Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Non-existent CNAME target in the same zone should be returned with NXDOMAIN instead of NOERROR #11

Closed
SivaKesava1 opened this issue Nov 12, 2020 · 1 comment
Closed

Non-existent CNAME target in the same zone should be returned with NXDOMAIN instead of NOERROR #11

SivaKesava1 opened this issue Nov 12, 2020 · 1 comment

Comments

@SivaKesava1
Copy link

Hi,

This is related to if 'A CNAME B' exists in a zone, but B (related to the same zone) does not exist, then the return code should be NXDOMAIN. RFC 6604 mentions that

When chains are followed, the RCODE in the ultimate DNS response MUST BE set based on the final query cycle leading to that
response.

YADIFA already does not follow CNAME chains, as mentioned in #10, but even for a single CNAME one, it does not return the rcode properly.

Consider the following sample zone file:
example.com. 500 SOA ns1.outside.com. root.example.com. 3 604800 86400 2419200 604800
example.com. 500 NS ns1.outside.com.
b.c.example.com. 500 CNAME c.c.example.com.

For the query <b.c.example.com. , A>, the YADIFA server returns the following response:

          "opcode QUERY",
          "rcode NOERROR",
          "flags QR AA",
          ";QUESTION",
          "b.c.campus.edu. IN A",
          ";ANSWER",
          "b.c.example.com. 500 IN CNAME c.c.example.com.",
          ";AUTHORITY",
          ";ADDITIONAL"

Expected:
The expected response is the same as above except that the rcode should be NXDOMAIN.
@edfeu
Copy link

edfeu commented Nov 27, 2020

Hello,

Thank you for reporting this issue.
It is related to #10
It is now fixed internally and the correction will be made available with the next update on github.
It should happen early next week.

yadifa added a commit that referenced this issue Dec 3, 2020
@yadifa
adds patch for musl support (from https://github.com/kolbma, see #9 (…
4202e1b 
…comment))

adds stack size fix for musl support (the default size is way too small)
adds error reporting in socket_server_opensocket_init
fixes CNAME recursion not returning the same answer as named in NXDOMAIN cases (reported by https://github.com/SivaKesava1, see #11)
modified the keyroll key hash so output would group by flags then algorithm then tag
adds a new yadifa module : zonesign
    zone (re-)signature tool that can replace dnssec-signzone
    designed to work through some limit cases (yakeyrolld)
fixes an issue where a zone signature could incorrectly be detected as already ongoing
fixes an issue that could occur parsing confguration files with optional content
fixes CNAME answers not following the aliases chain (side effect of a previous fix, regression added)
fixes a possible race-condition when initialising the keyroll context error codes
added an internal tool to verify what decided a configuration value (default, command line, ...)
added a NSEC3 record view so they can directly be signed
added stdatomic.h for older compilers (CentOS 7)
zdb_zone_write_text nolonger closes the output stream, the responsibility is left to the caller
keyroll context destruction now releases all the memory (needed now that a keyroll can be fully restarted during a run)
uqs pushed a commit to freebsd/freebsd-ports that referenced this issue Dec 31, 2020
dns/yadifa: update to 2.4.1
07ce956 
* YADIFA 2.4.1-public:
  - Fixes an issue in dnscore where a DNS TCP query would not return the real
    DNS error code.
  - Fixes an issue that could happen when a network model isn't supported.
  - Fixes the propagation of sendmmsg/recvmmsg function availability detection.
  - Fixes an issue where yadifad would issue a warning when a key with
    algorithm > 7 is used with an NSEC zone.
  - Fixes an issue that will occur on a chrooted environment where a
    managed-path would be used incorrectly.
  - Fixes CNAME answers not following the aliases chain.
  - Fixes CNAME recursion not returning the same answer as named in NXDOMAIN
    cases (reported by https://github.com/SivaKesava1, see
    yadifa/yadifa#11)
  - Adds patch for musl support
  - Adds stack size fix for musl support (the default size is way too small)
  - Now imports a custom version of stdatomic.h for systems where it is
    missing, located in dnscore/thirdpary/stdatomic.h. Made for CentOS 7 and
    any other release where that file is missing. The import is only active if
    strictly needed and will only be visible during the build. At the moment,
    it is not being installed with the other headers.

* YAKEYROLLD 2.4.1:
  - Fixes the handling of incomplete TCP queries.
  - Fixes a possible race-condition when initialising the keyroll context error
    codes.
  - The keyroll now has another automatic recovery layer where it completely
    restarts the handling of a domain, generating a one-step update to put the
    zone in the expected state.

Full changelog at https://github.com/yadifa/yadifa/blob/master/ChangeLog

And while here, reformat Makefile according to portfmt and portclippy

PR:		252107
Submitted by:	Leo Vandewoestijne <freebsd@dns.company> (maintainer)
Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D27808


git-svn-id: svn+ssh://svn.freebsd.org/ports/head@559762 35697150-7ecd-e111-bb59-0022644237b5
uqs pushed a commit to freebsd/freebsd-ports that referenced this issue Dec 31, 2020
@jurajlutter
dns/yadifa: update to 2.4.1
24c4aab 
* YADIFA 2.4.1-public:
  - Fixes an issue in dnscore where a DNS TCP query would not return the real
    DNS error code.
  - Fixes an issue that could happen when a network model isn't supported.
  - Fixes the propagation of sendmmsg/recvmmsg function availability detection.
  - Fixes an issue where yadifad would issue a warning when a key with
    algorithm > 7 is used with an NSEC zone.
  - Fixes an issue that will occur on a chrooted environment where a
    managed-path would be used incorrectly.
  - Fixes CNAME answers not following the aliases chain.
  - Fixes CNAME recursion not returning the same answer as named in NXDOMAIN
    cases (reported by https://github.com/SivaKesava1, see
    yadifa/yadifa#11)
  - Adds patch for musl support
  - Adds stack size fix for musl support (the default size is way too small)
  - Now imports a custom version of stdatomic.h for systems where it is
    missing, located in dnscore/thirdpary/stdatomic.h. Made for CentOS 7 and
    any other release where that file is missing. The import is only active if
    strictly needed and will only be visible during the build. At the moment,
    it is not being installed with the other headers.

