From: Kees Monshouwer <mind04@monshouwer.org>
Date: Sat, 22 Feb 2014 13:42:27 +0000 (+0100)
Subject: saxfr: a (signed) zone transfer tool with readable output
X-Git-Tag: rec-3.6.0-rc1~169^2~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=df82962db51dcc6a4c33c9b28bd75305e9c76039;p=thirdparty%2Fpdns.git

saxfr: a (signed) zone transfer tool with readable output
---

diff --git a/pdns/.gitignore b/pdns/.gitignore
index 624d2a5c89..2c4f780929 100644
--- a/pdns/.gitignore
+++ b/pdns/.gitignore
@@ -11,6 +11,7 @@
 /pdns_recursor
 /pdnssec
 /sdig
+/saxfr
 /dnslabeltext.cc
 /dnsreplay
 /dnsbulktest
diff --git a/pdns/Makefile.am b/pdns/Makefile.am
index 6dc488a4ff..5fc639dc8f 100644
--- a/pdns/Makefile.am
+++ b/pdns/Makefile.am
@@ -35,7 +35,7 @@ if TOOLS
   bin_PROGRAMS += dnsbulktest dnsreplay dnsscan dnsscope dnstcpbench dnswasher nproxy dnsdist nsec3dig
 endif
 
-EXTRA_PROGRAMS=pdns_recursor sdig dnstcpbench dnsdist tsig-tests speedtest pdns_control dnsscope dnsgram rec_control \
+EXTRA_PROGRAMS=pdns_recursor sdig saxfr dnstcpbench dnsdist tsig-tests speedtest pdns_control dnsscope dnsgram rec_control \
 testrunner dnsreplay \
 toysdig dnsdemog dnswasher dnsscan nproxy notify pdnssec dnsbulktest nsec3dig
 
@@ -163,6 +163,10 @@ sdig_SOURCES=sdig.cc sstuff.hh dnsparser.cc dnsparser.hh dnsrecords.cc dnswriter
 	misc.cc misc.hh rcpgenerator.cc rcpgenerator.hh base64.cc base64.hh unix_utility.cc \
 	logger.cc statbag.cc qtype.cc sillyrecords.cc nsecrecords.cc base32.cc
 
