Validating lack of DS records at trust anchors wasn't working. [RT #17151]

diff --git a/CHANGES b/CHANGES
index a2f172064c4abccdc27f611c26eb4bd9e4312999..aae686033d3df69d9425ed825b4229c5fab3e943 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,12 +1,16 @@
+
+       --- 9.4.2rc1 released ---
+
 2251.  [doc]           Update memstatistics-file documentation to reflect
                        reality. Note there is behaviour change for BIND 9.5.
                        [RT #17113]
 
-       --- 9.4.2rc1 released ---
-
 2249.   [bug]           Only set Authentic Data bit if client requested
                         DNSSEC, per RFC 3655 [RT #17175]
 
+2245.  [bug]           Validating lack of DS records at trust anchors wasn't
+                       working. [RT #17151]
+
 2238.  [bug]           It was possible to trigger a REQUIRE when a
                        validation was cancelled. [RT #17106]
 

diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
index 7f297d192decc109e91245c69417a8abfd9d3c2b..c94fc3af5ee9ba6a880d5f86e7d1ed88ffe40ff8 100644 (file)
--- a/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.h,v 1.27.18.9 2007/08/28 07:20:05 tbox Exp $ */
+/* $Id: validator.h,v 1.27.18.10 2007/09/26 04:39:45 each Exp $ */
 
 #ifndef DNS_VALIDATOR_H
 #define DNS_VALIDATOR_H 1
@@ -81,11 +81,24 @@ typedef struct dns_validatorevent {
        ISC_EVENT_COMMON(struct dns_validatorevent);
        dns_validator_t *               validator;
        isc_result_t                    result;
+       /*
+        * Name and type of the response to be validated.
+        */
        dns_name_t *                    name;
        dns_rdatatype_t                 type;
+       /*
+        * Rdata and RRSIG (if any) for positive responses.
+        */
        dns_rdataset_t *                rdataset;
        dns_rdataset_t *                sigrdataset;
+       /*
+        * The full response.  Required for negative responses.
+        * Also required for positive wildcard responses.
+        */
        dns_message_t *                 message;
+       /*
+        * Proofs to be cached.
+        */
        dns_name_t *                    proofs[3];
 } dns_validatorevent_t;
 

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 87c183c47a50d45917a96a8c8a343fd9813d7861..9538b3023823f7e0f64db66b3930b02cb80747a6 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.119.18.34 2007/09/14 05:52:50 marka Exp $ */
+/* $Id: validator.c,v 1.119.18.35 2007/09/26 04:39:45 each Exp $ */
 
 /*! \file */
 
@@ -2392,6 +2392,10 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) {
                dns_fixedname_init(&val->dlvsep);
                dlvsep = dns_fixedname_name(&val->dlvsep);
                dns_name_copy(val->event->name, dlvsep, NULL);
+               /*
+                * If this is a response to a DS query, we need to look in
+                * the parent zone for the trust anchor.
+                */
                if (val->event->type == dns_rdatatype_ds) {
                        labels = dns_name_countlabels(dlvsep);
                        if (labels == 0)
@@ -2494,9 +2498,16 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
        if (val->havedlvsep)
                dns_name_copy(dns_fixedname_name(&val->dlvsep), secroot, NULL);
        else {
+               dns_name_copy(val->event->name, secroot, NULL);
+               /*
+                * If this is a response to a DS query, we need to look in
+                * the parent zone for the trust anchor.
+                */
+               if (val->event->type == dns_rdatatype_ds &&
+                   dns_name_countlabels(secroot) > 1U)
+                       dns_name_split(secroot, 1, NULL, secroot);
                result = dns_keytable_finddeepestmatch(val->keytable,
-                                                      val->event->name,
-                                                      secroot);
+                                                      secroot, secroot);
        
                if (result == ISC_R_NOTFOUND) {
                        validator_log(val, ISC_LOG_DEBUG(3),