From: bert hubert <bert.hubert@netherlabs.nl>
Date: Fri, 1 Jul 2016 13:50:03 +0000 (+0200)
Subject: fix up arpa/com.co insecure delegations
X-Git-Tag: rec-4.0.0~28
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0b1df3315428aed45b24fbac42d9c5fdabe23f57;p=thirdparty%2Fpdns.git

fix up arpa/com.co insecure delegations
---

diff --git a/pdns/validate.cc b/pdns/validate.cc
index b5e126d5f7..38a7be2577 100644
--- a/pdns/validate.cc
+++ b/pdns/validate.cc
@@ -388,8 +388,12 @@ vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, keyset_t &keyset)
               if(nsec) {
                 if(v.first.first == qname && !nsec->d_set.count(QType::DS))
                   return Insecure;
+                else if(v.first.first < qname && qname < nsec->d_next ) {
+                  LOG("Did not find DS for this level, trying one lower"<<endl);
+                  goto skipLevel;
+                }
                 else {
-                  LOG("Did not deny existence of DS, "<<v.first.first<<"?="<<qname<<", "<<nsec->d_set.count(QType::DS)<<endl);
+                  LOG("Did not deny existence of DS, "<<v.first.first<<"?="<<qname<<", "<<nsec->d_set.count(QType::DS)<<", next: "<<nsec->d_next<<endl);
                 }
               }
             }
@@ -442,6 +446,7 @@ vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, keyset_t &keyset)
         dState dres = getDenial(validrrsets, qname, QType::DS);
         if(dres == INSECURE) return Insecure;
       }
+    skipLevel:;
     } while(!dsmap.size() && labels.size());
 
     // break;