+saxfr_SOURCES=saxfr.cc sstuff.hh dnsparser.cc dnsparser.hh dnsrecords.cc dnswriter.cc dnslabeltext.cc dnswriter.hh \
+	misc.cc misc.hh rcpgenerator.cc rcpgenerator.hh base64.cc base64.hh unix_utility.cc \
+	logger.cc statbag.cc qtype.cc sillyrecords.cc nsecrecords.cc base32.cc
+
 dnstcpbench_SOURCES=dnstcpbench.cc sstuff.hh dnsparser.cc dnsparser.hh dnsrecords.cc dnswriter.cc dnslabeltext.cc dnswriter.hh \
 	misc.cc misc.hh rcpgenerator.cc rcpgenerator.hh base64.cc base64.hh unix_utility.cc \
 	logger.cc statbag.cc qtype.cc sillyrecords.cc nsecrecords.cc base32.cc
diff --git a/pdns/saxfr.cc b/pdns/saxfr.cc
new file mode 100644
index 0000000000..114320e1ac
--- /dev/null
+++ b/pdns/saxfr.cc
@@ -0,0 +1,110 @@
+#include "dnsparser.hh"
+#include "sstuff.hh"
+#include "misc.hh"
+#include "dnswriter.hh"
+#include "dnsrecords.hh"
+#include "statbag.hh"
+StatBag S;
+
+int main(int argc, char** argv)
+try
+{
+  if(argc < 4) {
+    cerr<<"Syntax: saxfr IP-address port zone [showflags] [hidesoadetails]\n";
+    exit(EXIT_FAILURE);
+  }
+
+  bool showflags=false;
+  bool hidesoadetails=false;
+
+  if (argc > 4) {
+    for(int i=4; i<argc; i++) {
+      if (strcmp(argv[i], "showflags") == 0)
+        showflags=true;
+      if (strcmp(argv[i], "hidesoadetails") == 0)
+        hidesoadetails=true;
+    }
+  }
+
+  reportAllTypes();
+
+  vector<uint8_t> packet;
+  DNSPacketWriter pw(packet, argv[3], 252);
+
+  Socket sock(InterNetwork, Stream);
+  ComboAddress dest(argv[1] + (*argv[1]=='@'), atoi(argv[2]));
+  sock.connect(dest);
+  uint16_t len;
+  len = htons(packet.size());
+  if(sock.write((char *) &len, 2) != 2)
+    throw PDNSException("tcp write failed");
+
+  sock.writen(string((char*)&*packet.begin(), (char*)&*packet.end()));
+
+  int soacount=0;
+  while(soacount<2) {
+    if(sock.read((char *) &len, 2) != 2)
+      throw PDNSException("tcp read failed");
+
+    len=ntohs(len);
+    char *creply = new char[len];
+    int n=0;
+    int numread;
+    while(n<len) {
+      numread=sock.read(creply+n, len-n);
+      if(numread<0)
+        throw PDNSException("tcp read failed");
+      n+=numread;
+    }
+
+    MOADNSParser mdp(string(creply, len));
+    for(MOADNSParser::answers_t::const_iterator i=mdp.d_answers.begin(); i!=mdp.d_answers.end(); ++i) {
+      if(i->first.d_type == QType::SOA)
+      {
+        ++soacount;
+      }
+
+      cout<<i->first.d_label<<"\tIN\t"<<DNSRecordContent::NumberToType(i->first.d_type);
+      if(i->first.d_type == QType::RRSIG)
+      {
+        string zoneRep = i->first.d_content->getZoneRepresentation();
+        vector<string> parts;
+        stringtok(parts, zoneRep);
+        cout<<"\t"<<i->first.d_ttl<<"\t"<< parts[0]<<" "<<parts[1]<<" "<<parts[2]<<" "<<parts[3]<<" [expiry] [inception] [keytag] "<<parts[7]<<" ...\n";
+      }
+      else if(!showflags && i->first.d_type == QType::NSEC3)
+      {
+        string zoneRep = i->first.d_content->getZoneRepresentation();
+        vector<string> parts;
+        stringtok(parts, zoneRep);
+        cout<<"\t"<<i->first.d_ttl<<"\t"<< parts[0]<<" [flags] "<<parts[2]<<" "<<parts[3]<<" "<<parts[4];
+        for(vector<string>::iterator iter = parts.begin()+5; iter != parts.end(); ++iter)
+          cout<<" "<<*iter;
+        cout<<"\n";
+      }
+      else if(i->first.d_type == QType::DNSKEY)
+      {
+        string zoneRep = i->first.d_content->getZoneRepresentation();
+        vector<string> parts;
+        stringtok(parts, zoneRep);
+        cout<<"\t"<<i->first.d_ttl<<"\t"<< parts[0]<<" "<<parts[1]<<" "<<parts[2]<<" ...\n";
+      }
+      else if (i->first.d_type == QType::SOA && hidesoadetails)
+      {
+        string zoneRep = i->first.d_content->getZoneRepresentation();
+        vector<string> parts;
+        stringtok(parts, zoneRep);
+        cout<<"\t"<<i->first.d_ttl<<"\t"<<parts[0]<<" "<<parts[1]<<" [serial] "<<parts[3]<<" "<<parts[4]<<" "<<parts[5]<<" "<<parts[6]<<"\n";
+      }
+      else
+      {
+        cout<<"\t"<<i->first.d_ttl<<"\t"<< i->first.d_content->getZoneRepresentation()<<"\n";
+      }
+    }
+    delete[] creply;
+  }
+}
+catch(std::exception &e)
+{
+  cerr<<"Fatal: "<<e.what()<<endl;
+}
diff --git a/regression-tests/cleandig b/regression-tests/cleandig
index 3fbc87f690..3bc2ad7ab6 100755
--- a/regression-tests/cleandig
+++ b/regression-tests/cleandig
@@ -1,7 +1,12 @@
 #!/bin/sh
 if [ ! -e ${testsdir}/${testname}/use.drill ]
 then
-	../pdns/sdig $nameserver $port "$1" $2 $3 $4 $5 | LC_ALL=C sort
+	if [ "$2" != "AXFR" ]
+	then
+		../pdns/sdig $nameserver $port "$1" $2 $3 $4 $5 | LC_ALL=C sort
+	else
+		../pdns/saxfr $nameserver $port "$1" $3 $4 | LC_ALL=C sort
+	fi
 fi
 ../pdns/nsec3dig $nameserver $port "$1" $2 > ${testsdir}/${testname}/nsec3dig.out 2>&1
 if [ ! -e ${testsdir}/${testname}/skip-drill ]
diff --git a/regression-tests/runtests b/regression-tests/runtests
index d8f4f27e82..af89860300 100755
--- a/regression-tests/runtests
+++ b/regression-tests/runtests
@@ -5,7 +5,7 @@ MAKE=${MAKE:-make}
 spectest=$1
 [ -z $spectest ] && spectest=""
 
