TrueCloudLab/coredns
16
0
Fork 2
Code Issues Pull requests 4 Projects Releases Packages Wiki Activity Actions

plugin/cache: Unset AD flag when DO is not set for cache miss (#4736)

Browse source 
* unset AD bit when client DO is 0

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* add flag check to existing tests

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
This commit is contained in:
Chris O'Haver 2021-07-09 04:53:50 -04:00 • committed by GitHub
parent bfb6972d30
commit 002b748ccd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 19 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
plugin/cache/cache.go vendored
View file

@ -181,6 +181,10 @@ func (w *ResponseWriter) WriteMsg(res *dns.Msg) error {
res.Ns = filterRRSlice(res.Ns, ttl, w.do, false) res.Ns = filterRRSlice(res.Ns, ttl, w.do, false)
res.Extra = filterRRSlice(res.Extra, ttl, w.do, false) res.Extra = filterRRSlice(res.Extra, ttl, w.do, false)
if !w.do {
res.AuthenticatedData = false // unset AD bit if client is not OK with DNSSEC
}
return w.ResponseWriter.WriteMsg(res) return w.ResponseWriter.WriteMsg(res)
} }

7
plugin/cache/dnssec_test.go vendored
View file

@ -23,7 +23,8 @@ func TestResponseWithDNSSEC(t *testing.T) {
}, },
{ {
Qname: "invent.example.org.", Qtype: dns.TypeA, Qname: "invent.example.org.", Qtype: dns.TypeA,
Do: true, Do: true,
AuthenticatedData: true,
Answer: []dns.RR{ Answer: []dns.RR{
test.CNAME("invent.example.org. 1781 IN CNAME leptone.example.org."), test.CNAME("invent.example.org. 1781 IN CNAME leptone.example.org."),
test.RRSIG("invent.example.org. 1781 IN RRSIG CNAME 8 3 1800 20201012085750 20200912082613 57411 example.org. ijSv5FmsNjFviBcOFwQgqjt073lttxTTNqkno6oMa3DD3kC+"), test.RRSIG("invent.example.org. 1781 IN RRSIG CNAME 8 3 1800 20201012085750 20200912082613 57411 example.org. ijSv5FmsNjFviBcOFwQgqjt073lttxTTNqkno6oMa3DD3kC+"),
@ -40,6 +41,9 @@ func TestResponseWithDNSSEC(t *testing.T) {
m := tc.Msg() m := tc.Msg()
rec := dnstest.NewRecorder(&test.ResponseWriter{}) rec := dnstest.NewRecorder(&test.ResponseWriter{})
c.ServeDNS(context.TODO(), rec, m) c.ServeDNS(context.TODO(), rec, m)
if tc.AuthenticatedData != rec.Msg.AuthenticatedData {
t.Errorf("Test %d, expected AuthenticatedData=%v", i, tc.AuthenticatedData)
}
if err := test.Section(tc, test.Answer, rec.Msg.Answer); err != nil { if err := test.Section(tc, test.Answer, rec.Msg.Answer); err != nil {
t.Errorf("Test %d, expected no error, got %s", i, err) t.Errorf("Test %d, expected no error, got %s", i, err)
} }
@ -64,6 +68,7 @@ func dnssecHandler() plugin.Handler {
m := new(dns.Msg) m := new(dns.Msg)
m.SetQuestion("example.org.", dns.TypeA) m.SetQuestion("example.org.", dns.TypeA)
m.AuthenticatedData = true
m.Answer = make([]dns.RR, 4) m.Answer = make([]dns.RR, 4)
m.Answer[0] = test.CNAME("invent.example.org. 1781 IN CNAME leptone.example.org.") m.Answer[0] = test.CNAME("invent.example.org. 1781 IN CNAME leptone.example.org.")
m.Answer[1] = test.RRSIG("invent.example.org. 1781 IN RRSIG CNAME 8 3 1800 20201012085750 20200912082613 57411 example.org. ijSv5FmsNjFviBcOFwQgqjt073lttxTTNqkno6oMa3DD3kC+") m.Answer[1] = test.RRSIG("invent.example.org. 1781 IN RRSIG CNAME 8 3 1800 20201012085750 20200912082613 57411 example.org. ijSv5FmsNjFviBcOFwQgqjt073lttxTTNqkno6oMa3DD3kC+")

17
plugin/test/helpers.go
View file

@ -29,14 +29,15 @@ func (p RRSet) Less(i, j int) bool { return p[i].String() < p[j].String() }
// Case represents a test case that encapsulates various data from a query and response. // Case represents a test case that encapsulates various data from a query and response.
// Note that is the TTL of a record is 303 we don't compare it with the TTL. // Note that is the TTL of a record is 303 we don't compare it with the TTL.
type Case struct { type Case struct {
Qname string Qname string
Qtype uint16 Qtype uint16
Rcode int Rcode int
Do bool Do bool
Answer []dns.RR AuthenticatedData bool
Ns []dns.RR Answer []dns.RR
Extra []dns.RR Ns []dns.RR
Error error Extra []dns.RR
Error error
} }
// Msg returns a *dns.Msg embedded in c. // Msg returns a *dns.Msg embedded in c.