clones/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2024-09-21 06:37:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

- disable-edns-do, queriers receive no EDNS in response if the

Browse Source 
disable-edns-do option is enabled and they set the DO flag. And unit test
  for that.
This commit is contained in:
W.C.A. Wijngaards 2023-10-04 13:54:05 +02:00
parent eff3e01ec3
commit 39df4f0923
5 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
daemon/worker.c
View File

@ -543,6 +543,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
edns->udp_size = EDNS_ADVERTISED_SIZE;
edns->ext_rcode = 0;
edns->bits &= EDNS_DO;
if(worker->env.cfg->disable_edns_do && (edns->bits & EDNS_DO))
edns->edns_present = 0;
if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad,
worker->env.now_tv))
@ -703,6 +705,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
edns->udp_size = EDNS_ADVERTISED_SIZE;
edns->ext_rcode = 0;
edns->bits &= EDNS_DO;
if(worker->env.cfg->disable_edns_do && (edns->bits & EDNS_DO))
edns->edns_present = 0;
if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
worker->env.now_tv))
@ -743,6 +747,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
edns->udp_size = EDNS_ADVERTISED_SIZE;
edns->ext_rcode = 0;
edns->bits &= EDNS_DO;
if(worker->env.cfg->disable_edns_do && (edns->bits & EDNS_DO))
edns->edns_present = 0;
*alias_rrset = NULL; /* avoid confusion if caller set it to non-NULL */
if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
!partial_rep && !apply_respip_action(worker, qinfo, cinfo, rep,

2
doc/unbound.conf.5.in
View File

@ -1307,6 +1307,8 @@ Disable the EDNS DO flag in upstream requests. This can be helpful for
devices that cannot handle DNSSEC information. But it should not be enabled
otherwise, because that would stop DNSSEC validation. The DNSSEC validation
would not work for Unbound itself, and also not for downstream users.
When the option is enabled, queriers that set the DO flag receive no EDNS
record in the response to indicate the lack of support to them.
Default is no.
.TP
.B serve\-expired: \fI<yes or no>

4
services/mesh.c
View File

@ -1197,6 +1197,8 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
r->edns.udp_size = EDNS_ADVERTISED_SIZE;
r->edns.ext_rcode = 0;
r->edns.bits &= EDNS_DO;
if(m->s.env->cfg->disable_edns_do && (r->edns.bits&EDNS_DO))
r->edns.edns_present = 0;
if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||
@ -1372,6 +1374,8 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
r->edns.udp_size = EDNS_ADVERTISED_SIZE;
r->edns.ext_rcode = 0;
r->edns.bits &= EDNS_DO;
if(m->s.env->cfg->disable_edns_do && (r->edns.bits&EDNS_DO))
r->edns.edns_present = 0;
m->s.qinfo.qname = r->qname;
m->s.qinfo.local_alias = r->local_alias;

2
testdata/disable_edns_do.rpl vendored
View File

@ -150,7 +150,7 @@ ENTRY_END
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA DO NOERROR
REPLY QR RD RA NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER

4
util/data/msgencode.c
View File

@ -1012,8 +1012,10 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
ede_size = calc_ede_option_size(edns, &ede_txt_size);
if(sldns_buffer_capacity(pkt) < udpsize)
udpsize = sldns_buffer_capacity(pkt);
if(!edns || !edns->edns_present) {
attach_edns = 0;
/* EDEs are optional, try to fit anything else before them */
if(udpsize < LDNS_HEADER_SIZE + edns_field_size - ede_size) {
} else if(udpsize < LDNS_HEADER_SIZE + edns_field_size - ede_size) {
/* packet too small to contain edns, omit it. */
attach_edns = 0;
} else {