Commit 57a4a2f875 for bind
commit 57a4a2f875bac0374804aef5c13a685de8b0e147
Author: Ondřej Surý <ondrej@isc.org>
Date: Tue Nov 10 12:24:29 2026 +0100
Remove the leftover handling of RRSIG queries
A standalone RRSIG query no longer reaches query_respond_any() or the
resolver's answer processing, so the code that treated it as a subset
of ANY there is dead: the query type is always ANY when a node is
iterated, and the response context's copy of the fetch type never
differs from the fetch type itself.
Assisted-by: Claude:claude-fable-5-2
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index 0187197ca4..912241dab3 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -730,11 +730,11 @@ dns_rdatatype_isknown(dns_rdatatype_t type) {
/*%
* Return true iff a query for the rdata type can have multiple
- * unrelated answers in a response: ANY, or RRSIG.
+ * unrelated answers in a response: ANY.
*/
static inline bool
dns_rdatatype_ismulti(dns_rdatatype_t type) {
- return type == dns_rdatatype_any || type == dns_rdatatype_rrsig;
+ return type == dns_rdatatype_any;
}
/*%
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index c55e50909a..2ac6f2d13f 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -936,13 +936,11 @@ typedef struct respctx {
unsigned int retryopts; /* updated options to pass to
* fctx_query() when resending */
- dns_rdatatype_t type; /* type being sought (set to
- * ANY if qtype was RRSIG) */
- bool aa; /* authoritative answer? */
- dns_trust_t trust; /* answer trust level */
- bool chaining; /* CNAME/DNAME processing? */
- bool next_server; /* give up, try the next server
- * */
+ bool aa; /* authoritative answer? */
+ dns_trust_t trust; /* answer trust level */
+ bool chaining; /* CNAME/DNAME processing? */
+ bool next_server; /* give up, try the next server
+ * */
badnstype_t broken_type; /* type of name server problem
* */
@@ -8199,11 +8197,6 @@ rctx_answer_init(respctx_t *rctx) {
rctx->trust = dns_trust_answer;
}
- /*
- * RRSIG fetches are never created, see fctx__create().
- */
- rctx->type = fctx->type;
-
/*
* Bigger than any valid DNAME label count.
*/
@@ -8644,7 +8637,7 @@ rctx_answer_positive(respctx_t *rctx) {
* type ANY, CNAME, DNAME, or an answer matching QNAME/QTYPE.
* Call the appropriate routine to handle the answer type.
*/
- if (rctx->aname != NULL && rctx->type == dns_rdatatype_any) {
+ if (rctx->aname != NULL && fctx->type == dns_rdatatype_any) {
result = rctx_answer_any(rctx);
if (result == ISC_R_COMPLETE) {
return rctx->result;
@@ -8732,11 +8725,11 @@ rctx_answer_scan(respctx_t *rctx) {
switch (namereln) {
case dns_namereln_equal:
ISC_LIST_FOREACH(name->list, rdataset, link) {
- if (rdataset->type == rctx->type ||
- rctx->type == dns_rdatatype_any)
+ if (rdataset->type == fctx->type ||
+ fctx->type == dns_rdatatype_any)
{
rctx->aname = name;
- if (rctx->type != dns_rdatatype_any) {
+ if (fctx->type != dns_rdatatype_any) {
rctx->ardataset = rdataset;
}
break;
@@ -8878,8 +8871,8 @@ rctx_answer_match(respctx_t *rctx) {
return ISC_R_COMPLETE;
}
if (dns_rdatatype_isalias(rctx->ardataset->type) &&
- rctx->type != rctx->ardataset->type &&
- rctx->type != dns_rdatatype_any &&
+ fctx->type != rctx->ardataset->type &&
+ fctx->type != dns_rdatatype_any &&
!is_answertarget_allowed(fctx, fctx->name, rctx->aname,
rctx->ardataset, NULL))
{
@@ -8902,7 +8895,7 @@ rctx_answer_match(respctx_t *rctx) {
return ISC_R_COMPLETE;
}
- if (!dns_rdataset_issigtype(sigrdataset, rctx->type)) {
+ if (!dns_rdataset_issigtype(sigrdataset, fctx->type)) {
continue;
}
diff --git a/lib/ns/query.c b/lib/ns/query.c
index b87dea132f..e87aa6de4d 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -5636,7 +5636,7 @@ query_lookup(query_ctx_t *qctx) {
/*
* Keep fname as the name query.c should answer with, while
* qctx->foundname keeps the actual database owner for later
- * node resolution, such as ANY/RRSIG iteration.
