db4030
From bd79638f1c2c8f765e316c30b15dfb3e5d31e1e4 Mon Sep 17 00:00:00 2001
db4030
From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
db4030
Date: Thu, 3 Jan 2019 14:58:05 +0100
db4030
Subject: [PATCH] If possible don't use forwarders when priming the resolver.
db4030
db4030
If we try to fetch a record from cache and need to look into
db4030
hints database we assume that the resolver is not primed and
db4030
start dns_resolver_prime(). Priming query is supposed to return
db4030
NSes for "." in ANSWER section and glue records for them in
db4030
ADDITIONAL section, so that we can fill that info in 'regular'
db4030
cache and not use hints db anymore.
db4030
However, if we're using a forwarder the priming query goes through
db4030
it, and if it's configured to return minimal answers we won't get
db4030
the addresses of root servers in ADDITIONAL section. Since the
db4030
only records for root servers we have are in hints database we'll
db4030
try to prime the resolver with every single query.
db4030
db4030
This patch adds a DNS_FETCHOPT_NOFORWARD flag which avoids using
db4030
forwarders if possible (that is if we have forward-first policy).
db4030
Using this flag on priming fetch fixes the problem as we get the
db4030
proper glue. With forward-only policy the problem is non-existent,
db4030
as we'll never ask for root server addresses because we'll never
db4030
have a need to query them.
db4030
db4030
Also added a test to confirm priming queries are not forwarded.
db4030
db4030
(cherry picked from commit b49310ac06ac87733dc2867828e61370a84b2a9a)
db4030
(cherry picked from commit f8963ad70e222edad0c1e64f855f7fb41fb13c3c)
db4030
(cherry picked from commit aa9866c390a21d6984aa75cdb84d7bc77e114c2f)
db4030
---
db4030
 bin/tests/system/forward/ns4/named.conf.in |  3 ++
db4030
 bin/tests/system/forward/ns7/named.conf.in | 28 +++++++++++++++++
db4030
 bin/tests/system/forward/ns7/root.db       | 28 +++++++++++++++++
db4030
 bin/tests/system/forward/setup.sh          |  1 +
db4030
 bin/tests/system/forward/tests.sh          | 12 ++++++++
db4030
 lib/dns/include/dns/resolver.h             | 36 ++++++++++++----------
db4030
 lib/dns/resolver.c                         | 17 ++++++++--
db4030
 7 files changed, 106 insertions(+), 19 deletions(-)
db4030
 create mode 100644 bin/tests/system/forward/ns7/named.conf.in
db4030
 create mode 100644 bin/tests/system/forward/ns7/root.db
db4030
db4030
diff --git a/bin/tests/system/forward/ns4/named.conf.in b/bin/tests/system/forward/ns4/named.conf.in
db4030
index 480530b0f2..643e1271b5 100644
db4030
--- a/bin/tests/system/forward/ns4/named.conf.in
db4030
+++ b/bin/tests/system/forward/ns4/named.conf.in
db4030
@@ -17,6 +17,9 @@ options {
db4030
 	pid-file "named.pid";
db4030
 	listen-on { 10.53.0.4; };
db4030
 	listen-on-v6 { none; };
db4030
+	recursion yes;
db4030
+	dnssec-validation yes;
db4030
+	minimal-responses yes;
db4030
 };
db4030
 
db4030
 zone "." {
db4030
diff --git a/bin/tests/system/forward/ns7/named.conf.in b/bin/tests/system/forward/ns7/named.conf.in
db4030
new file mode 100644
db4030
index 0000000000..d9f5e8a9db
db4030
--- /dev/null
db4030
+++ b/bin/tests/system/forward/ns7/named.conf.in
db4030
@@ -0,0 +1,28 @@
db4030
+/*
db4030
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
db4030
+ *
db4030
+ * This Source Code Form is subject to the terms of the Mozilla Public
db4030
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
db4030
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
db4030
+ *
db4030
+ * See the COPYRIGHT file distributed with this work for additional
db4030
+ * information regarding copyright ownership.
db4030
+ */
db4030
+
db4030
+options {
db4030
+	query-source address 10.53.0.7;
db4030
+	notify-source 10.53.0.7;
db4030
+	transfer-source 10.53.0.7;
db4030
+	port @PORT@;
db4030
+	pid-file "named.pid";
db4030
+	listen-on { 10.53.0.7; };
db4030
+	listen-on-v6 { none; };
db4030
+	forwarders { 10.53.0.4; };
db4030
+	forward first;
db4030
+	dnssec-validation yes;
db4030
+};
db4030
+
db4030
+zone "." {
db4030
+	type hint;
db4030
+	file "root.db";
db4030
+};
db4030
diff --git a/bin/tests/system/forward/ns7/root.db b/bin/tests/system/forward/ns7/root.db
db4030
new file mode 100644
db4030
index 0000000000..7346810ba6
db4030
--- /dev/null
db4030
+++ b/bin/tests/system/forward/ns7/root.db
db4030
@@ -0,0 +1,28 @@
db4030
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
db4030
+;
db4030
+; This Source Code Form is subject to the terms of the Mozilla Public
db4030
+; License, v. 2.0. If a copy of the MPL was not distributed with this
db4030
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
db4030
+;
db4030
+; See the COPYRIGHT file distributed with this work for additional
db4030
+; information regarding copyright ownership.
