3981. [bug] Cache DS/NXDOMAIN independently of other query types.

                        [RT #37467]

diff --git a/CHANGES b/CHANGES
index 67d50aee4625f5dc2b8b063a9eabfb0fbac07503..710ab531d9418bf82f4b6650c2d2ebf33bb108e9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3981.  [bug]           Cache DS/NXDOMAIN independently of other query types.
+                       [RT #37467]
+
 3980.  [bug]           Improve --with-tuning=large by self tuning of SO_RCVBUF
                        size. [RT #37187]
 

diff --git a/bin/tests/system/forward/ns2/named.conf b/bin/tests/system/forward/ns2/named.conf
index 8860f44ff0cbf24a88ef5a2638b017d2bfde5fb0..9c855b4753332fe58d0f778af34e189877862afe 100644 (file)
--- a/bin/tests/system/forward/ns2/named.conf
+++ b/bin/tests/system/forward/ns2/named.conf
@@ -55,6 +55,11 @@ zone "example4." {
        file "example.db";
 };
 
+zone "grafted." {
+       type master;
+       file "example.db";
+};
+
 zone "1.0.10.in-addr.arpa." {
        type master;
        file "example.db";

diff --git a/bin/tests/system/forward/ns4/named.conf b/bin/tests/system/forward/ns4/named.conf
index 6fb7ae2e526d3431d5778298f0140bfeeb2c5eda..e39703867669eb830e1630ac1a44296a3663837c 100644 (file)
--- a/bin/tests/system/forward/ns4/named.conf
+++ b/bin/tests/system/forward/ns4/named.conf
@@ -56,3 +56,9 @@ zone "1.0.10.in-addr.arpa" {
        forward only;
        forwarders { 10.53.0.2; };
 };
+
+zone "grafted" {
+       type forward;
+       forward only;
+       forwarders { 10.53.0.2; };
+};

diff --git a/bin/tests/system/forward/tests.sh b/bin/tests/system/forward/tests.sh
index a2abbbb8d4635e34646265db21590dab6f232677..3ce272f6dd47e28b1f022c99e5da3906e21abedb 100644 (file)
--- a/bin/tests/system/forward/tests.sh
+++ b/bin/tests/system/forward/tests.sh
@@ -110,5 +110,18 @@ grep "status: NXDOMAIN" dig.out.f2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking that DS lookups for grafting forward zones are isolated"
+ret=0
+$DIG grafted A @10.53.0.4 -p 5300 > dig.out.q1
+$DIG grafted DS @10.53.0.4 -p 5300 > dig.out.q2
+$DIG grafted A @10.53.0.4 -p 5300 > dig.out.q3
+$DIG grafted AAAA @10.53.0.4 -p 5300 > dig.out.q4
+grep "status: NOERROR" dig.out.q1 > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.q2 > /dev/null || ret=1
+grep "status: NOERROR" dig.out.q3 > /dev/null || ret=1
+grep "status: NOERROR" dig.out.q4 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 7dfc2c66739d3bc4df0490c1aceeaa122d5dcbb2..f833337bb1fc461e4954595f3fd74e00b103517f 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4536,7 +4536,11 @@ validated(isc_task_t *task, isc_event_t *event) {
 
                inc_stats(res, dns_resstatscounter_valnegsuccess);
 
-               if (fctx->rmessage->rcode == dns_rcode_nxdomain)
+               /*
+                * Cache DS NXDOMAIN seperately to other types.
+                */
+               if (fctx->rmessage->rcode == dns_rcode_nxdomain &&
+                   fctx->type != dns_rdatatype_ds)
                        covers = dns_rdatatype_any;
                else
                        covers = fctx->type;
@@ -7960,7 +7964,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
         */
        if (WANTNCACHE(fctx)) {
                dns_rdatatype_t covers;
-               if (message->rcode == dns_rcode_nxdomain)
+
+               /*
+                * Cache DS NXDOMAIN seperately to other types.
+                */
+               if (message->rcode == dns_rcode_nxdomain &&
+                   fctx->type != dns_rdatatype_ds)
                        covers = dns_rdatatype_any;
                else
                        covers = fctx->type;