recursor: add 38696 root anchor

fetched from https://www.iana.org/dnssec/files after their 2024-07-24 update

(cherry picked from commit 0bbbdd60ab054e7bbfc2b0d0604d1f7e15f0a229)

diff --git a/pdns/recursordist/settings/table.py b/pdns/recursordist/settings/table.py
index 91824c126a94366da13105ca8a11c9c90cd9dfbf..d7282a0ab943ba62efc3e5f11ef4dc9fee9bdd16 100644 (file)
--- a/pdns/recursordist/settings/table.py
+++ b/pdns/recursordist/settings/table.py
@@ -3302,7 +3302,7 @@ If this check draws the wrong conclusion, you can disable it.
         'name' : 'trustanchors',
         'section' : 'dnssec',
         'type' : LType.ListTrustAnchors,
-        'default' : '[{name: ., dsrecords: [\'20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d\']}]',
+        'default' : '[{name: ., dsrecords: [\'20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d\', \'38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16\']}]',
         'docdefault' : '''
 
 .. code-block:: yaml
@@ -3310,6 +3310,7 @@ If this check draws the wrong conclusion, you can disable it.
    - name: .
      dsrecords:
      - 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
+     - 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
 
 ''',
         'help' : 'Sequence of trust anchors',

diff --git a/pdns/recursordist/test-settings.cc b/pdns/recursordist/test-settings.cc
index 36e952e1098a1ec64b283f0a73ecd8542e38f7c0..c616cfe61cd4e8acc563f6827213d81cddc3de7b 100644 (file)
--- a/pdns/recursordist/test-settings.cc
+++ b/pdns/recursordist/test-settings.cc
@@ -497,7 +497,7 @@ BOOST_AUTO_TEST_CASE(test_yaml_ta_merge)
   LuaConfigItems lua2;
   pdns::settings::rec::fromBridgeStructToLuaConfig(settings, lua2, proxyMapping);
   BOOST_CHECK_EQUAL(lua2.dsAnchors.size(), 2U);
-  BOOST_CHECK_EQUAL(lua2.dsAnchors[DNSName(".")].size(), 1U);
+  BOOST_CHECK_EQUAL(lua2.dsAnchors[DNSName(".")].size(), 2U);
   BOOST_CHECK_EQUAL(lua2.dsAnchors[DNSName("a")].size(), 2U);
 }
 

diff --git a/pdns/root-dnssec.hh b/pdns/root-dnssec.hh
index 1a193ffae08c438d68ae59cf0a048517a626f276..47beda38b77b126eacfafff23dc05f5ca79c2d86 100644 (file)
--- a/pdns/root-dnssec.hh
+++ b/pdns/root-dnssec.hh
@@ -25,6 +25,7 @@
 #include <array>
 #include <string>
 
-static const std::array<std::string, 1> rootDSs = {
-  "20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d"
+static const std::array<std::string, 2> rootDSs = {
+  "20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d",
+  "38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16"
 };

diff --git a/regression-tests.recursor-dnssec/test_TrustAnchors.py b/regression-tests.recursor-dnssec/test_TrustAnchors.py
index f44497881aba4f1fc17ea98dc8891848521dd010..ca6dfa15b2a808ca056941b6bb52d0406b6d863c 100644 (file)
--- a/regression-tests.recursor-dnssec/test_TrustAnchors.py
+++ b/regression-tests.recursor-dnssec/test_TrustAnchors.py
@@ -22,7 +22,7 @@ addNTA("example.com", "some reason")
     def testTrustanchorDotServer(self):
         expected = dns.rrset.from_text_list(
             'trustanchor.server.', 86400, dns.rdataclass.CH, 'TXT',
-            ['". 20326"', '"powerdns.com. 44030"'])
+            ['". 20326 38696"', '"powerdns.com. 44030"'])
         query = dns.message.make_query('trustanchor.server', 'TXT',
                                        dns.rdataclass.CH)
         result = self.sendUDPQuery(query)