From: bert hubert <bert.hubert@netherlabs.nl>
Date: Fri, 1 Jul 2016 10:16:56 +0000 (+0200)
Subject: more ways to wrap an nsec3
X-Git-Tag: rec-4.0.0~29
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf9ce517a14cebd17594eb2717b3bd92ca06b624;p=thirdparty%2Fpdns.git

more ways to wrap an nsec3
---

diff --git a/pdns/validate.cc b/pdns/validate.cc
index ee326b321a..b5e126d5f7 100644
--- a/pdns/validate.cc
+++ b/pdns/validate.cc
@@ -405,7 +405,8 @@ vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, keyset_t &keyset)
               LOG("\tquery hash: "<<toBase32Hex(h)<<endl);
               string beginHash=fromBase32Hex(v.first.first.getRawLabels()[0]);
               if( (beginHash < h && h < nsec3->d_nexthash) ||
-                  (nsec3->d_nexthash > h  && beginHash > nsec3->d_nexthash) ||  //wrap
+                  (nsec3->d_nexthash > h  && beginHash > nsec3->d_nexthash) ||  // wrap // HASH --- END --- BEGINNING
+                  (nsec3->d_nexthash < beginHash  && beginHash < h) ||  // wrap other case // END -- BEGINNING -- HASH
                   beginHash == nsec3->d_nexthash)  // "we have only 1 NSEC3 record, LOL!"  
               {
                 LOG("Denies existence of DS!"<<endl);