- Fix bug when DLV below a trust-anchor that uses NSEC3 optout where

         the zone has a secure delegation hosted on the same server did not
         verify as secure (it was insecure by mistake).

git-svn-id: file:///svn/unbound/trunk@2275 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index b17b096060857c15d1eca0ce6fc22c6822c6dfce..6cc6f58331f2ddf3a04bace9e40994ae29c6b8cb 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+11 October 2010: Wouter
+       - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
+         the zone has a secure delegation hosted on the same server did not
+         verify as secure (it was insecure by mistake).
+
 1 October 2010: Wouter
        - test for unbound-anchor. fix for reading certs.
        - Fix alloc_reg_release for longer uptime in out of memory conditions.

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 3edae50b1b0fa483d3bfb103ff199c52fda628c1..62340f86139f7d4587cf7b5503e49712e90b8c49 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -938,7 +938,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
                        msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
                                qstate->region, qstate->env->rrset_cache,
                                qstate->env->scratch_buffer, 
-                               *qstate->env->now, 1/*add SOA*/);
+                               *qstate->env->now, 1/*add SOA*/, NULL);
                }
        }
        if(msg) {

diff --git a/testdata/dlv_optout.rpl b/testdata/dlv_optout.rpl
new file mode 100644 (file)
index 0000000..1b9d7b2
--- /dev/null
+++ b/testdata/dlv_optout.rpl
@@ -0,0 +1,437 @@
+; config options
+; The island of trust is at example.com (the DLV repository)
+server:
+       dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+       trust-anchor: "example.net.     3600    IN      DS      30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix"
+       val-override-date: "20070916134226"
+       target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+       name: "."
+       stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator, DLV to zone below optout, check negative cache.
+; DLV example.com.
+; trust anchor at example.net but no secure delegation to
+; sub.example.net  signed with DLV but not by parent.
+; parent uses optout NSEC3.
+; then a signed delegation to down.sub.example.net.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+       ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS        K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.    IN      A       193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.   IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.    IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN A
+SECTION AUTHORITY
+net.   IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.    IN      A       192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+       ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.   IN NS   ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.                IN      A       1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN A
+SECTION AUTHORITY
+example.net.   IN NS   ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.                IN      A       1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.   IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.                IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; DLV query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net.example.com. IN DLV
+SECTION ANSWER
+sub.example.net.example.com.   3600    IN      DLV     30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
+sub.example.net.example.com.   3600    IN      RRSIG   DLV 3 5 3600 20070926135752 20070829135752 2854 example.com. AAdhy87nuDEaxmc+k9pJHYnhKiEYL++OLPxzOdwEQOtsHi7jeD3lRDU= ;{id = 2854}
+SECTION AUTHORITY
+example.com.   IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.                IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+down.sub.example.net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.   3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+sub.example.net.example.com. IN NSEC zzz.example.net.example.com. RRSIG NSEC DLV
+sub.example.net.example.com.   3600    IN      RRSIG   NSEC 3 5 3600 20070926134150 20070829134150 2854 example.com. AG/M+H/lex1CMTIuO+JpdmTjCzt7XBsLtRLPDfYTykhxnnECzZwkMnQ= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.   3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
+example.com.   3600    IN      RRSIG   NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+com.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.   3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC sub.example.net.example.com. SOA NS RRSIG NSEC
+example.com.   3600    IN      RRSIG   NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. ALITtZY03PDWnuAeEL/5VwMIXY3iC2y7Qkeq5DgAHmPbNyWiOmJNEKg= ;{id = 2854}
+ENTRY_END
+
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.5
+; DS RR is
+; example.net. 3600    IN      DS      30899 5 1 14188c885f20623ad1d3bec42798f3f951793e4c ; xehac-mofum-malyd-bomaf-pegit-fuzes-ganin-misiz-nigel-nozog-soxix
+; DNSKEY prime query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN DNSKEY
+SECTION ANSWER
+example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
+SECTION AUTHORITY
+example.net.    IN NS   ns.example.net.
+example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
+ENTRY_END
+
+; NS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.    IN NS   ns.example.net.
+example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
+ENTRY_END
+
+; no DS to sub.example.net, optout NSEC3.
+; NSEC3PARAM 1 1 31 DE15C001
+; example.net.                 -> hk4jq0lg6q3bt992urc88dqten1k2be8.
+; sub.example.net.     -> ecs17hqd0kf7dk9g1cjvevj25pginrf2.
