<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I confirmed the fix here</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Jeroen Koekkoek <jeroen@nlnetlabs.nl><br>
<b>Sent:</b> Wednesday, October 23, 2024 5:13 AM<br>
<b>To:</b> Chris LaVallee <clavallee@edg.io>; nsd-users@lists.nlnetlabs.nl <nsd-users@lists.nlnetlabs.nl><br>
<b>Subject:</b> Re: [nsd-users] SIGSEGV in rbtree_find_less_equal</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Chris,<br>
<br>
I've merged the commit that resolves the issue<br>
(<a href="https://github.com/NLnetLabs/nsd/pull/389">https://github.com/NLnetLabs/nsd/pull/389</a>). The next release will<br>
include it. Thanks again for reporting.<br>
<br>
Also, a statement in my previous response was incorrect.<br>
<br>
RFC 5155 says:<br>
Each empty non-terminal MUST have a corresponding NSEC3 RR, unless the<br>
empty non-terminal is only derived from an insecure delegation covered<br>
by an Opt-Out NSEC3 RR.<br>
<br>
Best regards,<br>
Jeroen<br>
<br>
<br>
On Wed, 2024-10-16 at 14:30 +0000, Chris LaVallee wrote:<br>
> <br>
> Hi Jeroen,<br>
> <br>
> <br>
> In the case that triggered this crash for us, someone typo-ed<br>
> nsd.conf by adding the zone "bar.foo.com" (which didn't exist). They<br>
> meant to add a different zone name.<br>
> <br>
> <br>
> Chris<br>
> From: Jeroen Koekkoek <jeroen@nlnetlabs.nl><br>
> Sent: Wednesday, October 16, 2024 3:18 AM<br>
> To: Chris LaVallee <clavallee@edg.io>; nsd-users@lists.nlnetlabs.nl<br>
> <nsd-users@lists.nlnetlabs.nl><br>
> Subject: Re: [nsd-users] SIGSEGV in rbtree_find_less_equal<br>
> <br>
> <br>
> <br>
> <br>
> Hi Chris,<br>
> <br>
> I've properly started looking into this yesterday. NSD definitely<br>
> shouldn't crash, still working on that.<br>
> <br>
> However, the provided zone is invalid too(?) I'm not the foremost<br>
> expert on NSEC3 (or even DNSSEC), but is seems an NSEC3 is missing<br>
> for<br>
> bar.foo.com. Empty non-terminals should still have an NSEC3 RR.<br>
> <br>
> (Of course, the delegation point should be at bar.foo.com. too and<br>
> a.bar.foo.com. is an occluded name and this situation is purely<br>
> hypothetical).<br>
> <br>
> I used the attached zone file along with the following commands to<br>
> generate a zone file to The input I used to generate:<br>
> <br>
> ldns-keygen -a 13 -k foo.com<br>
> dnssec-signzone -3 AA61D5A398769C09 -H 0 -S -A -z -o foo.com.<br>
> foo.com.zone Kfoo.com.+013+58636<br>
> <br>
> Doesn't get me the exact the same thing, but good enough to get the<br>
> same segfault.<br>
> <br>
> - Jeroen<br>
> <br>
> <br>
> On Wed, 2024-10-09 at 13:53 +0200, Jeroen Koekkoek via nsd-users<br>
> wrote:<br>
> > Hi Chris,<br>
> > <br>
> > I can reproduce with your zone. Thanks!<br>
> > <br>
> > Best,<br>
> > Jeroen<br>
> > <br>
> > <br>
> > On Tue, 2024-10-08 at 14:07 +0000, Chris LaVallee wrote:<br>
> > > <br>
> > > Hi Jeroen,<br>
> > > <br>
> > > <br>
> > > Attached is the zone I used. Did you add the record for a.bar ?<br>
> > > <br>
> > > <br>
> > > Ex:<br>
> > > <br>
> > > <br>
> > > a.bar 300 IN NS ns.somewhere.net.<br>
> > > <br>
> > > <br>
> > > Chris<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > From: Jeroen Koekkoek <jeroen@nlnetlabs.nl><br>
> > > Sent: Tuesday, October 8, 2024 5:33 AM<br>
> > > To: Chris LaVallee <clavallee@edg.io>;<br>
> > > nsd-users@lists.nlnetlabs.nl<br>
> > > <nsd-users@lists.nlnetlabs.nl><br>
