From: Evan Hunt <each@isc.org>
Date: Tue, 30 Sep 2025 04:52:43 +0000 (-0700)
Subject: Further restrict addresses that are cached when processing referrals
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=50479358efdf432d690415131b74b5df158a9d69;p=thirdparty%2Fbind9.git

Further restrict addresses that are cached when processing referrals

Use the owner name of the NS record as the bailwick apex name
when determining which additional records to cache, rather than
the name of the delegating zone (or a parent thereof).

(cherry picked from commit a41054e9e606a61f1b3c8bc0c54e2f1059347165)
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 7a2768c1416..168fcc5e808 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7162,8 +7162,9 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
  * subdomain or because it's below a forward declaration or a
  * locally served zone.
  */
-static bool
-name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+static inline bool
+name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) {
+	fetchctx_t *fctx = rctx->fctx;
 	isc_result_t result;
 	dns_forwarders_t *forwarders = NULL;
 	dns_fixedname_t fixed, zfixed;
@@ -7176,7 +7177,7 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
 	dns_namereln_t rel;
 
 	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
-		       ? &fctx->domain
+		       ? rctx->ns_name != NULL ? rctx->ns_name : &fctx->domain
 		       : fctx->fwdname;
 
 	/*
@@ -7285,7 +7286,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 	result = dns_message_findname(rctx->query->rmessage, section, addname,
 				      dns_rdatatype_any, 0, &name, NULL);
 	if (result == ISC_R_SUCCESS) {
-		external = name_external(name, type, fctx);
+		external = name_external(name, type, rctx);
 		if (type == dns_rdatatype_a) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -8920,7 +8921,7 @@ rctx_answer_scan(respctx_t *rctx) {
 			/*
 			 * Don't accept DNAME from parent namespace.
 			 */
-			if (name_external(name, dns_rdatatype_dname, fctx)) {
+			if (name_external(name, dns_rdatatype_dname, rctx)) {
 				continue;
 			}
 
@@ -9243,7 +9244,7 @@ rctx_authority_positive(respctx_t *rctx) {
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_AUTHORITY, &name);
 
-		if (!name_external(name, dns_rdatatype_ns, fctx) &&
+		if (!name_external(name, dns_rdatatype_ns, rctx) &&
 		    dns_name_issubdomain(&fctx->name, name))
 		{
 			dns_rdataset_t *rdataset = NULL;