+; *.example.net.       -> 1tgbedpeeuubbsejh2dqvso62f8n4dk1.
+; down.sub.example.net. -> 9j1r8re9b1238vd907tilclgat1i0fre.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id 
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.net. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.net.   3600    IN      RRSIG   SOA 5 2 3600 20070926134150 20070829134150 30899 example.net. ELVULZHTRc0Qk06rSBRnB/T6sm1+AbAtdEJHN6PCsz2Z3s3E5A8NH7Krz0VzRaYIEUStnbAtuE3oP8XHWHBnyQ== ;{id = 30899}
+; CE is example.net
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.  3600    IN      RRSIG   NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
+; NC covers sub.example.net
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.  3600    IN      RRSIG   NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
+SECTION ADDITIONAL
+ENTRY_END
+
+; delegation to sub.example.net, optout NSEC3.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.net. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net. IN NSEC3 1 1 31 DE15C001 hl4jq0lg6q3bt992urc88dqten1k2be8 NS SOA NAPTR RRSIG DNSKEY NSEC3PARAM
+hk4jq0lg6q3bt992urc88dqten1k2be8.example.net.  3600    IN      RRSIG   NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. n1dQKbRoB+X4K003RAhdUp6ZUP5dCiwQi+apGfLII8wmCUmw/cKiz7/Ijhs/+88hZwq/7yhlZM0D/yqAUKUiAA== ;{id = 30899}
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net. IN NSEC3 1 1 31 de15c001 efs17hqd0kf7dk9g1cjvevj25pginrf2 A RRSIG
+ebs17hqd0kf7dk9g1cjvevj25pginrf2.example.net.  3600    IN      RRSIG   NSEC3 5 3 3600 20070926134150 20070829134150 30899 example.net. oSVB7Dyp7/yaOlT8AFwBJZdqwRRSQ8XFzCpu1AP51JPIuhCg5byepdvY6UC3xXc7YVO6h74tpxFCGqLpRXwDoQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ENTRY_END
+
+
+RANGE_END
+
+; ns.sub.example.net.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.6
+; DS is
+; sub.example.net.     3600    IN      DS      30899 5 1 36b39460f94a807cbbbf3b31cc9db955081b2b36 ; xetir-fahok-bovug-pebyl-sovur-zyvaf-cufan-tivih-hadec-rypof-kixox
+; DNSKEY query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.net. IN DNSKEY
+SECTION ANSWER
+sub.example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.net.       3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. PATh0K1jz9QeN02C79noX9gwK+Nr5VznWPQwygm/pYDsOb0z3EsaiOrzyoreegDKgoNn3kN0CywS+usCWM6hrw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.       3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; NS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.net. IN NS
+SECTION ANSWER
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.       3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; www.sub.example.net query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.net. IN A
+SECTION ANSWER
+www.sub.example.net. IN A 10.20.30.40
+www.sub.example.net.   3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. Q+88AIM3K8q6S0bHeFVT742EepZFxOxgtaL1V68DEkP4NePKzL4zttWQD3uI/5ALw/fIrC7G43Eo+epWn2ZGCA== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.net.    IN NS   ns.sub.example.net.
+sub.example.net.       3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.net. JZUK303aE7R428S5XXLaowpM79YSc2g7wy2rDOH+6Ts2UefZInv6X5cjJU4+qBrS8i9XhdllqG7SEnPKZ0GtAw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.net.         IN      A       1.2.3.6
+ns.sub.example.net.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AluXPa4XdlCysQMVrt0YairoOug4GMvy8rNUeKLCfQ5xVqRMqkTisbzJXBQPgYEVA0DJR74eEpgLrcz5ztb1aA== ;{id = 30899}
+ENTRY_END
+
+; DS for down.sub.example.net
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+down.sub.example.net. IN DS
+SECTION ANSWER
+down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
+down.sub.example.net.  3600    IN      RRSIG   DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; delegation to down.sub.example.net
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+down.sub.example.net. IN NS
+SECTION ANSWER
+SECTION AUTHORITY
+down.sub.example.net. IN NS ns.down.sub.example.net.
+; the DS record is not given (like it was parent and child hosted on the same
+; server)
+;down.sub.example.net.   3600    IN      DS      60946 5 1 c636304ab7cdb6272215aceac95a8d312ac7a4f6 
+;down.sub.example.net. 3600    IN      RRSIG   DS 5 4 3600 20070926134150 20070829134150 30899 sub.example.net. AMc8J534UF2+0PtPSNBw6RzN4Q5gXfnBXiUfpuT/MR1YtOE/5AP/0dTgvqvKRiFZx3NjOPeZmRnaabxkw0Qzrw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.down.sub.example.net. IN A 1.2.3.7
+ENTRY_END
+
+RANGE_END
+
+; ns.down.sub.example.net.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.7
+; DNSKEY query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+down.sub.example.net. IN DNSKEY
+SECTION ANSWER
+down.sub.example.net.  3600    IN      DNSKEY  257 3 5 AwEAAeiaUiUIpWMfYz5L0sfJTZWnuN9IyBX4em9VjsoqQTsOD1HDQpNb4buvJo7pN2aBCxNS7e0OL8e2mVB6CLZ+8ek= ;{id = 60946 (ksk), size = 512b}
+down.sub.example.net.  3600    IN      RRSIG   DNSKEY 5 4 3600 20070926134150 20070829134150 60946 down.sub.example.net. lK5HNva/IPw0CS9BfBd16fqm5y9bgCSwGsBLBAA1d5SCcKep6AVrv6NFuXl12d1G3MdQ4ruHi6eDDO5dhtkfrw== ;{id = 60946}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; www.down.sub.example.net.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.down.sub.example.net. IN A
+SECTION ANSWER
+www.down.sub.example.net. IN A 10.20.30.44
+www.down.sub.example.net.      3600    IN      RRSIG   A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.down.sub.example.net. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.down.sub.example.net. IN A
+SECTION ANSWER
+www.down.sub.example.net. IN A 10.20.30.44
+www.down.sub.example.net.      3600    IN      RRSIG   A 5 5 3600 20070926134150 20070829134150 60946 down.sub.example.net. Hg5WF/xW8PRth2rl1mZcYK8/pgGpM73e/fD+mH/XElEKgL9zq0ou8psA0I6OvMLGBN6RQeknQHRAy3D2/5k/Wg== ;{id = 60946}
+ENTRY_END
+
+SCENARIO_END

