Bugfix 398 Allow RRSIG for NSEC3 to be before the NSEC3 they are about in zonefiles...

diff --git a/Changelog b/Changelog
index c22af1c1ed5f130051fabbbab8cbcc270971e969..15d490f9c82a57ad96754fb84eaa837bf0f1ab70 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,7 @@
 1.6.11
        * bugfix #394: Fix socket leak on errors
        * bugfix #392: Apex only and percentage checks for ldns-verify-zone
+       * bugfix #398: Allow nsec rrsig before the nsec3 in ldns-verify-zone
 
 1.6.10 2011-05-31
        * New example tool added: ldns-gen-zone.

diff --git a/examples/ldns-verify-zone.c b/examples/ldns-verify-zone.c
index f126d08c0d445741a361fa6cbd12735e66f546a5..5686078f8a51cd391ba043d106f152aae5745b4d 100644 (file)
--- a/examples/ldns-verify-zone.c
+++ b/examples/ldns-verify-zone.c
@@ -87,6 +87,7 @@ create_dnssec_zone(ldns_zone *orig_zone)
           because the needed information is to be read later. in that case
           we keep a list of those nsec3's and retry to add them later */
        ldns_rr_list *failed_nsec3s = ldns_rr_list_new();
+       ldns_rr_list *failed_nsec3_rrsigs = ldns_rr_list_new();
 
        dnssec_zone = ldns_dnssec_zone_new();
        if (ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(orig_zone)) !=
@@ -102,7 +103,20 @@ create_dnssec_zone(ldns_zone *orig_zone)
                status = ldns_dnssec_zone_add_rr(dnssec_zone, cur_rr);
                if (status != LDNS_STATUS_OK) {
                        if (status == LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND) {
-                               ldns_rr_list_push_rr(failed_nsec3s, cur_rr);
+                               if (ldns_rr_get_type(cur_rr)
+                                           == LDNS_RR_TYPE_RRSIG
+                                           && ldns_rdf2rr_type(
+                                                 ldns_rr_rrsig_typecovered(
+                                                         cur_rr
+                                                  )
+                                               ) == LDNS_RR_TYPE_NSEC3) {
+                                       ldns_rr_list_push_rr(
+                                                       failed_nsec3_rrsigs, 
+                                                       cur_rr);
+                               } else {
+                                       ldns_rr_list_push_rr(failed_nsec3s, 
+                                                       cur_rr);
+                               }
                        } else {
                                if (verbosity > 0) {
                                        fprintf(stderr, "Error adding RR to dnssec zone");
@@ -119,6 +133,11 @@ create_dnssec_zone(ldns_zone *orig_zone)
                        cur_rr = ldns_rr_list_rr(failed_nsec3s, i);
                        status = ldns_dnssec_zone_add_rr(dnssec_zone, cur_rr);
                }
+               for (i = 0; i < ldns_rr_list_rr_count(failed_nsec3_rrsigs); 
+                               i++) {
+                       cur_rr = ldns_rr_list_rr(failed_nsec3_rrsigs, i);
+                       status = ldns_dnssec_zone_add_rr(dnssec_zone, cur_rr);
+               }
        }
 
        ldns_rr_list_free(failed_nsec3s);