From 7c0601102a2fda3e8450203f7ce11c2375f65e74 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 24 Jan 2022 05:51:47 +0900 Subject: [PATCH 1/4] Revert "resolve: refuse to resolve empty hostname" This reverts commit 6e8ecb8974db74eba716bfd75231987172e10d83. --- src/resolve/resolved-bus.c | 6 ------ src/resolve/resolved-varlink.c | 3 --- src/shared/dns-domain.h | 4 ---- 3 files changed, 13 deletions(-) diff --git a/src/resolve/resolved-bus.c b/src/resolve/resolved-bus.c index 9978d35727..48e5321d79 100644 --- a/src/resolve/resolved-bus.c +++ b/src/resolve/resolved-bus.c @@ -433,9 +433,6 @@ static int bus_method_resolve_hostname(sd_bus_message *message, void *userdata, if (r != 0) return r; - if (dns_name_is_empty(hostname)) - return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Empty hostname"); - r = dns_name_is_valid(hostname); if (r < 0) return r; @@ -743,9 +740,6 @@ static int bus_method_resolve_record(sd_bus_message *message, void *userdata, sd if (ifindex < 0) return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid interface index"); - if (dns_name_is_empty(name)) - return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Empty name"); - r = dns_name_is_valid(name); if (r < 0) return r; diff --git a/src/resolve/resolved-varlink.c b/src/resolve/resolved-varlink.c index feca5f74f1..cc684608a6 100644 --- a/src/resolve/resolved-varlink.c +++ b/src/resolve/resolved-varlink.c @@ -303,9 +303,6 @@ static int vl_method_resolve_hostname(Varlink *link, JsonVariant *parameters, Va if (p.ifindex < 0) return varlink_error_invalid_parameter(link, JSON_VARIANT_STRING_CONST("ifindex")); - if (dns_name_is_empty(p.name)) - return varlink_error_invalid_parameter(link, JSON_VARIANT_STRING_CONST("name")); - r = dns_name_is_valid(p.name); if (r < 0) return r; diff --git a/src/shared/dns-domain.h b/src/shared/dns-domain.h index 24bf00bd58..c25fcaacc2 100644 --- a/src/shared/dns-domain.h +++ b/src/shared/dns-domain.h @@ -60,10 +60,6 @@ static inline int dns_name_is_valid_ldh(const char *s) { return 1; } -static inline bool dns_name_is_empty(const char *s) { - return isempty(s) || streq(s, "."); -} - void dns_name_hash_func(const char *s, struct siphash *state); int dns_name_compare_func(const char *a, const char *b); extern const struct hash_ops dns_name_hash_ops; From 7bdf41983044268b4bc2f9d34462db7f89ba284a Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 24 Jan 2022 06:06:55 +0900 Subject: [PATCH 2/4] dns-domain: re-introduce dns_name_is_empty() --- src/shared/dns-domain.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/shared/dns-domain.h b/src/shared/dns-domain.h index c25fcaacc2..24bf00bd58 100644 --- a/src/shared/dns-domain.h +++ b/src/shared/dns-domain.h @@ -60,6 +60,10 @@ static inline int dns_name_is_valid_ldh(const char *s) { return 1; } +static inline bool dns_name_is_empty(const char *s) { + return isempty(s) || streq(s, "."); +} + void dns_name_hash_func(const char *s, struct siphash *state); int dns_name_compare_func(const char *a, const char *b); extern const struct hash_ops dns_name_hash_ops; From 3b2ac14ac45bef01cf489c3231b868936866444b Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 24 Jan 2022 06:07:33 +0900 Subject: [PATCH 3/4] resolve: synthesize empty name Do not return any error for empty name. Just returns empty answer. Before: --- $ dig . ; <<>> DiG 9.16.24-RH <<>> . ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 13617 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;. IN A ;; Query time: 0 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Mon Jan 24 05:49:30 JST 2022 ;; MSG SIZE rcvd: 28 --- After: --- $ dig . ; <<>> DiG 9.16.24-RH <<>> . ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7957 ;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;. IN A ;; Query time: 1 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Mon Jan 24 06:05:02 JST 2022 ;; MSG SIZE rcvd: 28 --- Replaces #22197. Fixes RHBZ#2039854 (https://bugzilla.redhat.com/show_bug.cgi?id=2039854). --- src/resolve/resolved-dns-scope.c | 4 ++++ src/resolve/resolved-dns-synthesize.c | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c index c0f6df6447..f0d0ca4bba 100644 --- a/src/resolve/resolved-dns-scope.c +++ b/src/resolve/resolved-dns-scope.c @@ -613,6 +613,10 @@ DnsScopeMatch dns_scope_good_domain( if ((SD_RESOLVED_FLAGS_MAKE(s->protocol, s->family, false, false) & flags) == 0) return DNS_SCOPE_NO; + /* Never resolve empty name. */ + if (dns_name_is_empty(domain)) + return DNS_SCOPE_NO; + /* Never resolve any loopback hostname or IP address via DNS, LLMNR or mDNS. Instead, always rely on * synthesized RRs for these. */ if (is_localhost(domain) || diff --git a/src/resolve/resolved-dns-synthesize.c b/src/resolve/resolved-dns-synthesize.c index ef1423f441..ea239e686d 100644 --- a/src/resolve/resolved-dns-synthesize.c +++ b/src/resolve/resolved-dns-synthesize.c @@ -394,7 +394,10 @@ int dns_synthesize_answer( name = dns_resource_key_name(key); - if (is_localhost(name)) { + if (dns_name_is_empty(name)) { + /* Do nothing. */ + + } else if (is_localhost(name)) { r = synthesize_localhost_rr(m, key, ifindex, &answer); if (r < 0) From 46b53e8035fb60c9a7f26dd32d6689ab3b7da97c Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 24 Jan 2022 06:36:53 +0900 Subject: [PATCH 4/4] resolve: synthesize null address, IPv4 broadcast address, or invalid domain These are filtered in `dns_scope_good_domain()`, but not synthesized. Fixes #22229. --- src/resolve/resolved-dns-synthesize.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/resolve/resolved-dns-synthesize.c b/src/resolve/resolved-dns-synthesize.c index ea239e686d..0914515fdf 100644 --- a/src/resolve/resolved-dns-synthesize.c +++ b/src/resolve/resolved-dns-synthesize.c @@ -397,6 +397,14 @@ int dns_synthesize_answer( if (dns_name_is_empty(name)) { /* Do nothing. */ + } else if (dns_name_endswith(name, "0.in-addr.arpa") > 0 || + dns_name_equal(name, "255.255.255.255.in-addr.arpa") > 0 || + dns_name_equal(name, "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa") > 0 || + dns_name_endswith(name, "invalid") > 0) { + + nxdomain = true; + continue; + } else if (is_localhost(name)) { r = synthesize_localhost_rr(m, key, ifindex, &answer);