|
 |
4359b6 |
From 52aeaf4924ec3f6689e6aafedbe41473d2bda992 Mon Sep 17 00:00:00 2001
|
|
|
4359b6 |
From: Wouter Wijngaards <wouter@nlnetlabs.nl>
|
|
|
4359b6 |
Date: Tue, 14 Nov 2017 10:01:44 +0000
|
|
|
4359b6 |
Subject: [PATCH] - Fix #2882: Unbound behaviour changes (wrong) when
|
|
|
4359b6 |
domain-insecure is set for stub zone. It no longer searches for DNSSEC
|
|
|
4359b6 |
information.
|
|
|
4359b6 |
|
|
|
4359b6 |
git-svn-id: file:///svn/unbound/trunk@4404 be551aaa-1e26-0410-a405-d3ace91eadb9
|
|
|
4359b6 |
---
|
|
|
4359b6 |
iterator/iter_utils.c | 5 +++++
|
|
|
4359b6 |
iterator/iter_utils.h | 2 +-
|
|
|
4359b6 |
2 files changed, 6 insertions(+), 1 deletion(-)
|
|
|
4359b6 |
|
|
|
4359b6 |
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
|
|
|
4359b6 |
index 0b1b456..70cab40 100644
|
|
|
4359b6 |
--- a/iterator/iter_utils.c
|
|
|
4359b6 |
+++ b/iterator/iter_utils.c
|
|
|
4359b6 |
@@ -656,6 +656,11 @@ iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
|
|
|
4359b6 |
/* a trust anchor exists with this name, RRSIGs expected */
|
|
|
4359b6 |
if((a=anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
|
|
|
4359b6 |
dclass))) {
|
|
|
4359b6 |
+ if(a->numDS == 0 && a->numDNSKEY == 0) {
|
|
|
4359b6 |
+ /* insecure trust point */
|
|
|
4359b6 |
+ lock_basic_unlock(&a->lock);
|
|
|
4359b6 |
+ return 0;
|
|
|
4359b6 |
+ }
|
|
|
4359b6 |
lock_basic_unlock(&a->lock);
|
|
|
4359b6 |
return 1;
|
|
|
4359b6 |
}
|
|
|
4359b6 |
diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
|
|
|
4359b6 |
index 50c5fc0..5b6df7f 100644
|
|
|
4359b6 |
--- a/iterator/iter_utils.h
|
|
|
4359b6 |
+++ b/iterator/iter_utils.h
|
|
|
4359b6 |
@@ -193,7 +193,7 @@ int iter_indicates_dnssec_fwd(struct module_env* env,
|
|
|
4359b6 |
* @param dp: delegation point.
|
|
|
4359b6 |
* @param msg: delegation message, with DS if a secure referral.
|
|
|
4359b6 |
* @param dclass: class of query.
|
|
|
4359b6 |
- * @return 1 if dnssec is expected, 0 if not.
|
|
|
4359b6 |
+ * @return 1 if dnssec is expected, 0 if not or insecure point above qname.
|
|
|
4359b6 |
*/
|
|
|
4359b6 |
int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
|
|
|
4359b6 |
struct dns_msg* msg, uint16_t dclass);
|
|
|
4359b6 |
--
|
|
|
4359b6 |
2.20.1
|
|
|
4359b6 |
|