db4030
+
db4030
+$TTL 300
db4030
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
db4030
+				2000042100   	; serial
db4030
+				600         	; refresh
db4030
+				600         	; retry
db4030
+				1200    	; expire
db4030
+				600       	; minimum
db4030
+				)
db4030
+.			NS	a.root-servers.nil.
db4030
+a.root-servers.nil.	A	10.53.0.1
db4030
+
db4030
+example1		NS	ns.example1
db4030
+ns.example1		A	10.53.0.1
db4030
+
db4030
+example2		NS	ns.example2
db4030
+ns.example2		A	10.53.0.1
db4030
+
db4030
+example3		NS	ns.example3
db4030
+ns.example3		A	10.53.0.1
db4030
diff --git a/bin/tests/system/forward/setup.sh b/bin/tests/system/forward/setup.sh
db4030
index c63aeb10d2..d64579e590 100644
db4030
--- a/bin/tests/system/forward/setup.sh
db4030
+++ b/bin/tests/system/forward/setup.sh
db4030
@@ -18,3 +18,4 @@ copy_setports ns2/named.conf.in ns2/named.conf
db4030
 copy_setports ns3/named.conf.in ns3/named.conf
db4030
 copy_setports ns4/named.conf.in ns4/named.conf
db4030
 copy_setports ns5/named.conf.in ns5/named.conf
db4030
+copy_setports ns7/named.conf.in ns7/named.conf
db4030
diff --git a/bin/tests/system/forward/tests.sh b/bin/tests/system/forward/tests.sh
db4030
index f23cde1751..8c6496037d 100644
db4030
--- a/bin/tests/system/forward/tests.sh
db4030
+++ b/bin/tests/system/forward/tests.sh
db4030
@@ -131,5 +131,17 @@ $CHECKCONF ula-notinherited.conf | grep "forward first;" >/dev/null && ret=1
db4030
 if [ $ret != 0 ]; then echo_i "failed"; fi
db4030
 status=`expr $status + $ret`
db4030
 
db4030
+echo_i "checking that priming queries are not forwarded"
db4030
+ret=0
db4030
+$DIG $DIGOPTS +noadd +noauth txt.example1. txt @10.53.0.7 > dig.out.f7 || ret=1
db4030
+sent=`sed -n '/sending packet to 10.53.0.1/,/^$/p' ns7/named.run | grep ";.*IN.*NS" | wc -l`
db4030
+[ $sent -eq 1 ] || ret=1
db4030
+sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run | wc -l`
db4030
+[ $sent -eq 0 ] || ret=1
db4030
+sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run | wc -l`
db4030
+[ $sent -eq 1 ] || ret=1
db4030
+if [ $ret != 0 ]; then echo_i "failed"; fi
db4030
+status=`expr $status + $ret`
db4030
+
db4030
 echo_i "exit status: $status"
db4030
 [ $status -eq 0 ] || exit 1
db4030
diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
db4030
index f2f8714d16..e1a10295f3 100644
db4030
--- a/lib/dns/include/dns/resolver.h
db4030
+++ b/lib/dns/include/dns/resolver.h
db4030
@@ -88,23 +88,25 @@ typedef enum {
db4030
 /*
db4030
  * Options that modify how a 'fetch' is done.
