>> So I'm sitting here scrathing my head even more confused than
>> usual. Anyone have any insights?
>
> The SOA has the wrong owner name. Bind followed a referral for
> map.media6degrees.com but the SOA wrongly says the zone apex is
> media6degrees.com.
>
> https://lists.isc.org/pipermail/bind-users/2009-December/078403.html
> http://fanf.livejournal.com/107721.html
Ah! OK, then let me offer the following patch to reduce
confusion among those who might inadvertently start following my
tracks:
--- lib/dns/resolver.c.orig 2012-08-24 04:40:57.000000000 +0000
+++ lib/dns/resolver.c
@@ -5418,10 +5418,10 @@ noanswer_response(fetchctx_t *fctx, dns_
{
isc_result_t result;
dns_message_t *message;
- dns_name_t *name, *qname, *ns_name, *soa_name, *ds_name;
+ dns_name_t *name, *qname, *ns_name, *soa_name, *ds_name, *save_name;
dns_rdataset_t *rdataset, *ns_rdataset;
isc_boolean_t aa, negative_response;
- dns_rdatatype_t type;
+ dns_rdatatype_t type, save_type;
dns_section_t section;
FCTXTRACE("noanswer_response");
@@ -5488,6 +5488,8 @@ noanswer_response(fetchctx_t *fctx, dns_
ns_rdataset = NULL;
soa_name = NULL;
ds_name = NULL;
+ save_name = NULL;
+ save_type = dns_rdatatype_none;
result = dns_message_firstname(message, section);
while (result == ISC_R_SUCCESS) {
name = NULL;
@@ -5580,6 +5582,9 @@ noanswer_response(fetchctx_t *fctx, dns_
dns_trust_additional;
}
}
+ } else {
+ save_name = name;
+ save_type = ISC_LIST_HEAD(name->list)->type;
}
result = dns_message_nextname(message, section);
if (result == ISC_R_NOMORE)
@@ -5721,7 +5726,35 @@ noanswer_response(fetchctx_t *fctx, dns_
/*
* The responder is insane.
*/
- log_formerr(fctx, "invalid response");
+ if (save_name == NULL) {
+ log_formerr(fctx, "invalid response");
+ return (DNS_R_FORMERR);
+ }
+ if (!dns_name_issubdomain(save_name, &fctx->domain)) {
+ char nbuf[DNS_NAME_FORMATSIZE];
+ char dbuf[DNS_NAME_FORMATSIZE];
+ char tbuf[DNS_RDATATYPE_FORMATSIZE];
+ const char *s;
+
+ dns_rdatatype_format(save_type,
+ tbuf, sizeof(tbuf));
+ dns_name_format(save_name, nbuf,
+ sizeof(nbuf));
+ dns_name_format(&fctx->domain, dbuf,
+ sizeof(dbuf));
+
+ if (section == DNS_SECTION_ANSWER)
+ s = "answer";
+ else
+ s = "authority";
+
+ log_formerr(fctx, "Name %s (%s) in %s section"
+ " not subdomain of"
+ " known-to-be zone %s --"
+ " invalid response",
+ nbuf, tbuf, s, dbuf);
+ } else
+ log_formerr(fctx, "invalid response");
return (DNS_R_FORMERR);
}
}
- Havard
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
