dnsimple / dns_erlang / 30259340523

92%

push

github

Decline zone transfers in decode_query/1 (rfc1995, rfc5936)

Two faults, one shape. The opcode 0 header guard from #101 required
NSCOUNT = 0, but rfc1995 §3 has an IXFR client state the serial it holds
by putting that SOA in the authority section, so every conformant IXFR
query was rejected as formerr; erldns drops what it cannot decode without
replying, so a secondary retried on a timer and never learned why. The
exemption was in #101's own survey, under miekg/dns: "Allows at most 1 RR
in Answer/Authority sections (for NOTIFY/IXFR)". NOTIFY got its clause.

Admitting the record is not enough, because nothing downstream knows what
a transfer is. Driving the erldns pipeline with a decoded IXFR gives
NOERROR, aa=true, an empty answer and the zone's SOA in authority: no
record carries type 251, so it resolves to NODATA like any other qtype
that matches nothing. That is worse than the formerr it replaces. rfc1995
§4 gives a lone SOA and nothing else the meaning "your copy is current",
and this reply is one SOA away from that, so a lenient secondary can read
it as confirmation that it is in sync with a zone it has never once
transferred. Silence at least fails loudly.

So decline them here, as the opcodes above already are. rfc1035 §4.1.1
defines NOTIMP as "the name server does not support the requested kind of
query", which is the literal truth: a transfer is answered as a stream of
messages over a held connection, and a caller that gets one decoded
message back cannot produce that. A server implementing transfers decodes
with decode_message/1 and runs its own loop, as it must regardless.

The check reads the decoded message rather than gating ahead of it. The
qtype lives in the question section, so testing it before decode_body/3
would parse the questions twice on every query to catch a rare one; two
clauses on the way out cost the same and only on the way out. AXFR needs
no authority record and never tripped the guard, but resolved to the same
NODATA, s... (continued)

5 of 5 new or added lines in 1 file covered. (100.0%)

2978 of 3240 relevant lines covered (91.91%)

11669.93 hits per line