fix NSEC3s for DS no data (mode 1)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 3ca60de48c924a5838131d0191d2fd9cb5f54e18..c946f9d38d208d3aeb208dfc28e472daf8ab208f 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -550,7 +550,7 @@ static void decrementHash(std::string& raw) // I wonder if this is correct, cmou
 }
 
 
-bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hashed, bool decrement, string& unhashed, string& before, string& after)
+bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hashed, bool decrement, string& unhashed, string& before, string& after, int mode)
 {
   bool ret;
   if(narrow) { // nsec3-narrow
@@ -564,7 +564,7 @@ bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hash
     incrementHash(after);
   }
   else {
-    if (decrement)
+    if (decrement || mode ==1)
       before.clear();
     else
       before=' ';
@@ -587,6 +587,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
     return;
   }
 
+  bool doNextcloser = false;
   string unhashed, hashed, before, after;
   string closest;
 
@@ -596,33 +597,41 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
   } else
     closest=target;
 
-  if (mode == 1) {
-    DNSResourceRecord rr;
-    while( chopOff( closest ) && (closest != sd.qname))  { // stop at SOA
-      B.lookup(QType(QType::ANY), closest, p, sd.domain_id);
-      if (B.get(rr)) {
-        while(B.get(rr));
-        break;
-      }
-    }
-  }
-
   // add matching NSEC3 RR
   // we used to skip this one for mode 3, but old BIND needs it
   // see https://github.com/PowerDNS/pdns/issues/814
   if (mode != 3 || g_addSuperfluousNSEC3) {
-    unhashed=(mode == 0 || mode == 5) ? target : closest;
-
+    unhashed=(mode == 0 || mode == 1 || mode == 5) ? target : closest;
     hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
     DLOG(L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
 
-    getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after);
+    getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after, mode);
+
+    if (mode == 1 && (hashed != before)) {
+      DLOG(L<<"No matching NSEC3 for DS, do closest (provable) encloser"<<endl);
+
+      DNSResourceRecord rr;
+      while( chopOff( closest ) && (closest != sd.qname))  { // stop at SOA
+        B.lookup(QType(QType::ANY), closest, p, sd.domain_id);
+        if (B.get(rr)) {
+          while(B.get(rr));
+          break;
+        }
+      }
+      doNextcloser = true;
+      unhashed=closest;
+      hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed)
+      DLOG(L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
+
+      getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after);
+    }
+
     DLOG(L<<"Done calling for matching, hashed: '"<<toBase32Hex(hashed)<<"' before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"'"<<endl);
     emitNSEC3(ns3rc, sd, unhashed, before, after, target, r, mode);
   }
 
   // add covering NSEC3 RR
-  if (mode != 0 && mode != 5) {
+  if ((mode >= 2 && mode <= 4) || doNextcloser) {
     string next(target);
     do {
       unhashed=next;

diff --git a/pdns/packethandler.hh b/pdns/packethandler.hh
index ac60b36df911491858d5163c025e34b63a73022c..b8f61a94cc37f1e33e1d220017c11cbacfaf714a 100644 (file)
--- a/pdns/packethandler.hh
+++ b/pdns/packethandler.hh
@@ -115,5 +115,5 @@ private:
   DNSSECKeeper d_dk; // same, might even share B?
 };
 void emitNSEC3(DNSBackend& B, const NSEC3PARAMRecordContent& ns3prc, const SOAData& sd, const std::string& unhashed, const std::string& begin, const std::string& end, const std::string& toNSEC3, DNSPacket *r, int mode);
-bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hashed, bool decrement, string& unhashed, string& before, string& after);
+bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hashed, bool decrement, string& unhashed, string& before, string& after, int mode=0);
 #endif /* PACKETHANDLER */

diff --git a/regression-tests/.gitignore b/regression-tests/.gitignore
index 48dd9087f3f4dbc738bfedff3e78873194ab13ea..7e7cda0e779f4e092fbcc5a481f9e6ec25aae401 100644 (file)
--- a/regression-tests/.gitignore
+++ b/regression-tests/.gitignore
@@ -31,8 +31,8 @@ real_result
 /nsd.*
 /nsd-slave.*
 /*.nsd
-/ixfr-slave.db
-/ixfr-slave.state
+/ixfr*.db
+/ixfr*.state
 /*.signed
 /*.bind
 /dsset-*

