From: Kees Monshouwer Date: Wed, 9 Jul 2014 23:45:54 +0000 (+0200) Subject: don't add superfluous nsec3 for old bind X-Git-Tag: auth-3.4.0-rc1~91^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F1526%2Fhead;p=thirdparty%2Fpdns.git don't add superfluous nsec3 for old bind --- diff --git a/debian/config/pdns.conf b/debian/config/pdns.conf index 6fb80f48ff..d70154f7a2 100644 --- a/debian/config/pdns.conf +++ b/debian/config/pdns.conf @@ -1,9 +1,4 @@ # Autogenerated configuration file template -################################# -# add-superfluous-nsec3-for-old-bind Add superfluous NSEC3 record to positive wildcard response -# -# add-superfluous-nsec3-for-old-bind=yes - ################################# # allow-axfr-ips Allow zonetransfers only to these subnets # diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc index 5bfa4e92c0..1cbaaa7ade 100644 --- a/pdns/common_startup.cc +++ b/pdns/common_startup.cc @@ -156,7 +156,6 @@ void declareArguments() ::arg().setSwitch("traceback-handler","Enable the traceback handler (Linux only)")="yes"; ::arg().setSwitch("direct-dnskey","Fetch DNSKEY RRs from backend during DNSKEY synthesis")="no"; - ::arg().setSwitch("add-superfluous-nsec3-for-old-bind","Add superfluous NSEC3 record to positive wildcard response")="yes"; ::arg().set("default-ksk-algorithms","Default KSK algorithms")="rsasha256"; ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0"; ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256"; @@ -356,7 +355,6 @@ void mainthread() newuid=Utility::makeUidNumeric(::arg()["setuid"]); g_anyToTcp = ::arg().mustDo("any-to-tcp"); - g_addSuperfluousNSEC3 = ::arg().mustDo("add-superfluous-nsec3-for-old-bind"); DNSPacket::s_udpTruncationThreshold = std::max(512, ::arg().asNum("udp-truncation-threshold")); DNSPacket::s_doEDNSSubnetProcessing = ::arg().mustDo("edns-subnet-processing"); diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc index 001d7d0b71..bcd59d3e4c 100644 --- a/pdns/packethandler.cc +++ b/pdns/packethandler.cc @@ -642,9 +642,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c closest=target; // add matching NSEC3 RR - // we used to skip this one for mode 3, but old BIND needs it - // see https://github.com/PowerDNS/pdns/issues/814 - if (mode != 3 || g_addSuperfluousNSEC3) { + if (mode != 3) { unhashed=(mode == 0 || mode == 1 || mode == 5) ? target : closest; hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed); DLOG(L<<"1 hash: "<