You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
431 lines
13 KiB
431 lines
13 KiB
diff --git a/bin/named/control.c b/bin/named/control.c |
|
index fabe442..06eadce 100644 |
|
--- a/bin/named/control.c |
|
+++ b/bin/named/control.c |
|
@@ -69,7 +69,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { |
|
#endif |
|
|
|
data = isccc_alist_lookup(message, "_data"); |
|
- if (data == NULL) { |
|
+ if (!isccc_alist_alistp(data)) { |
|
/* |
|
* No data section. |
|
*/ |
|
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c |
|
index c46a6e1..ef32790 100644 |
|
--- a/bin/named/controlconf.c |
|
+++ b/bin/named/controlconf.c |
|
@@ -396,7 +396,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) { |
|
* Limit exposure to replay attacks. |
|
*/ |
|
_ctrl = isccc_alist_lookup(request, "_ctrl"); |
|
- if (_ctrl == NULL) { |
|
+ if (!isccc_alist_alistp(_ctrl)) { |
|
log_invalid(&conn->ccmsg, ISC_R_FAILURE); |
|
goto cleanup_request; |
|
} |
|
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c |
|
index ba2c3f6..9a007e2 100644 |
|
--- a/bin/rndc/rndc.c |
|
+++ b/bin/rndc/rndc.c |
|
@@ -252,8 +252,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) { |
|
DO("parse message", isccc_cc_fromwire(&source, &response, &secret)); |
|
|
|
data = isccc_alist_lookup(response, "_data"); |
|
- if (data == NULL) |
|
- fatal("no data section in response"); |
|
+ if (!isccc_alist_alistp(data)) |
|
+ fatal("bad or missing data section in response"); |
|
result = isccc_cc_lookupstring(data, "err", &errormsg); |
|
if (result == ISC_R_SUCCESS) { |
|
failed = ISC_TRUE; |
|
@@ -316,8 +316,8 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) { |
|
DO("parse message", isccc_cc_fromwire(&source, &response, &secret)); |
|
|
|
_ctrl = isccc_alist_lookup(response, "_ctrl"); |
|
- if (_ctrl == NULL) |
|
- fatal("_ctrl section missing"); |
|
+ if (!isccc_alist_alistp(_ctrl)) |
|
+ fatal("bad or missing ctrl section in response"); |
|
nonce = 0; |
|
if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS) |
|
nonce = 0; |
|
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c |
|
index d220986..8696b15 100644 |
|
--- a/lib/dns/resolver.c |
|
+++ b/lib/dns/resolver.c |
|
@@ -5408,14 +5408,11 @@ cname_target(dns_rdataset_t *rdataset, dns_name_t *tname) { |
|
} |
|
|
|
static inline isc_result_t |
|
-dname_target(fetchctx_t *fctx, dns_rdataset_t *rdataset, dns_name_t *qname, |
|
- dns_name_t *oname, dns_fixedname_t *fixeddname) |
|
+dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, |
|
+ unsigned int nlabels, dns_fixedname_t *fixeddname) |
|
{ |
|
isc_result_t result; |
|
dns_rdata_t rdata = DNS_RDATA_INIT; |
|
- unsigned int nlabels; |
|
- int order; |
|
- dns_namereln_t namereln; |
|
dns_rdata_dname_t dname; |
|
dns_fixedname_t prefix; |
|
|
|
@@ -5430,21 +5427,6 @@ dname_target(fetchctx_t *fctx, dns_rdataset_t *rdataset, dns_name_t *qname, |
|
if (result != ISC_R_SUCCESS) |
|
return (result); |
|
|
|
- /* |
|
- * Get the prefix of qname. |
|
- */ |
|
- namereln = dns_name_fullcompare(qname, oname, &order, &nlabels); |
|
- if (namereln != dns_namereln_subdomain) { |
|
- char qbuf[DNS_NAME_FORMATSIZE]; |
|
- char obuf[DNS_NAME_FORMATSIZE]; |
|
- |
|
- dns_rdata_freestruct(&dname); |
|
- dns_name_format(qname, qbuf, sizeof(qbuf)); |
|
- dns_name_format(oname, obuf, sizeof(obuf)); |
|
- log_formerr(fctx, "unrelated DNAME in answer: " |
|
- "%s is not in %s", qbuf, obuf); |
|
- return (DNS_R_FORMERR); |
|
