Fix harden-referral-path so it does not generate lookup failures.

git-svn-id: file:///svn/unbound/trunk@2101 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 25321dade57b20cd4eaa069c1e6f81b84b3c1f69..1168334869ba9d6cbb6df30e06702d4a54e3a0b8 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,9 @@
        - unbound-control get_option domain-insecure shows config file items.
        - fix retry sequence if prime hints are recursion-lame.
        - autotrust anchor file can be initialized with a ZSK key as well.
+       - harden-referral-path does not result in failures due to max-depth.
+         You can increase the max-depth by adding numbers (' 0') after the
+         target-fetch-policy, this increases the depth to which is checked.
 
 26 April 2010: Wouter
        - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index fbe374890e11344cb7dcfa5204e68d54b7756cc2..16a607c93a2a1006d1a758f3f5aafd3a13180987 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -456,6 +456,8 @@ path to the answer.
 Default off, because it burdens the authority servers, and it is
 not RFC standard, and could lead to performance problems because of the
 extra query load that is generated.  Experimental option.
+If you enable it consider adding more numbers after the target\-fetch\-policy
+to increase the max depth that is checked to.
 .TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 08354e8f2056cbab51c592def28b4d61a95310a0..19b9a265cb597735542ec128fcf0fb98a7dbbe6c 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -695,12 +695,15 @@ static void
 generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, 
        int id)
 {
+       struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
        struct module_qstate* subq;
        size_t i;
        struct reply_info* rep = iq->response->rep;
        struct ub_packed_rrset_key* s;
        log_assert(iq->dp);
 
+       if(iq->depth == ie->max_dependency_depth)
+               return;
        /* walk through additional, and check if in-zone,
         * only relevant A, AAAA are left after scrub anyway */
        for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
@@ -746,9 +749,12 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
 static void
 generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 {
+       struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
        struct module_qstate* subq;
        log_assert(iq->dp);
 
+       if(iq->depth == ie->max_dependency_depth)
+               return;
        /* is this query the same as the nscheck? */
        if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS &&
                query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&