diff --git a/regression-tests/1dyndns-update-delegate-in-between/expected_result.narrow b/regression-tests/1dyndns-update-delegate-in-between/expected_result.narrow
index 008635edce3633c248d384ca6546210d96c1be85..0d05ebcf97da01523ccb8a64ac3b76578490b4df 100644 (file)
--- a/regression-tests/1dyndns-update-delegate-in-between/expected_result.narrow
+++ b/regression-tests/1dyndns-update-delegate-in-between/expected_result.narrow
@@ -136,10 +136,8 @@ Reply to question for qname='a.host.test.dyndns.', qtype=ANY
 Rcode: 3, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='b.host.test.dyndns.', qtype=ANY
 1      c.host.test.dyndns.     IN      NS      3600    ns1.c.host.test.dyndns.
-1      fgun0ru4oe3g76tr551hg97mpu37b6mh.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FGUN0RU4OE3G76TR551HG97MPU37B6MJ
-1      fgun0ru4oe3g76tr551hg97mpu37b6mh.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd LMRSADK2BB62QPRUAULES5I5AP06CP56
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
+1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FGUN0RU4OE3G76TR551HG97MPU37B6MJ NS
+1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
 2      .       IN      OPT     32768   
 2      ns1.c.host.test.dyndns. IN      A       3600    192.168.0.1
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0
@@ -194,10 +192,8 @@ Reply to question for qname='a.a.host.test.dyndns.', qtype=ANY
 Rcode: 3, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='b.b.host.test.dyndns.', qtype=ANY
 1      c.host.test.dyndns.     IN      NS      3600    ns1.c.host.test.dyndns.
-1      fgun0ru4oe3g76tr551hg97mpu37b6mh.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FGUN0RU4OE3G76TR551HG97MPU37B6MJ
-1      fgun0ru4oe3g76tr551hg97mpu37b6mh.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd LMRSADK2BB62QPRUAULES5I5AP06CP56
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
+1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FGUN0RU4OE3G76TR551HG97MPU37B6MJ NS
+1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
 2      .       IN      OPT     32768   
 2      ns1.c.host.test.dyndns. IN      A       3600    192.168.0.1
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0

diff --git a/regression-tests/1dyndns-update-delegate-in-between/expected_result.nsec3 b/regression-tests/1dyndns-update-delegate-in-between/expected_result.nsec3
index 67eafa690dbf6fe9aa99eeb83e4b7996524c75fa..a81f3cf4c49fbf696c72ecc0f3e4bffb3c947457 100644 (file)
--- a/regression-tests/1dyndns-update-delegate-in-between/expected_result.nsec3
+++ b/regression-tests/1dyndns-update-delegate-in-between/expected_result.nsec3
@@ -130,8 +130,6 @@ Reply to question for qname='b.host.test.dyndns.', qtype=ANY
 1      c.host.test.dyndns.     IN      NS      3600    ns1.c.host.test.dyndns.
 1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FQU365VN7BR5CSV8CG6NE9V8HA6D008P NS
 1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd LRESBBP3LV8BLGJ9FSGTDMM4Q7VJ3D6J
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
 2      .       IN      OPT     32768   
 2      ns1.c.host.test.dyndns. IN      A       3600    192.168.0.1
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0
@@ -184,8 +182,6 @@ Reply to question for qname='b.b.host.test.dyndns.', qtype=ANY
 1      c.host.test.dyndns.     IN      NS      3600    ns1.c.host.test.dyndns.
 1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd FQU365VN7BR5CSV8CG6NE9V8HA6D008P NS
 1      fgun0ru4oe3g76tr551hg97mpu37b6mi.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      NSEC3   86400   1 [flags] 1 abcd LRESBBP3LV8BLGJ9FSGTDMM4Q7VJ3D6J
-1      lmrsadk2bb62qpruaules5i5ap06cp55.test.dyndns.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.dyndns. ...
 2      .       IN      OPT     32768   
 2      ns1.c.host.test.dyndns. IN      A       3600    192.168.0.1
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0