- } |
|
dns_fixedname_init(&prefix); |
|
dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL); |
|
dns_fixedname_init(fixeddname); |
|
@@ -6057,13 +6039,13 @@ static isc_result_t |
|
answer_response(fetchctx_t *fctx) { |
|
isc_result_t result; |
|
dns_message_t *message; |
|
- dns_name_t *name, *qname, tname, *ns_name; |
|
+ dns_name_t *name, *dname = NULL, *qname, tname, *ns_name; |
|
dns_rdataset_t *rdataset, *ns_rdataset; |
|
isc_boolean_t done, external, chaining, aa, found, want_chaining; |
|
isc_boolean_t have_answer, found_cname, found_type, wanted_chaining; |
|
unsigned int aflag; |
|
dns_rdatatype_t type; |
|
- dns_fixedname_t dname, fqname; |
|
+ dns_fixedname_t fdname, fqname; |
|
dns_view_t *view; |
|
|
|
FCTXTRACE("answer_response"); |
|
@@ -6091,10 +6073,15 @@ answer_response(fetchctx_t *fctx) { |
|
view = fctx->res->view; |
|
result = dns_message_firstname(message, DNS_SECTION_ANSWER); |
|
while (!done && result == ISC_R_SUCCESS) { |
|
+ dns_namereln_t namereln; |
|
+ int order; |
|
+ unsigned int nlabels; |
|
+ |
|
name = NULL; |
|
dns_message_currentname(message, DNS_SECTION_ANSWER, &name); |
|
external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain)); |
|
- if (dns_name_equal(name, qname)) { |
|
+ namereln = dns_name_fullcompare(qname, name, &order, &nlabels); |
|
+ if (namereln == dns_namereln_equal) { |
|
wanted_chaining = ISC_FALSE; |
|
for (rdataset = ISC_LIST_HEAD(name->list); |
|
rdataset != NULL; |
|
@@ -6219,10 +6206,11 @@ answer_response(fetchctx_t *fctx) { |
|
*/ |
|
INSIST(!external); |
|
if (aflag == |
|
- DNS_RDATASETATTR_ANSWER) |
|
+ DNS_RDATASETATTR_ANSWER) { |
|
have_answer = ISC_TRUE; |
|
- name->attributes |= |
|
- DNS_NAMEATTR_ANSWER; |
|
+ name->attributes |= |
|
+ DNS_NAMEATTR_ANSWER; |
|
+ } |
|
rdataset->attributes |= aflag; |
|
if (aa) |
|
rdataset->trust = |
|
@@ -6277,6 +6265,8 @@ answer_response(fetchctx_t *fctx) { |
|
if (wanted_chaining) |
|
chaining = ISC_TRUE; |
|
} else { |
|
+ dns_rdataset_t *dnameset = NULL; |
|
+ |
|
/* |
|
* Look for a DNAME (or its SIG). Anything else is |
|
* ignored. |
|
@@ -6284,32 +6274,56 @@ answer_response(fetchctx_t *fctx) { |
|
wanted_chaining = ISC_FALSE; |
|
for (rdataset = ISC_LIST_HEAD(name->list); |
|
rdataset != NULL; |
|
- rdataset = ISC_LIST_NEXT(rdataset, link)) { |
|
- isc_boolean_t found_dname = ISC_FALSE; |
|
- dns_name_t *dname_name; |
|
+ rdataset = ISC_LIST_NEXT(rdataset, link)) |
|
+ { |
|
+ /* |
|
+ * Only pass DNAME or RRSIG(DNAME). |
|
+ */ |
|
+ if (rdataset->type != dns_rdatatype_dname && |
|
+ (rdataset->type != dns_rdatatype_rrsig || |
|
+ rdataset->covers != dns_rdatatype_dname)) |
|
+ continue; |
|
+ |
|
+ /* |
|
+ * If we're not chaining, then the DNAME and |
|
+ * its signature should not be external. |
|
+ */ |
|
+ if (!chaining && external) { |
|
+ char qbuf[DNS_NAME_FORMATSIZE]; |
|
+ char obuf[DNS_NAME_FORMATSIZE]; |
|
+ |
|
+ dns_name_format(name, qbuf, |
|
+ sizeof(qbuf)); |
|
+ dns_name_format(&fctx->domain, obuf, |
|
+ sizeof(obuf)); |
|
+ log_formerr(fctx, "external DNAME or " |
|
+ "RRSIG covering DNAME " |
|
+ "in answer: %s is " |
|
+ "not in %s", qbuf, obuf); |
|
+ return (DNS_R_FORMERR); |
|
+ } |
|
+ |
|
+ if (namereln != dns_namereln_subdomain) { |
|
+ char qbuf[DNS_NAME_FORMATSIZE]; |
|
+ char obuf[DNS_NAME_FORMATSIZE]; |
|
+ |
|
+ dns_name_format(qname, qbuf, |
|
+ sizeof(qbuf)); |
|
+ dns_name_format(name, obuf, |
|
+ sizeof(obuf)); |
|
