ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Do not treat mirror zone data as authoritative

Browse Source 
Section 4 of RFC 7706 suggests that responses sourced from a local copy
of a zone should not have the AA bit set.  Follow that recommendation by
setting 'qctx->authoritative' to ISC_FALSE when a response to a query is
coming from a mirror zone.
This commit is contained in:
Michał Kępień
2018-06-28 13:38:39 +02:00
parent 179d5faa28
commit ad0ec2ea93
2 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
bin/tests/system/mirror/tests.sh
View File

@@ -249,5 +249,15 @@ grep "sub.example.*IN.*NS" dig.out.ns3.test$n.2 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking flags set in a response sourced from a mirror zone ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 . DNSKEY > dig.out.ns3.test$n 2>&1 || ret=1
# Check response code and flags in the answer.
grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1