Do not treat mirror zone data as authoritative

Section 4 of RFC 7706 suggests that responses sourced from a local copy
of a zone should not have the AA bit set.  Follow that recommendation by
setting 'qctx->authoritative' to ISC_FALSE when a response to a query is
coming from a mirror zone.

diff --git a/bin/tests/system/mirror/tests.sh b/bin/tests/system/mirror/tests.sh
index bba836c217072d36952ea6efa8c7828f6f9ef3ca..dfadcf05c6340a32cfe4e1c07914e645bc64decb 100644 (file)
--- a/bin/tests/system/mirror/tests.sh
+++ b/bin/tests/system/mirror/tests.sh
@@ -249,5 +249,15 @@ grep "sub.example.*IN.*NS" dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "checking flags set in a response sourced from a mirror zone ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 . DNSKEY > dig.out.ns3.test$n 2>&1 || ret=1
+# Check response code and flags in the answer.
+grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
+grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 7f7bc4220ca7bfd03f45f967035e97ac93584107..692da1c37a7ab4ae3d7803cf43d5717e882bd24e 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -5363,10 +5363,15 @@ ns__query_start(query_ctx_t *qctx) {
        qctx->is_staticstub_zone = ISC_FALSE;
        if (qctx->is_zone) {
                qctx->authoritative = ISC_TRUE;
-               if (qctx->zone != NULL &&
-                   dns_zone_gettype(qctx->zone) == dns_zone_staticstub)
-               {
-                       qctx->is_staticstub_zone = ISC_TRUE;
+               if (qctx->zone != NULL) {
+                       if (dns_zone_ismirror(qctx->zone)) {
+                               qctx->authoritative = ISC_FALSE;
+                       }
+                       if (dns_zone_gettype(qctx->zone) ==
+                           dns_zone_staticstub)
+                       {
+                               qctx->is_staticstub_zone = ISC_TRUE;
+                       }
                }
        }