Don't validate non-pending glue when adding to the additional section

(cherry picked from commit 31bd3147d118106faa62fe90ec39f36c64239e5d)

diff --git a/bin/named/query.c b/bin/named/query.c
index 8328de7cc2a4d009b2004caa4869fe5e01326f45..3bfddfbe00b57e98b2619dabd5da65137e2aa109 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -1583,8 +1583,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                        have_a = ISC_TRUE;
 #endif
                        if (additionaltype == dns_rdatasetadditional_fromcache &&
-                           (DNS_TRUST_PENDING(rdataset->trust) ||
-                            DNS_TRUST_GLUE(rdataset->trust)) &&
+                           DNS_TRUST_PENDING(rdataset->trust) &&
                            !validate(client, db, fname, rdataset, sigrdataset))
                        {
                                dns_rdataset_disassociate(rdataset);
@@ -1654,8 +1653,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                                goto addname;
 #endif
                        if (additionaltype == dns_rdatasetadditional_fromcache &&
-                           (DNS_TRUST_PENDING(rdataset->trust) ||
-                            DNS_TRUST_GLUE(rdataset->trust)) &&
+                           DNS_TRUST_PENDING(rdataset->trust) &&
                            !validate(client, db, fname, rdataset, sigrdataset))
                        {
                                dns_rdataset_disassociate(rdataset);
@@ -2122,9 +2120,9 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
         */
        if (result == ISC_R_SUCCESS &&
            additionaltype == dns_rdatasetadditional_fromcache &&
-           (DNS_TRUST_PENDING(rdataset->trust) ||
-            DNS_TRUST_GLUE(rdataset->trust)) &&
-           !validate(client, db, fname, rdataset, sigrdataset)) {
+           DNS_TRUST_PENDING(rdataset->trust) &&
+           !validate(client, db, fname, rdataset, sigrdataset))
+       {
                dns_rdataset_disassociate(rdataset);
                if (dns_rdataset_isassociated(sigrdataset))
                        dns_rdataset_disassociate(sigrdataset);
@@ -2164,9 +2162,9 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
         */
        if (result == ISC_R_SUCCESS &&
            additionaltype == dns_rdatasetadditional_fromcache &&
-           (DNS_TRUST_PENDING(rdataset->trust) ||
-            DNS_TRUST_GLUE(rdataset->trust)) &&
-           !validate(client, db, fname, rdataset, sigrdataset)) {
+           DNS_TRUST_PENDING(rdataset->trust) &&
+           !validate(client, db, fname, rdataset, sigrdataset))
+       {
                dns_rdataset_disassociate(rdataset);
                if (dns_rdataset_isassociated(sigrdataset))
                        dns_rdataset_disassociate(sigrdataset);