2057. [bug] Make setting "ra" dependent on both allow-query and

                        allow-recursion. [RT #16290]

diff --git a/CHANGES b/CHANGES
index 84bc61f0136f36c5727c2d37f32f14a53f85ab0a..1659207b7f86baed84ec73c7ff5ffa3e197fc8ee 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2057.  [bug]           Make setting "ra" dependent on both allow-query and
+                       allow-recursion. [RT #16290]
+
 2056.  [bug]           dig: ixfr= was not being treated case insensitively
                        at all times. [RT #15955]
 

diff --git a/bin/named/client.c b/bin/named/client.c
index 807e78a6f012d69f9a4b7c68b4c8f9e9e6d97591..b0ce793b98eaa8f8b89e91e3e9f86f7ed81e49a4 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.176.2.13.4.30 2006/07/21 23:41:41 marka Exp $ */
+/* $Id: client.c,v 1.176.2.13.4.31 2006/07/22 01:09:38 marka Exp $ */
 
 #include <config.h>
 
@@ -1609,12 +1609,15 @@ client_request(isc_task_t *task, isc_event_t *event) {
         * Decide whether recursive service is available to this client.
         * We do this here rather than in the query code so that we can
         * set the RA bit correctly on all kinds of responses, not just
-        * responses to ordinary queries.
+        * responses to ordinary queries.  Note if you can't query the
+        * cache there is no point in setting RA.
         */
        ra = ISC_FALSE;
        if (client->view->resolver != NULL &&
            client->view->recursion == ISC_TRUE &&
            ns_client_checkaclsilent(client, client->view->recursionacl,
+                                    ISC_TRUE) == ISC_R_SUCCESS &&
+           ns_client_checkaclsilent(client, client->view->queryacl,
                                     ISC_TRUE) == ISC_R_SUCCESS)
                ra = ISC_TRUE;