+ log_formerr(fctx, "unrelated DNAME " |
|
+ "in answer: %s is " |
|
+ "not in %s", qbuf, obuf); |
|
+ return (DNS_R_FORMERR); |
|
+ } |
|
|
|
- found = ISC_FALSE; |
|
aflag = 0; |
|
if (rdataset->type == dns_rdatatype_dname) { |
|
- /* |
|
- * We're looking for something else, |
|
- * but we found a DNAME. |
|
- * |
|
- * If we're not chaining, then the |
|
- * DNAME should not be external. |
|
- */ |
|
- if (!chaining && external) { |
|
- log_formerr(fctx, |
|
- "external DNAME"); |
|
- return (DNS_R_FORMERR); |
|
- } |
|
- found = ISC_TRUE; |
|
want_chaining = ISC_TRUE; |
|
POST(want_chaining); |
|
aflag = DNS_RDATASETATTR_ANSWER; |
|
- result = dname_target(fctx, rdataset, |
|
- qname, name, |
|
- &dname); |
|
+ result = dname_target(rdataset, qname, |
|
+ nlabels, &fdname); |
|
if (result == ISC_R_NOSPACE) { |
|
/* |
|
* We can't construct the |
|
@@ -6321,90 +6335,73 @@ answer_response(fetchctx_t *fctx) { |
|
} else if (result != ISC_R_SUCCESS) |
|
return (result); |
|
else |
|
- found_dname = ISC_TRUE; |
|
+ dnameset = rdataset; |
|
|
|
- dname_name = dns_fixedname_name(&dname); |
|
+ dname = dns_fixedname_name(&fdname); |
|
if (!is_answertarget_allowed(view, |
|
- qname, |
|
- rdataset->type, |
|
- dname_name, |
|
- &fctx->domain)) { |
|
+ qname, rdataset->type, |
|
+ dname, &fctx->domain)) { |
|
return (DNS_R_SERVFAIL); |
|
} |
|
- } else if (rdataset->type == dns_rdatatype_rrsig |
|
- && rdataset->covers == |
|
- dns_rdatatype_dname) { |
|
+ } else { |
|
/* |
|
* We've found a signature that |
|
* covers the DNAME. |
|
*/ |
|
- found = ISC_TRUE; |
|
aflag = DNS_RDATASETATTR_ANSWERSIG; |
|
} |
|
|
|
- if (found) { |
|
+ /* |
|
+ * We've found an answer to our |
|
+ * question. |
|
+ */ |
|
+ name->attributes |= DNS_NAMEATTR_CACHE; |
|
+ rdataset->attributes |= DNS_RDATASETATTR_CACHE; |
|
+ rdataset->trust = dns_trust_answer; |
|
+ if (!chaining) { |
|
/* |
|
- * We've found an answer to our |
|
- * question. |
|
+ * This data is "the" answer to |
|
+ * our question only if we're |
|
+ * not chaining. |
|
*/ |
|
- name->attributes |= |
|
- DNS_NAMEATTR_CACHE; |
|
- rdataset->attributes |= |
|
- DNS_RDATASETATTR_CACHE; |
|
- rdataset->trust = dns_trust_answer; |
|
- if (!chaining) { |
|
- /* |
|
- * This data is "the" answer |
|
- * to our question only if |
|
- * we're not chaining. |
|
- */ |
|
- INSIST(!external); |
|
- if (aflag == |
|
- DNS_RDATASETATTR_ANSWER) |
|
- have_answer = ISC_TRUE; |
|
+ INSIST(!external); |
|
+ if (aflag == DNS_RDATASETATTR_ANSWER) { |
|
+ have_answer = ISC_TRUE; |
|
name->attributes |= |
|
DNS_NAMEATTR_ANSWER; |
|
- rdataset->attributes |= aflag; |
|
- if (aa) |
|
- rdataset->trust = |
|
- dns_trust_authanswer; |
|
- } else if (external) { |
|
- rdataset->attributes |= |
|
- DNS_RDATASETATTR_EXTERNAL; |
|
- } |
|
- |
|
- /* |
|
- * DNAME chaining. |
|
- */ |
|
- if (found_dname) { |
|
- /* |
|
- * Copy the dname into the |
|
- * qname fixed name. |
|
- * |
|
- * Although we check for |
|
- * failure of the copy |
|
- * operation, in practice it |
|
- * should never fail since |
|
- * we already know that the |
|
- * result fits in a fixedname. |
|
- */ |
|
- dns_fixedname_init(&fqname); |
|
- result = dns_name_copy( |
|
- dns_fixedname_name(&dname), |
|
- dns_fixedname_name(&fqname), |
|
- NULL); |
|
- if (result != ISC_R_SUCCESS) |
|
- return (result); |
|
- wanted_chaining = ISC_TRUE; |
|
- name->attributes |= |
|
- DNS_NAMEATTR_CHAINING; |
|
- rdataset->attributes |= |
