[PATCH] resolv: Add test for NOERROR/NODATA handling [BZ #14308]

[Sergey Kolosov]

Add a test which verifies that getaddrinfo does not fail if one of A/AAAA
responses is NOERROR/NODATA reply with recursion unavailable and the other
response provides an address.
---
This patch adds a test for BZ #14308

When getaddrinfo is called with AF_UNSPEC, glibc may issue A and AAAA
queries.  Older glibc versions could fail the entire lookup if one of
the two responses was a NOERROR/NODATA reply with recursion unavailable
(RA=0), even if the other response contained a usable address.

The added test (tst-resolv-af-unspec-noerror-nodata) uses resolv_test to
simulate this situation in both directions:
  - A returns an address, AAAA returns NOERROR/NODATA with RA cleared
  - AAAA returns an address, A returns NOERROR/NODATA with RA cleared

The test fails on an unfixed glibc and passes on glibc with the BZ #14308 fix.
---

 resolv/Makefile                              |   3 +
 resolv/tst-resolv-af-unspec-noerror-nodata.c | 157 +++++++++++++++++++
 2 files changed, 160 insertions(+)
 create mode 100644 resolv/tst-resolv-af-unspec-noerror-nodata.c

diff --git a/resolv/Makefile b/resolv/Makefile
index d294c3f3fc..bbc06888a6 100644
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -140,6 +140,7 @@ tests-static += tst-ns_rr_cursor
 ifeq (yes,$(build-shared))
 tests += \
   tst-getaddrinfo-eai-again-timeout \
+  tst-resolv-af-unspec-noerror-nodata \
   tst-resolv-ai_idn \
   tst-resolv-ai_idn-latin1 \
   tst-resolv-ai_idn-nolibidn2 \
@@ -283,6 +284,8 @@ $(objpfx)mtrace-tst-resolv-res_ninit.out: $(objpfx)tst-resolv-res_ninit.out
 
 $(objpfx)tst-bug18665-tcp: $(objpfx)libresolv.so $(shared-thread-library)
 $(objpfx)tst-bug18665: $(objpfx)libresolv.so $(shared-thread-library)
+$(objpfx)tst-resolv-af-unspec-noerror-nodata: \
+  $(objpfx)libresolv.so $(shared-thread-library)
 $(objpfx)tst-getaddrinfo-eai-again-timeout: \
   $(objpfx)libresolv.so $(shared-thread-library)
 $(objpfx)tst-resolv-ai_idn: $(objpfx)libresolv.so $(shared-thread-library)
diff --git a/resolv/tst-resolv-af-unspec-noerror-nodata.c b/resolv/tst-resolv-af-unspec-noerror-nodata.c
new file mode 100644
index 0000000000..be925c5f72
--- /dev/null
+++ b/resolv/tst-resolv-af-unspec-noerror-nodata.c
@@ -0,0 +1,157 @@
+/* Test for BZ #14308.
+   Verify that getaddrinfo (AF_UNSPEC) succeeds if one of the A/AAAA
+   responses is a NOERROR/NODATA reply with recursion unavailable (RA=0),
+   but the other response contains a usable address.
+
+   Copyright (C) 2025 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <netdb.h>
+#include <resolv.h>
+#include <stdlib.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/check_nss.h>
+#include <support/resolv_test.h>
+#include <support/support.h>
+
+enum scenario
+{
+  /* A contains data, AAAA is NOERROR/NODATA with RA cleared.  */
+  A_AUTH_AAAA_FAKE,
+
+  /* AAAA contains data, A is NOERROR/NODATA with RA cleared.  */
+  A_FAKE_AAAA_AUTH
+};
+
+static enum scenario current_scenario;
+
+/* Create a NOERROR reply without answers and with RA cleared.  */
+static void
+add_fake (struct resolv_response_builder *b,
+          const char *qname, uint16_t qclass, uint16_t qtype)
+{
+  struct resolv_response_flags flags =
+    {
+      .rcode = ns_r_noerror,
+      .clear_ra = true
+    };
+  resolv_response_init (b, flags);
+  resolv_response_add_question (b, qname, qclass, qtype);
+}
+
+static void
+response (const struct resolv_response_context *ctx,
+          struct resolv_response_builder *b,
+          const char *qname, uint16_t qclass, uint16_t qtype)
+{
+  if (strcmp (qname, "foo.site.example") != 0)
+    FAIL_EXIT1 ("Unexpected qname: %s", qname);
+
+  if (qtype == T_A)
+    {
+      if (current_scenario == A_AUTH_AAAA_FAKE)
+        {
+          struct resolv_response_flags flags = { .rcode = ns_r_noerror };
+          resolv_response_init (b, flags);
+          resolv_response_add_question (b, qname, qclass, qtype);
+
+          resolv_response_section (b, ns_s_an);
+          resolv_response_open_record (b, qname, qclass, T_A, 100);
+          char addr_ipv4[4] = { 127, 128, 129, 130 };
+          resolv_response_add_data (b, addr_ipv4, sizeof (addr_ipv4));
+          resolv_response_close_record (b);
+        }
+      else if (current_scenario == A_FAKE_AAAA_AUTH)
+        add_fake (b, qname, qclass, qtype);
+      else
+        FAIL_EXIT1 ("Unknown scenario: %d", current_scenario);
+
+      return;
+    }
+
+  if (qtype == T_AAAA)
+    {
+      if (current_scenario == A_AUTH_AAAA_FAKE)
+        add_fake (b, qname, qclass, qtype);
+      else if (current_scenario == A_FAKE_AAAA_AUTH)
+        {
+          struct resolv_response_flags flags = { .rcode = ns_r_noerror };
+          resolv_response_init (b, flags);
+          resolv_response_add_question (b, qname, qclass, qtype);
+
+          resolv_response_section (b, ns_s_an);
+          resolv_response_open_record (b, qname, qclass, T_AAAA, 100);
+          char addr_ipv6[16] =
+            { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 };
+          resolv_response_add_data (b, addr_ipv6, sizeof (addr_ipv6));
+          resolv_response_close_record (b);
+        }
+      else
+        FAIL_EXIT1 ("Unknown scenario: %d", current_scenario);
+
+      return;
+    }
+
+  FAIL_EXIT1 ("qtype must be one of A, AAAA");
+}
+
+static void
+query_host (const char *host_name)
+{
+  struct addrinfo hints =
+    {
+      .ai_socktype = SOCK_STREAM,
+      .ai_family = AF_UNSPEC,
+    };
+
+  struct addrinfo *result = NULL;
+  int res = getaddrinfo (host_name, "80", &hints, &result);
+
+  if (current_scenario == A_AUTH_AAAA_FAKE)
+    check_addrinfo (host_name, result, res,
+                    "address: STREAM/TCP 127.128.129.130 80\n");
+  else if (current_scenario == A_FAKE_AAAA_AUTH)
+    check_addrinfo (host_name, result, res,
+                    "address: STREAM/TCP ::1 80\n");
+  else
+    FAIL_EXIT1 ("Unexpected scenario: %d", current_scenario);
+
+  if (res == 0)
+    freeaddrinfo (result);
+}
+
+static int
+do_test (void)
+{
+  struct resolv_test *aux = resolv_test_start
+    ((struct resolv_redirect_config)
+     {
+       .response_callback = response,
+     });
+
+  current_scenario = A_AUTH_AAAA_FAKE;
+  query_host ("foo.site.example");
+
+  current_scenario = A_FAKE_AAAA_AUTH;
+  query_host ("foo.site.example");
+
+  resolv_test_end (aux);
+  return 0;
+}
+
+#include <support/test-driver.c>
-- 
2.52.0