diff --git a/regression-tests/ds-at-unsecure-delegation/expected_result.narrow b/regression-tests/ds-at-unsecure-delegation/expected_result.narrow
index 9f73d539029d3638f4a0cb6ec62e6c60c3536173..d3ca5742fe4c4bbe80f7c6a99d9e1a306f991d5a 100644 (file)
--- a/regression-tests/ds-at-unsecure-delegation/expected_result.narrow
+++ b/regression-tests/ds-at-unsecure-delegation/expected_result.narrow
@@ -1,9 +1,7 @@
 1      example.com.    IN      RRSIG   86400   SOA 8 2 100000 [expiry] [inception] [keytag] example.com. ...
 1      example.com.    IN      SOA     86400   ns1.example.com. ahu.example.com. 2000081501 28800 7200 604800 86400
-1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      NSEC3   86400   1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1
-1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   86400   1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
+1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      NSEC3   86400   1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1 NS
+1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 2      .       IN      OPT     32768   
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='usa.example.com.', qtype=DS

diff --git a/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3 b/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
index ee1c7ae721e17f9bead988978c63e8ae62f92191..c530967deb8f5ad7715a6ea2b8dced48cc365abe 100644 (file)
--- a/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
+++ b/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
@@ -2,8 +2,6 @@
 1      example.com.    IN      SOA     86400   ns1.example.com. ahu.example.com. 2000081501 28800 7200 604800 86400
 1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      NSEC3   86400   1 0 1 abcd T6A44A7N1B90T5RIS4IBQKT51MMDL0LO NS
 1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   86400   1 0 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 2      .       IN      OPT     32768   
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='usa.example.com.', qtype=DS

diff --git a/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow b/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow
index 8b9130ea2034a25582104bc97d39d8bec9dace8f..f9249b8438eddd4ba177084771b1474ba460d28d 100644 (file)
--- a/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow
+++ b/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow
@@ -1,9 +1,7 @@
-1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoi.dnssec-parent.com.     IN      NSEC3   86400   1 1 1 abcd BE6IQH4FJRTDHACQK7G3IQ96QCVF2QOK
-1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoi.dnssec-parent.com.     IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
+1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoj.dnssec-parent.com.     IN      NSEC3   86400   1 1 1 abcd BE6IQH4FJRTDHACQK7G3IQ96QCVF2QOK NS
+1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoj.dnssec-parent.com.     IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
 1      dnssec-parent.com.      IN      RRSIG   3600    SOA 8 2 3600 [expiry] [inception] [keytag] dnssec-parent.com. ...
 1      dnssec-parent.com.      IN      SOA     3600    ns1.dnssec-parent.com. ahu.example.com. 2005092501 28800 7200 604800 86400
-1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      NSEC3   86400   1 1 1 abcd DVKUO8KJA65GCSQ600E6DI9U719LSJ8V A NS SOA RRSIG DNSKEY NSEC3PARAM
-1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
 2      .       IN      OPT     32768   
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='delegated.dnssec-parent.com.', qtype=DS

diff --git a/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3 b/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3
index 1f701a8d3c617713e491bd7a5722064a24473228..2b43c449a7960935804e482eaeaa367a18d0adab 100644 (file)
--- a/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3
+++ b/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3
@@ -2,8 +2,6 @@
 1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoj.dnssec-parent.com.     IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
 1      dnssec-parent.com.      IN      RRSIG   3600    SOA 8 2 3600 [expiry] [inception] [keytag] dnssec-parent.com. ...
 1      dnssec-parent.com.      IN      SOA     3600    ns1.dnssec-parent.com. ahu.example.com. 2005092501 28800 7200 604800 86400
-1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      NSEC3   86400   1 0 1 abcd 1SCAQA30LQ0DO5EIRNE4KPJFBEBFGR54 A NS SOA RRSIG DNSKEY NSEC3PARAM
-1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] dnssec-parent.com. ...
 2      .       IN      OPT     32768   
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
 Reply to question for qname='delegated.dnssec-parent.com.', qtype=DS

