johanix / tdns

Authoritative nameserver + tools. Intended for experiments and testing new things.
BSD 2-Clause "Simplified" License
1 stars 0 forks source link

Utilising private EDE error codes to provide finer granularity to DNS UPDATE responses #68

Open johanix opened 6 days ago

johanix commented 6 days ago
johanix commented 6 days ago

This mostly works fine. However there is presently a strange problem where adding an EDE in the failure path of zd.TrustUpdate(). This code (in tdns/updateresponder.go) works fine:

if zd.Options["frozen"] {
    log.Printf("UpdateResponder: zone %s is frozen (i.e. updates not possible). Ignoring update.",
        zd.ZoneName, qname)
    m.SetRcode(r, dns.RcodeRefused)
    AttachEDEToResponse(m, EDEZoneFrozen)
    w.WriteMsg(m)
    return nil
}

But this code (later in the same function) cause a FORMERR in the receiving client end:

err = zd.TrustUpdate(r, dur.Status)
if err != nil {
    zd.Logger.Printf("Error from TrustUpdate(): %v", err)
    m.SetRcode(m, int(dur.Status.ValidationRcode))
    AttachEDEToResponse(m, EDESig0KeyKnownButNotTrusted)
    w.WriteMsg(m)
    return err
}