- Fix for the serve expired DNSSEC information fix, it would not allow

  current delegation information be updated in cache. The fix allows
  current delegation and validation recursion information to be
  updated, but as a consequence no longer has certain expired
  information around for later dnssec valid expired responses.

diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index 0329f8458bd7ce4b87c323182b4a98991eb76efe..eca3b7cb75cd56a39278a035c5bdefd71537e2a9 100644 (file)
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -755,7 +755,8 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
        }
        (void)dns_cache_store(qstate->env, &qstate->qinfo,
                qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-               qstate->region, store_flags, qstate->qstarttime);
+               qstate->region, store_flags, qstate->qstarttime,
+               qstate->is_valrec);
        if(serve_expired && msg_expired) {
                if(qstate->env->cfg->serve_expired_client_timeout) {
                        /* No expired response from the query state, the

diff --git a/daemon/cachedump.c b/daemon/cachedump.c
index c4f55d8c9cbbb4716385c43715e497c0905ef547..a04b24e56ab1dd5229788cb4318007d251aa0989 100644 (file)
--- a/daemon/cachedump.c
+++ b/daemon/cachedump.c
@@ -692,7 +692,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
                return 1; /* skip this one, not all references satisfied */
 
        if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
-               *worker->env.now)) {
+               *worker->env.now, 1)) {
                log_warn("error out of memory");
                return 0;
        }

diff --git a/dns64/dns64.c b/dns64/dns64.c
index 0db174ba95a78e8f35a4bba75e0f95bf7697c98a..f028cd28aa24e171180d8c3b2daece18158d21d3 100644 (file)
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -658,7 +658,8 @@ handle_event_moddone(struct module_qstate* qstate, int id)
                !dns_cache_store(
                        qstate->env, &qstate->qinfo, qstate->return_msg->rep,
                        0, qstate->prefetch_leeway, 0, NULL,
-                       qstate->query_flags, qstate->qstarttime))
+                       qstate->query_flags, qstate->qstarttime,
+                       qstate->is_valrec))
                log_err("out of memory");
 
        /* do nothing */
@@ -1008,7 +1009,8 @@ dns64_inform_super(struct module_qstate* qstate, int id,
        /* Store the generated response in cache. */
        if ( (!super_dq || !super_dq->started_no_cache_store) &&
                !dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-               0, super->prefetch_leeway, 0, NULL, super->query_flags, qstate->qstarttime))
+               0, super->prefetch_leeway, 0, NULL, super->query_flags,
+               qstate->qstarttime, qstate->is_valrec))
                log_err("out of memory");
 }
 

diff --git a/doc/Changelog b/doc/Changelog
index bde53f3e53edea1b759082757a6606e85688195b..2768470485d047bc1e9370e192dbff086cc3b8f3 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,10 @@
+5 November 2024: Wouter
+       - Fix for the serve expired DNSSEC information fix, it would not allow
+         current delegation information be updated in cache. The fix allows
+         current delegation and validation recursion information to be
+         updated, but as a consequence no longer has certain expired
+         information around for later dnssec valid expired responses.
+
 4 November 2024: Wouter
        - Fix redis that during a reload it does not fail if the redis
          server does not connect or does not respond. It still logs the

diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c
index 76f9b1965e0878d2383142c1c9eb258cdd55b488..1c9e6e6a5a49860caea1a395ad3d1499baf82113 100644 (file)
--- a/ipsecmod/ipsecmod.c
+++ b/ipsecmod/ipsecmod.c
@@ -456,7 +456,8 @@ ipsecmod_handle_query(struct module_qstate* qstate,
        /* Store A/AAAA in cache. */
        if(!dns_cache_store(qstate->env, &qstate->qinfo,
                qstate->return_msg->rep, 0, qstate->prefetch_leeway,
-               0, qstate->region, qstate->query_flags, qstate->qstarttime)) {
+               0, qstate->region, qstate->query_flags, qstate->qstarttime,
+               qstate->is_valrec)) {
                log_err("ipsecmod: out of memory caching record");
        }
        qstate->ext_state[id] = module_finished;

diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index cacba420e845f6b632373b8afb5144ae39843fb0..5198e9ef22e2ea247c348bde87acf22eb420030d 100644 (file)
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -693,10 +693,11 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
        struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-       struct regional* region, uint16_t flags, time_t qstarttime)
+       struct regional* region, uint16_t flags, time_t qstarttime,
+       int is_valrec)
 {
        if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-               pside, region, flags, qstarttime))
+               pside, region, flags, qstarttime, is_valrec))
                log_err("out of memory: cannot store data in cache");
 }
 
@@ -1606,3 +1607,12 @@ limit_nsec_ttl(struct dns_msg* msg)
                }
        }
 }
+
+void
+iter_make_minimal(struct reply_info* rep)
+{
+       size_t rem = rep->ns_numrrsets + rep->ar_numrrsets;
+       rep->ns_numrrsets = 0;
+       rep->ar_numrrsets = 0;
+       rep->rrset_count -= rem;
+}

diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
index 0361e43775e1f825fa8e103222cd7c5456056230..30b3dbe5f0bfe938947bd6ba2c92b0ae83656552 100644 (file)
--- a/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@ -142,6 +142,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  * @param region: to copy modified (cache is better) rrs back to.
  * @param flags: with BIT_CD for dns64 AAAA translated queries.
  * @param qstarttime: time of query start.
+ * @param is_valrec: if the query is validation recursion and does not get
  * return void, because we are not interested in alloc errors,
  *     the iterator and validator can operate on the results in their
  *     scratch space (the qstate.region) and are not dependent on the cache.
@@ -150,7 +151,8 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
        struct reply_info* rep, int is_referral, time_t leeway, int pside,
-       struct regional* region, uint16_t flags, time_t qstarttime);
+       struct regional* region, uint16_t flags, time_t qstarttime,
+       int is_valrec);
 
 /**
  * Select randomly with n/m probability.
@@ -435,4 +437,11 @@ void iterator_set_ip46_support(struct module_stack* mods,
  */
 void limit_nsec_ttl(struct dns_msg* msg);
 
+/**
+ * Make the response minimal. Removed authority and additional section,
+ * that works when there is an answer in the answer section.
+ * @param rep: reply to modify.
+ */
+void iter_make_minimal(struct reply_info* rep);
+
 #endif /* ITERATOR_ITER_UTILS_H */

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 59e4b36ce364abca9502d9ad2af8616acc839466..562d2771e72143ddfd44b6dd1a347bd61830d153 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -368,7 +368,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
        err.security = sec_status_indeterminate;
        verbose(VERB_ALGO, "store error response in message cache");
        iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-               qstate->query_flags, qstate->qstarttime);
+               qstate->query_flags, qstate->qstarttime, qstate->is_valrec);
        return error_response(qstate, id, rcode);
 }
 