> > > Subject: Re: [nsd-users] SIGSEGV in rbtree_find_less_equal<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > Hi Chris,<br>
> > > <br>
> > > I'm having trouble trying to reproduce the issue locally.<br>
> > > <br>
> > > Like you I configure two zones.<br>
> > > <br>
> > > zone:<br>
> > > name: example.com.<br>
> > > zonefile: example.com.zone.signed<br>
> > > <br>
> > > zone:<br>
> > > name: bar.example.com.<br>
> > > zonefile: bar.example.com.zone<br>
> > > <br>
> > > The file bar.example.com.zone does not exist. After touching and<br>
> > > reloading the signed zone, no segfault occurs. I've tried with<br>
> > > and<br>
> > > without the "--disable-radix-tree" configure option (as the error<br>
> > > occurs in the rbtree). I've also tried with example.com. being an<br>
> > > NSEC<br>
> > > and NSEC3 zone.<br>
> > > <br>
> > > Can you provide some more details?<br>
> > > <br>
> > > Best regards,<br>
> > > Jeroen<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > On Wed, 2024-10-02 at 14:57 +0000, Chris LaVallee via nsd-users<br>
> > > wrote:<br>
> > > > <br>
> > > > Hi,<br>
> > > > <br>
> > > > <br>
> > > > I found a reproducible seg fault with a DNSSEC signed zone and<br>
> > > > overlapping config. I'm running NSD 4.10.1. Here's how to<br>
> > > > reproduce.<br>
> > > > <br>
> > > > <br>
> > > > 2 zones in nsd.conf:<br>
> > > > <br>
> > > > <br>
> > > > zone:<br>
> > > > name: "foo.com."<br>
> > > > zonefile: "/zones/foo.com.zone.signed"<br>
> > > > <br>
> > > > <br>
> > > > zone:<br>
> > > > name: "bar.foo.com."<br>
> > > > zonefile: "/zones/bar.foo.com.zone"<br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > Zone files:<br>
> > > > <br>
> > > > <br>
> > > > foo.com.zone.signed is DNSSEC signed with a record for a.bar (A<br>
> > > > record or anything)<br>
> > > > bar.foo.com.zone doesn't exist (but it's in nsd.conf shown<br>
> > > > above)<br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > Steps:<br>
> > > > 1) Startup NSD<br>
> > > > 2) touch foo.com.zone.signed<br>
> > > > 3) reload NSD<br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > nsd.log will say:<br>
> > > > [2024-10-02 07:19:58.691] nsd[962739]: info: control cmd:<br>
> > > > reload<br>
> > > > [2024-10-02 07:19:58.845] nsd[962752]: error:<br>
> > > > handle_reload_cmd:<br>
> > > > reload closed cmd channel<br>
> > > > [2024-10-02 07:19:58.845] nsd[962752]: warning: Reload process<br>
> > > > 962740<br>
> > > > failed, continuing with old database<br>
> > > > <br>
> > > > <br>
> > > > core dump says SIGSEGV in rbtree_find_less_equal<br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > Chris LaVallee<br>
> > > > Edgio (formally EdgeCast Networks)<br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > <br>
> > > > _______________________________________________<br>
> > > > nsd-users mailing list<br>
> > > > nsd-users@lists.nlnetlabs.nl<br>
> > > > <a href="https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users">https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users</a><br>
> > > <br>
> > <br>
> > _______________________________________________<br>
> > nsd-users mailing list<br>
> > nsd-users@lists.nlnetlabs.nl<br>
> > <a href="https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users">https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users</a><br>
> <br>
<br>
</div>
</span></font></div>
</body>
</html>