- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC signed zones.

git-svn-id: file:///svn/unbound/trunk@3722 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 0b50a169df10897510f94485307c3e130a48feb0..3c8ed60bdcea9720082659bc4990f4a9fefabe9a 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+20 May 2016: Ralph
+       - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC 
+         signed zones.
+
 19 May 2016: Wouter
        - Fix #766: dns64 should synthesize results on timeout/errors.
 

diff --git a/iterator/iterator.c b/iterator/iterator.c
index d3022c4a7b4cc0cff4c1ed84c5803aee222a7cf1..c47ee3754e2d70b9a86563ce15d9e9eea6557abc 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -2262,28 +2262,37 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
                        /* Best effort qname-minimisation. 
                         * Stop minimising and send full query when RCODE
-                        * is not NOERROR */
+                        * is not NOERROR. */
                        if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
                                LDNS_RCODE_NOERROR)
                                iq->minimisation_state = DONOT_MINIMISE_STATE;
-                       /* Make subrequest to validate intermediate NXDOMAIN if
-                        * harden-below-nxdomain is enabled. */
                        if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
-                               LDNS_RCODE_NXDOMAIN &&
-                               qstate->env->cfg->harden_below_nxdomain) {
-                               struct module_qstate* subq = NULL;
-                               log_query_info(VERB_QUERY,
-                                       "schedule NXDOMAIN validation:",
-                                       &iq->response->qinfo);
-                               if(!generate_sub_request(
-                                       iq->response->qinfo.qname,
-                                       iq->response->qinfo.qname_len,
-                                       iq->response->qinfo.qtype,
-                                       iq->response->qinfo.qclass,
-                                       qstate, id, iq, INIT_REQUEST_STATE,
-                                       FINISHED_STATE, &subq, 1)) {
-                                       verbose(VERB_ALGO,
-                                       "could not validate NXDOMAIN response");
+                               LDNS_RCODE_NXDOMAIN) {
+                               /* Stop resolving when NXDOMAIN is DNSSEC
+                                * signed. Based on assumption that namservers
+                                * serving signed zones do not return NXDOMAIN
+                                * for empty-non-terminals. */
+                               if(iq->dnssec_expected)
+                                       return final_state(iq);
+                               /* Make subrequest to validate intermediate
+                                * NXDOMAIN if harden-below-nxdomain is
+                                * enabled. */
+                               if(qstate->env->cfg->harden_below_nxdomain) {
+                                       struct module_qstate* subq = NULL;
+                                       log_query_info(VERB_QUERY,
+                                               "schedule NXDOMAIN validation:",
+                                               &iq->response->qinfo);
+                                       if(!generate_sub_request(
+                                               iq->response->qinfo.qname,
+                                               iq->response->qinfo.qname_len,
+                                               iq->response->qinfo.qtype,
+                                               iq->response->qinfo.qclass,
+                                               qstate, id, iq,
+                                               INIT_REQUEST_STATE,
+                                               FINISHED_STATE, &subq, 1))
+                                               verbose(VERB_ALGO,
+                                               "could not validate NXDOMAIN "
+                                               "response");
                                }
                        }
                        return next_state(iq, QUERYTARGETS_STATE);