diff --git a/regression-tests/ds-inside-delegation/expected_result.narrow b/regression-tests/ds-inside-delegation/expected_result.narrow
index 7a75ea1a070cd13982f50df834f470c9550ce6e7..791dc0cb8241b090c39dd061f3b03975ccaf3382 100644 (file)
--- a/regression-tests/ds-inside-delegation/expected_result.narrow
+++ b/regression-tests/ds-inside-delegation/expected_result.narrow
@@ -1,9 +1,7 @@
-1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      NSEC3   86400   1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1
-1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
+1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      NSEC3   86400   1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1 NS
+1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 1      usa.example.com.        IN      NS      120     usa-ns1.usa.example.com.
 1      usa.example.com.        IN      NS      120     usa-ns2.usa.example.com.
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   86400   1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 2      .       IN      OPT     32768   
 2      usa-ns1.usa.example.com.        IN      A       120     192.168.4.1
 2      usa-ns2.usa.example.com.        IN      A       120     192.168.4.2

diff --git a/regression-tests/ds-inside-delegation/expected_result.nsec3 b/regression-tests/ds-inside-delegation/expected_result.nsec3
index c676fcb59bb8faf96b5ac8a5f6ab6da3c498d341..760c1dac4b01b665c41954a326159b45bad6bbce 100644 (file)
--- a/regression-tests/ds-inside-delegation/expected_result.nsec3
+++ b/regression-tests/ds-inside-delegation/expected_result.nsec3
@@ -2,8 +2,6 @@
 1      t67rqvqprigd7rtb5fah6c3o7g9th3j0.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 1      usa.example.com.        IN      NS      120     usa-ns1.usa.example.com.
 1      usa.example.com.        IN      NS      120     usa-ns2.usa.example.com.
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   86400   1 0 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
 2      .       IN      OPT     32768   
 2      usa-ns1.usa.example.com.        IN      A       120     192.168.4.1
 2      usa-ns2.usa.example.com.        IN      A       120     192.168.4.2

diff --git a/regression-tests/nsec-glue-at-delegation/expected_result.narrow b/regression-tests/nsec-glue-at-delegation/expected_result.narrow
index 78cb4a2331b4e29f56ddb583bd911ae8a7c20ca5..3f7a5a216063d7acb5ac7062879d63e07c735f35 100644 (file)
--- a/regression-tests/nsec-glue-at-delegation/expected_result.narrow
+++ b/regression-tests/nsec-glue-at-delegation/expected_result.narrow
@@ -1,8 +1,6 @@
-1      2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.      IN      NSEC3   86400   1 1 1 abcd 2EU2GULBU53H9UVHFALSHPBO2A83T6L3 NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.      IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
 1      blah.test.com.  IN      NS      3600    blah.test.com.
-1      s96h2qicbt8d9i5aa43kp8sjjresq4ka.test.com.      IN      NSEC3   86400   1 1 1 abcd S96H2QICBT8D9I5AA43KP8SJJRESQ4KC
-1      s96h2qicbt8d9i5aa43kp8sjjresq4ka.test.com.      IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
+1      s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.      IN      NSEC3   86400   1 1 1 abcd S96H2QICBT8D9I5AA43KP8SJJRESQ4KC NS
+1      s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.      IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
 2      .       IN      OPT     32768   
 2      blah.test.com.  IN      A       3600    192.168.6.1
 Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0

diff --git a/regression-tests/nsec-glue-at-delegation/expected_result.nsec3 b/regression-tests/nsec-glue-at-delegation/expected_result.nsec3
index b018eb0f68d4a91dc494a9ed2ecf139d10ef5ce7..d9e08e794772e0bae9edc9716d93d01fc880aa90 100644 (file)
--- a/regression-tests/nsec-glue-at-delegation/expected_result.nsec3
+++ b/regression-tests/nsec-glue-at-delegation/expected_result.nsec3
@@ -1,5 +1,3 @@
-1      2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.      IN      NSEC3   86400   1 0 1 abcd 2GKS2N3JPQF62QOHAVFQ1PHOLM3HR7RA NS SOA MX RRSIG DNSKEY NSEC3PARAM
-1      2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.      IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
 1      blah.test.com.  IN      NS      3600    blah.test.com.
 1      s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.      IN      NSEC3   86400   1 0 1 abcd SA5VVPQN1COEJGJ3HBKFEKDNII8KKSQA NS
 1      s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.      IN      RRSIG   86400   NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...