1509. [bug] Hint zones should accept delegation-only. Forward

                        zone should not accept delegation-only.

1508.   [bug]           Don't apply delegation-only checks to answers from
                        forwarders.

1507.   [bug]           Handle BIND 8 style returns to NS queries to parents
                        when making delegation-only checks.

diff --git a/CHANGES b/CHANGES
index cb714af8d46912311e640db4e433756f29f4fdc6..87d625bb1561a1dce0b61f0fb311ab272161d0f3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,15 @@
+1509.  [bug]           Hint zones should accept delegation-only.  Forward
+                       zone should not accept delegation-only.
+
+1508.  [bug]           Don't apply delegation-only checks to answers from
+                       forwarders.
+
+1507.  [bug]           Handle BIND 8 style returns to NS queries to parents
+                       when making delegation-only checks.
+
 1506.  [bug]           Wrong return type for dns_view_isdelegationonly().
 
-1505.  [bug]           Uninitialized rdataset in sdb. [RT #8750]
+1505.  [bug]           Uninitialised rdataset in sdb. [RT #8750]
 
 1504.  [func]          New zone type "delegation-only".
 

diff --git a/bin/named/server.c b/bin/named/server.c
index 5568dae3665f736229f1c83840aa04dfa096d224..f22cdbbd16c00ef86ea6a6f7b189557b2939a511 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.401 2003/09/17 05:24:41 marka Exp $ */
+/* $Id: server.c,v 1.402 2003/09/19 05:53:26 marka Exp $ */
 
 #include <config.h>
 
@@ -1276,6 +1276,7 @@ configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
        cfg_obj_t *forwardtype = NULL;
        cfg_obj_t *only = NULL;
        isc_result_t result;
+       isc_result_t tresult;
        isc_buffer_t buffer;
        dns_fixedname_t fixorigin;
        dns_name_t *origin;
@@ -1341,14 +1342,25 @@ configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
                }
                if (dns_name_equal(origin, dns_rootname)) {
                        char *hintsfile = cfg_obj_asstring(fileobj);
+
                        result = configure_hints(view, hintsfile);
-                       if (result != ISC_R_SUCCESS)
+                       if (result != ISC_R_SUCCESS) {
                                isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
                                              NS_LOGMODULE_SERVER,
                                              ISC_LOG_ERROR,
                                              "could not configure root hints "
                                              "from '%s': %s", hintsfile,
                                              isc_result_totext(result));
+                               goto cleanup;
+                       }
+                       /*
+                        * Hint zones may also refer to delegation only points.
+                        */
+                       only = NULL;
+                       tresult = cfg_map_get(zoptions, "delegation-only",
+                                             &only);
+                       if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
+                               CHECK(dns_view_adddelegationonly(view, origin));
                } else {
                        isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
                                      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 1c9a3f681936bd84b4cc14e92629ba8764a25aca..956608add460ac2796bb5c1912d53f0019110218 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd">
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.223 2003/09/17 05:24:41 marka Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.224 2003/09/19 05:53:26 marka Exp $ -->
 
 <book>
 <title>BIND 9 Administrator Reference Manual</title>
@@ -2638,8 +2638,7 @@ those servers during resolution.
 <entry colname = "1"><para><command>delegation-only</command></para></entry>
 <entry colname = "2"><para>Delegation only.  Logs queries that have have
 been forced to NXDOMAIN as the result of a delegation-only zone or
-a <command>delegation-only</command> in a stub or forward
-zone declartation.
+a <command>delegation-only</command> in a hint or stub zone declartation.
 </para></entry>
 </row>
 </tbody>
@@ -4436,7 +4435,7 @@ view "external" {
 <sect2 id="zone_statement_grammar"><title><command>zone</command>
 Statement Grammar</title>
       <programlisting>zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> <optional>{ 
-    type ( master | slave | hint | stub | forward /| delegation-only ) ;
+    type ( master | slave | hint | stub | forward | delegation-only ) ;
     <optional> allow-notify { <replaceable>address_match_list</replaceable> } ; </optional>
     <optional> allow-query { <replaceable>address_match_list</replaceable> } ; </optional>
     <optional> allow-transfer { <replaceable>address_match_list</replaceable> } ; </optional>
@@ -4582,7 +4581,9 @@ Classes other than IN have no built-in defaults hints.</para></entry>
 status of infrastructure zones (e.g. COM, NET, ORG).  Any answer that
 is received without a explicit or implict delegation in the authority
 section will be treated as NXDOMAIN.  This does not apply to the zone
-apex.  This SHOULD NOT be applied to leaf zones.</para></entry>
+apex.  This SHOULD NOT be applied to leaf zones.</para>
+<para><varname>delegation-only</varname> has no effect on answers received
+from forwarders.</para></entry>
 </row>
 </tbody>
 </tgroup></informaltable></sect3>
@@ -4681,7 +4682,7 @@ with the distribution but none are linked in by default.</para>
 </listitem></varlistentry>
 
