Replace remaining usage of DNS_R_MUSTBESECURE with DNS_R_NOVALIDSIG

The DNS_R_MUSTBESECURE lost its meaning with removal of
dnssec-must-be-secure option, so replace the few remaining (and a bit
confusing) use of this result code with DNS_R_NOVALIDSIG.

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index b175ef4a9c6c153a3479900c4d845c71ce2214bf..4dc4edbd7166872a294234e4b3ef7e2ac9fe00b1 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -3068,7 +3068,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
                        validator_log(val, ISC_LOG_WARNING,
                                      "can't validate existing "
                                      "negative responses (no DS)");
-                       *resp = DNS_R_MUSTBESECURE;
+                       *resp = DNS_R_NOVALIDSIG;
                        return ISC_R_COMPLETE;
                }
 
@@ -3167,8 +3167,6 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
  * Returns:
  * \li ISC_R_SUCCESS           val->name is in an unsecure zone
  * \li DNS_R_WAIT              validation is in progress.
- * \li DNS_R_MUSTBESECURE      val->name is supposed to be secure
- *                             (policy) but we proved that it is unsecure.
  * \li DNS_R_NOVALIDSIG
  * \li DNS_R_NOVALIDNSEC
  * \li DNS_R_NOTINSECURE

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index e0c186ff8fdde8c87fc828b5f05c6cd9516c0fbb..ba5bd8f73192a818cbfd016c065a065a12ba87ac 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -21666,7 +21666,7 @@ nsfetch_done(void *arg) {
        if (!dns_rdataset_isassociated(nssigset)) {
                dnssec_log(zone, ISC_LOG_WARNING, "No NS RRSIGs found for '%s'",
                           pnamebuf);
-               result = DNS_R_MUSTBESECURE;
+               result = DNS_R_NOVALIDSIG;
                goto done;
        }
 
@@ -21675,7 +21675,7 @@ nsfetch_done(void *arg) {
                dnssec_log(zone, ISC_LOG_WARNING,
                           "Invalid NS RRset for '%s' trust level %u", pnamebuf,
                           nsrrset->trust);
-               result = DNS_R_MUSTBESECURE;
+               result = DNS_R_NOVALIDSIG;
                goto done;
        }
 

diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
index d359924177f099f000438ba737d0db7c2c310b07..6db606ee78e8a92971603fce91da94386ba6b9ae 100644 (file)
--- a/lib/isc/include/isc/result.h
+++ b/lib/isc/include/isc/result.h
@@ -195,7 +195,6 @@ typedef enum isc_result {
        DNS_R_BADNAME,
        DNS_R_DYNAMIC,
        DNS_R_UNKNOWNCOMMAND,
-       DNS_R_MUSTBESECURE,
        DNS_R_COVERINGNSEC,
        DNS_R_MXISADDRESS,
        DNS_R_DUPLICATE,

diff --git a/lib/isc/result.c b/lib/isc/result.c
index f54e71e8a57dd3440d0de1b3749c1598bc5937d2..7ce2fb5f4fea86e8236c662ae39117352d5fd5c4 100644 (file)
--- a/lib/isc/result.c
+++ b/lib/isc/result.c
@@ -194,7 +194,6 @@ static const char *description[ISC_R_NRESULTS] = {
        [DNS_R_BADNAME] = "bad name (check-names)",
        [DNS_R_DYNAMIC] = "dynamic zone",
        [DNS_R_UNKNOWNCOMMAND] = "unknown command",
-       [DNS_R_MUSTBESECURE] = "must-be-secure",
        [DNS_R_COVERINGNSEC] = "covering NSEC record returned",
        [DNS_R_MXISADDRESS] = "MX is an address",
        [DNS_R_DUPLICATE] = "duplicate query",
@@ -449,7 +448,6 @@ static const char *identifier[ISC_R_NRESULTS] = {
        [DNS_R_BADNAME] = "DNS_R_BADNAME",
        [DNS_R_DYNAMIC] = "DNS_R_DYNAMIC",
        [DNS_R_UNKNOWNCOMMAND] = "DNS_R_UNKNOWNCOMMAND",
-       [DNS_R_MUSTBESECURE] = "DNS_R_MUSTBESECURE",
        [DNS_R_COVERINGNSEC] = "DNS_R_COVERINGNSEC",
        [DNS_R_MXISADDRESS] = "DNS_R_MXISADDRESS",
        [DNS_R_DUPLICATE] = "DNS_R_DUPLICATE",