mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 14:07:59 +00:00
Code Issues Releases Wiki Activity

1982. [bug] DNSKEY was being accepted on the parent side of

Browse Source 
a delegation.  KEY is still accepted there for
                        RFC 3007 validated updates. [RT #15620]
This commit is contained in:
Mark Andrews
2006-02-16 00:59:38 +00:00
parent d849f8d79b
commit 3bf783a6d4
2 changed files with 24 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
1982. [bug] DNSKEY was being accepted on the parent side of
a delegation. KEY is still accepted there for
RFC 3007 validated updates. [RT #15620]
1981. [bug] win32: condition.c:wait() could fail to reattain 1981. [bug] win32: condition.c:wait() could fail to reattain
the mutex lock. the mutex lock.

31
lib/dns/rbtdb.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE. * PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: rbtdb.c,v 1.225 2006/01/06 00:01:44 marka Exp $ */ /* $Id: rbtdb.c,v 1.226 2006/02/16 00:59:38 marka Exp $ */
/*! \file */ /*! \file */
@@ -2581,12 +2581,12 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
/* /*
* Certain DNSSEC types are not subject to CNAME matching * Certain DNSSEC types are not subject to CNAME matching
* (RFC2535, section 2.3.5). * (RFC4035, section 2.5 and RFC3007).
* *
* We don't check for RRSIG, because we don't store RRSIG records * We don't check for RRSIG, because we don't store RRSIG records
* directly. * directly.
*/ */
if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec) if (type == dns_rdatatype_key || type == dns_rdatatype_nsec)
cname_ok = ISC_FALSE; cname_ok = ISC_FALSE;
/* /*
@@ -2645,9 +2645,15 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
search.need_cleanup = ISC_TRUE; search.need_cleanup = ISC_TRUE;
maybe_zonecut = ISC_FALSE; maybe_zonecut = ISC_FALSE;
at_zonecut = ISC_TRUE; at_zonecut = ISC_TRUE;
/*
* It is not clear if KEY should still be
* allowed at the parent side of the zone
* cut or not. It is needed for RFC3007
* validated updates.
*/
if ((search.options & DNS_DBFIND_GLUEOK) == 0 if ((search.options & DNS_DBFIND_GLUEOK) == 0
&& type != dns_rdatatype_nsec && type != dns_rdatatype_nsec
&& type != dns_rdatatype_dnskey) { && type != dns_rdatatype_key) {
/* /*
* Glue is not OK, but any answer we * Glue is not OK, but any answer we
* could return would be glue. Return * could return would be glue. Return
@@ -2831,8 +2837,14 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
* and the type is NSEC or KEY. * and the type is NSEC or KEY.
*/ */
if (search.zonecut == node) { if (search.zonecut == node) {
/*
* It is not clear if KEY should still be
* allowed at the parent side of the zone
* cut or not. It is needed for RFC3007
* validated updates.
*/
if (type == dns_rdatatype_nsec || if (type == dns_rdatatype_nsec ||
type == dns_rdatatype_dnskey) type == dns_rdatatype_key)
result = ISC_R_SUCCESS; result = ISC_R_SUCCESS;
else if (type == dns_rdatatype_any) else if (type == dns_rdatatype_any)
result = DNS_R_ZONECUT; result = DNS_R_ZONECUT;
@@ -3377,12 +3389,12 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
/* /*
* Certain DNSSEC types are not subject to CNAME matching * Certain DNSSEC types are not subject to CNAME matching
* (RFC2535, section 2.3.5). * (RFC4035, section 2.5 and RFC3007).
* *
* We don't check for RRSIG, because we don't store RRSIG records * We don't check for RRSIG, because we don't store RRSIG records
* directly. * directly.
*/ */
if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec) if (type == dns_rdatatype_key || type == dns_rdatatype_nsec)
cname_ok = ISC_FALSE; cname_ok = ISC_FALSE;
/* /*
@@ -4307,16 +4319,13 @@ cname_and_other_data(dns_rbtnode_t *node, rbtdb_serial_t serial) {
* Look for active extant "other data". * Look for active extant "other data".
* *
* "Other data" is any rdataset whose type is not * "Other data" is any rdataset whose type is not
* DNSKEY, RRSIG DNSKEY, NSEC, RRSIG NSEC, * KEY, RRSIG KEY, NSEC, RRSIG NSEC or RRSIG CNAME.
* or RRSIG CNAME.
*/ */
rdtype = RBTDB_RDATATYPE_BASE(header->type); rdtype = RBTDB_RDATATYPE_BASE(header->type);
if (rdtype == dns_rdatatype_rrsig || if (rdtype == dns_rdatatype_rrsig ||
rdtype == dns_rdatatype_sig) rdtype == dns_rdatatype_sig)
rdtype = RBTDB_RDATATYPE_EXT(header->type); rdtype = RBTDB_RDATATYPE_EXT(header->type);
if (rdtype != dns_rdatatype_nsec && if (rdtype != dns_rdatatype_nsec &&
rdtype != dns_rdatatype_dnskey &&
rdtype != dns_rdatatype_nxt &&
rdtype != dns_rdatatype_key && rdtype != dns_rdatatype_key &&
rdtype != dns_rdatatype_cname) { rdtype != dns_rdatatype_cname) {
/* /*