Commit c4a90849c1 for bind
commit c4a90849c1d5adeaf7c54a0c9e3e2d336ac54edd
Author: Evan Hunt <each@isc.org>
Date: Tue Oct 13 18:19:05 2026 -0700
Update the Extended DNS Error codes
IANA has registered several new EDE codes since the last
time the list was updated; we can now display them correctly.
diff --git a/bin/tests/system/digdelv/tests_dig.py b/bin/tests/system/digdelv/tests_dig.py
index 2f4fae3687..b03b432431 100644
--- a/bin/tests/system/digdelv/tests_dig.py
+++ b/bin/tests/system/digdelv/tests_dig.py
@@ -429,7 +429,7 @@ def test_nxname_returns_formerr(dig, ns3):
checking dig NXNAME returns FORMERR.
"""
result = dig(f"@{ns3.ip} +qr NXNAME a.example")
- assert Re(r"^; EDE: 30: \(Invalid Query Type\)") in result.out
+ assert Re(r"^; EDE: 30 \(Invalid Query Type\)") in result.out
assert Re(r"^;a\.example\.\s+IN\sNXNAME$") in result.out
assert "FORMERR" in result.out
@@ -649,8 +649,12 @@ def test_keepalive_yaml(dig, ns1):
"payload,expected",
[
param("ede:0000666f6f", "; EDE: 0 (Other): (foo)", id="first-defined-code"),
- param("ede:0018", "; EDE: 24 (Invalid Data)", id="last-defined-code"),
- param("ede:0019666f6f", "; EDE: 25: (foo)", id="undefined-code"),
+ param(
+ "ede:0023",
+ "; EDE: 35 (Blocked by Upstream DNS Server)",
+ id="last-defined-code",
+ ),
+ param("ede:0040666f6f", "; EDE: 64: (foo)", id="undefined-code"),
param("ede", "; EDE:", id="empty"),
param("ede:00", '; EDE: 00 (".")', id="too-short"),
],
@@ -668,8 +672,13 @@ def test_ednsopt_ede(dig, ns3, payload, expected):
"payload,info_code,extra_text",
[
param("ede:0000666f6f", "0 (Other)", "foo", id="first-defined-code"),
- param("ede:0018", "24 (Invalid Data)", None, id="last-defined-code"),
- param("ede:0019666f6f", 25, "foo", id="undefined-code"),
+ param(
+ "ede:0023",
+ "35 (Blocked by Upstream DNS Server)",
+ None,
+ id="last-defined-code",
+ ),
+ param("ede:0040666f6f", 64, "foo", id="undefined-code"),
],
)
def test_ednsopt_ede_yaml(dig, ns3, payload, info_code, extra_text):
diff --git a/lib/dns/include/dns/ede.h b/lib/dns/include/dns/ede.h
index 903e4e65f2..ba70f21764 100644
--- a/lib/dns/include/dns/ede.h
+++ b/lib/dns/include/dns/ede.h
@@ -48,8 +48,18 @@ typedef enum ISC_FIXED_ENUM(dns_edecode, uint16_t) {
DNS_EDE_NOREACHABLEAUTH = 22, /*%< No Reachable Authority */
DNS_EDE_NETWORKERROR = 23, /*%< Network Error */
DNS_EDE_INVALIDDATA = 24, /*%< Invalid Data */
- DNS_EDE_INVALIDQTYPE = 30, /*%< Invalid Query Type */
- DNS_EDE_NTA = 33, /*%< Negative Trust Anchor */
+ DNS_EDE_BEFOREVALID = 25, /*%< Signature Expired before Valid */
+ DNS_EDE_TOOEARLY = 26, /*%< Too Early*/
+ DNS_EDE_BADITERATIONS = 27, /*%< Unsupported NSEC3 Iterations Value */
+ DNS_EDE_POLICYUNABLE = 28, /*%< Unable to conform to policy */
+ DNS_EDE_SYNTHESIZED = 29, /*%< Synthesized */
+ DNS_EDE_INVALIDQTYPE = 30, /*%< Invalid Query Type */
+ DNS_EDE_RATELIMITED = 31, /*%< Rate Limited */
+ DNS_EDE_QUOTA = 32, /*%< Over Quota */
+ DNS_EDE_NTA = 33, /*%< Negative Trust Anchor */
+ DNS_EDE_DELEGONLY = 34, /*%< New Delegation Only */
+ DNS_EDE_BLOCKEDUPSTREAM = 35, /*%< Blocked by Upstream DNS Server */
+
DNS_EDE_MAX_CODE,
DNS_EDE_ENFORCE = UINT16_MAX, /*%< Enforce uint16_t size */
} dns_edecode_t;
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 41dfc04784..680034c89f 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -148,31 +148,44 @@ static const char *opcodetext[] = { "QUERY", "IQUERY", "STATUS",
"RESERVED12", "RESERVED13", "RESERVED14",
"RESERVED15" };
-static const char *edetext[] = { "Other",
- "Unsupported DNSKEY Algorithm",
- "Unsupported DS Digest Type",
- "Stale Answer",
- "Forged Answer",
- "DNSSEC Indeterminate",
