From 7cbc52557d42ff64af8d5368ab5df3437e9ceb35 Mon Sep 17 00:00:00 2001
From: Christian Hofstaedtler <christian.hofstaedtler@deduktiva.com>
Date: Thu, 6 Oct 2016 16:18:09 +0200
Subject: [PATCH] API: search should not return ENTs

This should also fix #4534, when backported.
---
 pdns/ws-auth.cc                     |  3 +++
 regression-tests.api/runtests.py    | 11 +++++++++--
 regression-tests.api/test_Zones.py  | 22 ++++++++++++++++++++--
 regression-tests.api/test_helper.py |  7 +++++++
 4 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 2960be0563..a1d7ec0d9e 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -1522,6 +1522,9 @@ static void apiServerSearchData(HttpRequest* req, HttpResponse* resp) {
   {
     for(const DNSResourceRecord& rr: result_rr)
     {
+      if (!rr.qtype.getCode())
+        continue; // skip empty non-terminals
+
       auto object = Json::object {
         { "object_type", "record" },
         { "name", rr.qname.toString() },
diff --git a/regression-tests.api/runtests.py b/regression-tests.api/runtests.py
index cb66a4880e..97efcf3a63 100755
--- a/regression-tests.api/runtests.py
+++ b/regression-tests.api/runtests.py
@@ -13,6 +13,7 @@ import time
 SQLITE_DB = 'pdns.sqlite3'
 WEBPORT = '5556'
 APIKEY = '1234567890abcdefghijklmnopq-key'
+PDNSUTIL_CMD = ["../pdns/pdnsutil", "--config-dir=."]
 
 NAMED_CONF_TPL = """
 # Generated by runtests.py
@@ -100,7 +101,7 @@ if daemon == 'authoritative':
     with open('pdns.conf', 'w') as named_conf:
         named_conf.write(AUTH_CONF_TPL)
 
-    subprocess.check_call(["../pdns/pdnsutil", "--config-dir=.", "secure-zone", "powerdnssec.org"])
+    subprocess.check_call(PDNSUTIL_CMD + ["secure-zone", "powerdnssec.org"])
     pdnscmd = ("../pdns/pdns_server --daemon=no --local-address=127.0.0.1 --local-port=5300 --socket-dir=./ --no-shuffle --dnsupdate=yes --cache-ttl=0 --config-dir=. --api=yes --webserver-port="+WEBPORT+" --webserver-address=127.0.0.1 --api-key="+APIKEY).split()
 
 else:
@@ -141,7 +142,13 @@ print "Running tests..."
 rc = 0
 test_env = {}
 test_env.update(os.environ)
-test_env.update({'WEBPORT': WEBPORT, 'APIKEY': APIKEY, 'DAEMON': daemon, 'SQLITE_DB': SQLITE_DB})
+test_env.update({
+    'WEBPORT': WEBPORT,
+    'APIKEY': APIKEY,
+    'DAEMON': daemon,
+    'SQLITE_DB': SQLITE_DB,
+    'PDNSUTIL_CMD': ' '.join(PDNSUTIL_CMD),
+})
 
 try:
     print ""
diff --git a/regression-tests.api/test_Zones.py b/regression-tests.api/test_Zones.py
index 45efc0464a..64a5b8e809 100644
--- a/regression-tests.api/test_Zones.py
+++ b/regression-tests.api/test_Zones.py
@@ -3,7 +3,7 @@ import time
 import unittest
 from copy import deepcopy
 from pprint import pprint
-from test_helper import ApiTestCase, unique_zone_name, is_auth, is_recursor, get_db_records
+from test_helper import ApiTestCase, unique_zone_name, is_auth, is_recursor, get_db_records, pdnsutil_rectify
 
 
 def get_rrset(data, qname, qtype):
@@ -1147,6 +1147,25 @@ fred   IN  A      192.168.0.4
         # should return zone, SOA, ns1, ns2
         self.assertEquals(len(r.json()), 4)
 
+    def test_search_after_rectify_with_ent(self):
+        name = 'search-rectified.name.'
+        rrset = {
+            "name": 'sub.sub.' + name,
+            "type": "A",
+            "ttl": 3600,
+            "records": [{
+                "content": "4.3.2.1",
+                "disabled": False,
+            }],
+        }
+        self.create_zone(name=name, rrsets=[rrset])
+        pdnsutil_rectify(name)
+        r = self.session.get(self.url("/api/v1/servers/localhost/search-data?q=*search-rectified*"))
+        self.assert_success_json(r)
+        print r.json()
+        # should return zone, SOA, ns1, ns2, sub.sub A (but not the ENT)
+        self.assertEquals(len(r.json()), 5)
+
 
 @unittest.skipIf(not is_auth(), "Not applicable")
 class AuthRootZone(ApiTestCase, AuthZonesHelperMixin):
@@ -1246,7 +1265,6 @@ class RecursorZones(ApiTestCase):
             self.assertEquals(data[k], payload[k])
 
     def test_create_zone_no_name(self):
-        name = unique_zone_name()
         payload = {
             'name': '',
             'kind': 'Native',
diff --git a/regression-tests.api/test_helper.py b/regression-tests.api/test_helper.py
index 21f54ac379..14c2ea4c21 100644
--- a/regression-tests.api/test_helper.py
+++ b/regression-tests.api/test_helper.py
@@ -4,8 +4,10 @@ import requests
 import urlparse
 import unittest
 import sqlite3
+import subprocess
 
 DAEMON = os.environ.get('DAEMON', 'authoritative')
+PDNSUTIL_CMD = os.environ.get('PDNSUTIL_CMD', 'NOT_SET BUT_THIS MIGHT_BE_A_LIST').split(' ')
 SQLITE_DB = os.environ.get('SQLITE_DB', 'pdns.sqlite3')
 
 
@@ -70,3 +72,8 @@ def get_db_records(zonename, qtype):
         recs = [{'name': row[0], 'type': row[1], 'content': row[2], 'ttl': row[3]} for row in rows]
         print "DB Records:", recs
         return recs
+
+
+def pdnsutil_rectify(zonename):
+    """Run pdnsutil rectify-zone on the given zone."""
+    subprocess.check_call(PDNSUTIL_CMD + ['rectify-zone', zonename])
-- 
2.47.2