From d0ca4e90e2dd584db70e403ef92ab08d78d9cd6d Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Wed, 25 Nov 2009 02:22:05 +0000
Subject: [PATCH] 2786.   [bug]           Additional could be promoted to
 answer. [RT #20663]

---
 CHANGES                  |  2 ++
 bin/named/query.c        |  8 +++++---
 lib/dns/include/dns/db.h | 23 ++++++++++++++---------
 lib/dns/rbtdb.c          |  4 +++-
 4 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/CHANGES b/CHANGES
index 55d6b21a31..c0ff75de3d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2786.	[bug]		Additional could be promoted to answer. [RT #20663]
+
 	--- 9.7.0b3 released ---
 
 2785.	[bug]		Revoked keys could fail to self-sign [RT #20652]
diff --git a/bin/named/query.c b/bin/named/query.c
index b767a75e68..8f7d40e36b 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.333 2009/11/24 03:09:57 marka Exp $ */
+/* $Id: query.c,v 1.334 2009/11/25 02:22:05 marka Exp $ */
 
 /*! \file */
 
@@ -1160,7 +1160,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto cleanup;
 	}
 	result = dns_db_find(db, name, version, type,
-			     client->query.dboptions | DNS_DBFIND_GLUEOK,
+			     client->query.dboptions |
+			     DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK,
 			     client->now, &node, fname, rdataset,
 			     sigrdataset);
 	if (result == DNS_R_GLUE &&
@@ -1645,7 +1646,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		goto try_glue;
 
 	result = dns_db_find(db, name, version, type,
-			     client->query.dboptions | DNS_DBFIND_GLUEOK,
+			     client->query.dboptions |
+			     DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK,
 			     client->now, &node, fname, NULL, NULL);
 	if (result == ISC_R_SUCCESS)
 		goto found;
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index e3b0e550c6..3522840616 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.h,v 1.100 2009/07/19 23:47:55 tbox Exp $ */
+/* $Id: db.h,v 1.101 2009/11/25 02:22:05 marka Exp $ */
 
 #ifndef DNS_DB_H
 #define DNS_DB_H 1
@@ -208,14 +208,15 @@ struct dns_db {
 /*%
  * Options that can be specified for dns_db_find().
  */
-#define DNS_DBFIND_GLUEOK		0x01
-#define DNS_DBFIND_VALIDATEGLUE		0x02
-#define DNS_DBFIND_NOWILD		0x04
-#define DNS_DBFIND_PENDINGOK		0x08
-#define DNS_DBFIND_NOEXACT		0x10
-#define DNS_DBFIND_FORCENSEC		0x20
-#define DNS_DBFIND_COVERINGNSEC		0x40
-#define DNS_DBFIND_FORCENSEC3		0x80
+#define DNS_DBFIND_GLUEOK		0x0001
+#define DNS_DBFIND_VALIDATEGLUE		0x0002
+#define DNS_DBFIND_NOWILD		0x0004
+#define DNS_DBFIND_PENDINGOK		0x0008
+#define DNS_DBFIND_NOEXACT		0x0010
+#define DNS_DBFIND_FORCENSEC		0x0020
+#define DNS_DBFIND_COVERINGNSEC		0x0040
+#define DNS_DBFIND_FORCENSEC3		0x0080
+#define DNS_DBFIND_ADDITIONALOK		0x0100
 /*@}*/
 
 /*@{*/
@@ -701,6 +702,10 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *	For cache databases, glue is any rdataset with a trust of
  *	dns_trust_glue.
  *
+ * \li	If 'options' does not have #DNS_DBFIND_ADDITIONALOK set, then no
+ *	additional records will be returned.  Only caches can have 
+ *	rdataset with trust dns_trust_additional.
+ *
  * \li	If 'options' does not have #DNS_DBFIND_PENDINGOK set, then no
  *	pending data will be returned.  This option is only meaningful for
  *	cache databases.
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 5aef2c5e8c..6397fb3704 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.289 2009/11/23 02:10:16 marka Exp $ */
+/* $Id: rbtdb.c,v 1.290 2009/11/25 02:22:05 marka Exp $ */
 
 /*! \file */
 
@@ -4664,6 +4664,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	 * If we didn't find what we were looking for...
 	 */
 	if (found == NULL ||
+	    (found->trust == dns_trust_additional &&
+	     ((options & DNS_DBFIND_ADDITIONALOK) == 0)) ||
 	    (found->trust == dns_trust_glue &&
 	     ((options & DNS_DBFIND_GLUEOK) == 0)) ||
 	    (DNS_TRUST_PENDING(found->trust) &&