From: Michał Kępień <michal@isc.org>
Date: Thu, 28 Jun 2018 11:38:39 +0000 (+0200)
Subject: Do not treat mirror zone data as authoritative
X-Git-Tag: v9.13.2~7^2~12
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=ad0ec2ea93bb98938f2a6e27e06d71286d0825ba;p=thirdparty%2Fbind9.git

Do not treat mirror zone data as authoritative

Section 4 of RFC 7706 suggests that responses sourced from a local copy
of a zone should not have the AA bit set.  Follow that recommendation by
setting 'qctx->authoritative' to ISC_FALSE when a response to a query is
coming from a mirror zone.
---

diff --git a/bin/tests/system/mirror/tests.sh b/bin/tests/system/mirror/tests.sh
index bba836c2170..dfadcf05c63 100644
--- a/bin/tests/system/mirror/tests.sh
+++ b/bin/tests/system/mirror/tests.sh
@@ -249,5 +249,15 @@ grep "sub.example.*IN.*NS" dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "checking flags set in a response sourced from a mirror zone ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 . DNSKEY > dig.out.ns3.test$n 2>&1 || ret=1
+# Check response code and flags in the answer.
+grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
+grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 7f7bc4220ca..692da1c37a7 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -5363,10 +5363,15 @@ ns__query_start(query_ctx_t *qctx) {
 	qctx->is_staticstub_zone = ISC_FALSE;
 	if (qctx->is_zone) {
 		qctx->authoritative = ISC_TRUE;
-		if (qctx->zone != NULL &&
-		    dns_zone_gettype(qctx->zone) == dns_zone_staticstub)
-		{
-			qctx->is_staticstub_zone = ISC_TRUE;
+		if (qctx->zone != NULL) {
+			if (dns_zone_ismirror(qctx->zone)) {
+				qctx->authoritative = ISC_FALSE;
+			}
+			if (dns_zone_gettype(qctx->zone) ==
+			    dns_zone_staticstub)
+			{
+				qctx->is_staticstub_zone = ISC_TRUE;
+			}
 		}
 	}