|
- DNS_RDATASETATTR_CHAINING; |
|
- qname = dns_fixedname_name( |
|
- &fqname); |
|
} |
|
+ rdataset->attributes |= aflag; |
|
+ if (aa) |
|
+ rdataset->trust = |
|
+ dns_trust_authanswer; |
|
+ } else if (external) { |
|
+ rdataset->attributes |= |
|
+ DNS_RDATASETATTR_EXTERNAL; |
|
} |
|
} |
|
+ |
|
+ /* |
|
+ * DNAME chaining. |
|
+ */ |
|
+ if (dnameset != NULL) { |
|
+ /* |
|
+ * Copy the dname into the qname fixed name. |
|
+ * |
|
+ * Although we check for failure of the copy |
|
+ * operation, in practice it should never fail |
|
+ * since we already know that the result fits |
|
+ * in a fixedname. |
|
+ */ |
|
+ dns_fixedname_init(&fqname); |
|
+ qname = dns_fixedname_name(&fqname); |
|
+ result = dns_name_copy(dname, qname, NULL); |
|
+ if (result != ISC_R_SUCCESS) |
|
+ return (result); |
|
+ wanted_chaining = ISC_TRUE; |
|
+ name->attributes |= DNS_NAMEATTR_CHAINING; |
|
+ dnameset->attributes |= |
|
+ DNS_RDATASETATTR_CHAINING; |
|
+ } |
|
if (wanted_chaining) |
|
chaining = ISC_TRUE; |
|
} |
|
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c |
|
index ae5391a..10e5dc9 100644 |
|
--- a/lib/isccc/cc.c |
|
+++ b/lib/isccc/cc.c |
|
@@ -286,10 +286,10 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length, |
|
* Extract digest. |
|
*/ |
|
_auth = isccc_alist_lookup(alist, "_auth"); |
|
- if (_auth == NULL) |
|
+ if (!isccc_alist_alistp(_auth)) |
|
return (ISC_R_FAILURE); |
|
hmd5 = isccc_alist_lookup(_auth, "hmd5"); |
|
- if (hmd5 == NULL) |
|
+ if (!isccc_sexpr_binaryp(hmd5)) |
|
return (ISC_R_FAILURE); |
|
/* |
|
* Compute digest. |
|
@@ -543,7 +543,7 @@ isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok, |
|
REQUIRE(ackp != NULL && *ackp == NULL); |
|
|
|
_ctrl = isccc_alist_lookup(message, "_ctrl"); |
|
- if (_ctrl == NULL || |
|
+ if (!isccc_alist_alistp(_ctrl) || |
|
isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || |
|
isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS) |
|
return (ISC_R_FAILURE); |
|
@@ -588,7 +588,7 @@ isccc_cc_isack(isccc_sexpr_t *message) |
|
isccc_sexpr_t *_ctrl; |
|
|
|
_ctrl = isccc_alist_lookup(message, "_ctrl"); |
|
- if (_ctrl == NULL) |
|
+ if (!isccc_alist_alistp(_ctrl)) |
|
return (ISC_FALSE); |
|
if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS) |
|
return (ISC_TRUE); |
|
@@ -601,7 +601,7 @@ isccc_cc_isreply(isccc_sexpr_t *message) |
|
isccc_sexpr_t *_ctrl; |
|
|
|
_ctrl = isccc_alist_lookup(message, "_ctrl"); |
|
- if (_ctrl == NULL) |
|
+ if (!isccc_alist_alistp(_ctrl)) |
|
return (ISC_FALSE); |
|
if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS) |
|
return (ISC_TRUE); |
|
@@ -621,7 +621,7 @@ isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now, |
|
|
|
_ctrl = isccc_alist_lookup(message, "_ctrl"); |
|
_data = isccc_alist_lookup(message, "_data"); |
|
- if (_ctrl == NULL || _data == NULL || |
|
+ if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) || |
|
isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS || |
|
isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS) |
|
return (ISC_R_FAILURE); |
|
@@ -810,7 +810,7 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message, |
|
isccc_sexpr_t *_ctrl; |
|
|
|
_ctrl = isccc_alist_lookup(message, "_ctrl"); |
|
- if (_ctrl == NULL || |
|
+ if (!isccc_alist_alistp(_ctrl) || |
|
isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS || |
|
isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS) |
|
return (ISC_R_FAILURE);
|
|
|