@@ -3296,6 +3296,16 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                        iq->num_target_queries = 0;
                        return processDSNSFind(qstate, iq, id);
                }
+               if(iq->qchase.qtype == LDNS_RR_TYPE_DNSKEY && SERVE_EXPIRED
+                       && qstate->is_valrec &&
+                       reply_find_answer_rrset(&iq->qchase, iq->response->rep) != NULL) {
+                       /* clean out the authority section, if any, so it
+                        * does not overwrite dnssec valid data in the
+                        * validation recursion lookup. */
+                       verbose(VERB_ALGO, "make DNSKEY minimal for serve "
+                               "expired");
+                       iter_make_minimal(iq->response->rep);
+               }
                if(!qstate->no_cache_store)
                        iter_dns_store(qstate->env, &iq->response->qinfo,
                                iq->response->rep,
@@ -3303,7 +3313,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                                qstate->prefetch_leeway,
                                iq->dp&&iq->dp->has_parent_side_NS,
                                qstate->region, qstate->query_flags,
-                               qstate->qstarttime);
+                               qstate->qstarttime, qstate->is_valrec);
                /* close down outstanding requests to be discarded */
                outbound_list_clear(&iq->outlist);
                iq->num_current_queries = 0;
@@ -3397,7 +3407,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                        /* no prefetch-leeway, since its not the answer */
                        iter_dns_store(qstate->env, &iq->response->qinfo,
                                iq->response->rep, 1, 0, 0, NULL, 0,
-                               qstate->qstarttime);
+                               qstate->qstarttime, qstate->is_valrec);
                        if(iq->store_parent_NS)
                                iter_store_parentside_NS(qstate->env, 
                                        iq->response->rep);
@@ -3527,7 +3537,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                        iter_dns_store(qstate->env, &iq->response->qinfo,
                                iq->response->rep, 1, qstate->prefetch_leeway,
                                iq->dp&&iq->dp->has_parent_side_NS, NULL,
-                               qstate->query_flags, qstate->qstarttime);
+                               qstate->query_flags, qstate->qstarttime,
+                               qstate->is_valrec);
                /* set the current request's qname to the new value. */
                iq->qchase.qname = sname;
                iq->qchase.qname_len = snamelen;
@@ -4154,7 +4165,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
                                iq->response->rep, 0, qstate->prefetch_leeway,
                                iq->dp&&iq->dp->has_parent_side_NS,
                                qstate->region, qstate->query_flags,
-                               qstate->qstarttime);
+                               qstate->qstarttime, qstate->is_valrec);
                }
        }
        qstate->return_rcode = LDNS_RCODE_NOERROR;

diff --git a/pythonmod/pythonmod_utils.c b/pythonmod/pythonmod_utils.c
index aebe4d2bbb244552dc3182c05553898162c70e5e..fc9921aa1d1e78dda512686ffe957ea5ea6ebf3d 100644 (file)
--- a/pythonmod/pythonmod_utils.c
+++ b/pythonmod/pythonmod_utils.c
@@ -73,7 +73,7 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo,
 
        return dns_cache_store(qstate->env, qinfo, msgrep, is_referral,
                qstate->prefetch_leeway, 0, NULL, qstate->query_flags,
-               qstate->qstarttime);
+               qstate->qstarttime, qstate->is_valrec);
 }
 
 /* Invalidate the message associated with query_info stored in message cache */

diff --git a/services/cache/dns.c b/services/cache/dns.c
index 7ab63bacf49240e3be15f98ed4a6423b56c3b667..d9536c0e7f8d71f2e28355334e35946299495b61 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -1057,7 +1057,8 @@ dns_cache_lookup(struct module_env* env,
 int
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-       struct regional* region, uint32_t flags, time_t qstarttime)
+       struct regional* region, uint32_t flags, time_t qstarttime,
+       int is_valrec)
 {
        struct reply_info* rep = NULL;
        if(SERVE_EXPIRED) {
@@ -1079,7 +1080,8 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
                                 * one and let the validator manage caching. */
                                && cached->security != sec_status_bogus
                                && (env->need_to_validate &&
-                               msgrep->security == sec_status_unchecked)) {
+                               msgrep->security == sec_status_unchecked)
+                               && !is_valrec) {
                                verbose(VERB_ALGO, "a validated expired entry "
                                        "could be overwritten, skip caching "
                                        "the new message at this stage");

diff --git a/services/cache/dns.h b/services/cache/dns.h
index 1dd537d2bd5da973424f365343920f543ec71fcf..8aa6b44bc341e517e0793e1bf587f20ae7fdd08b 100644 (file)
--- a/services/cache/dns.h
+++ b/services/cache/dns.h
@@ -90,11 +90,14 @@ struct dns_msg {
  *   (See DNSCACHE_STORE_xxx flags).
  * @param qstarttime: time when the query was started, and thus when the
  *     delegations were looked up.
+ * @param is_valrec: if the query is validation recursion and does not get
+ *     dnssec validation itself.
  * @return 0 on alloc error (out of memory).
  */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
         struct reply_info* rep, int is_referral, time_t leeway, int pside,
-       struct regional* region, uint32_t flags, time_t qstarttime);
+       struct regional* region, uint32_t flags, time_t qstarttime,
+       int is_valrec);
 