diff --git a/validator/val_neg.c b/validator/val_neg.c
index 27839c6ab8ded9567502d397dee6e36d4393b705..e58cfbdc66d0d7e2769307f214c66a2e0a601c33 100644 (file)
--- a/validator/val_neg.c
+++ b/validator/val_neg.c
@@ -1255,7 +1255,7 @@ neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
 static struct dns_msg*
 neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
                int qlabs, ldns_buffer* buf, struct rrset_cache* rrset_cache,
-               struct regional* region, uint32_t now)
+               struct regional* region, uint32_t now, uint8_t* topname)
 {
        struct dns_msg* msg;
        struct val_neg_data* data;
@@ -1305,6 +1305,12 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
                        return NULL;
                return msg;
        }
+
+       /* optout is not allowed without knowing the trust-anchor in use,
+        * otherwise the optout could spoof away that anchor */
+       if(!topname)
+               return NULL;
+
        /* if there is no exact match, it must be in an optout span
         * (an existing DS implies an NSEC3 must exist) */
        nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache, 
@@ -1379,7 +1385,7 @@ static int add_soa(struct rrset_cache* rrset_cache, uint32_t now,
 struct dns_msg* 
 val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo, 
        struct regional* region, struct rrset_cache* rrset_cache, 
-       ldns_buffer* buf, uint32_t now, int addsoa)
+       ldns_buffer* buf, uint32_t now, int addsoa, uint8_t* topname)
 {
        struct dns_msg* msg;
        struct ub_packed_rrset_key* rrset;
@@ -1391,6 +1397,7 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
        /* only for DS queries */
        if(qinfo->qtype != LDNS_RR_TYPE_DS)
                return NULL;
+       log_assert(!topname || dname_subdomain_c(qinfo->qname, topname));
 
