temporarily revert change #4859

diff --git a/CHANGES b/CHANGES
index 85d4d32c185de8dc5161a1aa3e74e2f7534df7ac..f1c4a20f8e8b0c9887645f5c13fbe8e1bbbda8c5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -145,11 +145,7 @@
 
 4860.  [bug]           isc_int8_t should be signed char.  [RT #46973]
 
-4859.  [bug]           A loop was possible when attempting to validate
-                       unsigned CNAME responses from secure zones;
-                       this caused a delay in returning SERVFAIL and
-                       also increased the chances of encountering
-                       CVE-2017-3145. [RT #46839]
+4859.   [placeholder]
 
 4858.  [security]      Addresses could be referenced after being freed
                        in resolver.c, causing an assertion failure.

diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
index 1dbf09bcc666bf0967cd2f78c0387c2ec1472880..50fd2ba3f248c2808452ba440e951c762eb95f09 100644 (file)
--- a/bin/named/bind9.xsl.h
+++ b/bin/named/bind9.xsl.h
@@ -5,11 +5,14 @@
 static char xslmsg[] =
        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
        "<!--\n"
-       " - Copyright (C) 2006-2009, 2012-2017 Internet Systems Consortium, Inc. (\"ISC\")\n"
+       " - Copyright (C) Internet Systems Consortium, Inc. (\"ISC\")\n"
        " -\n"
        " - This Source Code Form is subject to the terms of the Mozilla Public\n"
        " - License, v. 2.0. If a copy of the MPL was not distributed with this\n"
        " - file, You can obtain one at http://mozilla.org/MPL/2.0/.\n"
+       " -\n"
+       " - See the COPYRIGHT file distributed with this work for additional\n"
+       " - information regarding copyright ownership.\n"
        "-->\n"
        "\n"
        "<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 212524e9af71f1b1ebdb3b85bb083d0d7c42616a..e898576d3875dc632b9f482c48b2756b9a4cd667 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1103,8 +1103,7 @@ check_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 
        for (parent = val; parent != NULL; parent = parent->parent) {
                if (parent->event != NULL &&
-                   (parent->event->type == type ||
-                    parent->event->type == dns_rdatatype_cname) &&
+                   parent->event->type == type &&
                    dns_name_equal(parent->event->name, name) &&
                    /*
                     * As NSEC3 records are meta data you sometimes