1806. [bug] The resolver returned the wrong result when a CNAME /

                        DNAME was encountered when fetching glue from a
                        secure namespace. [RT #13501]

1805.   [bug]           Pending status was not being cleared when DLV was
                        active. [RT #13501]

diff --git a/CHANGES b/CHANGES
index fb6c156288c8f79b23a1ca8beff785244573f3ab..a81bdc0bb4954966dd18005ba6771d3aa9341d75 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,13 @@
 1808.  [bug]           zone.c:notify_zone() contained a race condition,
                        zone->db could change underneath it.  [RT #13511]
 
+1806.  [bug]           The resolver returned the wrong result when a CNAME /
+                       DNAME was encountered when fetching glue from a
+                       secure namespace. [RT #13501]
+
+1805.  [bug]           Pending status was not being cleared when DLV was
+                       active. [RT #13501]
+
        --- 9.3.1beta2 released ---
 
 1800.  [bug]           Changes #1719 allowed a INSIST to be triggered.

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 937e420d56f7f9ffef5ef1bd3e6f10adf29cfda1..90af5b020e7b0f580d2963afbb6264dd4df08626 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.218.2.18.4.50 2005/01/20 00:00:13 marka Exp $ */
+/* $Id: resolver.c,v 1.218.2.18.4.51 2005/02/08 23:59:44 marka Exp $ */
 
 #include <config.h>
 
@@ -3585,6 +3585,14 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
                                                        fctx->validators,
                                                        validator, link);
                                }
+                       } else if (CHAINING(rdataset)) {
+                               if (rdataset->type == dns_rdatatype_cname)
+                                       eresult = DNS_R_CNAME;
+                               else {
+                                       INSIST(rdataset->type ==
+                                              dns_rdatatype_dname);
+                                       eresult = DNS_R_DNAME;
+                               }
                        }
                } else if (!EXTERNAL(rdataset)) {
                        /*

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 569b3d760168fa3f0594cb030a2aa4379cbfa7a0..8fca6a7ccac9b4adfd32013b5f7ce20014832d0a 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.91.2.5.8.13 2004/11/17 23:53:10 marka Exp $ */
+/* $Id: validator.c,v 1.91.2.5.8.14 2005/02/08 23:59:45 marka Exp $ */
 
 #include <config.h>
 
@@ -2356,8 +2356,18 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
        }
 
        if (result == ISC_R_NOTFOUND) {
-               if (!val->havedlvsep)
+               if (!val->havedlvsep) {
+                       validator_log(val, ISC_LOG_DEBUG(3),
+                                     "not beneath secure root / DLV");
+                       if (val->mustbesecure) {
+                               validator_log(val, ISC_LOG_WARNING,
+                                             "must be secure failure");
+                               result = DNS_R_MUSTBESECURE;
+                               goto out;
+                       }
+                       val->event->rdataset->trust = dns_trust_answer;
                        return (ISC_R_SUCCESS);
+               }
                dns_name_copy(dns_fixedname_name(&val->dlvsep),
                              dns_fixedname_name(&secroot), NULL);
        } else if (result != ISC_R_SUCCESS)