        /* see if info from neg cache is available 
         * For NSECs, because there is no optout; a DS next to a delegation
@@ -1426,13 +1433,19 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
                qinfo->qclass);
        while(zone && !zone->in_use)
                zone = zone->parent;
+       /* check that the zone is not too high up so that we do not pick data
+        * out of a zone that is above the last-seen key (or trust-anchor). */
+       if(zone && topname) {
+               if(!dname_subdomain_c(zone->name, topname))
+                       zone = NULL;
+       }
        if(!zone) {
                lock_basic_unlock(&neg->lock);
                return NULL;
        }
 
        msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len, 
-               zname_labs+1, buf, rrset_cache, region, now);
+               zname_labs+1, buf, rrset_cache, region, now, topname);
        if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {
                lock_basic_unlock(&neg->lock);
                return NULL;

diff --git a/validator/val_neg.h b/validator/val_neg.h
index 8b17b32dbd31fb1b9a201151383b6dd07aefbfea..01b423e1afb39a453037c130f7dc0ecdf8525803 100644 (file)
--- a/validator/val_neg.h
+++ b/validator/val_neg.h
@@ -242,6 +242,13 @@ int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
  * @param now: to check TTLs against.
  * @param addsoa: if true, produce result for external consumption.
  *     if false, do not add SOA - for unbound-internal consumption.
+ * @param topname: do not look higher than this name, 
+ *     so that the result cannot be taken from a zone above the current
+ *     trust anchor.  Which could happen with multiple islands of trust.
+ *     if NULL, then no trust anchor is used, but also the algorithm becomes
+ *     more conservative, especially for opt-out zones, since the receiver
+ *     may have a trust-anchor below the optout and thus the optout cannot
+ *     be used to create a proof from the negative cache.
  * @return a reply message if something was found. 
  *     This reply may still need validation.
  *     NULL if nothing found (or out of memory).
@@ -249,7 +256,7 @@ int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
 struct dns_msg* val_neg_getmsg(struct val_neg_cache* neg, 
        struct query_info* qinfo, struct regional* region, 
        struct rrset_cache* rrset_cache, ldns_buffer* buf, uint32_t now,
-       int addsoa);
+       int addsoa, uint8_t* topname);
 
 
 /**** functions exposed for unit test ****/

diff --git a/validator/val_utils.c b/validator/val_utils.c
index 9dfafb21a4b6444a81aac26be5fd24a50e7473bd..98ff8a8c6c7ec450b6f5cca9182f1da236d26fc1 100644 (file)
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -909,7 +909,7 @@ int val_has_signed_nsecs(struct reply_info* rep, char** reason)
 
 struct dns_msg* 
 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 
-       struct regional* region)
+       struct regional* region, uint8_t* topname)
 {
        struct dns_msg* msg;
        struct query_info qinfo;
@@ -938,6 +938,6 @@ val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
        qinfo.qclass = c;
        /* do not add SOA to reply message, it is going to be used internal */
        msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache,
-               env->scratch_buffer, *env->now, 0);
+               env->scratch_buffer, *env->now, 0, topname);
        return msg;
 }

diff --git a/validator/val_utils.h b/validator/val_utils.h
index a5bc6c9adc96d4b3a9e49399614b2ad6ea155339..c78ec92b13397d06ceff9163a6a40dd63f833468 100644 (file)
--- a/validator/val_utils.h
+++ b/validator/val_utils.h
@@ -339,9 +339,12 @@ int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset);
  * @param nmlen: length of name.
  * @param c: class of DS RR.
  * @param region: where to allocate result.
+ * @param topname: name of the key that is currently in use, that will get
+ *     used to validate the result, and thus no higher entries from the
+ *     negative cache need to be examined.
  * @return a dns_msg on success. NULL on failure.
  */
 struct dns_msg* val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen,
-       uint16_t c, struct regional* region);
+       uint16_t c, struct regional* region, uint8_t* topname);
 
 #endif /* VALIDATOR_VAL_UTILS_H */

diff --git a/validator/validator.c b/validator/validator.c
index f0a150a57803eac7ef41bfdf1dcdcdb3e70fc6f9..635058388d7dd0b51366723b750d11af067b28a0 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -1488,7 +1488,8 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
                struct dns_msg* msg;
                if(!qstate->blacklist && !vq->chain_blacklist &&
                        (msg=val_find_DS(qstate->env, target_key_name, 
-                       target_key_len, vq->qchase.qclass, qstate->region)) ) {
+                       target_key_len, vq->qchase.qclass, qstate->region,
+                       vq->key_entry->name)) ) {
                        verbose(VERB_ALGO, "Process cached DS response");
                        process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
                                msg, &msg->qinfo, NULL);