1720. [bug] 'dig +chase' did not terminate on a RFC 2308 Type 1

                        negative response. [RT #12506]

1719.   [bug]           named was not correctly caching a RFC 2308 Type 1
                        negative response. [RT #12506]

1718.   [bug]           nsupdate was not handling RFC 2308 Type 3 negative
                        responses when looking for the zone / master server.
                        [RT #12506]

CHANGES

@@ -2,11 +2,15 @@
 
 1721.	[placeholder]	rt12519
 
-1720.	[placeholder]	rt12505a
+1720.	[bug]		'dig +chase' did not terminate on a RFC 2308 Type 1
+			negative response. [RT #12506]
 
-1719.	[placeholder]	rt12505a
+1719.	[bug]		named was not correctly caching a RFC 2308 Type 1
+			negative response. [RT #12506]
 
-1718.	[placeholder]	rt12505a
+1718.	[bug]		nsupdate was not handling RFC 2308 Type 3 negative
+			responses when looking for the zone / master server.
+			[RT #12506]
 
 1717.	[port]		solaris: ifconfig.sh did not support Solaris 10.
 			"ifconfig.sh down" didn't work for Solaris 9.

bin/dig/dighost.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.266 2004/09/16 01:01:25 marka Exp $ */
+/* $Id: dighost.c,v 1.267 2004/09/16 02:10:41 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -1416,6 +1416,13 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		name = NULL;
 		dns_message_currentname(msg, section, &name);
 
+		if (section == DNS_SECTION_AUTHORITY) {
+			rdataset = NULL;
+			result = dns_message_findtype(name, dns_rdatatype_soa,
+						      0, &rdataset);
+			if (result == ISC_R_SUCCESS)
+				return (0);
+		}
 		rdataset = NULL;
 		result = dns_message_findtype(name, dns_rdatatype_ns, 0,
 					      &rdataset);

bin/nsupdate/nsupdate.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.134 2004/09/16 01:01:26 marka Exp $ */
+/* $Id: nsupdate.c,v 1.135 2004/09/16 02:10:42 marka Exp $ */
 
 #include <config.h>
 
@@ -1595,6 +1595,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_message_t *soaquery = NULL;
 	isc_sockaddr_t *addr;
 	isc_boolean_t seencname = ISC_FALSE;
+	dns_name_t tname;
+	unsigned int nlabels;
 
 	UNUSED(task);
 
@@ -1703,9 +1705,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		section = DNS_SECTION_ANSWER;
 	else if (pass == 1)
 		section = DNS_SECTION_AUTHORITY;
-	else
-		fatal("response to SOA query didn't contain an SOA");
-
+	else 
+		goto droplabel;
 
 	result = dns_message_firstname(rcvmsg, section);
 	if (result != ISC_R_SUCCESS) {
@@ -1742,29 +1743,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		goto lookforsoa;
 	}
 
-	if (seencname) {
-		dns_name_t tname;
-		unsigned int nlabels;
-
-		result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
-		INSIST(result == ISC_R_SUCCESS);
-		name = NULL;
-		dns_message_currentname(soaquery, DNS_SECTION_QUESTION, &name);
-		nlabels = dns_name_countlabels(name);
-		if (nlabels == 1)
-			fatal("could not find enclosing zone");
-		dns_name_init(&tname, NULL);
-		dns_name_getlabelsequence(name, 1, nlabels - 1, &tname);
-		dns_name_clone(&tname, name);
-		dns_request_destroy(&request);
-		dns_message_renderreset(soaquery);
-		if (userserver != NULL)
-			sendrequest(localaddr, userserver, soaquery, &request);
-		else
-			sendrequest(localaddr, &servers[ns_inuse], soaquery,
-				    &request);
-		goto out;
-	}
+	if (seencname)
+		goto droplabel;
 