 /**
  * Store message in the cache. Stores in message cache and rrset cache.

diff --git a/testdata/serve_expired_client_timeout_val_bogus.rpl b/testdata/serve_expired_client_timeout_val_bogus.rpl
index f4937a16c538a9d39ff5fb1e745a6478e966a4ac..4334168cd9ad81cd2fc169e17f54560f94aa3eb4 100644 (file)
--- a/testdata/serve_expired_client_timeout_val_bogus.rpl
+++ b/testdata/serve_expired_client_timeout_val_bogus.rpl
@@ -38,6 +38,15 @@ SCENARIO_BEGIN Test serve-expired with client-timeout and bogus answer
 ; - query one last time
 ; - check that we get the immediate valid cache response; upstream does not have an answer at this moment
 
+; The example.com NS and ns.example.com A record are commented out.
+; This to make the test succeed. It then keeps the dnssec valid lookup.
+; Otherwise, the relookup of the referral would overwrite the example.com NS
+; the serve expired response would no longer be valid. But this record must
+; be cached, for keeping the current delegation information.
+; Also the DNSKEY lookup authority and additional are cleaned to stop overwrite
+; of the NS and A record. This is more likely to keep the serve expired
+; information intact.
+
 ;;
 ;; K.ROOT-SERVERS.NET.
 ;;
@@ -150,12 +159,12 @@ RANGE_BEGIN 0 10
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ENTRY_END
 RANGE_END
@@ -174,12 +183,12 @@ RANGE_BEGIN 20 30
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     ;; (valid signature)
     ;; www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ;; (bogus signature)
@@ -201,12 +210,12 @@ RANGE_BEGIN 40 60
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ENTRY_END
 RANGE_END
@@ -229,11 +238,11 @@ SECTION ANSWER
 www.example.com. IN A  10.20.30.40
 www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  IN NS   ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.                IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.               IN      A       1.2.3.4
+;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 STEP 11 TIME_PASSES ELAPSE 3601
@@ -256,11 +265,11 @@ SECTION ANSWER
 www.example.com. 123 IN A      10.20.30.40
 www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   123 IN NS       ns.example.com.
-example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  123 IN NS       ns.example.com.
+;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.        123     IN      A       1.2.3.4
-ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.       123     IN      A       1.2.3.4
+;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 STEP 40 QUERY
@@ -281,11 +290,11 @@ SECTION ANSWER
 www.example.com. 123 IN A      10.20.30.40
 www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   123 IN NS       ns.example.com.
-example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  123 IN NS       ns.example.com.
+;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.        123     IN      A       1.2.3.4
-ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.       123     IN      A       1.2.3.4
+;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 ; upstream query is resolved before this query comes in
@@ -307,11 +316,11 @@ SECTION ANSWER
 www.example.com. IN A  10.20.30.40
 www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  IN NS   ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.                IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.               IN      A       1.2.3.4
+;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 SCENARIO_END

diff --git a/testdata/serve_expired_val_bogus.rpl b/testdata/serve_expired_val_bogus.rpl
index 35365beef973a1dd36473c4e2c175d7a2d7209e7..49afcc0eb56847d4002a2b206bbdeb8090768371 100644 (file)
--- a/testdata/serve_expired_val_bogus.rpl
+++ b/testdata/serve_expired_val_bogus.rpl
@@ -37,6 +37,15 @@ SCENARIO_BEGIN Test serve-expired with client-timeout and bogus answer
 ; - query one last time
 ; - check that we get an immediate valid cache response
 