db4030
  */
db4030
-#define DNS_FETCHOPT_TCP		0x0001	     /*%< Use TCP. */
db4030
-#define DNS_FETCHOPT_UNSHARED		0x0002	     /*%< See below. */
db4030
-#define DNS_FETCHOPT_RECURSIVE		0x0004	     /*%< Set RD? */
db4030
-#define DNS_FETCHOPT_NOEDNS0		0x0008	     /*%< Do not use EDNS. */
db4030
-#define DNS_FETCHOPT_FORWARDONLY	0x0010	     /*%< Only use forwarders. */
db4030
-#define DNS_FETCHOPT_NOVALIDATE		0x0020	     /*%< Disable validation. */
db4030
-#define DNS_FETCHOPT_EDNS512		0x0040	     /*%< Advertise a 512 byte
db4030
-							  UDP buffer. */
db4030
-#define DNS_FETCHOPT_WANTNSID		0x0080	     /*%< Request NSID */
db4030
-#define DNS_FETCHOPT_PREFETCH		0x0100	     /*%< Do prefetch */
db4030
-#define DNS_FETCHOPT_NOCDFLAG		0x0200	     /*%< Don't set CD flag. */
db4030
-#define DNS_FETCHOPT_NONTA		0x0400	     /*%< Ignore NTA table. */
db4030
-/* RESERVED ECS				0x0000 */
db4030
-/* RESERVED ECS				0x1000 */
db4030
-/* RESERVED ECS				0x2000 */
db4030
-/* RESERVED TCPCLIENT			0x4000 */
db4030
-#define DNS_FETCHOPT_NOCACHED		0x8000	     /*%< Force cache update. */
db4030
+#define DNS_FETCHOPT_TCP		0x00001	     /*%< Use TCP. */
db4030
+#define DNS_FETCHOPT_UNSHARED		0x00002	     /*%< See below. */
db4030
+#define DNS_FETCHOPT_RECURSIVE		0x00004	     /*%< Set RD? */
db4030
+#define DNS_FETCHOPT_NOEDNS0		0x00008	     /*%< Do not use EDNS. */
db4030
+#define DNS_FETCHOPT_FORWARDONLY	0x00010	     /*%< Only use forwarders. */
db4030
+#define DNS_FETCHOPT_NOVALIDATE		0x00020	     /*%< Disable validation. */
db4030
+#define DNS_FETCHOPT_EDNS512		0x00040	     /*%< Advertise a 512 byte
db4030
+					0		  UDP buffer. */
db4030
+#define DNS_FETCHOPT_WANTNSID		0x00080	     /*%< Request NSID */
db4030
+#define DNS_FETCHOPT_PREFETCH		0x00100	     /*%< Do prefetch */
db4030
+#define DNS_FETCHOPT_NOCDFLAG		0x00200	     /*%< Don't set CD flag. */
db4030
+#define DNS_FETCHOPT_NONTA		0x00400	     /*%< Ignore NTA table. */
db4030
+/* RESERVED ECS				0x00000 */
db4030
+/* RESERVED ECS				0x01000 */
db4030
+/* RESERVED ECS				0x02000 */
db4030
+/* RESERVED TCPCLIENT			0x04000 */
db4030
+#define DNS_FETCHOPT_NOCACHED		0x08000	     /*%< Force cache update. */
db4030
+#define DNS_FETCHOPT_NOFORWARD		0x80000 /*%< Do not use forwarders
db4030
+							if possible. */
db4030
 
db4030
 /* Reserved in use by adb.c		0x00400000 */
db4030
 #define	DNS_FETCHOPT_EDNSVERSIONSET	0x00800000
db4030
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
db4030
index 301ad52fe2..f701a09be9 100644
db4030
--- a/lib/dns/resolver.c
db4030
+++ b/lib/dns/resolver.c
db4030
@@ -3261,6 +3261,18 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {
db4030
 	INSIST(ISC_LIST_EMPTY(fctx->forwaddrs));
db4030
 	INSIST(ISC_LIST_EMPTY(fctx->altaddrs));
db4030
 
db4030
+	/*
db4030
+	 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy
db4030
+	 * allows us to not forward - skip forwarders and go straight
db4030
+	 * to NSes. This is currently used to make sure that priming query
db4030
+	 * gets root servers' IP addresses in ADDITIONAL section.
db4030
+	 */
db4030
+	if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 &&
db4030
+	    (fctx->fwdpolicy != dns_fwdpolicy_only))
db4030
+	{
db4030
+		goto normal_nses;
db4030
+	}
db4030
+
db4030
 	/*
db4030
 	 * If this fctx has forwarders, use them; otherwise use any
db4030
 	 * selective forwarders specified in the view; otherwise use the
db4030
@@ -3346,7 +3358,7 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {
db4030
 	/*
db4030
 	 * Normal nameservers.
db4030
 	 */
db4030
-
db4030
+ normal_nses:
db4030
 	stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT;
db4030
 	if (fctx->restarts == 1) {
db4030
 		/*
db4030
@@ -9194,7 +9206,8 @@ dns_resolver_prime(dns_resolver_t *res) {
db4030
 		LOCK(&res->primelock);
db4030
 		result = dns_resolver_createfetch(res, dns_rootname,
db4030
 						  dns_rdatatype_ns,
db4030
-						  NULL, NULL, NULL, 0,
db4030
+						  NULL, NULL, NULL,
db4030
+						  DNS_FETCHOPT_NOFORWARD,
db4030
 						  res->buckets[0].task,
db4030
 						  prime_done,
db4030
 						  res, rdataset, NULL,
db4030
-- 
db4030
2.21.1
db4030