Remove check for missing RRSIG records from getsection

Checking whether the authority section is properly signed should
be left to the validator.  Checking in getsection (dns_message_parse)
was way too early and resulted in resolution failures of lookups
that should have otherwise succeeded.

diff --git a/lib/dns/message.c b/lib/dns/message.c
index bdb3044a78ac5f42e7434beb5db40b703509e7a1..7c8d5a95b4b1e920a7beb4a3cbaea528845c49b1 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1169,57 +1169,6 @@ update(dns_section_t section, dns_rdataclass_t rdclass) {
        return false;
 }
 
-/*
- * Check to confirm that all DNSSEC records (DS, NSEC, NSEC3) have
- * covering RRSIGs.
- */
-static bool
-auth_signed(dns_namelist_t *section) {
-       dns_name_t *name = NULL;
-
-       ISC_LIST_FOREACH (*section, name, link) {
-               int auth_dnssec = 0, auth_rrsig = 0;
-               dns_rdataset_t *rds = NULL;
-               ISC_LIST_FOREACH (name->list, rds, link) {
-                       switch (rds->type) {
-                       case dns_rdatatype_ds:
-                               auth_dnssec |= 0x1;
-                               break;
-                       case dns_rdatatype_nsec:
-                               auth_dnssec |= 0x2;
-                               break;
-                       case dns_rdatatype_nsec3:
-                               auth_dnssec |= 0x4;
-                               break;
-                       case dns_rdatatype_rrsig:
-                               break;
-                       default:
-                               continue;
-                       }
-
-                       switch (rds->covers) {
-                       case dns_rdatatype_ds:
-                               auth_rrsig |= 0x1;
-                               break;
-                       case dns_rdatatype_nsec:
-                               auth_rrsig |= 0x2;
-                               break;
-                       case dns_rdatatype_nsec3:
-                               auth_rrsig |= 0x4;
-                               break;
-                       default:
-                               break;
-                       }
-               }
-
-               if (auth_dnssec != auth_rrsig) {
-                       return false;
-               }
-       }
-
-       return true;
-}
-
 static isc_result_t
 getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
           dns_section_t sectionid, unsigned int options) {
@@ -1691,21 +1640,6 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
                INSIST(!free_name);
        }
 
-       /*
-        * If any of DS, NSEC or NSEC3 appeared in the
-        * authority section of a query response without
-        * a covering RRSIG, FORMERR
-        */
-       if (sectionid == DNS_SECTION_AUTHORITY &&
-           msg->opcode == dns_opcode_query &&
-           ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) &&
-           ((msg->flags & DNS_MESSAGEFLAG_TC) == 0) && !preserve_order &&
-           !auth_signed(section))
-       {
-               /* XXX test coverage */
-               DO_ERROR(DNS_R_FORMERR);
-       }
-
        if (seen_problem) {
                result = DNS_R_RECOVERABLE;
        }