ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Handle DNS_R_NCACHENXRRSET in fetch_callback_{dnskey,validator}()

Browse Source 
DNS_R_NCACHENXRRSET can be return when zones are in transition state
from being unsigned to signed and signed to unsigned.  The validation
should be resumed and should result in a insecure answer.
This commit is contained in:
Mark Andrews
2020-10-28 11:58:38 +11:00
parent d9f3220424
commit 718e597def
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lib/dns/validator.c
View File

@@ -410,13 +410,20 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
val->fetch = NULL;
if (CANCELED(val)) {
validator_done(val, ISC_R_CANCELED);
} else if (eresult == ISC_R_SUCCESS) {
validator_log(val, ISC_LOG_DEBUG(3), "keyset with trust %s",
} else if (eresult == ISC_R_SUCCESS || eresult == DNS_R_NCACHENXRRSET) {
/*
* We have an answer to our DNSKEY query. Either the DNSKEY
* RRset or a NODATA response.
*/
validator_log(val, ISC_LOG_DEBUG(3), "%s with trust %s",
eresult == ISC_R_SUCCESS ? "keyset"
: "NCACHENXRRSET",
dns_trust_totext(rdataset->trust));
/*
* Only extract the dst key if the keyset is secure.
* Only extract the dst key if the keyset exists and is secure.
*/
if (rdataset->trust >= dns_trust_secure) {
if (eresult == ISC_R_SUCCESS &&
rdataset->trust >= dns_trust_secure) {
result = select_signing_key(val, rdataset);
if (result == ISC_R_SUCCESS) {
val->keyset = &val->frdataset;