Merge tag 'v9.21.24'

diff --cc lib/dns/include/dns/validator.h
index b7d0d8e712f381b356c5c84ce74b9d7f2e36b846,269b4f6ae6bf5ccbeab423226aa6b31f0b91ce12..d5a52a5be3d12889351860bc90532af28a9e04e1
--- 1/lib/dns/include/dns/validator.h
--- 2/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@@ -124,6 -125,8 +125,8 @@@ struct dns_validator 
        /* Internal validator state */
        atomic_bool        canceling;
        unsigned int       attributes;
 -      isc_job_cb         offloaded_cb;
+       isc_work_t        *offloaded_work;
++      isc_work_cb        offloaded_cb;
        dns_fetch_t       *fetch;
        dns_validator_t   *subvalidator;
        dns_validator_t   *parent;

diff --cc lib/dns/name.c
Simple merge

diff --cc lib/dns/qpcache.c
Simple merge

diff --cc lib/dns/resolver.c
Simple merge

diff --cc lib/dns/validator.c
index 1db756ad38740cb02eb8a3a6ee573f0ad4645868,b6e5f2c66a76dc2fa89048c50b5634b9c290f474..ab02e8a0de733948e464e589d4aa4a06ceb636e1
--- 1/lib/dns/validator.c
--- 2/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@@ -540,6 -415,12 +540,11 @@@ resume_answer_with_key(void *arg) 
        dns_validator_t *val = arg;
        dns_rdataset_t *rdataset = &val->frdataset;
  
 -              (void)validate_async_run(val, resume_answer_with_key_done);
 -              return;
+       if (CANCELED(val) || CANCELING(val)) {
+               val->result = ISC_R_CANCELED;
++              return validate_async_run(val, resume_answer_with_key_done);
+       }
+ 
        isc_result_t result = select_signing_key(val, rdataset);
        if (result == ISC_R_SUCCESS) {
                val->keyset = &val->frdataset;
@@@ -885,36 -772,19 +908,36 @@@ validator_callback_ds(void *arg) 
                                      ? "dsset"
                                      : "ds non-existence",
                              dns_trust_totext(val->frdataset.trust));
-               have_dsset = (val->frdataset.type == dns_rdatatype_ds);
-               name = dns_fixedname_name(&val->fname);
+               bool have_dsset = (val->frdataset.type == dns_rdatatype_ds);
+               dns_name_t *name = dns_fixedname_name(&val->fname);
  
 -              if ((val->attributes & VALATTR_INSECURITY) != 0 &&
 -                  val->frdataset.covers == dns_rdatatype_ds &&
 -                  NEGATIVE(&val->frdataset) &&
 -                  is_insecure_referral(val, name, &val->frdataset,
 -                                       DNS_R_NCACHENXRRSET,
 -                                       "validator_callback_ds"))
 -              {
 -                      result = markanswer(val, "validator_callback_ds");
 -              } else if ((val->attributes & VALATTR_INSECURITY) != 0) {
 -                      result = proveunsecure(val, have_dsset, false, true);
 +              if ((val->attributes & VALATTR_INSECURITY) != 0) {
 +                      bool crossed = false;
 +                      bool insecure = false;
 +
 +                      if (val->frdataset.covers == dns_rdatatype_ds &&
 +                          NEGATIVE(&val->frdataset))
 +                      {
 +                              insecure = is_insecure_referral(
 +                                      val, name, &val->frdataset,
 +                                      DNS_R_NCACHENXRRSET,
 +                                      "validator_callback_ds", &crossed);
 +                      }
 +
 +                      if (insecure) {
 +                              result = markanswer(val,
 +                                                  "validator_callback_ds");
 +                      } else if (crossed) {
 +                              /*
 +                               * The NSEC/NSEC3 signer sits above a known
 +                               * secure delegation, so this proof is forged.
 +                               * Stop instead of descending further.
 +                               */
 +                              result = DNS_R_NOTINSECURE;
 +                      } else {
 +                              result = proveunsecure(val, have_dsset, false,
 +                                                     true);
 +                      }
                } else {
                        result = validate_async_run(val, validate_dnskey);
                }
@@@ -2145,9 -2068,11 +2221,11 @@@ helper_cancel(void *arg) 
  }
  
  static isc_result_t
 -validate_work_enqueue(dns_validator_t *val, isc_job_cb cb) {
 +validate_work_enqueue(dns_validator_t *val, isc_work_cb cb) {
        val->attributes |= VALATTR_OFFLOADED;
-       isc_work_enqueue(val->loop, ISC_WORKLANE_FAST, cb, null_done, val);
+       val->offloaded_cb = cb;
+       val->offloaded_work = isc_work_enqueue(val->loop, ISC_WORKLANE_FAST, cb,
+                                              helper_done, val);
        return DNS_R_WAIT;
  }
  

diff --cc lib/ns/query.c
Simple merge

diff --cc tests/dns/name_test.c
index 52ab63add66091f2d8af563f7842c267d4901534,f9a0dcf2e11062ad535af3c705f5114c56d7739e..151e4c4c3268092d5dff3bf2861ac45e50043623
--- 1/tests/dns/name_test.c
--- 2/tests/dns/name_test.c
+++ b/tests/dns/name_test.c
@@@ -1153,22 -1037,22 +1179,23 @@@ ISC_RUN_TEST_IMPL(benchmark) 
  #endif /* DNS_BENCHMARK_TESTS */
  
  ISC_TEST_LIST_START
 -ISC_TEST_ENTRY(fullcompare)
 -ISC_TEST_ENTRY(compression)
 +ISC_TEST_ENTRY(buffer)
  ISC_TEST_ENTRY(collision)
 +ISC_TEST_ENTRY(compression)
 +ISC_TEST_ENTRY(countlabels)
  ISC_TEST_ENTRY(fromregion)
 -ISC_TEST_ENTRY(istat)
+ ISC_TEST_ENTRY(fromwire)
 +ISC_TEST_ENTRY(fullcompare)
 +ISC_TEST_ENTRY(getlabel)
 +ISC_TEST_ENTRY(getlabelsequence)
 +ISC_TEST_ENTRY(hash)
  ISC_TEST_ENTRY(init)
  ISC_TEST_ENTRY(invalidate)
 -ISC_TEST_ENTRY(buffer)
  ISC_TEST_ENTRY(isabsolute)
 -ISC_TEST_ENTRY(hash)
  ISC_TEST_ENTRY(issubdomain)
 -ISC_TEST_ENTRY(countlabels)
 -ISC_TEST_ENTRY(getlabel)
 -ISC_TEST_ENTRY(getlabelsequence)
 +ISC_TEST_ENTRY(istat)
  ISC_TEST_ENTRY(maxlabels)
 +ISC_TEST_ENTRY(totext)
  #ifdef DNS_BENCHMARK_TESTS
  ISC_TEST_ENTRY(benchmark)
  #endif /* DNS_BENCHMARK_TESTS */