bind9/lib/dns
Evan Hunt 836825611d Don't synthesize negative responses with pending NSEC
If a cached record has not yet been validated and has trust
level pending, don't use it to synthesize negative responses.

Fixes: isc-projects/bind9#5872
Fixes: isc-projects/bind9#5887
Fixes: isc-projects/bind9#5977
(cherry picked from commit adb5c63e70)
2026-07-08 15:29:25 +02:00
..
include Add DNS_PRIVATE_BUFFERSIZE and use it 2026-07-03 04:07:30 +10:00
rdata Consume the preference before reading the locator in NID/L64/L32 tostruct 2026-07-02 10:55:30 +00:00
.gitignore
acl.c Use ControlStatementsExceptControlMacros for SpaceBeforeParens 2025-08-19 08:08:23 +02:00
adb.c Disable UPDATE and NOTIFY for non-IN classes 2026-05-07 13:09:18 +02:00
badcache.c Fix use-after-free when destroying the bad and unreachable caches 2026-06-24 15:49:56 +02:00
byaddr.c Use clang-format-20 to update formatting 2025-06-25 13:32:08 +10:00
cache.c
callbacks.c
catz.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
client.c Fix memory context leak in dns_client_resolve() error path 2026-03-16 10:50:22 +01:00
clientinfo.c
compress.c
db.c Fix assertion failure in dns_db_findrdataset() for SIG records 2026-04-17 19:24:13 +02:00
db_p.h
dbiterator.c Implement dns_dbiterator_seek3 2025-12-11 13:53:25 +01:00
diff.c Remove name boundary optimization 2026-06-01 13:49:55 +02:00
dispatch.c Add the tcp-reuse-timeout option 2026-06-25 11:37:51 +02:00
dlz.c
dns64.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
dnsrps.c
dnssec.c Remove CDs/CDNSKEY records on reconfig 2026-06-19 12:39:11 +02:00
dnstap.c Take 'env' reference before async calling perform_reopen() 2026-03-18 17:04:56 +00:00
dnstap.proto
ds.c
dst_api.c Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 20:54:22 +02:00
dst_internal.h Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 20:54:22 +02:00
dst_openssl.h
dst_parse.c Use isc__zero_or_more when calling isc_base64_tobuffer 2026-01-28 08:02:06 +11:00
dst_parse.h
dyndb.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
ecs.c
ede.c Don't copy EDE codes if source is same as destination 2025-04-02 16:42:23 +00:00
fixedname.c
forward.c
gen.c
geoip2.c Fix 'geoip' ACL matching bug 2026-06-11 16:15:45 +00:00
gssapi_link.c
gssapictx.c Fix output token and GSS context leaks in TKEY/GSS-API error paths 2026-05-07 13:09:18 +02:00
hmac_link.c Size HMAC key generation buffers to the maximum block size 2026-04-30 06:00:07 +02:00
ipkeylist.c
iptable.c
journal.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
kasp.c Implement named-checkconf -k (check keys) 2025-09-29 15:13:26 +02:00
key.c Don't check DNS_KEYFLAG_NOAUTH 2025-03-24 23:52:02 -07:00
keydata.c
keymgr.c Make keymgr state machine more robust 2025-12-05 13:22:00 +01:00
keystore.c Fix log level bug in keystore 2026-02-25 16:27:29 +00:00
keytable.c Fix rwlock type mismatch in delete_ds() error path 2026-03-17 23:25:21 +01:00
log.c
Makefile.am Add support for parsing DSYNC scheme mnemonics 2025-08-06 13:13:34 +10:00
master.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
masterdump.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
message.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
name.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
nametree.c
ncache.c
nsec.c Check that an NSEC signer is at or above the name to be validated 2026-06-24 21:50:08 +00:00
nsec3.c Add DNS_PRIVATE_BUFFERSIZE and use it 2026-07-03 04:07:30 +10:00
nta.c Hold a reference to the NTA table for the lifetime of each NTA 2026-05-06 09:33:11 +02:00
openssl_link.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
openssl_shim.c
openssl_shim.h Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 20:54:22 +02:00
opensslecdsa_link.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
openssleddsa_link.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
opensslrsa_link.c Enforce strict RSA DNSKEY shape during DNSSEC validation 2026-06-08 20:54:22 +02:00
order.c
peer.c
private.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
probes.d
qp.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
qp_p.h Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
qpcache.c Don't synthesize negative responses with pending NSEC 2026-07-08 15:29:25 +02:00
qpcache_p.h
qpzone.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
qpzone_p.h
rbt-cachedb.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
rbt-zonedb.c Check for secure data before caching CD=1 NXDOMAIN 2026-07-02 15:04:19 -07:00
rbt.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
rbtdb.c Check for secure data before caching CD=1 NXDOMAIN 2026-07-02 15:04:19 -07:00
rbtdb_p.h Check for secure data before caching CD=1 NXDOMAIN 2026-07-02 15:04:19 -07:00
rcode.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
rdata.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
rdatalist.c
rdataset.c Move setresign to rdataset.c and rename it 2026-01-29 09:13:02 +01:00
rdatasetiter.c
rdataslab.c Reject oversized RRsets at slab construction 2026-05-05 19:24:29 +02:00
remote.c
request.c Use sequential per-dispatch message IDs for TCP 2026-05-06 15:05:48 +02:00
resconf.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
resolver.c Check for secure data before caching CD=1 NXDOMAIN 2026-07-02 15:04:19 -07:00
result.c
rootns.c
rpz.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
rriterator.c
rrl.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
sdlz.c Implement dns_dbiterator_seek3 2025-12-11 13:53:25 +01:00
skr.c Importing invalid SKR file might overflow the stack buffer 2026-02-24 18:45:41 +00:00
soa.c
ssu.c
ssu_external.c
stats.c Use clang-format-20 to update formatting 2025-06-25 13:32:08 +10:00
tests
time.c Use clang-format-22 to update formatting 2026-03-04 12:18:27 +01:00
tkey.c Fix use-after-free in concurrent dns_tsigkey_delete() 2026-05-28 11:05:34 +02:00
transport.c
tsig.c Fix use-after-free in concurrent dns_tsigkey_delete() 2026-05-28 11:05:34 +02:00
tsig_p.h
ttl.c standardize CHECK and RETERR macros 2025-12-03 19:17:20 -08:00
update.c Stop leaking DNSSEC keys past the zone key limit 2026-07-01 14:04:36 +02:00
validator.c Restrict the alias-chain deadlock check to chaining CNAMEs 2026-07-08 12:23:45 +02:00
view.c Fix use-after-free when destroying the bad and unreachable caches 2026-06-24 15:49:56 +02:00
xfrin.c Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 21:15:17 +02:00
zone.c Fix memory leak bug during zone shutdown 2026-06-22 21:14:02 +00:00
zone_p.h
zonekey.c
zoneverify.c Check wildcard signer and NOQNAME signer match 2026-06-18 10:58:11 -07:00
zt.c