Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-07-13 19:20:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/file: do not expand wildcard across a closer empty non-terminal (#8223)

Browse Source 
A query for a name that sits below a closer empty non-terminal was wrongly
answered with a shallower wildcard record instead of NXDOMAIN. Per RFC 4592
2.2.1 a wildcard is the source of synthesis only when the wildcard owner's
parent is the closest encloser of the queried name; if an empty non-terminal
exists between that parent and the queried name, it is the closer encloser and
the shallower wildcard must not be expanded.

Guard the wildcard expansion in Zone.Lookup with closerENTExists, which walks
the strict ancestors of the queried name between the wildcard parent and the
name and reports whether any of them is an empty non-terminal.

Adds TestLookupWildcardRespectsCloserEmptyNonTerminal, which asserts NXDOMAIN
for a name below a closer empty non-terminal and keeps a no-regression case
where a plain wildcard with no closer empty non-terminal still applies.

Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
Co-authored-by: Omkhar Arasaratnam <omkhar@linkedin.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Omkhar Arasaratnam
2026-07-11 06:03:52 -04:00
committed by GitHub
parent af1e34ebc8
commit 38e26f25c4
2 changed files with 84 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
plugin/file/lookup.go
View File

@@ -203,7 +203,7 @@ func (z *Zone) Lookup(ctx context.Context, state request.Request, qname string)
// Haven't found the original name.
// Found wildcard.
if wildElem != nil {
if wildElem != nil && !closerENTExists(tr, qname, wildElem.Name()) {
// set metadata value for the wildcard record that synthesized the result
metadata.SetValueFunc(ctx, "zone/wildcard", func() string {
return wildElem.Name()
@@ -288,6 +288,33 @@ Out:
return nil, ret, nil, rcode
}
// closerENTExists reports whether there is an empty-non-terminal between the
// wildcard's parent and qname. Per RFC 4592, such an ENT is the closest
// encloser and the shallower wildcard does not apply to qname.
func closerENTExists(tr *tree.Tree, qname, wildcardName string) bool {
// The wildcard owner is "*.<parent>"; anything with that exact prefix is not a closer encloser.
if len(wildcardName) < 2 || wildcardName[0] != '*' || wildcardName[1] != '.' {
return false
}
parent := wildcardName[2:]
// Walk strict ancestors of qname that are strict descendants of parent.
// Each ancestor is an ENT if the tree contains any name strictly below it.
name := qname
offset, end := dns.NextLabel(name, 0)
for !end {
name = name[offset:]
if name == parent || !dns.IsSubDomain(parent, name) {
return false
}
// An ENT exists at `name` iff tr.Next(name) returns a descendant of name.
if x, found := tr.Next(name); found && dns.IsSubDomain(name, x.Name()) {
return true
}
offset, end = dns.NextLabel(name, 0)
}
return false
}
// typeFromElem returns the type tp from e and adds signatures (if they exist) and do is true.
func typeFromElem(elem *tree.Elem, tp uint16, do bool) []dns.RR {
rrs := elem.Type(tp)