From: Michał Kępień <michal@isc.org>
Date: Wed, 22 Jul 2026 12:23:39 +0000 (+0200)
Subject: Merge tag 'v9.21.24'
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=36f0688f7707b4758c9bca3d47570287fa7cbdc1;p=thirdparty%2Fbind9.git

Merge tag 'v9.21.24'
---

36f0688f7707b4758c9bca3d47570287fa7cbdc1
diff --cc lib/dns/include/dns/validator.h
index b7d0d8e712f,269b4f6ae6b..d5a52a5be3d
--- a/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@@ -124,6 -125,8 +125,8 @@@ struct dns_validator 
  	/* Internal validator state */
  	atomic_bool	   canceling;
  	unsigned int	   attributes;
+ 	isc_work_t	  *offloaded_work;
 -	isc_job_cb	   offloaded_cb;
++	isc_work_cb	   offloaded_cb;
  	dns_fetch_t	  *fetch;
  	dns_validator_t	  *subvalidator;
  	dns_validator_t	  *parent;
diff --cc lib/dns/validator.c
index 1db756ad387,b6e5f2c66a7..ab02e8a0de7
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@@ -540,6 -415,12 +540,11 @@@ resume_answer_with_key(void *arg) 
  	dns_validator_t *val = arg;
  	dns_rdataset_t *rdataset = &val->frdataset;
  
+ 	if (CANCELED(val) || CANCELING(val)) {
+ 		val->result = ISC_R_CANCELED;
 -		(void)validate_async_run(val, resume_answer_with_key_done);
 -		return;
++		return validate_async_run(val, resume_answer_with_key_done);
+ 	}
+ 
  	isc_result_t result = select_signing_key(val, rdataset);
  	if (result == ISC_R_SUCCESS) {
  		val->keyset = &val->frdataset;
@@@ -885,36 -772,19 +908,36 @@@ validator_callback_ds(void *arg) 
  				      ? "dsset"
  				      : "ds non-existence",
  			      dns_trust_totext(val->frdataset.trust));
- 		have_dsset = (val->frdataset.type == dns_rdatatype_ds);
- 		name = dns_fixedname_name(&val->fname);
+ 		bool have_dsset = (val->frdataset.type == dns_rdatatype_ds);
+ 		dns_name_t *name = dns_fixedname_name(&val->fname);
  
 -		if ((val->attributes & VALATTR_INSECURITY) != 0 &&
 -		    val->frdataset.covers == dns_rdatatype_ds &&
 -		    NEGATIVE(&val->frdataset) &&
 -		    is_insecure_referral(val, name, &val->frdataset,
 -					 DNS_R_NCACHENXRRSET,
 -					 "validator_callback_ds"))
 -		{
 -			result = markanswer(val, "validator_callback_ds");
 -		} else if ((val->attributes & VALATTR_INSECURITY) != 0) {
 -			result = proveunsecure(val, have_dsset, false, true);
 +		if ((val->attributes & VALATTR_INSECURITY) != 0) {
 +			bool crossed = false;
 +			bool insecure = false;
 +
 +			if (val->frdataset.covers == dns_rdatatype_ds &&
 +			    NEGATIVE(&val->frdataset))
 +			{
 +				insecure = is_insecure_referral(
 +					val, name, &val->frdataset,
 +					DNS_R_NCACHENXRRSET,
 +					"validator_callback_ds", &crossed);
 +			}
 +
 +			if (insecure) {
 +				result = markanswer(val,
 +						    "validator_callback_ds");
 +			} else if (crossed) {
 +				/*
 +				 * The NSEC/NSEC3 signer sits above a known
 +				 * secure delegation, so this proof is forged.
 +				 * Stop instead of descending further.
 +				 */
 +				result = DNS_R_NOTINSECURE;
 +			} else {
 +				result = proveunsecure(val, have_dsset, false,
 +						       true);
 +			}
  		} else {
  			result = validate_async_run(val, validate_dnskey);
  		}
@@@ -2145,9 -2068,11 +2221,11 @@@ helper_cancel(void *arg) 
  }
  
  static isc_result_t
 -validate_work_enqueue(dns_validator_t *val, isc_job_cb cb) {
 +validate_work_enqueue(dns_validator_t *val, isc_work_cb cb) {
  	val->attributes |= VALATTR_OFFLOADED;
- 	isc_work_enqueue(val->loop, ISC_WORKLANE_FAST, cb, null_done, val);
+ 	val->offloaded_cb = cb;
+ 	val->offloaded_work = isc_work_enqueue(val->loop, ISC_WORKLANE_FAST, cb,
+ 					       helper_done, val);
  	return DNS_R_WAIT;
  }
  
diff --cc tests/dns/name_test.c
index 52ab63add66,f9a0dcf2e11..151e4c4c326
--- a/tests/dns/name_test.c
+++ b/tests/dns/name_test.c
@@@ -1153,22 -1037,22 +1179,23 @@@ ISC_RUN_TEST_IMPL(benchmark) 
  #endif /* DNS_BENCHMARK_TESTS */
  
  ISC_TEST_LIST_START
 -ISC_TEST_ENTRY(fullcompare)
 -ISC_TEST_ENTRY(compression)
 +ISC_TEST_ENTRY(buffer)
  ISC_TEST_ENTRY(collision)
 +ISC_TEST_ENTRY(compression)
 +ISC_TEST_ENTRY(countlabels)
  ISC_TEST_ENTRY(fromregion)
+ ISC_TEST_ENTRY(fromwire)
 -ISC_TEST_ENTRY(istat)
 +ISC_TEST_ENTRY(fullcompare)
 +ISC_TEST_ENTRY(getlabel)
 +ISC_TEST_ENTRY(getlabelsequence)
 +ISC_TEST_ENTRY(hash)
  ISC_TEST_ENTRY(init)
  ISC_TEST_ENTRY(invalidate)
 -ISC_TEST_ENTRY(buffer)
  ISC_TEST_ENTRY(isabsolute)
 -ISC_TEST_ENTRY(hash)
  ISC_TEST_ENTRY(issubdomain)
 -ISC_TEST_ENTRY(countlabels)
 -ISC_TEST_ENTRY(getlabel)
 -ISC_TEST_ENTRY(getlabelsequence)
 +ISC_TEST_ENTRY(istat)
  ISC_TEST_ENTRY(maxlabels)
 +ISC_TEST_ENTRY(totext)
  #ifdef DNS_BENCHMARK_TESTS
  ISC_TEST_ENTRY(benchmark)
  #endif /* DNS_BENCHMARK_TESTS */