From 1f8512873050d11ecd5684a4118f041b6158e9b7 Mon Sep 17 00:00:00 2001 From: dougb Date: Mon, 25 Jan 2010 04:22:19 +0000 Subject: Vendor import of BIND 9.6.1-P3 --- lib/dns/include/dns/db.h | 19 ++++++++++--------- lib/dns/include/dns/ncache.h | 4 ++-- lib/dns/include/dns/types.h | 4 +++- lib/dns/rbtdb.c | 4 +++- lib/dns/resolver.c | 36 +++++++++++++----------------------- lib/dns/validator.c | 14 +++++++------- 6 files changed, 38 insertions(+), 43 deletions(-) (limited to 'lib/dns') diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h index 3b78208..c75c774 100644 --- a/lib/dns/include/dns/db.h +++ b/lib/dns/include/dns/db.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: db.h,v 1.93.50.3 2009/01/18 23:25:17 marka Exp $ */ +/* $Id: db.h,v 1.93.50.3.12.1 2009/12/31 21:44:37 each Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -205,14 +205,15 @@ struct dns_db { /*% * Options that can be specified for dns_db_find(). */ -#define DNS_DBFIND_GLUEOK 0x01 -#define DNS_DBFIND_VALIDATEGLUE 0x02 -#define DNS_DBFIND_NOWILD 0x04 -#define DNS_DBFIND_PENDINGOK 0x08 -#define DNS_DBFIND_NOEXACT 0x10 -#define DNS_DBFIND_FORCENSEC 0x20 -#define DNS_DBFIND_COVERINGNSEC 0x40 -#define DNS_DBFIND_FORCENSEC3 0x80 +#define DNS_DBFIND_GLUEOK 0x0001 +#define DNS_DBFIND_VALIDATEGLUE 0x0002 +#define DNS_DBFIND_NOWILD 0x0004 +#define DNS_DBFIND_PENDINGOK 0x0008 +#define DNS_DBFIND_NOEXACT 0x0010 +#define DNS_DBFIND_FORCENSEC 0x0020 +#define DNS_DBFIND_COVERINGNSEC 0x0040 +#define DNS_DBFIND_FORCENSEC3 0x0080 +#define DNS_DBFIND_ADDITIONALOK 0x0100 /*@}*/ /*@{*/ diff --git a/lib/dns/include/dns/ncache.h b/lib/dns/include/dns/ncache.h index a818fe6..d61684d 100644 --- a/lib/dns/include/dns/ncache.h +++ b/lib/dns/include/dns/ncache.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ncache.h,v 1.25 2008/09/25 04:02:39 tbox Exp $ */ +/* $Id: ncache.h,v 1.25.142.1 2009/12/31 20:29:21 each Exp $ */ #ifndef DNS_NCACHE_H #define DNS_NCACHE_H 1 @@ -76,7 +76,7 @@ dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache, * The 'covers' argument is the RR type whose nonexistence we are caching, * or dns_rdatatype_any when caching a NXDOMAIN response. * - * 'optout' indicates a DNS_RATASETATTR_OPTOUT should be set. + * 'optout' indicates a DNS_RDATASETATTR_OPTOUT should be set. * * Note: *\li If 'addedrdataset' is not NULL, then it will be attached to the added diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h index 8c7773c..525dd8d 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: types.h,v 1.130.50.3.12.1 2009/11/18 23:58:04 marka Exp $ */ +/* $Id: types.h,v 1.130.50.3.12.2 2009/12/31 20:29:21 each Exp $ */ #ifndef DNS_TYPES_H #define DNS_TYPES_H 1 @@ -301,6 +301,8 @@ enum { #define DNS_TRUST_PENDING(x) ((x) == dns_trust_pending_answer || \ (x) == dns_trust_pending_additional) +#define DNS_TRUST_ADDITIONAL(x) ((x) == dns_trust_additional || \ + (x) == dns_trust_pending_additional) #define DNS_TRUST_GLUE(x) ((x) == dns_trust_glue) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index b163441..d5b5b5c 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbtdb.c,v 1.270.12.6.10.1 2009/11/18 23:58:04 marka Exp $ */ +/* $Id: rbtdb.c,v 1.270.12.6.10.2 2009/12/31 21:44:36 each Exp $ */ /*! \file */ @@ -4546,6 +4546,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * If we didn't find what we were looking for... */ if (found == NULL || + (DNS_TRUST_ADDITIONAL(found->trust) && + ((options & DNS_DBFIND_ADDITIONALOK) == 0)) || (found->trust == dns_trust_glue && ((options & DNS_DBFIND_GLUEOK) == 0)) || (DNS_TRUST_PENDING(found->trust) && diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 3b90af4..1b4f407 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resolver.c,v 1.384.14.14.8.1 2009/11/18 23:58:04 marka Exp $ */ +/* $Id: resolver.c,v 1.384.14.14.8.2 2010/01/07 17:17:19 each Exp $ */ /*! \file */ @@ -4289,11 +4289,19 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, rdataset->ttl = res->view->maxcachettl; /* - * If this rrset is in a secure domain, do DNSSEC validation - * for it, unless it is glue. + * If this RRset is in a secure domain, is in bailiwick, + * and is not glue, attempt DNSSEC validation. (We do not + * attempt to validate glue or out-of-bailiwick data--even + * though there might be some performance benefit to doing + * so--because it makes it simpler and safer to ensure that + * records from a secure domain are only cached if validated + * within the context of a query to the domain that owns + * them.) */ - if (secure_domain && rdataset->trust != dns_trust_glue) { + if (secure_domain && rdataset->trust != dns_trust_glue && + !EXTERNAL(rdataset)) { dns_trust_t trust; + /* * RRSIGs are validated as part of validating the * type they cover. @@ -4330,22 +4338,6 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo, } /* - * Reject out of bailiwick additional records - * without RRSIGs as they can't possibly validate - * as "secure" and as we will never never want to - * store these as "answers" after validation. - */ - if (rdataset->trust == dns_trust_additional && - sigrdataset == NULL && EXTERNAL(rdataset)) - continue; - - /* - * XXXMPA: If we store as "answer" after validating - * then we need to do bailiwick processing and - * also need to track whether RRsets are in or - * out of bailiwick. This will require a another - * pending trust level. - * * Cache this rdataset/sigrdataset pair as * pending data. Track whether it was additional * or not. @@ -5463,9 +5455,7 @@ answer_response(fetchctx_t *fctx) { /* * This data is outside of * our query domain, and - * may only be cached if it - * comes from a secure zone - * and validates. + * may not be cached. */ rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 46a7491..ce49daf 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.164.12.9.8.1 2009/11/18 23:58:04 marka Exp $ */ +/* $Id: validator.c,v 1.164.12.9.8.2 2009/12/31 20:29:21 each Exp $ */ #include @@ -3242,20 +3242,20 @@ proveunsecure(dns_validator_t *val, isc_boolean_t have_ds, isc_boolean_t resume) if (val->havedlvsep) dns_name_copy(dns_fixedname_name(&val->dlvsep), secroot, NULL); else { + unsigned int labels; dns_name_copy(val->event->name, secroot, NULL); /* * If this is a response to a DS query, we need to look in * the parent zone for the trust anchor. */ - if (val->event->type == dns_rdatatype_ds && - dns_name_countlabels(secroot) > 1U) - dns_name_split(secroot, 1, NULL, secroot); + + labels = dns_name_countlabels(secroot); + if (val->event->type == dns_rdatatype_ds && labels > 1U) + dns_name_getlabelsequence(secroot, 1, labels - 1, + secroot); result = dns_keytable_finddeepestmatch(val->keytable, secroot, secroot); - if (result == ISC_R_NOTFOUND) { - validator_log(val, ISC_LOG_DEBUG(3), - "not beneath secure root"); if (val->mustbesecure) { validator_log(val, ISC_LOG_WARNING, "must be secure failure"); -- cgit v1.1