3371. [bug] AD=1 should behave like DO=1 when deciding whether to

                        add NS RRsets to the additional section or not.
                        [RT #30479]

diff --git a/CHANGES b/CHANGES
index 6545802d19a735120522a331effe4a5c76a0fdcb..b95c679b0191b44da465574b7a0d62abaae7e852 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3371.  [bug]           AD=1 should behave like DO=1 when deciding whether to
+                       add NS RRsets to the additional section or not.
+                       [RT #30479]
+
 3370.  [bug]           Address use after free while shutting down. [RT #30241]
 
 3369.  [bug]           nsupdate terminated unexpectedly in interactive mode

diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h
index 9762e5753515c8a211ad997daede136d42597c55..d8969f31bb48af7e7ea43ada49a8330a28bec01a 100644 (file)
--- a/bin/named/include/named/client.h
+++ b/bin/named/include/named/client.h
@@ -167,16 +167,17 @@ typedef ISC_LIST(ns_client_t) client_list_t;
 #define NS_CLIENT_MAGIC                        ISC_MAGIC('N','S','C','c')
 #define NS_CLIENT_VALID(c)             ISC_MAGIC_VALID(c, NS_CLIENT_MAGIC)
 
-#define NS_CLIENTATTR_TCP              0x01
-#define NS_CLIENTATTR_RA               0x02 /*%< Client gets recursive service */
-#define NS_CLIENTATTR_PKTINFO          0x04 /*%< pktinfo is valid */
-#define NS_CLIENTATTR_MULTICAST                0x08 /*%< recv'd from multicast */
-#define NS_CLIENTATTR_WANTDNSSEC       0x10 /*%< include dnssec records */
-#define NS_CLIENTATTR_WANTNSID          0x20 /*%< include nameserver ID */
+#define NS_CLIENTATTR_TCP              0x001
+#define NS_CLIENTATTR_RA               0x002 /*%< Client gets recursive service */
+#define NS_CLIENTATTR_PKTINFO          0x004 /*%< pktinfo is valid */
+#define NS_CLIENTATTR_MULTICAST                0x008 /*%< recv'd from multicast */
+#define NS_CLIENTATTR_WANTDNSSEC       0x010 /*%< include dnssec records */
+#define NS_CLIENTATTR_WANTNSID          0x020 /*%< include nameserver ID */
 #ifdef ALLOW_FILTER_AAAA
-#define NS_CLIENTATTR_FILTER_AAAA      0x40 /*%< suppress AAAAs */
-#define NS_CLIENTATTR_FILTER_AAAA_RC   0x80 /*%< recursing for A against AAAA */
+#define NS_CLIENTATTR_FILTER_AAAA      0x040 /*%< suppress AAAAs */
+#define NS_CLIENTATTR_FILTER_AAAA_RC   0x080 /*%< recursing for A against AAAA */
 #endif
+#define NS_CLIENTATTR_WANTAD           0x100 /*%< want AD in response if possible */
 
 extern unsigned int ns_client_requests;
 

diff --git a/bin/named/query.c b/bin/named/query.c
index f57aac0f5050ef6c077efcb49da3f742127628d4..c1a63e082d2def46d30effddd0ecdb1c77f5fc86 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -95,6 +95,10 @@
 /*% Want DNSSEC? */
 #define WANTDNSSEC(c)          (((c)->attributes & \
                                  NS_CLIENTATTR_WANTDNSSEC) != 0)
+/*% Want WANTAD? */
+#define WANTAD(c)              (((c)->attributes & \
+                                 NS_CLIENTATTR_WANTAD) != 0)
+
 /*% No authority? */
 #define NOAUTHORITY(c)         (((c)->query.attributes & \
                                  NS_QUERYATTR_NOAUTHORITY) != 0)
@@ -3140,6 +3144,14 @@ query_addbestns(ns_client_t *client) {
            SECURE(client) && WANTDNSSEC(client))
                goto cleanup;
 
+       /*
+        * If the answer is secure only add NS records if they are secure                * when the client may be looking for AD in the response.
+        */
+       if (SECURE(client) && (WANTDNSSEC(client) || WANTAD(client)) &&
+           ((rdataset->trust != dns_trust_secure) ||
+           (sigrdataset != NULL && sigrdataset->trust != dns_trust_secure)))
+               goto cleanup;
+
        /*
         * If the client doesn't want DNSSEC we can discard the sigrdataset
         * now.
@@ -7366,7 +7378,6 @@ ns_query_start(ns_client_t *client) {
        dns_rdatatype_t qtype;
        unsigned int saved_extflags = client->extflags;
        unsigned int saved_flags = client->message->flags;
-       isc_boolean_t want_ad;
 
        CTRACE("ns_query_start");
 
@@ -7528,13 +7539,11 @@ ns_query_start(ns_client_t *client) {
                client->query.attributes &= ~NS_QUERYATTR_SECURE;
 
        /*
-        * Set 'want_ad' if the client has set AD in the query.
+        * Set NS_CLIENTATTR_WANTDNSSEC if the client has set AD in the query.
         * This allows AD to be returned on queries without DO set.
         */
        if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)
-               want_ad = ISC_TRUE;
-       else
-               want_ad = ISC_FALSE;
+               client->attributes |= NS_CLIENTATTR_WANTAD;
 
        /*
         * This is an ordinary query.
@@ -7559,7 +7568,7 @@ ns_query_start(ns_client_t *client) {
         * Set AD.  We must clear it if we add non-validated data to a
         * response.
         */
-       if (WANTDNSSEC(client) || want_ad)
+       if (WANTDNSSEC(client) || WANTAD(client))
                message->flags |= DNS_MESSAGEFLAG_AD;
 
        qclient = NULL;