From: Colin Vidal <colin@isc.org>
Date: Wed, 1 Jul 2026 08:58:41 +0000 (+0200)
Subject: Follow-up of disambiguate `query_cname()` and `query_dname()` usage
X-Git-Tag: v9.21.24~8^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=84d3734485cc7ee2d522f796a164a8d660a12c51;p=thirdparty%2Fbind9.git

Follow-up of disambiguate `query_cname()` and `query_dname()` usage

Previous commit "Disambiguate `query_cname()` and `query_dname()` usage"
was harmless but also useless, as it was checking `qctx->result` which
is always set to `ISC_R_SUCCESS` when `qctx` is initialized. The intent
was to check `qctx->fresp->result` (which is the result provided by the
resolver). But this was also wrong (this is actually the case we do
expect `query_cname()`/`query_dname()` to be called, to follow the
chain).

The actual invarant that needs to be checked is if the qtype is CNAME
then we do not follow the chain, so we can't call `query_cname()`. This
invariant has been added.

If the qtype is DNAME, it's more complex, because a DNAME can be found
from a local zone or cache and the chain can be locally followed. In
which case, calling `query_dname()` is legit, as soon as the qname is a
subname of the DNAME target. This invariant is already checked.
---

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 615f3b8e05c..4f6410b2bed 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -9826,7 +9826,7 @@ query_cname(query_ctx_t *qctx) {
 
 	CALL_HOOK(NS_QUERY_CNAME_BEGIN, qctx);
 
-	REQUIRE(qctx->result != DNS_R_CNAME);
+	REQUIRE(qctx->qtype != dns_rdatatype_cname);
 
 	result = query_zerottl_refetch(qctx);
 	if (result != ISC_R_COMPLETE) {
@@ -9914,9 +9914,6 @@ cleanup:
 	return result;
 }
 
-/*
- * Handle DNAME responses of a query which its type is _not_ DNAME.
- */
 static isc_result_t
 query_dname(query_ctx_t *qctx) {
 	dns_name_t *tname, *prefix;
@@ -9935,8 +9932,6 @@ query_dname(query_ctx_t *qctx) {
 
 	CALL_HOOK(NS_QUERY_DNAME_BEGIN, qctx);
 
-	REQUIRE(qctx->result != DNS_R_DNAME);
-
 	/*
 	 * Compare the current qname to the found name.  We need
 	 * to know how many labels and bits are in common because
@@ -9944,6 +9939,11 @@ query_dname(query_ctx_t *qctx) {
 	 */
 	namereln = dns_name_fullcompare(qctx->client->query.qname, qctx->fname,
 					&order, &nlabels);
+
+	/*
+	 * Handling DNAME response is valid as soon as the qname is a subname of
+	 * the DNAME target.
+	 */
 	INSIST(namereln == dns_namereln_subdomain);
 
 	/*