[ADNS] Re: CNAME chains Brad Spencer spencer at infointeractive.com Mon, 28 Aug 2006 14:43:00 -0300 Previous message: CNAME chains Next message: CNAME chains option Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] --pf9I7BMVVzbSWLtt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Fri, Aug 25, 2006 at 11:36:04AM -0700, William Ahern wrote: > On Fri, Aug 25, 2006 at 09:39:01AM +0100, peter burden wrote: > > Hello, > > Is there any way to make ADNS follow CNAME chains ? > > > > I have set the adns_qf_cname_loose query flag and it seems OK for a > > single > > CNAME - e.g. (output from 'dig') I posted a small patch back in 2003 that made changes to adns so that it would follow CNAME chains. See http://www.chiark.greenend.org.uk/pipermail/adns-discuss/2003/001072.html The patch included in that post is against an old adns version, so I have attached my latest version of the patch to this message. (I have not tested that the attached patch applied cleanly to the current adns source, but it may be slightly more in sync with the current version.) > CNAME chains are technically not allowed. Such chains are violations of the > specifications. Also, I believe MX host lookups returning CNAMEs (i.e. MX > yahoo.com -> A mail.yahoo.com -> CNAME foo) is also illegal. I have also been told that CNAME chains are illegal, but I can not find any actual text that says that a resolver should fail when it encounters them. In fact, RFC 1034 Section 3.6.2 says: Domain names in RRs which point at another name should always point at the primary name and not the alias. This avoids extra indirections in accessing information. For example, the address to name RR for the above host should be: 52.0.0.10.IN-ADDR.ARPA IN PTR C.ISI.EDU rather than pointing at USC-ISIC.ARPA. The above implies that CNAME chains are illegal, IMO. But then, the next sentence is: Of course, by the robustness principle, domain software should not fail when presented with CNAME chains or loops; CNAME chains should be followed and CNAME loops signalled as an error. This advice, coupled with the fact that CNAME chains exist in the wild, triggered me to create the patch in the first place. My patch doesn't detect loops, but instead simply won't follow chains longer than a certain (hard-coded) size. Hope this helps! -- ------------------------------------------------------------------ Brad Spencer - spencer@infointeractive.com - "It's quite nice..." Systems Architect | InfoInterActive Corp. | A Canadian AOL Company --pf9I7BMVVzbSWLtt Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="cname_chains.diff" Index: src/internal.h =================================================================== RCS file: /iia/cvsroot/3rdParty/gnu/adns/adns-1.0/src/internal.h,v retrieving revision 1.3 retrieving revision 1.4 diff -u -p -r1.3 -r1.4 --- src/internal.h 2 Oct 2003 17:01:46 -0000 1.3 +++ src/internal.h 2 Oct 2003 17:14:29 -0000 1.4 @@ -206,6 +206,9 @@ struct adns__query { int cname_dglen, cname_begin; /* If non-0, has been allocated using . */ + int cname_alias_hops_left; + /* The number of cname alias hops we will allow */ + vbuf search_vb; int search_origlen, search_pos, search_doneabs; /* Used by the searching algorithm. The query domain in textual form Index: src/query.c =================================================================== RCS file: /iia/cvsroot/3rdParty/gnu/adns/adns-1.0/src/query.c,v retrieving revision 1.3 retrieving revision 1.4 diff -u -p -r1.3 -r1.4 --- src/query.c 2 Oct 2003 17:01:47 -0000 1.3 +++ src/query.c 2 Oct 2003 17:14:29 -0000 1.4 @@ -63,6 +63,8 @@ static adns_query query_alloc(adns_state qu->cname_dgram= 0; qu->cname_dglen= qu->cname_begin= 0; + /* Allow CNAME chains up to some sane limit */ + qu->cname_alias_hops_left = 10; adns__vbuf_init(&qu->search_vb); qu->search_origlen= qu->search_pos= qu->search_doneabs= 0; Index: src/reply.c =================================================================== RCS file: /iia/cvsroot/3rdParty/gnu/adns/adns-1.0/src/reply.c,v retrieving revision 1.3 retrieving revision 1.4 diff -u -p -r1.3 -r1.4 --- src/reply.c 2 Oct 2003 17:01:47 -0000 1.3 +++ src/reply.c 2 Oct 2003 17:14:30 -0000 1.4 @@ -191,12 +191,13 @@ void adns__procdgram(adns_state ads, con if (qu->flags & adns_qf_cname_forbid) { adns__query_fail(qu,adns_s_prohibitedcname); return; - } else if (qu->cname_dgram) { /* Ignore second and subsequent CNAME(s) */ + } else if (qu->cname_dgram && --(qu->cname_alias_hops_left) <= 0) { /* Don't follow "too long" CNAME chains */ adns__debug(ads,serv,qu,"allegedly canonical name %s" - " is actually alias for %s", qu->answer->cname, + " is actually alias for %s and aliases too deep", + qu->answer->cname, adns__diag_domain(ads,serv,qu, &qu->vb, dgram,dglen,rdstart)); - adns__query_fail(qu,adns_s_prohibitedcname); + adns__query_fail(qu,adns_s_norecurse); return; } else if (wantedrrs) { /* Ignore CNAME(s) after RR(s). */ adns__debug(ads,serv,qu,"ignoring CNAME (to %s) coexisting with RR", --pf9I7BMVVzbSWLtt--