Add blacklisting log message #1434
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ine into translation-update
When resolving A and AAAA records for a name server name found in an NS
resource record, if that name happens to be an alias, then there is a
chance that we recurse indefinitely.
This happens because when Zonemaster does a follow-up query to try
resolving the alias target, it forgets that it was actually in the
process of resolving the name server name. It will try resolving the
name server name again, hit the alias again, then follow it again until
the heat death of the universe.
This commit ensures that the appropriate context is retained when
chasing an alias. It also modifies the loop detection slightly in order
to act on that previous context. Testing shows that there is no need, in
this particular case, to look at the CNAME chain itself because the
$state->{in_progress} hash contains the same data.
- Use a list of queried name servers instead of all name servers, in case any IP protocol is unavailable (or if the IP address has already been processed). - Add test scenario BAD-SERVERS-BUT-GOOD-NSEC-1 - Update unit test data
Now that only non-EDNS SOA queries trigger the name server blacklisting mechanism, those special treatments are no longer needed.
Co-authored-by: Marc van der Wal <[email protected]>
To ensure that this problem will not happen ever again, I’ve added a test scenario (currently under review in zonemaster/zonemaster) and implemented it here.
…ter#1421 Fix infinite recursion bug when NS record points to CNAME
Update name server blacklisting mechanism
Fix in DNSSEC10
Methods 'Zonemaster::Engine::TestMethodsV2::get_{zone,del}_ns_names_and_ips()' can return a mix of Zonemaster::Engine::Nameserver or Zonemaster::Engine::DNSName objects, depending on whether the name could be resolved into an IP address.
Due to a previous oversight, this can cause issues in Test Cases that use them. We can filter Zonemaster::Engine::DNSName objects out since they can't be queried.
Check for object type in returned values from some TestMethodsV2 methods used in Test Cases
It seems that setting the 'edns_size' parameter to the underlying Zonemaster::LDNS resolver object isn't sufficient when Zonemaster::LDNS::query_with_pkt() is used. We have to explicitly set it in the given Zonemaster::LDNS::Packet object.
Co-authored-by: Marc van der Wal <[email protected]>
Update French translation
Correctly set EDNS buffer size through 'edns_details'
Updating spanish translation for new zonemaster release
Adds translation to Slovenian
tgreenx
added
the
V-Patch
tgreenx
requested review from
mattias-p,
matsduf,
tolvmannen,
marc-vanderwal and
MichaelTimbert
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose
This PR proposes to add a new message tag when blacklisting a name server. It is currently not translated.
Note that this PR is based on top of current
release-v2024.2branch which is not yet merged in develop, so the only relevant commit is the last one: c7c9d52. Discard others when reviewing.Context
N/A
Changes
BLACKLISTINGat theDEBUGlevel (untranslated)How to test this PR
Test on a domain with a non-responsive name server, e.g: