Bugfix #4248 drill -DT fails for CNAME domain

diff --git a/Changelog b/Changelog
index b3ce4a2ce1ba4d886f8b6ebe4b4020a423b57414..2ed9909d5935737cc64cfeea836e2881395d6dbb 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -44,6 +44,8 @@
        * Allow -T flag to be used together with drill -x
        * Python bindings compile with swig 4.0
          Thanks Jitka Plesníková
+       * bugfix #4248: drill -DT fails for CNAME domain
+         Thanks Thom Wiggers
 
 1.7.0  2016-12-20
        * Fix lookup of relative names in ldns_resolver_search.

diff --git a/drill/securetrace.c b/drill/securetrace.c
index 863875e138cdfa6d235c799bafafd19b44e30f1c..b58d86eea6d71ceb05b371a5acb37d47217270fb 100644 (file)
--- a/drill/securetrace.c
+++ b/drill/securetrace.c
@@ -497,12 +497,43 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
                        p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
                        (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
                        if (!ds_list) {
-                               ldns_pkt_free(p);
-                               if (ds_sig_list) {
+                               ldns_rr_list_deep_free(ds_sig_list);
+                               (void) get_dnssec_rr( p, labels[i-1]
+                                                   , LDNS_RR_TYPE_CNAME
+                                                   , &ds_list, &ds_sig_list);
+                               if (ds_list) {
+                                       st = ldns_verify( ds_list, ds_sig_list
+                                                       , correct_key_list
+                                                       , current_correct_keys);
+
+                                       if (st == LDNS_STATUS_OK) {
+                                               printf(";; No DS record found "
+                                                      "for ");
+                                               ldns_rdf_print(stdout,
+                                                       labels[i-1]);
+                                               printf(", but valid CNAME");
+                                       } else {
+                                               printf("[B] Unable to verify de"
+                                                      "nial of existence for ");
+                                               ldns_rdf_print(stdout,
+                                                       labels[i-1]);
+                                               printf(", because of BOGUS CNAME");
+                                       }
+                                       printf("\n");
                                        ldns_rr_list_deep_free(ds_sig_list);
+                                       ldns_pkt_free(p);
+                                       ldns_rr_list_deep_free(ds_list);
+                                       ds_list = NULL;
+                                       ds_sig_list = NULL;
+                                       p = NULL;
+                               } else {
+                                       ldns_rr_list_deep_free(ds_sig_list);
+                                       ldns_pkt_free(p);
+                                       p = get_dnssec_pkt(res, name,
+                                                       LDNS_RR_TYPE_DNSKEY);
+                                       (void) get_ds(p, NULL
+                                                    , &ds_list, &ds_sig_list); 
                                }
-                               p = get_dnssec_pkt(res, name, LDNS_RR_TYPE_DNSKEY);
-                               (void) get_ds(p, NULL, &ds_list, &ds_sig_list); 
                        }
                        if (ds_sig_list) {
                                if (ds_list) {