From 1edbbc32b4cca228e05cb9646ad623cf31027a95 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Tue, 25 Feb 2025 14:41:41 -0800 Subject: [PATCH] set eresult based on the type in ncache_adderesult() when the caching of a negative record failed because of the presence of a positive one, ncache_adderesult() could override this to ISC_R_SUCCESS. this could cause CNAME and DNAME responses to be handled incorrectly. ncache_adderesult() now sets the result code correctly in such cases. --- lib/dns/resolver.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 6b88e08c3f..1bbd455af0 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -6422,15 +6422,21 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, } } else { /* - * Either we don't care about the nature of the - * cache rdataset (because no fetch is - * interested in the outcome), or the cache - * rdataset is not a negative cache entry. - * Whichever case it is, we can return success. - * - * XXXRTH There's a CNAME/DNAME problem here. + * The attempt to add a negative cache entry + * was rejected. Set *eresultp to reflect + * the type of the dataset being returned. */ - *eresultp = ISC_R_SUCCESS; + switch (ardataset->type) { + case dns_rdatatype_cname: + *eresultp = DNS_R_CNAME; + break; + case dns_rdatatype_dname: + *eresultp = DNS_R_DNAME; + break; + default: + *eresultp = ISC_R_SUCCESS; + break; + } } result = ISC_R_SUCCESS; }