3942. [bug] Wildcard responses from a optout range should be

                        marked as insecure. [RT #37072]

diff --git a/CHANGES b/CHANGES
index e343a30a1737b6322a9388b7ac2db0be03acd208..214c4d9323c28d2e87c01cb66e39e32d6f148fb9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3942.  [bug]           Wildcard responses from a optout range should be
+                       marked as insecure. [RT #37072]
+
 3941.  [doc]           Include the BIND version number in the ARM. [RT #37067]
 
        --- 9.9.6rc1 released ---

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index c5f3fc52ae8a573a49190ba6c77280ab3943801a..7d5ecdda21bc603499b933d3f68dd524213a00ee 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -258,7 +258,7 @@ $DIG $DIGOPTS a.wild.optout.example. \
 $DIG $DIGOPTS a.wild.optout.example. \
        @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi

diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 2433ffcbbc92d328d236dd9746c326a41f2ec4a3..ef43c35d27bb4b556a0547b26136980498420530 100644 (file)
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -2075,6 +2075,9 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
                                if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0)
                                        (*logit)(arg, ISC_LOG_DEBUG(3),
                                                 "NSEC3 indicates optout");
+                               else
+                                       (*logit)(arg, ISC_LOG_DEBUG(3),
+                                                "NSEC3 indicates secure range");
                                *optout =
                                    ISC_TF(nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
                        }

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 644927f5b5adaa9fa8ef740c67b7a64db2dc5c6a..5b74e6e55e745a6f1293e29aa841ed792043ccab 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -2803,7 +2803,7 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
        if (!NEEDNODATA(val) && !NEEDNOWILDCARD(val) && NEEDNOQNAME(val)) {
                if (!FOUNDNOQNAME(val))
                        findnsec3proofs(val);
-               if (FOUNDNOQNAME(val) && FOUNDCLOSEST(val)) {
+               if (FOUNDNOQNAME(val) && FOUNDCLOSEST(val) && !FOUNDOPTOUT(val)) {
                        validator_log(val, ISC_LOG_DEBUG(3),
                                      "marking as secure, noqname proof found");
                        marksecure(val->event);