mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

ensure that we attempt to validate glue if it's signed

Browse Source 
- incidentally fixed a bug in the dnssec system test where TTLs in the
  answer section rather than the additional section were being checked
This commit is contained in:
Evan Hunt
2018-05-17 20:05:25 -07:00
parent 4aecd153de
commit 8d923a05a9
2 changed files with 47 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
lib/ns/query.c
View File

@@ -1882,12 +1882,19 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
dns_rdataset_isassociated(sigrdataset))
dns_rdataset_disassociate(sigrdataset);
} else if (result == ISC_R_SUCCESS) {
isc_boolean_t invalid = ISC_FALSE;
mname = NULL;
have_a = ISC_TRUE;
if (additionaltype == dns_rdatasetadditional_fromcache &&
DNS_TRUST_PENDING(rdataset->trust) &&
!validate(client, db, fname, rdataset, sigrdataset))
if (additionaltype ==
dns_rdatasetadditional_fromcache &&
(DNS_TRUST_PENDING(rdataset->trust) ||
DNS_TRUST_GLUE(rdataset->trust)))
{
/* validate() may change rdataset->trust */
invalid = ISC_TF(!!validate(client, db, fname,
rdataset, sigrdataset));
}
if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {
dns_rdataset_disassociate(rdataset);
if (sigrdataset != NULL &&
dns_rdataset_isassociated(sigrdataset))
@@ -1896,7 +1903,8 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
dns_rdatatype_a, &mname)) {
if (mname != fname) {
if (mname != NULL) {
query_releasename(client, &fname);
query_releasename(client,
&fname);
fname = mname;
} else
need_addname = ISC_TRUE;
@@ -1938,6 +1946,7 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
dns_rdataset_isassociated(sigrdataset))
dns_rdataset_disassociate(sigrdataset);
} else if (result == ISC_R_SUCCESS) {
isc_boolean_t invalid = ISC_FALSE;
mname = NULL;
/*
* There's an A; check whether we're filtering AAAA
@@ -1948,10 +1957,17 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
(!WANTDNSSEC(client) || sigrdataset == NULL ||
!dns_rdataset_isassociated(sigrdataset)))))
goto addname;
if (additionaltype == dns_rdatasetadditional_fromcache &&
DNS_TRUST_PENDING(rdataset->trust) &&
!validate(client, db, fname, rdataset, sigrdataset))
if (additionaltype ==
dns_rdatasetadditional_fromcache &&
(DNS_TRUST_PENDING(rdataset->trust) ||
DNS_TRUST_GLUE(rdataset->trust)))
{
/* validate() may change rdataset->trust */
invalid = ISC_TF(!!validate(client, db, fname,
rdataset, sigrdataset));
}
if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {
dns_rdataset_disassociate(rdataset);
if (sigrdataset != NULL &&
dns_rdataset_isassociated(sigrdataset))
@@ -1960,7 +1976,8 @@ query_addadditional(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
dns_rdatatype_aaaa, &mname)) {
if (mname != fname) {
if (mname != NULL) {
query_releasename(client, &fname);
query_releasename(client,
&fname);
fname = mname;
} else
need_addname = ISC_TRUE;