respond correctly to DS query at delegation in unsigned zone

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 36ad75e2ef2ba599da0cdf55af9d08ef527b1173..1299407cee1a88e7f401eb8804815033406bc32e 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1435,8 +1435,8 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
 
 
     DLOG(g_log<<"After first ANY query for '"<<target<<"', id="<<sd.domain_id<<": weDone="<<weDone<<", weHaveUnauth="<<weHaveUnauth<<", weRedirected="<<weRedirected<<", haveAlias='"<<haveAlias<<"'"<<endl);
-    if(p->qtype.getCode() == QType::DS && weHaveUnauth &&  !weDone && !weRedirected && d_dk.isSecuredZone(sd.qname)) {
-      DLOG(g_log<<"Q for DS of a name for which we do have NS, but for which we don't have on a zone with DNSSEC need to provide an AUTH answer that proves we don't"<<endl);
+    if(p->qtype.getCode() == QType::DS && weHaveUnauth &&  !weDone && !weRedirected) {
+      DLOG(g_log<<"Q for DS of a name for which we do have NS, but for which we don't have DS; need to provide an AUTH answer that shows we don't"<<endl);
       makeNOError(p, r, target, DNSName(), sd, 1);
       goto sendit;
     }

diff --git a/regression-tests/tests/ds-at-unsecure-delegation/expected_result b/regression-tests/tests/ds-at-unsecure-delegation/expected_result
index de91e66b7fadb0b0b8b7c3f117993b4f777a3c28..a43425bed7a19c2c96184fce80428e14776e146f 100644 (file)
--- a/regression-tests/tests/ds-at-unsecure-delegation/expected_result
+++ b/regression-tests/tests/ds-at-unsecure-delegation/expected_result
@@ -1,7 +1,4 @@
-1      example.com.    IN      RRSIG   86400   SOA 13 2 100000 [expiry] [inception] [keytag] example.com. ...
 1      example.com.    IN      SOA     86400   ns1.example.com. ahu.example.com. 2847484148 28800 7200 604800 86400
-1      usa.example.com.        IN      NSEC    86400   *.w1.example.com. NS RRSIG NSEC
-1      usa.example.com.        IN      RRSIG   86400   NSEC 13 3 86400 [expiry] [inception] [keytag] example.com. ...
 2      .       IN      OPT     32768   
 Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='usa.example.com.', qtype=DS

diff --git a/regression-tests/tests/ds-at-unsecure-delegation/expected_result.dnssec b/regression-tests/tests/ds-at-unsecure-delegation/expected_result.dnssec
new file mode 100644 (file)
index 0000000..de91e66
--- /dev/null
+++ b/regression-tests/tests/ds-at-unsecure-delegation/expected_result.dnssec
@@ -0,0 +1,7 @@
+1      example.com.    IN      RRSIG   86400   SOA 13 2 100000 [expiry] [inception] [keytag] example.com. ...
+1      example.com.    IN      SOA     86400   ns1.example.com. ahu.example.com. 2847484148 28800 7200 604800 86400
+1      usa.example.com.        IN      NSEC    86400   *.w1.example.com. NS RRSIG NSEC
+1      usa.example.com.        IN      RRSIG   86400   NSEC 13 3 86400 [expiry] [inception] [keytag] example.com. ...
+2      .       IN      OPT     32768   
+Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
+Reply to question for qname='usa.example.com.', qtype=DS

diff --git a/regression-tests/tests/ds-at-unsecure-delegation/skip.nodnssec b/regression-tests/tests/ds-at-unsecure-delegation/skip.nodnssec
deleted file mode 100644 (file)
index e69de29..0000000

diff --git a/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result b/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result
index 459ce0f0894d0809120da828fff043a85523bec4..1f8a9c6c79ec2193c2c6de0fa3c5954097e2253a 100644 (file)
--- a/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result
+++ b/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result
@@ -1,6 +1,3 @@
-1      delegated.dnssec-parent.com.    IN      NSEC    86400   ns1.dnssec-parent.com. NS RRSIG NSEC
-1      delegated.dnssec-parent.com.    IN      RRSIG   86400   NSEC 13 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
-1      dnssec-parent.com.      IN      RRSIG   3600    SOA 13 2 3600 [expiry] [inception] [keytag] dnssec-parent.com. ...
 1      dnssec-parent.com.      IN      SOA     3600    ns1.dnssec-parent.com. ahu.example.com. 2005092501 28800 7200 604800 86400
 2      .       IN      OPT     32768   
 Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0

diff --git a/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result.dnssec b/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result.dnssec
new file mode 100644 (file)
index 0000000..459ce0f
--- /dev/null
+++ b/regression-tests/tests/ds-at-unsecure-zone-cut/expected_result.dnssec
@@ -0,0 +1,7 @@
+1      delegated.dnssec-parent.com.    IN      NSEC    86400   ns1.dnssec-parent.com. NS RRSIG NSEC
+1      delegated.dnssec-parent.com.    IN      RRSIG   86400   NSEC 13 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
+1      dnssec-parent.com.      IN      RRSIG   3600    SOA 13 2 3600 [expiry] [inception] [keytag] dnssec-parent.com. ...
+1      dnssec-parent.com.      IN      SOA     3600    ns1.dnssec-parent.com. ahu.example.com. 2005092501 28800 7200 604800 86400
+2      .       IN      OPT     32768   
+Rcode: 0 (No Error), RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
+Reply to question for qname='delegated.dnssec-parent.com.', qtype=DS

diff --git a/regression-tests/tests/ds-at-unsecure-zone-cut/skip.nodnssec b/regression-tests/tests/ds-at-unsecure-zone-cut/skip.nodnssec
deleted file mode 100644 (file)
index e69de29..0000000