From: JINMEI Tatuya <jinmei@isc.org>
Date: Mon, 26 Mar 2012 17:12:41 +0000 (-0700)
Subject: [1836] throw exception from addDS only when the find result != NXRRSET.
X-Git-Tag: trac2351_base~226^2~116^2~68^2~11^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=deafd46a146bf83ea3af9076c9ec808cfd1c168b;p=thirdparty%2Fkea.git

[1836] throw exception from addDS only when the find result != NXRRSET.

Otherwise, queries with DO bit can incorrectly trigger an exception if
the zone is unsigned and queyr result is delegation.
---

diff --git a/src/bin/auth/query.cc b/src/bin/auth/query.cc
index 793a64f110..f215c04ef8 100644
--- a/src/bin/auth/query.cc
+++ b/src/bin/auth/query.cc
@@ -278,8 +278,10 @@ Query::addDS(ZoneFinder& finder, const Name& dname) {
                ds_context->isNSEC3Signed()) {
         // Add no DS proof with NSEC3 as specified in RFC 5155 Section 7.2.7.
         addClosestEncloserProof(finder, dname, true);
-    } else {
-        // Any other case should be an error
+    } else if (ds_context->code != ZoneFinder::NXRRSET) {
+        // We know this domain should exist, so the result must be NXRRSET.
+        // If not, the zone is broken, so we'll return SERVFAIL by triggering
+        // an exception.
         isc_throw(BadDS, "Unexpected result for DS lookup for delegation");
     }
 }