+ * node resolution, such as ANY iteration.
*/
if (qctx->dns64 && qctx->rpz) {
dns_name_copy(qctx->client->query.qname, dns_name(qctx->fname));
@@ -7342,7 +7342,6 @@ query_respond_any(query_ctx_t *qctx) {
minimal-any */
dns_fixedname_t wildcardfixed;
dns_name_t *wildcardproof = NULL;
- isc_buffer_t b;
CCTRACE(ISC_LOG_DEBUG(3), "query_respond_any");
@@ -7400,20 +7399,11 @@ query_respond_any(query_ctx_t *qctx) {
/*
* We found an NS RRset; no need to add one later.
*/
- if (qctx->qtype == dns_rdatatype_any &&
- qctx->rdataset->type == dns_rdatatype_ns)
- {
+ if (qctx->rdataset->type == dns_rdatatype_ns) {
qctx->answer_has_ns = true;
}
- /*
- * Note: if we're in this function, then qctx->type
- * is guaranteed to be ANY, but qctx->qtype (i.e. the
- * original type requested) might have been RRSIG or
- * SIG; we need to check for that.
- */
- if (qctx->is_zone && qctx->qtype == dns_rdatatype_any &&
- !dns_db_issecure(qctx->db) &&
+ if (qctx->is_zone && !dns_db_issecure(qctx->db) &&
dns_rdatatype_isdnssec(qctx->rdataset->type))
{
/*
@@ -7424,8 +7414,7 @@ query_respond_any(query_ctx_t *qctx) {
hidden = true;
} else if (qctx->view->minimal_any &&
!qctx->client->inner.wantdnssec &&
- qctx->qtype == dns_rdatatype_any &&
- (dns_rdatatype_issig(qctx->rdataset->type)))
+ dns_rdatatype_issig(qctx->rdataset->type))
{
CCTRACE(ISC_LOG_DEBUG(5), "query_respond_any: "
"minimal-any skip signature");
@@ -7443,10 +7432,7 @@ query_respond_any(query_ctx_t *qctx) {
!PENDINGOK(qctx->client->query.dboptions))
{
dns_rdataset_disassociate(qctx->rdataset);
- } else if ((qctx->qtype == dns_rdatatype_any ||
- qctx->rdataset->type == qctx->qtype) &&
- !qctx->rdataset->attributes.negative)
- {
+ } else if (!qctx->rdataset->attributes.negative) {
if (qctx->rdataset->attributes.noqname &&
qctx->client->inner.wantdnssec)
{
@@ -7536,32 +7522,6 @@ query_respond_any(query_ctx_t *qctx) {
*/
query_addauth_ns(qctx);
query_addauth_wildcardproof(qctx, wildcardproof);
- } else if (dns_rdatatype_issig(qctx->qtype)) {
- /*
- * No matching rdatasets were found, but we got
- * here on a search for RRSIG/SIG, so that's okay.
- */
- if (!qctx->is_zone) {
- qctx->authoritative = false;
- qctx->client->inner.ra = false;
- query_addauth_ns(qctx);
- query_addauth_wildcardproof(qctx, wildcardproof);
- return ns_query_done(qctx);
- }
-
- if (qctx->qtype == dns_rdatatype_rrsig &&
- dns_db_issecure(qctx->db))
- {
- char namebuf[DNS_NAME_FORMATSIZE];
- dns_name_format(qctx->client->query.qname, namebuf,
- sizeof(namebuf));
- ns_client_log(qctx->client, DNS_LOGCATEGORY_DNSSEC,
- NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
- "missing signature for %s", namebuf);
- }
-
- qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
- return query_sign_nodata(qctx);
} else if (!hidden) {
/*
* No matching rdatasets were found and nothing was