 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -1807,17 +1787,38 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		get_address(serverstr, DNSDEFAULTPORT, &tempaddr);
 		serveraddr = &tempaddr;
 	}
+	dns_rdata_freestruct(&soa);
 
 	send_update(zonename, serveraddr, localaddr);
+	setzoneclass(dns_rdataclass_none);
 
 	dns_message_destroy(&soaquery);
 	dns_request_destroy(&request);
 
  out:
-	setzoneclass(dns_rdataclass_none);
-	dns_rdata_freestruct(&soa);
 	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvsoa");
+	return;
+ 
+ droplabel:
+	result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
+	INSIST(result == ISC_R_SUCCESS);
+	name = NULL;
+	dns_message_currentname(soaquery, DNS_SECTION_QUESTION, &name);
+	nlabels = dns_name_countlabels(name);
+	if (nlabels == 1)
+		fatal("could not find enclosing zone");
+	dns_name_init(&tname, NULL);
+	dns_name_getlabelsequence(name, 1, nlabels - 1, &tname);
+	dns_name_clone(&tname, name);
+	dns_request_destroy(&request);
+	dns_message_renderreset(soaquery);
+	if (userserver != NULL)
+		sendrequest(localaddr, userserver, soaquery, &request);
+	else
+		sendrequest(localaddr, &servers[ns_inuse], soaquery,
+			    &request);
+	goto out;
 }
 
 static void

lib/dns/resolver.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.294 2004/08/28 06:16:56 marka Exp $ */
+/* $Id: resolver.c,v 1.295 2004/09/16 02:10:42 marka Exp $ */
 
 #include <config.h>
 
@@ -4127,7 +4127,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 		dns_message_currentname(message, section, &name);
 		if (dns_name_issubdomain(name, &fctx->domain)) {
 			/*
-			 * Look for NS RRset first.
+			 * Look for NS/SOA RRsets first.
 			 */
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -4141,7 +4141,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 					return (DNS_R_FORMERR);
 				if (type == dns_rdatatype_ns) {
 					/*
-					 * NS or SIG NS.
+					 * NS or RRSIG NS.
 					 *
 					 * Only one set of NS RRs is allowed.
 					 */
@@ -4159,17 +4159,9 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 						DNS_RDATASETATTR_CACHE;
 					rdataset->trust = dns_trust_glue;
 				}
-			}
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
-				type = rdataset->type;
-				if (type == dns_rdatatype_rrsig)
-					type = rdataset->covers;
-				if (type == dns_rdatatype_soa ||
-				    type == dns_rdatatype_nsec) {
+				if (type == dns_rdatatype_soa) {
 					/*
-					 * SOA, RRSIG SOA, NSEC, or RRSIG NSEC.
+					 * SOA, or RRSIG SOA.
 					 *
 					 * Only one SOA is allowed.
 					 */
@@ -4180,8 +4172,38 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 							return (DNS_R_FORMERR);
 						soa_name = name;
 					}
-					if (ns_name == NULL) {
-						negative_response = ISC_TRUE;
+					name->attributes |=
+						DNS_NAMEATTR_NCACHE;
+					rdataset->attributes |=
+						DNS_RDATASETATTR_NCACHE;
+					if (aa)
+						rdataset->trust =
+						    dns_trust_authauthority;
+					else
+						rdataset->trust =
+							dns_trust_additional;
+				}
+			}
+			/*
+			 * A negative response has a SOA record (Type 2) 
+			 * and a optional NS RRset (Type 1) or it has neither
+			 * a SOA or a NS RRset (Type 3) or rcode is NXDOMAIN
+			 * (handled above) in which case the NS RRset is
+			 * allowed (Type 4).
+			 */
+			if (soa_name != NULL || ns_name == NULL)
+				negative_response = ISC_TRUE;
+			for (rdataset = ISC_LIST_HEAD(name->list);
+			     rdataset != NULL;
+			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+				type = rdataset->type;
+				if (type == dns_rdatatype_rrsig)
+					type = rdataset->covers;
+				if (type == dns_rdatatype_nsec) {
+					/*
+					 * NSEC or RRSIG NSEC.
+					 */
+					if (negative_response) {
 						name->attributes |=
 							DNS_NAMEATTR_NCACHE;
 						rdataset->attributes |=
@@ -4210,7 +4232,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 					 * this is a referral, and there
 					 * should only be one DS.
 					 */
-					if (negative_response)
+					if (ns_name == NULL)
 						return (DNS_R_FORMERR);
 					if (rdataset->type ==
 					    dns_rdatatype_ds) {