Skip to content

Unbound assumes index.html exists on RPZ host #552

@al3xtjames

Description

@al3xtjames

Describe the bug
Unbound uses index.html as a default filename there isn't one in the RPZ URL:

unbound/services/authzone.c

Lines 7162 to 7163 in 74f1f0a

if(!p || p[0] == 0)
*file = strdup("index.html");

If index.html does not exist and the host returns 404, downloading the zone file from the host fails.

To reproduce
Steps to reproduce the behavior:

  1. Set url in a rpz block to a host without a filename (e.g. https://rpz.oisd.nl).
  2. Run unbound -dd -vvvvv.
  3. Observe the following errors:
[1634507042] unbound[22239:0] debug: http header: HTTP/1.1 404 Not Found
[1634507042] unbound[22239:0] debug: http bad status 404 Not Found
[1634507042] unbound[22239:0] debug: comm_point_close of 13: event_del
[1634507042] unbound[22239:0] debug: close fd 13
[1634507042] unbound[22239:0] debug: auth zone transfer http callback
[1634507042] unbound[22239:0] debug: http stopped, connection lost to rpz.oisd.nl
[1634507042] unbound[22239:0] debug: auth zone oisd. transfer failed, wait
[1634507042] unbound[22239:0] debug: auth zone oisd. timeout in 12 seconds

Expected behavior
Unbound should successfully download the zone file.

System:

  • Unbound version: 1.13.1-1
  • OS: Ubuntu Server 21.04
  • unbound -V output:
Version 1.13.1

Configure line: --build=aarch64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/aarch64-linux-gnu --libexecdir=${prefix}/lib/aarch64-linux-gnu --disable-maintainer-mode --disable-dependency-tracking --disable-rpath --with-pidfile=/run/unbound.pid --with-rootkey-file=/var/lib/unbound/root.key --with-libevent --with-pythonmodule --enable-subnet --enable-dnstap --enable-systemd --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --libdir=/usr/lib --disable-flto
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 1.1.1j  16 Feb 2021
Linked modules: dns64 python subnetcache respip validator iterator

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues

Additional information
Appending /./ to the URL seems to function as a workaround (e.g. https://rpz.oisd.nl/./). But there are various timeouts while downloading chunks: https://gist.github.com/al3xtjames/ed483bad8b91b0bbbdee39bd5557250e

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions