From: Kees Monshouwer <mind04@monshouwer.org>
Date: Fri, 28 Feb 2014 00:07:07 +0000 (+0100)
Subject: fix for errata 3441 of RFC5155
X-Git-Tag: auth-3.3.2~2^2~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bbc0bc5aedc818dfb743b922bb3c47257c8e8a44;p=thirdparty%2Fpdns.git

fix for errata 3441 of RFC5155
---

diff --git a/pdns/backends/bind/bindbackend2.cc b/pdns/backends/bind/bindbackend2.cc
index 07e2f1c238..71e5bec792 100644
--- a/pdns/backends/bind/bindbackend2.cc
+++ b/pdns/backends/bind/bindbackend2.cc
@@ -613,7 +613,7 @@ void Bind2Backend::doEmptyNonTerminals(shared_ptr<State> stage, int id, bool nse
 
     while(chopOff(shorter))
     {
-      if(!qnames.count(shorter) && !nonterm.count(shorter))
+      if(!qnames.count(shorter))
       {
         if(!(maxent))
         {
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 18dc53f748..39fe8d7a2d 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -607,16 +607,18 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
 
     getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after, mode);
 
-    if (mode == 1 && (hashed != before)) {
-      DLOG(L<<"No matching NSEC3 for DS, do closest (provable) encloser"<<endl);
+    if ((mode == 0 ||  mode == 1) && (hashed != before)) {
+      DLOG(L<<"No matching NSEC3, do closest (provable) encloser"<<endl);
 
+      bool doBreak = false;
       DNSResourceRecord rr;
       while( chopOff( closest ) && (closest != sd.qname))  { // stop at SOA
         B.lookup(QType(QType::ANY), closest, p, sd.domain_id);
-        if (B.get(rr)) {
-          while(B.get(rr));
+        while(B.get(rr))
+          if (rr.auth)
+            doBreak = true;
+        if(doBreak)
           break;
-        }
       }
       doNextcloser = true;
       unhashed=closest;