative for the DS
    RRset being chased, passing an invalid name to
    dns_resolver_createfetch().

Fix by ensuring resume_dslookup() always checks whether DS chasing can
still make progress when a name server fetch fails.  Update code
comments to ensure the purpose of the relevant dns_name_equal() check is
clear.
2022-07-13 10:31:16 +02:00
..
include "rndc fetchlimit" now also lists rate-limited domains 2022-07-06 19:46:23 -07:00
rdata Shrink decompression contexts 2022-06-01 13:00:40 +01:00
.gitignore 4394. [func] Add rndc command "dnstap-reopen" to close and 2016-06-24 09:37:04 +10:00
acl.c Add isc_rwlock around dns_aclenv .localhost and .localnets member 2022-04-04 19:27:00 +02:00
adb.c add "rndc fetchlimit" to show fetchlimited servers 2022-07-06 19:46:20 -07:00
badcache.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
byaddr.c Remove dns_lookup and unused functions in dns_byaddr 2022-05-25 14:44:32 +02:00
cache.c Make all tasks to be bound to a thread 2022-05-25 16:04:51 +02:00
callbacks.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
catz.c Don't process DNSSEC-related and ZONEMD records in catz 2022-06-02 08:42:25 +00:00
client.c Add synth-from-dnssec namespaces for keytable entries 2022-07-05 12:29:01 +10:00
clientinfo.c allow dns_clientinfo to store client ECS data 2022-01-27 13:53:59 -08:00
compress.c Clean up remaining references to global compression 2022-06-01 13:00:40 +01:00
db.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
dbiterator.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
diff.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
dispatch.c REQUIRE should not have side effects 2022-07-05 12:22:55 -07:00
dlz.c Set hard thread affinity for each zone 2022-04-01 23:50:34 +02:00
dns64.c Add isc_rwlock around dns_aclenv .localhost and .localnets member 2022-04-04 19:27:00 +02:00
dnsrps.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
dnssec.c Cleanup dns_message_gettemp*() functions - they cannot fail 2022-05-17 12:39:25 +02:00
dnstap.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
dnstap.proto Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
ds.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
dst_api.c Require valid key for dst_key functions 2022-05-23 11:36:36 +02:00
dst_internal.h Check if key metadata is modified before writing 2022-05-13 13:31:17 +02:00
dst_openssl.h Use autoconf check for BN_GENCB_new() 2022-03-02 10:48:09 +00:00
dst_parse.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
dst_parse.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
dyndb.c Move netmgr/uv-compat.h to <isc/uv.h> 2022-05-03 10:02:19 +02:00
ecs.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
fixedname.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
forward.c Cleanup dns_fwdtable_delete() 2022-06-09 10:47:04 +00:00
gen.c Merge lib/dns/gen.h contents to lib/dns/gen.c 2022-03-04 14:13:58 +01:00
geoip2.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
gssapi_link.c Remove a redundant variable-length array 2022-03-18 15:06:31 +00:00
gssapictx.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
hmac_link.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
ipkeylist.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
iptable.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
journal.c Shrink decompression contexts 2022-06-01 13:00:40 +01:00
kasp.c Store built-in dnssec-policies in defaultconf 2022-06-28 11:56:31 +02:00
key.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
keydata.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
keymgr.c Nit changes in keymgr and kasp 2022-06-28 11:56:31 +02:00
keytable.c Add synth-from-dnssec namespaces for keytable entries 2022-07-05 12:29:01 +10:00
log.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
Makefile.am Update libdns_la_LIBADD rather than libdns_la_LDFLAGS 2022-07-13 00:14:13 +00:00
master.c Tighten $GENERATE directive parsing 2022-07-05 09:41:33 -07:00
masterdump.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
message.c Add missing INDENT call for UPDATE messages 2022-06-02 08:05:39 +10:00
name.c Don't compress in the rrset if compression was disabled 2022-07-11 12:26:15 +02:00
ncache.c There can no longer be multiple compression methods 2022-06-01 13:00:40 +01:00
nsec.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
nsec3.c Shrink decompression contexts 2022-06-01 13:00:40 +01:00
nta.c Make all tasks to be bound to a thread 2022-05-25 16:04:51 +02:00
openssl_link.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
openssl_shim.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
openssl_shim.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
openssldh_link.c Use autoconf check for BN_GENCB_new() 2022-03-02 10:48:09 +00:00
opensslecdsa_link.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
openssleddsa_link.c Add couple missing braces around single-line statements 2022-03-17 18:27:45 +01:00
opensslrsa_link.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
order.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
peer.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
private.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rbt.c Remove unused rbtnode->rpz flag 2022-05-02 19:47:58 +01:00
rbtdb.c don't keep stale NXDOMAIN cache entries 2022-06-13 12:53:37 -07:00
rbtdb.h Remove remaining checks for rbt64 2022-05-03 00:41:42 +01:00
rcode.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rdata.c Shrink decompression contexts 2022-06-01 13:00:40 +01:00
rdatalist.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rdatalist_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rdataset.c There can no longer be multiple compression methods 2022-06-01 13:00:40 +01:00
rdatasetiter.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rdataslab.c Clean up #include <isc/string.h> 2022-05-03 12:38:59 +00:00
request.c DNS name compression does not depend on the EDNS version 2022-06-01 13:00:40 +01:00
resolver.c Stop resolving invalid names in resume_dslookup() 2022-07-13 10:31:16 +02:00
result.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rootns.c Clean up #include <isc/string.h> 2022-05-03 12:38:59 +00:00
rpz.c Make all tasks to be bound to a thread 2022-05-25 16:04:51 +02:00
rriterator.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
rrl.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
sdb.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
sdlz.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
soa.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
ssu.c Add isc_rwlock around dns_aclenv .localhost and .localnets member 2022-04-04 19:27:00 +02:00
ssu_external.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
stats.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 08:33:43 +01:00
tests Move all the unit tests to /tests/<libname>/ 2022-05-28 14:53:02 -07:00
time.c Clean up #include <isc/string.h> 2022-05-03 12:38:59 +00:00
tkey.c Cleanup dns_message_gettemp*() functions - they cannot fail 2022-05-17 12:39:25 +02:00
transport.c Rename "hostname" to "remote-hostname" within "tls" 2022-05-03 17:15:43 +03:00
tsec.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 08:33:43 +01:00
tsig.c Cleanup dns_message_gettemp*() functions - they cannot fail 2022-05-17 12:39:25 +02:00
tsig_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
ttl.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
update.c Create per-thread task and memory context for zonemgr 2022-04-01 23:50:34 +02:00
validator.c the validator can attach to the view normally 2022-05-13 13:36:10 -07:00
view.c clean up unused API 2022-07-06 19:36:54 -07:00
xfrin.c DNS name compression does not depend on the EDNS version 2022-06-01 13:00:40 +01:00
zone.c REQUIRE should not have side effects 2022-07-05 12:22:55 -07:00
zone_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
zonekey.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
zoneverify.c Eliminate a variable that can confuse the compiler 2022-05-02 21:11:12 +01:00
zt.c Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00