From: Kees Monshouwer <mind04@monshouwer.org>
Date: Tue, 26 Mar 2019 23:51:57 +0000 (+0100)
Subject: auth: fix referral response for DS queries
X-Git-Tag: rec-4.2.0-rc1~36^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd65c85dc9ae30fb8734cf6b5d6a81f6136e1778;p=thirdparty%2Fpdns.git

auth: fix referral response for DS queries
---

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 72888474af..40ae41871d 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1448,19 +1448,38 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
       return 0;
     }
 
-    if(rrset.empty()) {
-      DLOG(g_log<<"checking if qtype is DS"<<endl);
-      if(p->qtype.getCode() == QType::DS)
-      {
+
+    // referral for DS query
+    if(p->qtype.getCode() == QType::DS) {
+      DLOG(g_log<<"Qtype is DS"<<endl);
+      bool doReferral = true;
+      if(d_dk.doesDNSSEC()) {
+        for(auto& loopRR: rrset) {
+          if(loopRR.auth) {
+            doReferral = false;
+            break;
+          }
+        }
+      } else {
+        for(auto& loopRR: rrset) {
+          if(loopRR.dr.d_type == QType::DS) {
+            doReferral = false;
+            break;
+          }
+        }
+      }
+      if(doReferral) {
         DLOG(g_log<<"DS query found no direct result, trying referral now"<<endl);
         if(tryReferral(p, r, sd, target, retargetcount))
         {
-          DLOG(g_log<<"got referral for DS query"<<endl);
+          DLOG(g_log<<"Got referral for DS query"<<endl);
           goto sendit;
         }
       }
+    }
 
 
+    if(rrset.empty()) {
       DLOG(g_log<<Logger::Warning<<"Found nothing in the by-name ANY, but let's try wildcards.."<<endl);
       bool wereRetargeted(false), nodata(false);
       DNSName wildcard;