3993. [func] Dig now supports EDNS negotiation by default.

(dig +[no]ednsnegotiation). [RT #37604] (cherry picked from commit 0f5144163c)
2014-10-30 23:13:12 +11:00
parent 449b5bdc99
commit 105720bad6
7 changed files with 75 additions and 5 deletions
--- a/3
+++ b/3
@@ -161,6 +161,9 @@
 			during operation. If the read failed, named
 			could segfault. [RT #38559]

+3993.	[func]		Dig now supports EDNS negotiation by default.
+			(dig +[no]ednsnegotiation). [RT #37604]
+
 3951.	[func]		Add the ability to set yet-to-be-defined EDNS flags
 			to dig (+ednsflags=#). [RT #37142]

--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -197,6 +197,7 @@ help(void) {
 "                 +ednsflags=###      (Set EDNS flag bits)\n"
 "                 +ednsopt=###[:value] (Send specified EDNS option)\n"
 "                 +noednsopt          (Clear list of +ednsopt options)\n"
+"                 +[no]ednsnegotiation (Set EDNS version negotiation)\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
 "                 +[no]defname        (Ditto)\n"
@@ -967,6 +968,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 							      "ednsflags");
 						lookup->ednsflags = num;
 						break;
+					case 'n':
+						FULLCHECK("ednsnegotiation");
+						lookup->ednsneg = state;
+						break;
 					case 'o':
 						FULLCHECK("ednsopt");
 						if (!state) {
--- a/bin/dig/dig.docbook
+++ b/bin/dig/dig.docbook
@@ -658,6 +658,16 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]ednsnegotiation</option></term>
+	  <listitem>
+	    <para>
+	      Enable / disable EDNS version negotiation. By default
+	      EDNS version negotiation is enabled.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]ednsopt[=code[:value]]</option></term>
 	  <listitem>
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -837,6 +837,7 @@ make_empty_lookup(void) {
 #endif
 	looknew->ednsopts = NULL;
 	looknew->ednsoptscnt = 0;
+	looknew->ednsneg = ISC_TRUE;
 	dns_fixedname_init(&looknew->fdomain);
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
@@ -893,6 +894,7 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 #endif
 	looknew->ednsopts = lookold->ednsopts;
 	looknew->ednsoptscnt = lookold->ednsoptscnt;
+	looknew->ednsneg = lookold->ednsneg;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = lookold->sigchase;
 #if DIG_SIGCHASE_TD
@@ -3464,6 +3466,10 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {
 }
 #endif

+static int
+ednsvers(dns_rdataset_t *opt) {
+	return ((opt->ttl >> 16) & 0xff);
+}

 /*%
 * Event handler for recv complete.  Perform whatever actions are necessary,
@@ -3493,6 +3499,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	isc_region_t r;
 	isc_buffer_t *buf = NULL;
 #endif
+	int newedns;

 	UNUSED(task);
 	INSIST(!free_now);
@@ -3724,6 +3731,25 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				goto udp_mismatch;
 		}
 	}
+	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
+	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg) {
+		/*
+		 * Add minimum EDNS version required checks here if needed.
+		 */
+		if (l->comments)
+			printf(";; BADVERS, retrying with EDNS version %u.\n",
+			       newedns);
+		l->edns = newedns;
+		n = requeue_lookup(l, ISC_TRUE);
+		n->origin = query->lookup->origin;
+		dns_message_destroy(&msg);
+		isc_event_free(&event);
+		clear_query(query);
+		cancel_lookup(l);
+		check_next_lookup(l);
+		UNLOCK_LOOKUP;
+		return;
+	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
 	    !l->ignore && !l->tcp_mode) {
 #ifdef ISC_PLATFORM_USESIT
--- a/bin/dig/include/dig/dig.h
+++ b/bin/dig/include/dig/dig.h
@@ -133,7 +133,8 @@ struct dig_lookup {
 #ifdef ISC_PLATFORM_USESIT
 		sit,
 #endif
-		nsid;   /*% Name Server ID (RFC 5001) */
+		nsid,   /*% Name Server ID (RFC 5001) */
+		ednsneg;
 #ifdef DIG_SIGCHASE
 isc_boolean_t	sigchase;
 #if DIG_SIGCHASE_TD
--- a/bin/tests/system/ednscompliance/tests.sh
+++ b/bin/tests/system/ednscompliance/tests.sh
@@ -48,7 +48,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:Unknown EDNS version ($n)"
 ret=0 reason=
-$DIG -p 5300 @10.53.0.1 +norec +edns=100 soa $zone > dig.out$n
+$DIG -p 5300 @10.53.0.1 +norec +edns=100 +noednsneg soa $zone > dig.out$n
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "IN.SOA." dig.out$n > /dev/null && { ret=1; reaons="soa"; }
@@ -69,7 +69,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:Unknown EDNS version + option ($n)"
 ret=0 reason=
-$DIG -p 5300 @10.53.0.1 +norec +edns=100 +ednsopt=100 soa $zone > dig.out$n
+$DIG -p 5300 @10.53.0.1 +norec +edns=100 +noednsneg +ednsopt=100 soa $zone > dig.out$n
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "; OPT=100" dig.out$n > /dev/null && { ret=1; reason="option"; }
@@ -91,7 +91,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:Unknown EDNS version + flag ($n)"
 ret=0 reason=
-$DIG -p 5300 @10.53.0.1 +norec +edns=100 +ednsflags=0x80 soa $zone > dig.out$n
+$DIG -p 5300 @10.53.0.1 +norec +edns=100 +noednsneg +ednsflags=0x80 soa $zone > dig.out$n
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "EDNS:.*MBZ" dig.out$n > /dev/null > /dev/null && { ret=1; reason="mbz"; }
@@ -100,5 +100,15 @@ if [ $ret != 0 ]; then echo "I:failed $reason"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

+echo "I:DiG's EDNS negotiation ($n)"
+ret=0 reason=
+$DIG -p 5300 @10.53.0.1 +norec +edns=100 soa $zone > dig.out$n
+grep "status: NOERROR," dig.out$n > /dev/null || { ret=1; reason="status"; }
+grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
+grep "IN.SOA." dig.out$n > /dev/null || { ret=1; reason="soa"; }
+if [ $ret != 0 ]; then echo "I:failed $reason"; fi
+status=`expr $status + $ret`
+n=`expr $n + 1`
+
 echo "I:exit status: $status"
 exit $status
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -47,7 +47,22 @@
    <title>New Features</title>
    <itemizedlist>
      <listitem>
-	<para>None</para>
+	<para>
+          <command>dig +ednsopt</command> can now be used to set
+          arbitrary EDNS options in DNS requests.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+          <command>dig +ednsflags</command> can now be used to set
+          yet-to-be-defined EDNS flags in DNS requests.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  <command>dig +[no]ednsnegotiation</command> can now be used enable /
+	  disable EDNS version negotiation.
+	</para>
      </listitem>
      <listitem>
 	<para>