<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Jeroen,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In the case that triggered this crash for us, someone typo-ed nsd.conf by adding the zone "bar.foo.com" (which didn't exist). They meant to add a different zone name.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Chris</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Jeroen Koekkoek <jeroen@nlnetlabs.nl><br>
<b>Sent:</b> Wednesday, October 16, 2024 3:18 AM<br>
<b>To:</b> Chris LaVallee <clavallee@edg.io>; nsd-users@lists.nlnetlabs.nl <nsd-users@lists.nlnetlabs.nl><br>
<b>Subject:</b> Re: [nsd-users] SIGSEGV in rbtree_find_less_equal</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Chris,<br>
<br>
I've properly started looking into this yesterday. NSD definitely<br>
shouldn't crash, still working on that.<br>
<br>
However, the provided zone is invalid too(?) I'm not the foremost<br>
expert on NSEC3 (or even DNSSEC), but is seems an NSEC3 is missing for<br>
bar.foo.com. Empty non-terminals should still have an NSEC3 RR.<br>
<br>
(Of course, the delegation point should be at bar.foo.com. too and<br>
a.bar.foo.com. is an occluded name and this situation is purely<br>
hypothetical).<br>
<br>
I used the attached zone file along with the following commands to<br>
generate a zone file to The input I used to generate:<br>
<br>
ldns-keygen -a 13 -k foo.com<br>
dnssec-signzone -3 AA61D5A398769C09 -H 0 -S -A -z -o foo.com.<br>
foo.com.zone Kfoo.com.+013+58636<br>
<br>
Doesn't get me the exact the same thing, but good enough to get the<br>
same segfault.<br>
<br>
- Jeroen<br>
<br>
<br>
On Wed, 2024-10-09 at 13:53 +0200, Jeroen Koekkoek via nsd-users wrote:<br>
> Hi Chris,<br>
> <br>
> I can reproduce with your zone. Thanks!<br>
> <br>
> Best,<br>
> Jeroen<br>
> <br>
> <br>
> On Tue, 2024-10-08 at 14:07 +0000, Chris LaVallee wrote:<br>
> > <br>
> > Hi Jeroen,<br>
> > <br>
> > <br>
> > Attached is the zone I used. Did you add the record for a.bar ?<br>
> > <br>
> > <br>
> > Ex:<br>
> > <br>
> > <br>
> > a.bar 300 IN NS ns.somewhere.net.<br>
> > <br>
> > <br>
> > Chris<br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > <br>
> > From: Jeroen Koekkoek <jeroen@nlnetlabs.nl><br>
> > Sent: Tuesday, October 8, 2024 5:33 AM<br>
> > To: Chris LaVallee <clavallee@edg.io>; nsd-users@lists.nlnetlabs.nl<br>
> > <nsd-users@lists.nlnetlabs.nl><br>
> > Subject: Re: [nsd-users] SIGSEGV in rbtree_find_less_equal<br>
> > <br>
> > <br>
> > <br>
> > <br>
> > Hi Chris,<br>
> > <br>
> > I'm having trouble trying to reproduce the issue locally.<br>
> > <br>
> > Like you I configure two zones.<br>
> > <br>
> > zone:<br>
> > name: example.com.<br>
> > zonefile: example.com.zone.signed<br>
> > <br>
> > zone:<br>
> > name: bar.example.com.<br>
> > zonefile: bar.example.com.zone<br>
> > <br>
> > The file bar.example.com.zone does not exist. After touching and<br>
> > reloading the signed zone, no segfault occurs. I've tried with and<br>
> > without the "--disable-radix-tree" configure option (as the error<br>
> > occurs in the rbtree). I've also tried with example.com. being an<br>
> > NSEC<br>
> > and NSEC3 zone.<br>
> > <br>
> > Can you provide some more details?<br>
> > <br>
> > Best regards,<br>
> > Jeroen<br>
> > <br>
> > <br>
> > <br>
> > <br>
> > On Wed, 2024-10-02 at 14:57 +0000, Chris LaVallee via nsd-users<br>
> > wrote:<br>
> > > <br>
> > > Hi,<br>
> > > <br>
> > > <br>
> > > I found a reproducible seg fault with a DNSSEC signed zone and<br>
> > > overlapping config. I'm running NSD 4.10.1. Here's how to<br>
> > > reproduce.<br>
> > > <br>
> > > <br>
> > > 2 zones in nsd.conf:<br>
> > > <br>
> > > <br>
> > > zone:<br>
> > > name: "foo.com."<br>
> > > zonefile: "/zones/foo.com.zone.signed"<br>
> > > <br>
> > > <br>
> > > zone:<br>
> > > name: "bar.foo.com."<br>
> > > zonefile: "/zones/bar.foo.com.zone"<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > Zone files:<br>
> > > <br>
> > > <br>
> > > foo.com.zone.signed is DNSSEC signed with a record for a.bar (A<br>
> > > record or anything)<br>
> > > bar.foo.com.zone doesn't exist (but it's in nsd.conf shown<br>
> > > above)<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > Steps:<br>
> > > 1) Startup NSD<br>
> > > 2) touch foo.com.zone.signed<br>
> > > 3) reload NSD<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > nsd.log will say:<br>
> > > [2024-10-02 07:19:58.691] nsd[962739]: info: control cmd: reload<br>
> > > [2024-10-02 07:19:58.845] nsd[962752]: error: handle_reload_cmd:<br>
> > > reload closed cmd channel<br>
> > > [2024-10-02 07:19:58.845] nsd[962752]: warning: Reload process<br>
> > > 962740<br>
> > > failed, continuing with old database<br>
> > > <br>
> > > <br>
> > > core dump says SIGSEGV in rbtree_find_less_equal<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > Chris LaVallee<br>
> > > Edgio (formally EdgeCast Networks)<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > _______________________________________________<br>
> > > nsd-users mailing list<br>
> > > nsd-users@lists.nlnetlabs.nl<br>
> > > <a href="https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users">https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users</a><br>
> > <br>
> <br>
> _______________________________________________<br>
> nsd-users mailing list<br>
> nsd-users@lists.nlnetlabs.nl<br>
> <a href="https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users">https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users</a><br>
<br>
</div>
</span></font></div>
</body>
</html>