Changeset 2136

Timestamp:

04/04/11 10:29:47 (2 years ago)

Author:

ahu

Message:

more properaly fake the 'auth' status of data in unmigrated non-dnsssec backends, again discovered by Frank Altpeter

Files:

• trunk/pdns/pdns/packethandler.cc (modified) (4 diffs)

trunk/pdns/pdns/packethandler.cc

@@ -1276 +1276 @@
     
     while(B.get(rr)) {
+      // cerr<<"Auth: "<<rr.auth<<", "<<(rr.qtype == p->qtype)<<", "<<rr.qtype.getName()<<endl;
       if((p->qtype.getCode() == QType::ANY || rr.qtype == p->qtype) && rr.auth) 
         weDone=1;
-      if((rr.qtype == p->qtype && !rr.auth) || rr.qtype.getCode() == QType::NS) 
+      // the line below fakes 'unauth NS' for delegations for non-DNSSEC backends.
+      if((rr.qtype == p->qtype && !rr.auth) || (rr.qtype.getCode() == QType::NS && (!rr.auth || !pdns_iequals(sd.qname, rr.qname))))
         weHaveUnauth=1;
 
@@ -1286 +1288 @@
     }
 
-    //cerr<<"After first ANY query: weDone="<<weDone<<", weHaveUnauth="<<weHaveUnauth<<", weRedirected="<<weRedirected<<endl;
+    DLOG(L<<"After first ANY query: weDone="<<weDone<<", weHaveUnauth="<<weHaveUnauth<<", weRedirected="<<weRedirected<<endl);
 
     if(rrset.empty()) {
@@ -1317 +1319 @@
         }
       }
-          
     }
     else if(weDone) {
@@ -1332 +1333 @@
     }
     else if(weHaveUnauth) {
-      
       DLOG(L<<"Have unauth data, so need to hunt for best NS records"<<endl);
       if(tryReferral(p, r, sd, target))