4405. [bug] Change 4342 introduced a regression where you could

                        not remove a delegation in a NSEC3 signed zone using
                        OPTOUT via nsupdate. [RT #42702]

(cherry picked from commit d811a7d9ef26169be8f60a2149c632ca9e9d49fb)
(cherry picked from commit d9cc1ed8ea7083069263257454564af1144b71fd)

diff --git a/CHANGES b/CHANGES
index 359b496dd08eec212e8edcab774befd7b1929499..6216c57a82596238346dbed0a8ee96f08b31dacf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4405.  [bug]           Change 4342 introduced a regression where you could
+                       not remove a delegation in a NSEC3 signed zone using
+                       OPTOUT via nsupdate. [RT #42702]
+
 4387.  [bug]           Change 4336 was not complete leading to SERVFAIL
                        being return as NS records expired. [RT #42683]
 

diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index dcb80d36eca6fb1d631f40a3aa301f99f03199d7..303d6ea151e12052bca7be664dc03677ffccd716 100644 (file)
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -19,20 +19,27 @@
 # Clean up after zone transfer tests.
 #
 
-rm -f ns1/*.jnl ns2/*.jnl
+rm -f */named.memstats
+rm -f */named.run
+rm -f Kxxx.*
+rm -f dig.out.*
+rm -f jp.out.ns3.*
+rm -f ns*/named.lock
+rm -f ns1/*.jnl ns2/*.jnl ns3/*.jnl
 rm -f ns1/example.db ns1/unixtime.db ns1/update.db ns1/other.db ns1/keytests.db
+rm -f ns1/example.db ns1/unixtime.db ns1/yyyymmddvv.db ns1/update.db ns1/other.db ns1/keytests.db
+rm -f ns1/many.test.db
 rm -f ns1/md5.key ns1/sha1.key ns1/sha224.key ns1/sha256.key ns1/sha384.key
 rm -f ns1/sha512.key ns1/ddns.key
-rm -f nsupdate.out
 rm -f ns2/example.bk
 rm -f ns2/update.bk ns2/update.alt.bk
-rm -f */named.memstats
-rm -f */named.run
-rm -f nsupdate.out*
-rm -f ns3/example.db.jnl ns3/example.db
-rm -f ns3/nsec3param.test.db.signed.jnl ns3/nsec3param.test.db ns3/nsec3param.test.db.signed ns3/dsset-nsec3param.test.
-rm -f ns3/dnskey.test.db.signed.jnl ns3/dnskey.test.db ns3/dnskey.test.db.signed ns3/dsset-dnskey.test.
+rm -f ns3/*.signed
 rm -f ns3/K*
-rm -f dig.out.*
-rm -f jp.out.ns3.*
-rm -f Kxxx.*
+rm -f ns3/delegation.test.db
+rm -f ns3/dnskey.test.db
+rm -f ns3/dsset-*
+rm -f ns3/example.db
+rm -f ns3/many.test.bk
+rm -f ns3/nsec3param.test.db
+rm -f nsupdate.out*
+rm -f typelist.out.*

diff --git a/bin/tests/system/nsupdate/ns3/delegation.test.db.in b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
new file mode 100644 (file)
index 0000000..674a7ed
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
@@ -0,0 +1,10 @@
+; Copyright (C) 2011, 2016  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+$TTL 10
+delegation.test. IN SOA delegation.test. hostmaster.delegation.test. 1 3600 900 2419200 3600
+delegation.test. IN NS delegation.test.
+delegation.test. IN A 10.53.0.3

diff --git a/bin/tests/system/nsupdate/ns3/named.conf b/bin/tests/system/nsupdate/ns3/named.conf
index 4b43efe4f22d293685ba34ea522ca9648ec1f41e..cfb258289b869d45b2aef3b87f34116df1aabe29 100644 (file)
--- a/bin/tests/system/nsupdate/ns3/named.conf
+++ b/bin/tests/system/nsupdate/ns3/named.conf
@@ -60,3 +60,9 @@ zone "dnskey.test" {
        allow-update { any; };
        file "dnskey.test.db.signed";
 };
+
+zone "delegation.test" {
+       type master;
+       allow-update { any; };
+       file "delegation.test.db.signed";
+};

diff --git a/bin/tests/system/nsupdate/ns3/sign.sh b/bin/tests/system/nsupdate/ns3/sign.sh
index 7b06a6bbcd94d9ce81556e8947176f6ac4a97855..9ed29ada338ee1aa280a92c12fbafa51c14c4f70 100644 (file)
--- a/bin/tests/system/nsupdate/ns3/sign.sh
+++ b/bin/tests/system/nsupdate/ns3/sign.sh
@@ -38,3 +38,14 @@ keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
 $SIGNER -P -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+
+zone=delegation.test.
+infile=delegation.test.db.in
+zonefile=delegation.test.db
+
+keyname1=`$KEYGEN -q -r $RANDFILE -3 -f KSK $zone`
+keyname2=`$KEYGEN -q -r $RANDFILE -3 $zone`
+
+cat $infile $keyname1.key $keyname2.key >$zonefile
+
+$SIGNER -A -3 - -P -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 799220d9c3749c5a0cecb127e683dd9963f006a2..d3d131d5a63cb5a670d428e3d9199e4ac98cca74 100644 (file)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -543,5 +543,34 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
+n=`expr $n + 1`
+echo "I:check adding of delegating NS records processing ($n)"
+ret=0
+$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+server 10.53.0.3 5300
+zone delegation.test.
+update add child.delegation.test. 3600 NS foo.example.net.
+update add child.delegation.test. 3600 NS bar.example.net.
+send
+EOF
+$DIG +tcp @10.53.0.3 -p 5300 ns child.delegation.test > dig.out.ns1.test$n
+grep "status: NOERROR" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+grep "AUTHORITY: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }
+
+n=`expr $n + 1`
+echo "I:check deleting of delegating NS records processing ($n)"
+ret=0
+$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+server 10.53.0.3 5300
+zone delegation.test.
+update del child.delegation.test. 3600 NS foo.example.net.
+update del child.delegation.test. 3600 NS bar.example.net.
+send
+EOF
+$DIG +tcp @10.53.0.3 -p 5300 ns child.delegation.test > dig.out.ns1.test$n
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 74ab9ddf649741a1ca2f2c17ee72801da7a0f9c7..ced4e0270f1f9e7245754fa31488c4e769b3213b 100644 (file)
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1342,7 +1342,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
        CHECK(dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbit));
 
        result = dns_dbiterator_seek(dbit, hashname);
-       if (result == ISC_R_NOTFOUND)
+       if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH)
                goto success;
        if (result != ISC_R_SUCCESS)
                goto failure;
@@ -1447,7 +1447,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
                                         &empty, origin, hash, iterations,
                                         salt, salt_length));
                result = dns_dbiterator_seek(dbit, hashname);
-               if (result == ISC_R_NOTFOUND)
+               if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH)
                        goto success;
                if (result != ISC_R_SUCCESS)
                        goto failure;

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 1912c8478d2e40c6600abd484e943954e7d6bb6e..82499d85c0ee00cd0be7f3ca2d599495c7a2cee9 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -8651,6 +8651,8 @@ dbiterator_first(dns_dbiterator_t *iterator) {
        dns_name_t *name, *origin;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -8704,6 +8706,8 @@ dbiterator_last(dns_dbiterator_t *iterator) {
        dns_name_t *name, *origin;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -8754,6 +8758,7 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
            rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -8979,6 +8984,8 @@ dbiterator_pause(dns_dbiterator_t *iterator) {
        rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);