4472. [bug] Named could fail to find the correct NSEC3 records when

                        a zone was update between looking for the answer and
                        looking for the NSEC3 records proving non-existance
                        of the answer. [RT #43247]

diff --git a/CHANGES b/CHANGES
index 97ed3a520df66ff10212ce9c386571442b1768ef..74a68ec2d32cd0b43a4c69c79f39c190a127aacd 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+4472.  [bug]           Named could fail to find the correct NSEC3 records when
+                       a zone was update between looking for the answer and
+                       looking for the NSEC3 records proving non-existance
+                       of the answer. [RT #43247]
+
        --- 9.11.0 released ---
 
        --- 9.11.0rc3 released ---

diff --git a/bin/named/query.c b/bin/named/query.c
index e4753941adcc2479d832e15ac88f76d5ffc1fa98..bd9df5cbfe5c01133364a7ed9276e3cee7fb2987 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -3621,7 +3621,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
                /*
                 * Add closest (provable) encloser NSEC3.
                 */
-               query_findclosestnsec3(cname, db, NULL, client, rdataset,
+               query_findclosestnsec3(cname, db, version, client, rdataset,
                                       sigrdataset, fname, ISC_TRUE, cname);
                if (!dns_rdataset_isassociated(rdataset))
                        goto cleanup;
@@ -3660,7 +3660,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
                else
                        dns_name_split(name, labels, NULL, wname);
 
-               query_findclosestnsec3(wname, db, NULL, client, rdataset,
+               query_findclosestnsec3(wname, db, version, client, rdataset,
                                       sigrdataset, fname, ISC_FALSE, NULL);
                if (!dns_rdataset_isassociated(rdataset))
                        goto cleanup;
@@ -3700,7 +3700,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
 
-               query_findclosestnsec3(wname, db, NULL, client, rdataset,
+               query_findclosestnsec3(wname, db, version, client, rdataset,
                                       sigrdataset, fname, nodata, NULL);
                if (!dns_rdataset_isassociated(rdataset))
                        goto cleanup;