Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not follow CNAME records for ANY or CNAME queries #15008

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Do not follow CNAME records for ANY or CNAME queries #15008

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
68f09dd
Do not follow CNAME records for ANY or CNAME queries.
miodvallat Jan 3, 2025
46928eb
Update test oracles due to behaviour change.
miodvallat Jan 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions pdns/packethandler.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1630,10 +1630,12 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
rr.scopeMask = p.getRealRemote().getBits(); // this makes sure answer is a specific as your question
rrset.push_back(rr);
}
if(rec->d_type == QType::CNAME && p.qtype.getCode() != QType::CNAME)
if(rec->d_type == QType::CNAME && (p.qtype.getCode() != QType::ANY && p.qtype.getCode() != QType::CNAME)) {
weRedirected = true;
else
}
else {
weDone = true;
}
}
}
catch(std::exception &e) {
Expand All @@ -1660,8 +1662,9 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
if((rr.dr.d_type == p.qtype.getCode() && !rr.auth) || (rr.dr.d_type == QType::NS && (!rr.auth || !(d_sd.qname==rr.dr.d_name))))
weHaveUnauth=true;

if(rr.dr.d_type == QType::CNAME && p.qtype.getCode() != QType::CNAME)
weRedirected=true;
if (rr.dr.d_type == QType::CNAME && (p.qtype.getCode() != QType::ANY && p.qtype.getCode() != QType::CNAME)) {
miodvallat marked this conversation as resolved.
Show resolved Hide resolved
weRedirected = true;
}

if (DP && rr.dr.d_type == QType::ALIAS && (p.qtype.getCode() == QType::A || p.qtype.getCode() == QType::AAAA || p.qtype.getCode() == QType::ANY) && !d_dk.isPresigned(d_sd.qname)) {
if (!d_doExpandALIAS) {
Expand Down
2 changes: 2 additions & 0 deletions regression-tests/tests/cname-to-nxdomain-any/expected_result.dnssec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
0 nxd.example.com. 120 IN CNAME nxdomain.example.com.
0 nxd.example.com. 120 IN RRSIG CNAME 13 3 120 [expiry] [inception] [keytag] example.com. ...
0 nxd.example.com. 86400 IN NSEC outpost.example.com. CNAME RRSIG NSEC
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this extra output is unexpected. If anything I would expect some responses to become smaller!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i wonder if we should be setting weDone when we match-but-don't-follow a CNAME?

0 nxd.example.com. 86400 IN RRSIG NSEC 13 3 86400 [expiry] [inception] [keytag] example.com. ...
2 . 32768 IN OPT
Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
Reply to question for qname='nxd.example.com.', qtype=ANY
2 changes: 2 additions & 0 deletions regression-tests/tests/cname-to-unauth-any/expected_result.dnssec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
0 unauth.example.com. 120 IN CNAME no-idea.example.org.
0 unauth.example.com. 120 IN RRSIG CNAME 13 3 120 [expiry] [inception] [keytag] example.com. ...
0 unauth.example.com. 86400 IN NSEC usa.example.com. CNAME RRSIG NSEC
0 unauth.example.com. 86400 IN RRSIG NSEC 13 3 86400 [expiry] [inception] [keytag] example.com. ...
2 . 32768 IN OPT
Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
Reply to question for qname='unauth.example.com.', qtype=ANY
Loading