Save the correct result value to resume with nxdomain-redirect

The wrong result value was being saved for resumption with
nxdomain-redirect when performing the fetch.  This lead to an assert
when checking that RFC 1918 reverse queries where not leaking to
the global internet.

(cherry picked from commit 9d0fa07c5e7a39db89862a4f843d2190059afb4b)

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 62b5ea846315418609c6285523b8ab3497fb7b24..55d815e6c0eb92a7af5330f46fa525816128e58b 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -455,10 +455,10 @@ static void
 query_addnxrrsetnsec(query_ctx_t *qctx);
 
 static isc_result_t
-query_nxdomain(query_ctx_t *qctx, bool empty_wild);
+query_nxdomain(query_ctx_t *qctx, isc_result_t result);
 
 static isc_result_t
-query_redirect(query_ctx_t *qctx);
+query_redirect(query_ctx_t *qctx, isc_result_t result);
 
 static isc_result_t
 query_ncache(query_ctx_t *qctx, isc_result_t result);
@@ -7345,8 +7345,7 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
  * result from the search.
  */
 static isc_result_t
-query_gotanswer(query_ctx_t *qctx, isc_result_t res) {
-       isc_result_t result = res;
+query_gotanswer(query_ctx_t *qctx, isc_result_t result) {
        char errmsg[256];
 
        CCTRACE(ISC_LOG_DEBUG(3), "query_gotanswer");
@@ -7416,16 +7415,16 @@ root_key_sentinel:
                return (query_nodata(qctx, DNS_R_NXRRSET));
 
        case DNS_R_EMPTYWILD:
-               return (query_nxdomain(qctx, true));
+               return (query_nxdomain(qctx, DNS_R_EMPTYWILD));
 
        case DNS_R_NXDOMAIN:
-               return (query_nxdomain(qctx, false));
+               return (query_nxdomain(qctx, DNS_R_NXDOMAIN));
 
        case DNS_R_COVERINGNSEC:
                return (query_coveringnsec(qctx));
 
        case DNS_R_NCACHENXDOMAIN:
-               result = query_redirect(qctx);
+               result = query_redirect(qctx, result);
                if (result != ISC_R_COMPLETE) {
                        return (result);
                }
@@ -9243,10 +9242,10 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {
  * Handle NXDOMAIN and empty wildcard responses.
  */
 static isc_result_t
-query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
+query_nxdomain(query_ctx_t *qctx, isc_result_t result) {
        dns_section_t section;
        uint32_t ttl;
-       isc_result_t result;
+       bool empty_wild = (result == DNS_R_EMPTYWILD);
 
        CCTRACE(ISC_LOG_DEBUG(3), "query_nxdomain");
 
@@ -9255,7 +9254,7 @@ query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
        INSIST(qctx->is_zone || REDIRECT(qctx->client));
 
        if (!empty_wild) {
-               result = query_redirect(qctx);
+               result = query_redirect(qctx, result);
                if (result != ISC_R_COMPLETE) {
                        return (result);
                }
@@ -9343,7 +9342,7 @@ cleanup:
  * redirecting, so query processing should continue past it.
  */
 static isc_result_t
-query_redirect(query_ctx_t *qctx) {
+query_redirect(query_ctx_t *qctx, isc_result_t saved_result) {
        isc_result_t result;
 
        CCTRACE(ISC_LOG_DEBUG(3), "query_redirect");
@@ -9384,7 +9383,7 @@ query_redirect(query_ctx_t *qctx) {
                SAVE(qctx->client->query.redirect.rdataset, qctx->rdataset);
                SAVE(qctx->client->query.redirect.sigrdataset,
                     qctx->sigrdataset);
-               qctx->client->query.redirect.result = DNS_R_NCACHENXDOMAIN;
+               qctx->client->query.redirect.result = saved_result;
                dns_name_copynf(qctx->fname,
                                qctx->client->query.redirect.fname);
                qctx->client->query.redirect.authoritative =
@@ -10005,7 +10004,7 @@ query_coveringnsec(query_ctx_t *qctx) {
         * We now have the proof that we have an NXDOMAIN.  Apply
         * NXDOMAIN redirection if configured.
         */
-       result = query_redirect(qctx);
+       result = query_redirect(qctx, DNS_R_COVERINGNSEC);
        if (result != ISC_R_COMPLETE) {
                redirected = true;
                goto cleanup;