pullup:

 323.   [bug]           dns_rbt_findname() did not ignore empty rbt nodes.
                        Because of this, servers authoritative for a parent
                        and grandchild zone but not authoritative for the
                        intervening child zone did not correctly issue
                        referrals to the servers of the child zone.

diff --git a/CHANGES b/CHANGES
index f5c2eff4ffe7c5dcc91083653dc81f21d188eb34..70ab2258093079c5efd70af15c845e13ec255d14 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,10 @@
 
+ 323.  [bug]           dns_rbt_findname() did not ignore empty rbt nodes.
+                       Because of this, servers authoritative for a parent 
+                       and grandchild zone but not authoritative for the
+                       intervening child zone did not correctly issue
+                       referrals to the servers of the child zone.
+
  322.  [bug]           Queries for KEY RRs are now sent to the parent 
                        server before the authoritative one, making
                        DNSSEC insecurity proofs work in many cases

diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
index 81c600b4e1d2d83e680f84322a20c65fd8e62dfd..c096a8340bd998f80b7cb322766c38254194bc60 100644 (file)
--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt.h,v 1.40 2000/06/22 21:55:55 tale Exp $ */
+/* $Id: rbt.h,v 1.40.2.1 2000/07/10 23:54:35 gson Exp $ */
 
 #ifndef DNS_RBT_H
 #define DNS_RBT_H 1
@@ -359,9 +359,9 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  * Find the node for 'name'.
  *
  * Notes:
- *     It is _not_ required that the node associated with 'name' has a
- *     non-NULL data pointer for an exact match.  A partial match must
- *     have associated data, unless the DNS_RBTFIND_EMPTYDATA option is set.
+ *     A node that has no data is considered not to exist for this function,
+ *     unless the DNS_RBTFIND_EMPTYDATA option is set.  This applies to both
+ *     exact matches and partial matches.
  *
  *     If the chain parameter is non-NULL, then the path through the tree
  *     to the DNSSEC predecessor of the searched for name is maintained,
@@ -415,14 +415,11 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  *     how the various elements of the chain are set.  This was done to 
  *     ensure that the chain's state was sane, and to prevent problems that
  *     occurred when running the predecessor location code under conditions
- *     it was not designed for.  It is clear *where* the chain should point
- *     when DNS_RBTFIND_NOEXACT is set, so if you end up using a chain
+ *     it was not designed for.  It is not clear *where* the chain should
+ *     point when DNS_RBTFIND_NOEXACT is set, so if you end up using a chain
  *     with this option because you want a particular node, let us know
  *     where you want the chain pointed, so this can be made more firm.
  *
- *      A node that has no data is considered not to exist for this function,
- *      unless the DNS_RBTFIND_EMPTYDATA option is set.  
- *
  * Requires:
  *     rbt is a valid rbt manager.
  *     dns_name_isabsolute(name) == TRUE.

diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 18433267a537c0e9eafbb53aa8721b18822175f9..070c6551f387304a42d67b60cc3a026f8c0dbfd1 100644 (file)
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.83 2000/06/19 22:55:42 tale Exp $ */
+/* $Id: rbt.c,v 1.83.2.1 2000/07/10 23:54:33 gson Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -890,7 +890,14 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
                }
        }
 
-       if (current != NULL && (options & DNS_RBTFIND_NOEXACT) == 0) {
+       /*
+        * If current is not NULL, NOEXACT is not disallowing exact matches,
+        * and either the node has data or an empty node is ok, return
+        * ISC_R_SUCCESS to indicate an exact match.
+        */
+       if (current != NULL && (options & DNS_RBTFIND_NOEXACT) == 0 &&
+           (DATA(current) != NULL ||
+            (options & DNS_RBTFIND_EMPTYDATA) != 0)) {
                /*
                 * Found an exact match.
                 */
@@ -949,15 +956,19 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
 
                if (current != NULL) {
                        /*
-                        * There was an exact match but DNS_RBTFIND_NOEXACT
-                        * was set.  A policy decision was made to set the
+                        * There was an exact match but either
+                        * DNS_RBTFIND_NOEXACT was set, or
+                        * DNS_RBTFIND_EMPTYDATA was set and the node had no
+                        * data.  A policy decision was made to set the
                         * chain to the exact match, but this is subject
                         * to change if it becomes apparent that something
                         * else would be more useful.  It is important that
                         * this case is handled here, because the predecessor
                         * setting code below assumes the match was not exact.
                         */
-                       INSIST((options & DNS_RBTFIND_NOEXACT) != 0);
+                       INSIST(((options & DNS_RBTFIND_NOEXACT) != 0) ||
+                              ((options & DNS_RBTFIND_EMPTYDATA) == 0 &&
+                               DATA(current) == NULL));
                        chain->end = current;
 
                } else if ((options & DNS_RBTFIND_NOPREDECESSOR) != 0) {
@@ -1087,7 +1098,8 @@ dns_rbt_findname(dns_rbt_t *rbt, dns_name_t *name, unsigned int options,
        result = dns_rbt_findnode(rbt, name, foundname, &node, NULL,
                                  options, NULL, NULL);
 
-       if (node != NULL && DATA(node) != NULL)
+       if (node != NULL &&
+           (DATA(node) != NULL || (options & DNS_RBTFIND_EMPTYDATA) != 0))
                *data = DATA(node);
        else
                result = ISC_R_NOTFOUND;