From: Colin Vidal <colin@isc.org>
Date: Wed, 29 Apr 2026 09:29:36 +0000 (+0200)
Subject: fix: usr: Glues from different parent are rejected
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=48d098467ff589efb9ef13745a2c8a85865f169a;p=thirdparty%2Fbind9.git

fix: usr: Glues from different parent are rejected

The changes making BIND 9 parent-centric !11621 introduced an issue where it could be possible, when processing a referral, to use the glue to a nameserver which has a different parent than the zonecut. For instance:

	AUTHORITY
	test.example.		NS	ns.test.example.
	test.example.		NS	ns.foo.example.
	test.example.		NS	ns.bar.

	ADDITIONAL
	ns.bar.			A	1.2.3.4
	ns.foo.example.		A	5.6.7.8
	ns.test.example.	A	9.8.7.6

In such situation, only the glues for `ns.foo.example.` and `ns.test.example.` should be used, and the glue from `ns.bar.` must be ignored as this is not either a sub-domain or a sibling domain, the parent is different (`bar.` instead of `example.`). This is now fixed.

Sibling glue and cyclic sibling glues are defined in RFC 9471 section 2.2 and section 2.3.

Merge branch 'colin/cyclic-glues-test' into 'main'

See merge request isc-projects/bind9!11873
---

48d098467ff589efb9ef13745a2c8a85865f169a