 <varlistentry><term><command>delegation-only</command></term>
-<listitem><para>The flag only applies to forward and stub zones.  If set
+<listitem><para>The flag only applies to hint and stub zones.  If set
 to <userinput>yes</userinput> then the zone will also be treated as if it
 is also a delegation-only type zone.
 </para>

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index a285e1a3381e7644a3b01874bc1264f6d4e20f16..e57a105877ceec241d533410135eeaf4c246a2c7 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.38 2003/09/17 05:24:42 marka Exp $ */
+/* $Id: check.c,v 1.39 2003/09/19 05:53:27 marka Exp $ */
 
 #include <config.h>
 
@@ -438,7 +438,7 @@ check_zoneconf(cfg_obj_t *zconfig, cfg_obj_t *config, isc_symtab_t *symtab,
        { "notify", MASTERZONE | SLAVEZONE },
        { "also-notify", MASTERZONE | SLAVEZONE },
        { "dialup", MASTERZONE | SLAVEZONE | STUBZONE },
-       { "delegation-only", STUBZONE | FORWARDZONE},
+       { "delegation-only", HINTZONE | STUBZONE },
        { "forward", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE},
        { "forwarders", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE},
        { "maintain-ixfr-base", MASTERZONE | SLAVEZONE },

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 54c42dab5c2c47bcff3df144fceece0dcc50c19d..ac6ebe94dcf9f56bd4b2d36ce774ac8fe25300aa 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.265 2003/09/17 05:24:42 marka Exp $ */
+/* $Id: resolver.c,v 1.266 2003/09/19 05:53:28 marka Exp $ */
 
 #include <config.h>
 
@@ -327,9 +327,9 @@ static isc_result_t ncache_adderesult(dns_message_t *message,
                                      isc_result_t *eresultp);
 
 static isc_boolean_t
-fix_mustbedelegationornxdomain(dns_message_t *message, dns_name_t *domain) {
-
+fix_mustbedelegationornxdomain(dns_message_t *message, fetchctx_t *fctx) {
        dns_name_t *name;
+       dns_name_t *domain = &fctx->domain;
        dns_rdataset_t *rdataset;
        dns_rdatatype_t type;
        isc_result_t result;
@@ -338,6 +338,33 @@ fix_mustbedelegationornxdomain(dns_message_t *message, dns_name_t *domain) {
        if (message->rcode == dns_rcode_nxdomain)
                return (ISC_FALSE);
 
+       /*
+        * Look for BIND 8 style delegations.
+        * Also look for answers to ANY queries where the duplicate NS RRset
+        * may have been stripped from the authority section.
+        */
+       if (message->counts[DNS_SECTION_ANSWER] != 0 &&
+           (fctx->type == dns_rdatatype_ns ||
+            fctx->type == dns_rdatatype_any)) {
+               result = dns_message_firstname(message, DNS_SECTION_ANSWER);
+               while (result == ISC_R_SUCCESS) {
+                       name = NULL;
+                       dns_message_currentname(message, DNS_SECTION_ANSWER,
+                                               &name);
+                       for (rdataset = ISC_LIST_HEAD(name->list);
+                            rdataset != NULL;
+                            rdataset = ISC_LIST_NEXT(rdataset, link)) {
+                               type = rdataset->type;
+                               if (type != dns_rdatatype_ns)
+                                       continue;
+                               if (dns_name_issubdomain(name, domain))
+                                       return (ISC_FALSE);
+                       }
+                       result = dns_message_nextname(message,
+                                                     DNS_SECTION_ANSWER);
+               }
+       }
+
        /* Look for referral. */
        if (message->counts[DNS_SECTION_AUTHORITY] == 0)
                goto munge;
@@ -345,8 +372,7 @@ fix_mustbedelegationornxdomain(dns_message_t *message, dns_name_t *domain) {
        result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
        while (result == ISC_R_SUCCESS) {
                name = NULL;
-               dns_message_currentname(message, DNS_SECTION_AUTHORITY,
-                                       &name);
+               dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
                for (rdataset = ISC_LIST_HEAD(name->list);
                     rdataset != NULL;
                     rdataset = ISC_LIST_NEXT(rdataset, link)) {
@@ -4967,9 +4993,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
        /*
         * Enforce delegations only zones like NET and COM.
         */
-       if (dns_view_isdelegationonly(fctx->res->view, &fctx->domain) &&
+       if (!ISFORWARDER(query->addrinfo) &&
+           dns_view_isdelegationonly(fctx->res->view, &fctx->domain) &&
            !dns_name_equal(&fctx->domain, &fctx->name) &&
-           fix_mustbedelegationornxdomain(message, &fctx->domain)) {
+           fix_mustbedelegationornxdomain(message, fctx)) {
                char namebuf[DNS_NAME_FORMATSIZE];
                char domainbuf[DNS_NAME_FORMATSIZE];