- "DNSSEC Bogus",
- "Signature Expired",
- "Signature Not Yet Valid",
- "DNSKEY Missing",
- "RRSIGs Missing",
- "No Zone Key Bit Set",
- "NSEC Missing",
- "Cached Error",
- "Not Ready",
- "Blocked",
- "Censored",
- "Filtered",
- "Prohibited",
- "Stale NXDOMAIN Answer",
- "Not Authoritative",
- "Not Supported",
- "No Reachable Authority",
- "Network Error",
- "Invalid Data" };
+static const char *edetext[] = {
+ [DNS_EDE_OTHER] = "Other",
+ [DNS_EDE_DNSKEYALG] = "Unsupported DNSKEY Algorithm",
+ [DNS_EDE_DSDIGESTTYPE] = "Unsupported DS Digest Type",
+ [DNS_EDE_STALEANSWER] = "Stale Answer",
+ [DNS_EDE_FORGEDANSWER] = "Forged Answer",
+ [DNS_EDE_DNSSECINDETERMINATE] = "DNSSEC Indeterminate",
+ [DNS_EDE_DNSSECBOGUS] = "DNSSEC Bogus",
+ [DNS_EDE_SIGNATUREEXPIRED] = "Signature Expired",
+ [DNS_EDE_SIGNATURENOTYETVALID] = "Signature Not Yet Valid",
+ [DNS_EDE_DNSKEYMISSING] = "DNSKEY Missing",
+ [DNS_EDE_RRSIGSMISSING] = "RRSIGs Missing",
+ [DNS_EDE_NOZONEKEYBITSET] = "No Zone Key Bit Set",
+ [DNS_EDE_NSECMISSING] = "NSEC Missing",
+ [DNS_EDE_CACHEDERROR] = "Cached Error",
+ [DNS_EDE_NOTREADY] = "Not Ready",
+ [DNS_EDE_BLOCKED] = "Blocked",
+ [DNS_EDE_CENSORED] = "Censored",
+ [DNS_EDE_FILTERED] = "Filtered",
+ [DNS_EDE_PROHIBITED] = "Prohibited",
+ [DNS_EDE_STALENXANSWER] = "Stale NXDOMAIN Answer",
+ [DNS_EDE_NOTAUTH] = "Not Authoritative",
+ [DNS_EDE_NOTSUPPORTED] = "Not Supported",
+ [DNS_EDE_NOREACHABLEAUTH] = "No Reachable Authority",
+ [DNS_EDE_NETWORKERROR] = "Network Error",
+ [DNS_EDE_INVALIDDATA] = "Invalid Data",
+ [DNS_EDE_BEFOREVALID] = "Signature Expired before Valid",
+ [DNS_EDE_TOOEARLY] = "Too Early",
+ [DNS_EDE_BADITERATIONS] = "Unsupported NSEC3 Iterations Value",
+ [DNS_EDE_POLICYUNABLE] = "Unable to conform to policy",
+ [DNS_EDE_SYNTHESIZED] = "Synthesized",
+ [DNS_EDE_INVALIDQTYPE] = "Invalid Query Type",
+ [DNS_EDE_RATELIMITED] = "Rate Limited",
+ [DNS_EDE_QUOTA] = "Over Quota",
+ [DNS_EDE_NTA] = "Negative Trust Anchor",
+ [DNS_EDE_DELEGONLY] = "New Delegation Only",
+ [DNS_EDE_BLOCKEDUPSTREAM] = "Blocked by Upstream DNS Server",
+};
/*%
* "helper" type, which consists of a block of some type, and is linkable.
@@ -3812,7 +3825,9 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
ede = isc_buffer_getuint16(&optbuf);
snprintf(buf, sizeof(buf), " %u", ede);
ADD_STRING(target, buf);
- if (ede < ARRAY_SIZE(edetext)) {
+ if (ede < ARRAY_SIZE(edetext) &&
+ edetext[ede] != NULL)
+ {
ADD_STRING(target, " (");
ADD_STRING(target,
edetext[ede]);
@@ -4235,7 +4250,9 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
ede = isc_buffer_getuint16(&optbuf);
snprintf(buf, sizeof(buf), " %u", ede);
ADD_STRING(target, buf);
- if (ede < ARRAY_SIZE(edetext)) {
+ if (ede < ARRAY_SIZE(edetext) &&
+ edetext[ede] != NULL)
+ {
ADD_STRING(target, " (");
ADD_STRING(target,
edetext[ede]);
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 3e86873722..89070b0586 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2472,8 +2472,7 @@ issecuredomain(fetchctx_t *fctx, const dns_name_t *name, dns_rdatatype_t type,
* once per fetch.
*/
if (nta) {
- dns_ede_add(&fctx->edectx, DNS_EDE_NTA,
- "Negative Trust Anchor applied (RFC 7646)");
+ dns_ede_add(&fctx->edectx, DNS_EDE_NTA, NULL);
}
return secure_domain;
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 37478342aa..56235e4a04 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -11388,8 +11388,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
DNS_RDATATYPEATTR_NOTQUESTION) != 0)
{
dns_ede_add(&client->edectx,
- DNS_EDE_INVALIDQTYPE,
- "Invalid Query Type");
+ DNS_EDE_INVALIDQTYPE, NULL);
}
query_error(client, DNS_R_FORMERR, __LINE__);
return;