* YAKEYROLLD 2.4.1:
  - Fixes the handling of incomplete TCP queries.
  - Fixes a possible race-condition when initialising the keyroll context error
    codes.
  - The keyroll now has another automatic recovery layer where it completely
    restarts the handling of a domain, generating a one-step update to put the
    zone in the expected state.

Full changelog at https://github.com/yadifa/yadifa/blob/master/ChangeLog

And while here, reformat Makefile according to portfmt and portclippy

PR:		252107
Submitted by:	Leo Vandewoestijne <freebsd@dns.company> (maintainer)
Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D27808
Jehops pushed a commit to Jehops/freebsd-ports-legacy that referenced this issue Jan 1, 2021
@jurajlutter
dns/yadifa: update to 2.4.1
5259bb6 
* YADIFA 2.4.1-public:
  - Fixes an issue in dnscore where a DNS TCP query would not return the real
    DNS error code.
  - Fixes an issue that could happen when a network model isn't supported.
  - Fixes the propagation of sendmmsg/recvmmsg function availability detection.
  - Fixes an issue where yadifad would issue a warning when a key with
    algorithm > 7 is used with an NSEC zone.
  - Fixes an issue that will occur on a chrooted environment where a
    managed-path would be used incorrectly.
  - Fixes CNAME answers not following the aliases chain.
  - Fixes CNAME recursion not returning the same answer as named in NXDOMAIN
    cases (reported by https://github.com/SivaKesava1, see
    yadifa/yadifa#11)
  - Adds patch for musl support
  - Adds stack size fix for musl support (the default size is way too small)
  - Now imports a custom version of stdatomic.h for systems where it is
    missing, located in dnscore/thirdpary/stdatomic.h. Made for CentOS 7 and
    any other release where that file is missing. The import is only active if
    strictly needed and will only be visible during the build. At the moment,
    it is not being installed with the other headers.

* YAKEYROLLD 2.4.1:
  - Fixes the handling of incomplete TCP queries.
  - Fixes a possible race-condition when initialising the keyroll context error
    codes.
  - The keyroll now has another automatic recovery layer where it completely
    restarts the handling of a domain, generating a one-step update to put the
    zone in the expected state.

Full changelog at https://github.com/yadifa/yadifa/blob/master/ChangeLog

And while here, reformat Makefile according to portfmt and portclippy

PR:		252107
Submitted by:	Leo Vandewoestijne <freebsd@dns.company> (maintainer)
Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D27808


git-svn-id: svn+ssh://svn.freebsd.org/ports/head@559762 35697150-7ecd-e111-bb59-0022644237b5
@yadifa yadifa closed this as completed Jan 22, 2021
@SivaKesava1 SivaKesava1 mentioned this issue Nov 30, 2023
Open
svmhdvn pushed a commit to svmhdvn/freebsd-ports that referenced this issue Jan 10, 2024
@jurajlutter
dns/yadifa: update to 2.4.1
8c0798b 
* YADIFA 2.4.1-public:
  - Fixes an issue in dnscore where a DNS TCP query would not return the real
    DNS error code.
  - Fixes an issue that could happen when a network model isn't supported.
  - Fixes the propagation of sendmmsg/recvmmsg function availability detection.
  - Fixes an issue where yadifad would issue a warning when a key with
    algorithm > 7 is used with an NSEC zone.
  - Fixes an issue that will occur on a chrooted environment where a
    managed-path would be used incorrectly.
  - Fixes CNAME answers not following the aliases chain.
  - Fixes CNAME recursion not returning the same answer as named in NXDOMAIN
    cases (reported by https://github.com/SivaKesava1, see
    yadifa/yadifa#11)
  - Adds patch for musl support
  - Adds stack size fix for musl support (the default size is way too small)
  - Now imports a custom version of stdatomic.h for systems where it is
    missing, located in dnscore/thirdpary/stdatomic.h. Made for CentOS 7 and
    any other release where that file is missing. The import is only active if
    strictly needed and will only be visible during the build. At the moment,
    it is not being installed with the other headers.

* YAKEYROLLD 2.4.1:
  - Fixes the handling of incomplete TCP queries.
  - Fixes a possible race-condition when initialising the keyroll context error
    codes.
  - The keyroll now has another automatic recovery layer where it completely
    restarts the handling of a domain, generating a one-step update to put the
    zone in the expected state.

Full changelog at https://github.com/yadifa/yadifa/blob/master/ChangeLog

And while here, reformat Makefile according to portfmt and portclippy

PR:		252107
Submitted by:	Leo Vandewoestijne <freebsd@dns.company> (maintainer)
Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D27808
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@SivaKesava1 @yadifa @edfeu