diff -ur bind-9.6-ESV-R5/lib/dns/rbtdb.c bind-9.6-ESV-R6/lib/dns/rbtdb.c --- bind-9.6-ESV-R5/lib/dns/rbtdb.c 2011-06-08 20:16:35.000000000 -0400 +++ bind-9.6-ESV-R6/lib/dns/rbtdb.c 2012-03-26 12:14:28.000000000 -0400 @@ -364,9 +364,12 @@ dns_db_secure } dns_db_secure_t; +typedef struct dns_rbtdb dns_rbtdb_t; + typedef struct rbtdb_version { /* Not locked */ rbtdb_serial_t serial; + dns_rbtdb_t * rbtdb; /* * Protected in the refcount routines. * XXXJT: should we change the lock policy based on the refcount @@ -391,7 +394,7 @@ typedef ISC_LIST(rbtdb_version_t) rbtdb_versionlist_t; -typedef struct { +struct dns_rbtdb { /* Unlocked. */ dns_db_t common; /* Locks the data in this struct */ @@ -449,7 +452,7 @@ /* Unlocked */ unsigned int quantum; -} dns_rbtdb_t; +}; #define RBTDB_ATTR_LOADED 0x01 #define RBTDB_ATTR_LOADING 0x02 @@ -1102,6 +1105,7 @@ version = allocate_version(rbtdb->common.mctx, rbtdb->next_serial, 1, ISC_TRUE); if (version != NULL) { + version->rbtdb = rbtdb; version->commit_ok = ISC_TRUE; version->secure = rbtdb->current_version->secure; version->havensec3 = rbtdb->current_version->havensec3; @@ -1143,6 +1147,7 @@ unsigned int refs; REQUIRE(VALID_RBTDB(rbtdb)); + INSIST(rbtversion != NULL && rbtversion->rbtdb == rbtdb); isc_refcount_increment(&rbtversion->references, &refs); INSIST(refs > 1); @@ -1536,14 +1541,14 @@ } /* - * Caller must be holding the node lock if its reference must be protected - * by the lock. + * Caller must be holding the node lock. */ static inline void new_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) { unsigned int lockrefs, noderefs; isc_refcount_t *lockref; + INSIST(!ISC_LINK_LINKED(node, deadlink)); dns_rbtnode_refincrement0(node, &noderefs); if (noderefs == 1) { /* this is the first reference to the node */ lockref = &rbtdb->node_locks[node->locknum].references; @@ -1567,33 +1572,43 @@ reactivate_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, isc_rwlocktype_t treelocktype) { - isc_boolean_t need_relock = ISC_FALSE; + isc_rwlocktype_t locktype = isc_rwlocktype_read; + nodelock_t *nodelock = &rbtdb->node_locks[node->locknum].lock; + isc_boolean_t maybe_cleanup = ISC_FALSE; - NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock); - new_reference(rbtdb, node); + POST(locktype); - NODE_WEAKLOCK(&rbtdb->node_locks[node->locknum].lock, - isc_rwlocktype_read); - if (ISC_LINK_LINKED(node, deadlink)) - need_relock = ISC_TRUE; - else if (!ISC_LIST_EMPTY(rbtdb->deadnodes[node->locknum]) && - treelocktype == isc_rwlocktype_write) - need_relock = ISC_TRUE; - NODE_WEAKUNLOCK(&rbtdb->node_locks[node->locknum].lock, - isc_rwlocktype_read); - if (need_relock) { - NODE_WEAKLOCK(&rbtdb->node_locks[node->locknum].lock, - isc_rwlocktype_write); + NODE_STRONGLOCK(nodelock); + NODE_WEAKLOCK(nodelock, locktype); + + /* + * Check if we can possibly cleanup the dead node. If so, upgrade + * the node lock below to perform the cleanup. + */ + if (!ISC_LIST_EMPTY(rbtdb->deadnodes[node->locknum]) && + treelocktype == isc_rwlocktype_write) { + maybe_cleanup = ISC_TRUE; + } + + if (ISC_LINK_LINKED(node, deadlink) || maybe_cleanup) { + /* + * Upgrade the lock and test if we still need to unlink. + */ + NODE_WEAKUNLOCK(nodelock, locktype); + locktype = isc_rwlocktype_write; + POST(locktype); + NODE_WEAKLOCK(nodelock, locktype); if (ISC_LINK_LINKED(node, deadlink)) ISC_LIST_UNLINK(rbtdb->deadnodes[node->locknum], node, deadlink); - if (treelocktype == isc_rwlocktype_write) + if (maybe_cleanup) cleanup_dead_nodes(rbtdb, node->locknum); - NODE_WEAKUNLOCK(&rbtdb->node_locks[node->locknum].lock, - isc_rwlocktype_write); } - NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock); + new_reference(rbtdb, node); + + NODE_WEAKUNLOCK(nodelock, locktype); + NODE_STRONGUNLOCK(nodelock); } /* @@ -1617,7 +1632,7 @@ rbtdb_nodelock_t *nodelock; unsigned int refs, nrefs; int bucket = node->locknum; - isc_boolean_t no_reference; + isc_boolean_t no_reference = ISC_TRUE; nodelock = &rbtdb->node_locks[bucket]; @@ -1637,6 +1652,7 @@ NODE_WEAKUNLOCK(&nodelock->lock, isc_rwlocktype_read); NODE_WEAKLOCK(&nodelock->lock, isc_rwlocktype_write); } + dns_rbtnode_refdecrement(node, &nrefs); INSIST((int)nrefs >= 0); if (nrefs > 0) { @@ -1646,7 +1662,7 @@ return (ISC_FALSE); } - if (node->dirty && dns_rbtnode_refcurrent(node) == 0) { + if (node->dirty) { if (IS_CACHE(rbtdb)) clean_cache_node(rbtdb, node); else { @@ -1664,19 +1680,6 @@ } } - isc_refcount_decrement(&nodelock->references, &refs); - INSIST((int)refs >= 0); - - /* - * XXXDCL should this only be done for cache zones? - */ - if (node->data != NULL || node->down != NULL) { - /* Restore the lock? */ - if (nlock == isc_rwlocktype_read) - NODE_WEAKDOWNGRADE(&nodelock->lock); - return (ISC_TRUE); - } - /* * Attempt to switch to a write lock on the tree. If this fails, * we will add this node to a linked list of nodes in this locking @@ -1700,13 +1703,18 @@ } else write_locked = ISC_TRUE; - no_reference = ISC_TRUE; - if (write_locked && dns_rbtnode_refcurrent(node) == 0) { + isc_refcount_decrement(&nodelock->references, &refs); + INSIST((int)refs >= 0); + + /* + * XXXDCL should this only be done for cache zones? + */ + if (node->data != NULL || node->down != NULL) + goto restore_locks; + + if (write_locked) { /* - * We can now delete the node if the reference counter is - * zero. This should be typically the case, but a different - * thread may still gain a (new) reference just before the - * current thread locks the tree (e.g., in findnode()). + * We can now delete the node. */ /* @@ -1758,6 +1766,7 @@ ISC_LOG_INFO, "decrement_reference: failed to " "allocate pruning event"); + INSIST(node->data == NULL); INSIST(!ISC_LINK_LINKED(node, deadlink)); ISC_LIST_APPEND(rbtdb->deadnodes[bucket], node, deadlink); @@ -1795,12 +1804,13 @@ isc_result_totext(result)); } } - } else if (dns_rbtnode_refcurrent(node) == 0) { + } else { + INSIST(node->data == NULL); INSIST(!ISC_LINK_LINKED(node, deadlink)); ISC_LIST_APPEND(rbtdb->deadnodes[bucket], node, deadlink); - } else - no_reference = ISC_FALSE; + } + restore_locks: /* Restore the lock? */ if (nlock == isc_rwlocktype_read) NODE_WEAKDOWNGRADE(&nodelock->lock); @@ -1867,11 +1877,10 @@ * from the list beforehand as we do in * reactivate_node(). */ - new_reference(rbtdb, parent); - if (ISC_LINK_LINKED(parent, deadlink)) { + if (ISC_LINK_LINKED(parent, deadlink)) ISC_LIST_UNLINK(rbtdb->deadnodes[locknum], parent, deadlink); - } + new_reference(rbtdb, parent); } else parent = NULL; @@ -1942,9 +1951,9 @@ result = dns_db_findrdataset(db, origin, version, dns_rdatatype_dnskey, 0, 0, &keyset, NULL); if (result == ISC_R_SUCCESS) { - dns_rdata_t keyrdata = DNS_RDATA_INIT; result = dns_rdataset_first(&keyset); while (result == ISC_R_SUCCESS) { + dns_rdata_t keyrdata = DNS_RDATA_INIT; dns_rdataset_current(&keyset, &keyrdata); if (dns_zonekey_iszonekey(&keyrdata)) { haszonekey = ISC_TRUE; @@ -2145,6 +2154,7 @@ REQUIRE(VALID_RBTDB(rbtdb)); version = (rbtdb_version_t *)*versionp; + INSIST(version->rbtdb == rbtdb); cleanup_version = NULL; ISC_LIST_INIT(cleanup_list); @@ -2455,20 +2465,19 @@ } static isc_result_t -findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, - dns_dbnode_t **nodep) +findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree, dns_name_t *name, + isc_boolean_t create, dns_dbnode_t **nodep) { - dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db; dns_rbtnode_t *node = NULL; dns_name_t nodename; isc_result_t result; isc_rwlocktype_t locktype = isc_rwlocktype_read; - REQUIRE(VALID_RBTDB(rbtdb)); + INSIST(tree == rbtdb->tree || tree == rbtdb->nsec3); dns_name_init(&nodename, NULL); RWLOCK(&rbtdb->tree_lock, locktype); - result = dns_rbt_findnode(rbtdb->tree, name, NULL, &node, NULL, + result = dns_rbt_findnode(tree, name, NULL, &node, NULL, DNS_RBTFIND_EMPTYDATA, NULL, NULL); if (result != ISC_R_SUCCESS) { RWUNLOCK(&rbtdb->tree_lock, locktype); @@ -2484,7 +2493,7 @@ locktype = isc_rwlocktype_write; RWLOCK(&rbtdb->tree_lock, locktype); node = NULL; - result = dns_rbt_addnode(rbtdb->tree, name, &node); + result = dns_rbt_addnode(tree, name, &node); if (result == ISC_R_SUCCESS) { dns_rbt_namefromnode(node, &nodename); #ifdef DNS_RBT_USEHASH @@ -2493,21 +2502,31 @@ node->locknum = dns_name_hash(&nodename, ISC_TRUE) % rbtdb->node_lock_count; #endif - node->nsec3 = 0; - add_empty_wildcards(rbtdb, name); - - if (dns_name_iswildcard(name)) { - result = add_wildcard_magic(rbtdb, name); - if (result != ISC_R_SUCCESS) { - RWUNLOCK(&rbtdb->tree_lock, locktype); - return (result); + if (tree == rbtdb->tree) { + node->nsec3 = 0; + add_empty_wildcards(rbtdb, name); + + if (dns_name_iswildcard(name)) { + result = add_wildcard_magic(rbtdb, + name); + if (result != ISC_R_SUCCESS) { + RWUNLOCK(&rbtdb->tree_lock, + locktype); + return (result); + } } } + if (tree == rbtdb->nsec3) + node->nsec3 = 1; } else if (result != ISC_R_EXISTS) { RWUNLOCK(&rbtdb->tree_lock, locktype); return (result); } } + + if (tree == rbtdb->nsec3) + INSIST(node->nsec3 == 1); + reactivate_node(rbtdb, node, locktype); RWUNLOCK(&rbtdb->tree_lock, locktype); @@ -2517,59 +2536,25 @@ } static isc_result_t -findnsec3node(dns_db_t *db, dns_name_t *name, isc_boolean_t create, +findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create, dns_dbnode_t **nodep) { dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db; - dns_rbtnode_t *node = NULL; - dns_name_t nodename; - isc_result_t result; - isc_rwlocktype_t locktype = isc_rwlocktype_read; REQUIRE(VALID_RBTDB(rbtdb)); - dns_name_init(&nodename, NULL); - RWLOCK(&rbtdb->tree_lock, locktype); - result = dns_rbt_findnode(rbtdb->nsec3, name, NULL, &node, NULL, - DNS_RBTFIND_EMPTYDATA, NULL, NULL); - if (result != ISC_R_SUCCESS) { - RWUNLOCK(&rbtdb->tree_lock, locktype); - if (!create) { - if (result == DNS_R_PARTIALMATCH) - result = ISC_R_NOTFOUND; - return (result); - } - /* - * It would be nice to try to upgrade the lock instead of - * unlocking then relocking. - */ - locktype = isc_rwlocktype_write; - RWLOCK(&rbtdb->tree_lock, locktype); - node = NULL; - result = dns_rbt_addnode(rbtdb->nsec3, name, &node); - if (result == ISC_R_SUCCESS) { - dns_rbt_namefromnode(node, &nodename); -#ifdef DNS_RBT_USEHASH - node->locknum = node->hashval % rbtdb->node_lock_count; -#else - node->locknum = dns_name_hash(&nodename, ISC_TRUE) % - rbtdb->node_lock_count; -#endif - node->nsec3 = 1U; - } else if (result != ISC_R_EXISTS) { - RWUNLOCK(&rbtdb->tree_lock, locktype); - return (result); - } - } else - INSIST(node->nsec3); - NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock); - new_reference(rbtdb, node); - NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock); - RWUNLOCK(&rbtdb->tree_lock, locktype); + return (findnodeintree(rbtdb, rbtdb->tree, name, create, nodep)); +} - *nodep = (dns_dbnode_t *)node; +static isc_result_t +findnsec3node(dns_db_t *db, dns_name_t *name, isc_boolean_t create, + dns_dbnode_t **nodep) +{ + dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db; - return (ISC_R_SUCCESS); + REQUIRE(VALID_RBTDB(rbtdb)); + + return (findnodeintree(rbtdb, rbtdb->nsec3, name, create, nodep)); } static isc_result_t @@ -3472,6 +3457,8 @@ search.rbtdb = (dns_rbtdb_t *)db; REQUIRE(VALID_RBTDB(search.rbtdb)); + INSIST(version == NULL || + ((rbtdb_version_t *)version)->rbtdb == (dns_rbtdb_t *)db); /* * We don't care about 'now'. @@ -4681,7 +4668,7 @@ rdataset); if (need_headerupdate(found, search.now)) update = found; - if (foundsig != NULL) { + if (!NEGATIVE(found) && foundsig != NULL) { bind_rdataset(search.rbtdb, node, foundsig, search.now, sigrdataset); if (need_headerupdate(foundsig, search.now)) @@ -5172,6 +5159,7 @@ REQUIRE(VALID_RBTDB(rbtdb)); REQUIRE(type != dns_rdatatype_any); + INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb); if (rbtversion == NULL) { currentversion(db, (dns_dbversion_t **) (void *)(&rbtversion)); @@ -5313,7 +5301,7 @@ } if (found != NULL) { bind_rdataset(rbtdb, rbtnode, found, now, rdataset); - if (foundsig != NULL) + if (!NEGATIVE(found) && foundsig != NULL) bind_rdataset(rbtdb, rbtnode, foundsig, now, sigrdataset); } @@ -5360,6 +5348,8 @@ else { unsigned int refs; + INSIST(rbtversion->rbtdb == rbtdb); + isc_refcount_increment(&rbtversion->references, &refs); INSIST(refs > 1); @@ -5749,6 +5739,19 @@ addedrdataset); return (ISC_R_SUCCESS); } + /* + * If we have will be replacing a NS RRset force its TTL + * to be no more than the current NS RRset's TTL. This + * ensures the delegations that are withdrawn are honoured. + */ + if (IS_CACHE(rbtdb) && header->rdh_ttl > now && + header->type == dns_rdatatype_ns && + !header_nx && !newheader_nx && + header->trust <= newheader->trust) { + if (newheader->rdh_ttl > header->rdh_ttl) { + newheader->rdh_ttl = header->rdh_ttl; + } + } if (IS_CACHE(rbtdb) && header->rdh_ttl > now && (header->type == dns_rdatatype_a || header->type == dns_rdatatype_aaaa) && @@ -6027,6 +6030,7 @@ isc_boolean_t cache_is_overmem = ISC_FALSE; REQUIRE(VALID_RBTDB(rbtdb)); + INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb); if (rbtdb->common.methods == &zone_methods) REQUIRE(((rbtnode->nsec3 && @@ -6043,8 +6047,7 @@ now = 0; result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx, - ®ion, - sizeof(rdatasetheader_t)); + ®ion, sizeof(rdatasetheader_t)); if (result != ISC_R_SUCCESS) return (result); @@ -6187,6 +6190,7 @@ rbtdb_changed_t *changed; REQUIRE(VALID_RBTDB(rbtdb)); + REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb); if (rbtdb->common.methods == &zone_methods) REQUIRE(((rbtnode->nsec3 && @@ -6367,6 +6371,7 @@ rdatasetheader_t *newheader; REQUIRE(VALID_RBTDB(rbtdb)); + INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb); if (type == dns_rdatatype_any) return (ISC_R_NOTIMPLEMENTED); @@ -6722,6 +6727,7 @@ rbtdb = (dns_rbtdb_t *)db; REQUIRE(VALID_RBTDB(rbtdb)); + INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb); RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read); @@ -6851,11 +6857,16 @@ REQUIRE(VALID_RBTDB(rbtdb)); REQUIRE(rdataset != NULL); + REQUIRE(rdataset->methods == &rdataset_methods); REQUIRE(rbtdb->future_version == rbtversion); + REQUIRE(rbtversion != NULL); REQUIRE(rbtversion->writer); + REQUIRE(rbtversion->rbtdb == rbtdb); node = rdataset->private2; + INSIST(node != NULL); header = rdataset->private3; + INSIST(header != NULL); header--; RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write); @@ -7233,6 +7244,7 @@ free_rbtdb(rbtdb, ISC_FALSE, NULL); return (ISC_R_NOMEMORY); } + rbtdb->current_version->rbtdb = rbtdb; rbtdb->current_version->secure = dns_db_insecure; rbtdb->current_version->havensec3 = ISC_FALSE; rbtdb->current_version->flags = 0; @@ -7963,7 +7975,7 @@ static isc_result_t dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) { - isc_result_t result; + isc_result_t result, tresult; rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator; dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db; dns_name_t *iname, *origin; @@ -8006,13 +8018,14 @@ DNS_RBTFIND_EMPTYDATA, NULL, NULL); if (result == DNS_R_PARTIALMATCH) { dns_rbtnode_t *node = NULL; - result = dns_rbt_findnode(rbtdb->nsec3, name, NULL, + tresult = dns_rbt_findnode(rbtdb->nsec3, name, NULL, &node, &rbtdbiter->nsec3chain, DNS_RBTFIND_EMPTYDATA, NULL, NULL); - if (result == ISC_R_SUCCESS) { + if (tresult == ISC_R_SUCCESS) { rbtdbiter->node = node; rbtdbiter->current = &rbtdbiter->nsec3chain; + result = tresult; } } } diff -ur bind-9.6-ESV-R5/lib/dns/validator.c bind-9.6-ESV-R6/lib/dns/validator.c --- bind-9.6-ESV-R5/lib/dns/validator.c 2011-06-08 20:16:37.000000000 -0400 +++ bind-9.6-ESV-R6/lib/dns/validator.c 2012-03-26 12:14:28.000000000 -0400 @@ -837,7 +837,7 @@ * Return ISC_R_IGNORE when the NSEC is not the appropriate one. */ static isc_result_t -nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname, +nsecnoexistnodata(dns_validator_t *val, dns_name_t *name, dns_name_t *nsecname, dns_rdataset_t *nsecset, isc_boolean_t *exists, isc_boolean_t *data, dns_name_t *wild) { @@ -878,9 +878,11 @@ if (order == 0) { /* - * The names are the same. + * The names are the same. If we are validating "." + * then atparent should not be set as there is no parent. */ - atparent = dns_rdatatype_atparent(val->event->type); + atparent = (olabels != 1) && + dns_rdatatype_atparent(val->event->type); ns = dns_nsec_typepresent(&rdata, dns_rdatatype_ns); soa = dns_nsec_typepresent(&rdata, dns_rdatatype_soa); if (ns && !soa) { @@ -1879,14 +1881,17 @@ isc_result_t result; dns_fixedname_t fixed; isc_boolean_t ignore = ISC_FALSE; + dns_name_t *wild; val->attributes |= VALATTR_TRIEDVERIFY; dns_fixedname_init(&fixed); + wild = dns_fixedname_name(&fixed); again: result = dns_dnssec_verify2(val->event->name, val->event->rdataset, - key, ignore, val->view->mctx, rdata, - dns_fixedname_name(&fixed)); - if (result == DNS_R_SIGEXPIRED && val->view->acceptexpired) { + key, ignore, val->view->mctx, rdata, wild); + if ((result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE) && + val->view->acceptexpired) + { ignore = ISC_TRUE; goto again; } @@ -1895,14 +1900,29 @@ "accepted expired %sRRSIG (keyid=%u)", (result == DNS_R_FROMWILDCARD) ? "wildcard " : "", keyid); + else if (result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE) + validator_log(val, ISC_LOG_INFO, + "verify failed due to bad signature (keyid=%u): " + "%s", keyid, isc_result_totext(result)); else validator_log(val, ISC_LOG_DEBUG(3), "verify rdataset (keyid=%u): %s", keyid, isc_result_totext(result)); if (result == DNS_R_FROMWILDCARD) { - if (!dns_name_equal(val->event->name, - dns_fixedname_name(&fixed))) + if (!dns_name_equal(val->event->name, wild)) { + dns_name_t *closest; + unsigned int labels; + + /* + * Compute the closest encloser in case we need it + * for the NSEC3 NOQNAME proof. + */ + closest = dns_fixedname_name(&val->closest); + dns_name_copy(wild, closest, NULL); + labels = dns_name_countlabels(closest) - 1; + dns_name_getlabelsequence(closest, 1, labels, closest); val->attributes |= VALATTR_NEEDNOQNAME; + } result = ISC_R_SUCCESS; } return (result); @@ -2832,9 +2852,9 @@ dns_name_t *name, tname; isc_result_t result; isc_boolean_t exists, data, optout, unknown; - isc_boolean_t setclosest, setnearest; + isc_boolean_t setclosest, setnearest, *setclosestp; dns_fixedname_t fclosest, fnearest, fzonename; - dns_name_t *closest, *nearest, *zonename; + dns_name_t *closest, *nearest, *zonename, *closestp; dns_name_t **proofs = val->event->proofs; dns_rdataset_t *rdataset, trdataset; @@ -2881,6 +2901,25 @@ if (dns_name_countlabels(zonename) == 0) return (ISC_R_SUCCESS); + /* + * If the val->closest is set then we want to use it otherwise + * we need to discover it. + */ + if (dns_name_countlabels(dns_fixedname_name(&val->closest)) != 0) { + char namebuf[DNS_NAME_FORMATSIZE]; + + dns_name_format(dns_fixedname_name(&val->closest), + namebuf, sizeof(namebuf)); + validator_log(val, ISC_LOG_DEBUG(3), "closest encloser from " + "wildcard signature '%s'", namebuf); + dns_name_copy(dns_fixedname_name(&val->closest), closest, NULL); + closestp = NULL; + setclosestp = NULL; + } else { + closestp = closest; + setclosestp = &setclosest; + } + for (result = val_rdataset_first(val, &name, &rdataset); result == ISC_R_SUCCESS; result = val_rdataset_next(val, &name, &rdataset)) @@ -2898,8 +2937,8 @@ unknown = ISC_FALSE; (void)nsec3noexistnodata(val, val->event->name, name, rdataset, zonename, &exists, &data, &optout, - &unknown, &setclosest, &setnearest, - closest, nearest); + &unknown, setclosestp, &setnearest, + closestp, nearest); if (setclosest) proofs[DNS_VALIDATOR_CLOSESTENCLOSER] = name; if (unknown) @@ -3662,9 +3701,8 @@ result = ISC_R_SUCCESS; goto out; } - result = startfinddlvsep(val, - dns_fixedname_name(&val->fname)); - goto out; + return(startfinddlvsep(val, + dns_fixedname_name(&val->fname))); } val->labels++; } @@ -3791,8 +3829,7 @@ result = ISC_R_SUCCESS; goto out; } - result = startfinddlvsep(val, tname); - goto out; + return(startfinddlvsep(val, tname)); } continue; }