+; The example.com NS and ns.example.com A record are commented out.
+; This to make the test succeed. It then keeps the dnssec valid lookup.
+; Otherwise, the relookup of the referral would overwrite the example.com NS
+; the serve expired response would no longer be valid. But this record must
+; be cached, for keeping the current delegation information.
+; Also the DNSKEY lookup authority and additional are cleaned to stop overwrite
+; of the NS and A record. This is more likely to keep the serve expired
+; information intact.
+
 ;;
 ;; K.ROOT-SERVERS.NET.
 ;;
@@ -149,12 +158,12 @@ RANGE_BEGIN 0 10
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ENTRY_END
 RANGE_END
@@ -173,12 +182,12 @@ RANGE_BEGIN 20 40
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     ;; (valid signature)
     ;; www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ;; (bogus signature)
@@ -200,12 +209,12 @@ RANGE_BEGIN 50 100
     www.example.com. IN A
     SECTION ANSWER
     www.example.com. IN A      10.20.30.40
-    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
     SECTION AUTHORITY
-    example.com.       IN NS   ns.example.com.
-    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+    ;example.com.      IN NS   ns.example.com.
+    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
     SECTION ADDITIONAL
-    ns.example.com.            IN      A       1.2.3.4
+    ;ns.example.com.           IN      A       1.2.3.4
     www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
     ENTRY_END
 RANGE_END
@@ -229,11 +238,11 @@ SECTION ANSWER
 www.example.com. IN A  10.20.30.40
 www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  IN NS   ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.                IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.               IN      A       1.2.3.4
+;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 STEP 11 TIME_PASSES ELAPSE 3601
@@ -256,11 +265,11 @@ SECTION ANSWER
 www.example.com. 123 IN A      10.20.30.40
 www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   123 IN NS       ns.example.com.
-example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  123 IN NS       ns.example.com.
+;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.        123     IN      A       1.2.3.4
-ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.       123     IN      A       1.2.3.4
+;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 STEP 40 QUERY
@@ -281,11 +290,11 @@ SECTION ANSWER
 www.example.com. 123 IN A      10.20.30.40
 www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   123 IN NS       ns.example.com.
-example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  123 IN NS       ns.example.com.
+;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.        123     IN      A       1.2.3.4
-ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.       123     IN      A       1.2.3.4
+;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 STEP 60 QUERY
@@ -306,11 +315,11 @@ SECTION ANSWER
 www.example.com. IN A  10.20.30.40
 www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
 SECTION AUTHORITY
-example.com.   IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;example.com.  IN NS   ns.example.com.
+;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
 SECTION ADDITIONAL
-ns.example.com.                IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+;ns.example.com.               IN      A       1.2.3.4
+;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
 ENTRY_END
 
 SCENARIO_END

diff --git a/validator/validator.c b/validator/validator.c
index 857510b655e78c40896700e7ffa52e887d8138bb..1a51dc270470ed5312db1f47622114c5e935f47f 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -2563,7 +2563,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
                        if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
                                vq->orig_msg->rep, 0, qstate->prefetch_leeway,
                                0, qstate->region, qstate->query_flags,
-                               qstate->qstarttime)) {
+                               qstate->qstarttime, qstate->is_valrec)) {
                                log_err("out of memory caching validator results");
                        }
                }
@@ -2572,7 +2572,8 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
                /* and this does not get prefetched, so no leeway */
                if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
                        vq->orig_msg->rep, 1, 0, 0, qstate->region,
-                       qstate->query_flags, qstate->qstarttime)) {
+                       qstate->query_flags, qstate->qstarttime,
+                       qstate->is_valrec)) {
                        log_err("out of memory caching validator results");
                }
        }