From 5508e253769fd17e713a96e14750b8ee7ccd32d8 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 2 Feb 2023 12:16:49 -0800 Subject: [PATCH 1/3] use configured source ports for UDP requests the optional 'port' option, when used with notify-source, transfer-source, etc, is used to set up UDP dispatches with a particular source port, but when the actual UDP connection was established the port would be overridden with a random one. this has been fixed. (configuring source ports is deprecated in 9.20 and slated for removal in 9.22, but should still work correctly until then.) (cherry picked from commit 4d50c912ba78ac6a98b3f0e01e2d7563ea5aefd7) --- lib/dns/dispatch.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 7bcf2e840a..b529a4ae8f 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -366,7 +366,7 @@ setup_socket(dns_dispatch_t *disp, dns_dispentry_t *resp, dns_dispatchmgr_t *mgr = disp->mgr; unsigned int nports; in_port_t *ports = NULL; - in_port_t port; + in_port_t port = *portp; if (resp->retries++ > 5) { return (ISC_R_FAILURE); @@ -386,12 +386,13 @@ setup_socket(dns_dispatch_t *disp, dns_dispentry_t *resp, resp->local = disp->local; resp->peer = *dest; - port = ports[isc_random_uniform(nports)]; - isc_sockaddr_setport(&resp->local, port); + if (port == 0) { + port = ports[isc_random_uniform(nports)]; + isc_sockaddr_setport(&resp->local, port); + *portp = port; + } resp->port = port; - *portp = port; - return (ISC_R_SUCCESS); } @@ -1421,7 +1422,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, dns_dispentry_t **respp) { dns_dispentry_t *resp = NULL; dns_qid_t *qid = NULL; - in_port_t localport = 0; + in_port_t dispport, localport = 0; dns_messageid_t id; unsigned int bucket; bool ok = false; @@ -1446,8 +1447,12 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, qid = disp->mgr->qid; - resp = isc_mem_get(disp->mgr->mctx, sizeof(*resp)); + dispport = isc_sockaddr_getport(&disp->local); + if (dispport != 0) { + localport = dispport; + } + resp = isc_mem_get(disp->mgr->mctx, sizeof(*resp)); *resp = (dns_dispentry_t){ .port = localport, .timeout = timeout, From 29ccc052dd3980f55490ba27acf291c9f9e09147 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 2 Feb 2023 13:35:32 -0800 Subject: [PATCH 2/3] add source port configuration tests check in the log files of receiving servers that the originating ports for notify and SOA query messages were set correctly from configured notify-source and transfer-source options. (cherry picked from commit 9cffd5c43111606d3605ca7f081daf51b801da10) --- bin/tests/system/notify/ns2/named.conf.in | 9 +++++---- bin/tests/system/notify/tests.sh | 4 ++++ bin/tests/system/xfer/ns3/named.conf.in | 1 + bin/tests/system/xfer/tests.sh | 7 +++++++ 4 files changed, 17 insertions(+), 4 deletions(-) diff --git a/bin/tests/system/notify/ns2/named.conf.in b/bin/tests/system/notify/ns2/named.conf.in index 44aac95013..abfdc102e2 100644 --- a/bin/tests/system/notify/ns2/named.conf.in +++ b/bin/tests/system/notify/ns2/named.conf.in @@ -51,16 +51,17 @@ primaries noport { 10.53.0.4; }; masters x21 port @EXTRAPORT1@ { noport; }; zone x1 { - type primary; + type primary; file "generic.db"; also-notify { 10.53.0.3; }; - notify primary-only; + notify-source 10.53.0.2 port @EXTRAPORT2@; + notify primary-only; }; zone x2 { - type primary; + type primary; file "generic.db"; also-notify { 10.53.0.3; }; - notify master-only; # test old syntax + notify master-only; # test old syntax }; zone x3 { type primary; file "generic.db"; also-notify { 10.53.0.3; }; }; diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh index 706b7fcd8d..afec83909a 100644 --- a/bin/tests/system/notify/tests.sh +++ b/bin/tests/system/notify/tests.sh @@ -202,6 +202,10 @@ grep "sending notify to 10.53.0.5#[0-9]* : TSIG (b)" ns5/named.run > /dev/null | grep "sending notify to 10.53.0.5#[0-9]* : TSIG (c)" ns5/named.run > /dev/null || ret=1 test_end +test_start "checking notify-source uses port option correctly" +grep "10.53.0.2#${EXTRAPORT2}: received notify for zone 'x1'" ns3/named.run > /dev/null || ret=1 +test_end + # notify messages were sent to unresponsive 10.53.10.53 during the tests # above, which should time out at some point; we need to wait for them to # appear in the logs in case the tests run faster than the notify timeouts diff --git a/bin/tests/system/xfer/ns3/named.conf.in b/bin/tests/system/xfer/ns3/named.conf.in index c0bb9873a0..7133781827 100644 --- a/bin/tests/system/xfer/ns3/named.conf.in +++ b/bin/tests/system/xfer/ns3/named.conf.in @@ -50,6 +50,7 @@ zone "example" { zone "primary" { type secondary; + transfer-source 10.53.0.3 port @EXTRAPORT1@; primaries { 10.53.0.6; }; file "primary.bk"; }; diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh index 6414454532..962b480bdd 100755 --- a/bin/tests/system/xfer/tests.sh +++ b/bin/tests/system/xfer/tests.sh @@ -573,5 +573,12 @@ retry_quiet 10 check_xfer_stats || tmp=1 if test $tmp != 0 ; then echo_i "failed"; fi status=$((status+tmp)) +n=$((n+1)) +echo_i "test that transfer-source uses port option correctly ($n)" +tmp=0 +grep "10.53.0.3#${EXTRAPORT1} (primary): query 'primary/SOA/IN' approved" ns6/named.run > /dev/null || ret=1 +if test $tmp != 0 ; then echo_i "failed"; fi +status=$((status+tmp)) + echo_i "exit status: $status" [ $status -eq 0 ] || exit 1 From 282f44d329630adf51a6f3c2d2a6bd5bdd2cb485 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 2 Feb 2023 12:22:27 -0800 Subject: [PATCH 3/3] CHANGES for [GL #3790] (cherry picked from commit 4f50854e7a77abda23e7efc9167d199591aed2e0) --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index eb1aa636fe..dd8bb5fd69 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ +6089. [bug] Source ports configured for query-source, + transfer-source, etc, were being ignored. (This + feature is deprecated, but it is not yet removed, + so the bug still needed fixing.) [GL #3790] + 6083. [bug] Fix DNSRPS-enabled builds as they were inadvertently broken by change 6042. [GL #3827]