diff -urp bind-9.3.3/lib/dns/include/dns/validator.h bind-9.3.4/lib/dns/include/dns/validator.h --- bind-9.3.3/lib/dns/include/dns/validator.h 2006-01-06 01:01:42.000000000 +0100 +++ bind-9.3.4/lib/dns/include/dns/validator.h 2007-01-11 05:51:39.000000000 +0100 @@ -144,6 +144,7 @@ struct dns_validator { * dns_validator_create() options. */ #define DNS_VALIDATOR_DLV 1U +#define DNS_VALIDATOR_DEFER 2U ISC_LANG_BEGINDECLS @@ -192,6 +193,15 @@ dns_validator_create(dns_view_t *view, d */ void +dns_validator_send(dns_validator_t *validator); +/*%< + * Send a deferred validation request + * + * Requires: + * 'validator' to points to a valid DNSSEC validator. + */ + +void dns_validator_cancel(dns_validator_t *validator); /*%< * Cancel a DNSSEC validation in progress. diff -urp bind-9.3.3/lib/dns/resolver.c bind-9.3.4/lib/dns/resolver.c --- bind-9.3.3/lib/dns/resolver.c 2006-08-31 05:57:11.000000000 +0200 +++ bind-9.3.4/lib/dns/resolver.c 2007-01-11 06:05:10.000000000 +0100 @@ -351,6 +356,7 @@ static isc_result_t ncache_adderesult(dn dns_rdataset_t *ardataset, isc_result_t *eresultp); static void validated(isc_task_t *task, isc_event_t *event); +static void maybe_destroy(fetchctx_t *fctx); static isc_result_t valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name, @@ -369,6 +375,9 @@ valcreate(fetchctx_t *fctx, dns_adbaddri valarg->fctx = fctx; valarg->addrinfo = addrinfo; + if (!ISC_LIST_EMPTY(fctx->validators)) + INSIST((valoptions & DNS_VALIDATOR_DEFER) != 0); + result = dns_validator_create(fctx->res->view, name, type, rdataset, sigrdataset, fctx->rmessage, valoptions, task, validated, valarg, @@ -973,6 +985,8 @@ fctx_query(fetchctx_t *fctx, dns_adbaddr if (result != ISC_R_SUCCESS) return (result); + INSIST(ISC_LIST_EMPTY(fctx->validators)); + dns_message_reset(fctx->rmessage, DNS_MESSAGE_INTENTPARSE); query = isc_mem_get(res->mctx, sizeof(*query)); @@ -3093,12 +3110,21 @@ maybe_destroy(fetchctx_t *fctx) { unsigned int bucketnum; isc_boolean_t bucket_empty = ISC_FALSE; dns_resolver_t *res = fctx->res; + dns_validator_t *validator; REQUIRE(SHUTTINGDOWN(fctx)); - if (fctx->pending != 0 || !ISC_LIST_EMPTY(fctx->validators)) + if (fctx->pending != 0 || fctx->nqueries != 0) return; + for (validator = ISC_LIST_HEAD(fctx->validators); + validator != NULL; + validator = ISC_LIST_HEAD(fctx->validators)) { + ISC_LIST_UNLINK(fctx->validators, validator, link); + dns_validator_cancel(validator); + dns_validator_destroy(&validator); + } + bucketnum = fctx->bucketnum; LOCK(&res->buckets[bucketnum].lock); if (fctx->references == 0) @@ -3232,7 +3258,9 @@ validated(isc_task_t *task, isc_event_t add_bad(fctx, &addrinfo->sockaddr, result); isc_event_free(&event); UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); - if (sentresponse) + if (!ISC_LIST_EMPTY(fctx->validators)) + dns_validator_send(ISC_LIST_HEAD(fctx->validators)); + else if (sentresponse) fctx_done(fctx, result); /* Locks bucket. */ else fctx_try(fctx); /* Locks bucket. */ @@ -3330,6 +3358,7 @@ validated(isc_task_t *task, isc_event_t * be validated. */ UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock); + dns_validator_send(ISC_LIST_HEAD(fctx->validators)); goto cleanup_event; } @@ -3640,6 +3669,13 @@ cache_name(fetchctx_t *fctx, dns_name_t rdataset, sigrdataset, valoptions, task); + /* + * Defer any further validations. + * This prevents multiple validators + * from manipulating fctx->rmessage + * simultaniously. + */ + valoptions |= DNS_VALIDATOR_DEFER; } } else if (CHAINING(rdataset)) { if (rdataset->type == dns_rdatatype_cname) diff -urp bind-9.3.3/lib/dns/validator.c bind-9.3.4/lib/dns/validator.c --- bind-9.3.3/lib/dns/validator.c 2006-02-27 00:03:52.000000000 +0100 +++ bind-9.3.4/lib/dns/validator.c 2007-01-11 05:51:39.000000000 +0100 @@ -2825,7 +2825,8 @@ dns_validator_create(dns_view_t *view, d ISC_LINK_INIT(val, link); val->magic = VALIDATOR_MAGIC; - isc_task_send(task, ISC_EVENT_PTR(&event)); + if ((options & DNS_VALIDATOR_DEFER) == 0) + isc_task_send(task, ISC_EVENT_PTR(&event)); *validatorp = val; @@ -2843,6 +2844,21 @@ dns_validator_create(dns_view_t *view, d } void +dns_validator_send(dns_validator_t *validator) { + isc_event_t *event; + REQUIRE(VALID_VALIDATOR(validator)); + + LOCK(&validator->lock); + + INSIST((validator->options & DNS_VALIDATOR_DEFER) != 0); + event = (isc_event_t *)validator->event; + validator->options &= ~DNS_VALIDATOR_DEFER; + UNLOCK(&validator->lock); + + isc_task_send(validator->task, ISC_EVENT_PTR(&event)); +} + +void dns_validator_cancel(dns_validator_t *validator) { REQUIRE(VALID_VALIDATOR(validator)); @@ -2856,6 +2872,12 @@ dns_validator_cancel(dns_validator_t *va if (validator->subvalidator != NULL) dns_validator_cancel(validator->subvalidator); + if ((validator->options & DNS_VALIDATOR_DEFER) != 0) { + isc_task_t *task = validator->event->ev_sender; + validator->options &= ~DNS_VALIDATOR_DEFER; + isc_event_free((isc_event_t **)&validator->event); + isc_task_detach(&task); + } } UNLOCK(&validator->lock); }