Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge master into develop (Engine) #1441

Merged
merged 39 commits into from
Mar 5, 2025
Merged

Merge master into develop (Engine) #1441

merged 39 commits into from
Mar 5, 2025

Conversation

matsduf
Copy link
Contributor

@matsduf matsduf commented Mar 5, 2025

bzwitt and others added 30 commits September 25, 2024 08:39
When resolving A and AAAA records for a name server name found in an NS
resource record, if that name happens to be an alias, then there is a
chance that we recurse indefinitely.

This happens because when Zonemaster does a follow-up query to try
resolving the alias target, it forgets that it was actually in the
process of resolving the name server name. It will try resolving the
name server name again, hit the alias again, then follow it again until
the heat death of the universe.

This commit ensures that the appropriate context is retained when
chasing an alias. It also modifies the loop detection slightly in order
to act on that previous context. Testing shows that there is no need, in
this particular case, to look at the CNAME chain itself because the
$state->{in_progress} hash contains the same data.
- Use a list of queried name servers instead of all name servers, in case any IP protocol is unavailable (or if the IP address has already been processed).
- Add test scenario BAD-SERVERS-BUT-GOOD-NSEC-1
- Update unit test data
Now that only non-EDNS SOA queries trigger the name server blacklisting mechanism, those special treatments are no longer needed.
Co-authored-by: Marc van der Wal <[email protected]>
To ensure that this problem will not happen ever again, I’ve added a
test scenario (currently under review in zonemaster/zonemaster) and
implemented it here.
Fix infinite recursion bug when NS record points to CNAME
Update name server blacklisting mechanism
Methods 'Zonemaster::Engine::TestMethodsV2::get_{zone,del}_ns_names_and_ips()' can return a mix of Zonemaster::Engine::Nameserver or Zonemaster::Engine::DNSName objects, depending on whether the name could be resolved into an IP address.
Due to a previous oversight, this can cause issues in Test Cases that use them. We can filter Zonemaster::Engine::DNSName objects out since they can't be queried.
Check for object type in returned values from some TestMethodsV2 methods used in Test Cases
It seems that setting the 'edns_size' parameter to the underlying Zonemaster::LDNS resolver object isn't sufficient when Zonemaster::LDNS::query_with_pkt() is used.
We have to explicitly set it in the given Zonemaster::LDNS::Packet object.
Co-authored-by: Marc van der Wal <[email protected]>
Correctly set EDNS buffer size through 'edns_details'
Updating spanish translation for new zonemaster release
@matsduf matsduf added this to the v2024.2.1 milestone Mar 5, 2025
@matsduf matsduf merged commit 7d4afef into develop Mar 5, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants