dnsimple / dns_erlang / 30253944014

92%

Build Type

push

github

Committed by NelsonVides

Commit Message

Decode rfc2136 UPDATE, and refuse to serve it with NOTIMP

a4f90e2 made empty RDATA an error for every type in requires_rrdata/1,
on the grounds that RFC 1035 §3.2.1 leaves no room for a known type to
carry zero octets. rfc2136 is the exception: §2.4 prerequisites and the
§2.5.2/§2.5.3 RRset deletes all encode a concrete RRTYPE with
RDLENGTH = 0, because such an RR names an RRset rather than asserting
one. Windows DHCP clients emit these continuously at whatever nameserver
DHCP hands them, so an authoritative server sees a steady stream.

The result was formerr on traffic that is not malformed. erldns logs
that at error and sends nothing back, so the client retries on a timer
and one misconfigured LAN produces an unbounded stream of events. Built
at a4f90e2^, the same datagrams decode clean, prerequisites and all --
this is a v5.0.14 regression, not a long-standing gap.

Gate the empty-RDATA clause on CLASS instead of dropping it: ANY and
NONE are exactly the rfc2136 delete and prerequisite encodings, and
neither can appear in query or response traffic. CLASS IN with
RDLENGTH = 0 still raises, so a zero-length A record is caught as
before and a4f90e2's reasoning is left intact -- only narrowed to the
records it did not consider.

Decoding an UPDATE is not the same as agreeing to serve one, so
decode_query/1 now hands opcode 5 to create_notimp_message/7 alongside
IQUERY, STATUS and DSO, which rfc2136 §3.1 permits from a server that
does not implement UPDATE. This is a breaking change for a caller
implementing rfc2136 on top of decode_query/1; that caller wants
decode_message/1, which parses the message in full. It also closes a
silent failure: erldns has no opcode dispatch at all, so a decoded
UPDATE would fall through the ordinary pipeline and be answered as a
plain SOA query for the zone -- NOERROR, telling the client its
registration succeeded. Returning notimp is the difference between a
wrong answer and an honest one.

The split mirrors PowerDNS, ... (continued)

Coverage Stats

1 of 0 new or added lines in 0 files covered. (NaN%)

8 existing lines in 1 file now uncovered.

2974 of 3236 relevant lines covered (91.9%)

11773.33 hits per line