pullup:

 427.   [bug]           Avoid going into an infinite loop when the validator
                        gets a negative response to a key query where the
                        records are signed by the missing key.
(Pulled up despite the fact that I don't fully understand how the
fix works; I expect Brian to explain it when he comes back from Europe
and/or by adding comments)

diff --git a/CHANGES b/CHANGES
index eae64e5c676bd59fee11eacc81c30977bbd886f8..5ce4ea61a03bc7a2184e8087aa5058cbb434d080 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,10 @@
                        was 2 bytes too short, leading to message
                        generation failures.
 
+ 427.  [bug]           Avoid going into an infinite loop when the validator
+                       gets a negative response to a key query where the
+                       records are signed by the missing key.
+
  426.  [bug]           Attempting to generate an oversized RSA key could
                        cause dnssec-keygen to dump core.
 

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 96605ae1a646803ccc668f66a6cbb9102831b729..0d360e1d01a79fab332f1505e6c6e09b069892e4 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.63.2.4 2000/08/22 01:45:16 bwelling Exp $ */
+/* $Id: validator.c,v 1.63.2.5 2000/09/11 17:04:58 gson Exp $ */
 
 #include <config.h>
 
@@ -1075,6 +1075,22 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) {
                        if (sigrdataset == NULL)
                                continue;
                        val->seensig = ISC_TRUE;
+                       if (val->event->type == dns_rdatatype_key &&
+                           dns_name_equal(name, val->event->name))
+                       {
+                               dns_rdata_t nxt;
+
+                               if (rdataset->type != dns_rdatatype_nxt)
+                                       continue;
+
+                               result = dns_rdataset_first(rdataset);
+                               INSIST(result == ISC_R_SUCCESS);
+                               dns_rdata_init(&nxt);
+                               dns_rdataset_current(rdataset, &nxt);
+                               if (dns_nxt_typepresent(&nxt,
+                                                       dns_rdatatype_soa))
+                                       continue;
+                       }
                        val->authvalidator = NULL;
                        val->currentset = rdataset;
                        result = dns_validator_create(val->view, name,