-${MAKE} -C ../pdns sdig nsec3dig || exit 1
+${MAKE} -C ../pdns sdig nsec3dig saxfr || exit 1
 
 rm -f test-results failed_tests passed_tests skipped_tests ${testsdir}/*/real_result ${testsdir}/*/diff ${testsdir}/*/*.out ${testsdir}/*/start ${testsdir}/*/step.*
 
diff --git a/regression-tests/start-test-stop b/regression-tests/start-test-stop
index e98e863825..42870c440e 100755
--- a/regression-tests/start-test-stop
+++ b/regression-tests/start-test-stop
@@ -191,7 +191,7 @@ __EOF__
 	exit
 fi
 
-${MAKE} -C ../pdns sdig nsec3dig || exit
+${MAKE} -C ../pdns sdig saxfr nsec3dig || exit
 # Copy original zones because the test might modify them (well only the dyndns stuff, but let's make this work for others as well)
 for zone in $(grep 'zone ' named.conf  | cut -f2 -d\")
 do
diff --git a/regression-tests/tests/ent-axfr/command b/regression-tests/tests/ent-axfr/command
index a48feb4483..a7079b6aa8 100755
--- a/regression-tests/tests/ent-axfr/command
+++ b/regression-tests/tests/ent-axfr/command
@@ -1,2 +1,2 @@
 #!/bin/sh
-USEDRILL=1 cleandig test.com AXFR dnssec | grep -P 'IN\tNSEC' | sed 's/ ;.*//' | LC_ALL=C sort
+cleandig test.com AXFR showdetails | grep -P 'IN\tNSEC'
\ No newline at end of file
diff --git a/regression-tests/tests/ent-axfr/expected_result b/regression-tests/tests/ent-axfr/expected_result
index 165f74719b..05ab7f2e5f 100644
--- a/regression-tests/tests/ent-axfr/expected_result
+++ b/regression-tests/tests/ent-axfr/expected_result
@@ -1,21 +1,21 @@
-*.a.b.c.test.com.	86400	IN	NSEC	counter.test.com. A RRSIG NSEC 
-*.test.test.com.	86400	IN	NSEC	sub.test.test.com. CNAME RRSIG NSEC 
-_double._tcp.dc.test.com.	86400	IN	NSEC	_ldap._tcp.dc.test.com. SRV RRSIG NSEC 
-_ldap._tcp.dc.test.com.	86400	IN	NSEC	_root._tcp.dc.test.com. SRV RRSIG NSEC 
-_root._tcp.dc.test.com.	86400	IN	NSEC	enum.test.com. SRV RRSIG NSEC 
-_underscore.test.com.	86400	IN	NSEC	aland.test.com. TXT RRSIG NSEC 
-aland.test.com.	86400	IN	NSEC	blah.test.com. TXT RRSIG NSEC 
-b.c.test.com.	86400	IN	NSEC	*.a.b.c.test.com. A RRSIG NSEC 
-blah.test.com.	86400	IN	NSEC	b.c.test.com. NS RRSIG NSEC 
-counter.test.com.	86400	IN	NSEC	_double._tcp.dc.test.com. A RRSIG NSEC 
-enum.test.com.	86400	IN	NSEC	hightxt.test.com. NAPTR RRSIG NSEC 
-hightxt.test.com.	86400	IN	NSEC	ns1.test.com. TXT RRSIG NSEC SPF 
-ns1.test.com.	86400	IN	NSEC	ns2.test.com. A RRSIG NSEC 
-ns2.test.com.	86400	IN	NSEC	server1.test.com. A RRSIG NSEC 
-server1.test.com.	86400	IN	NSEC	*.test.test.com. A RP RRSIG NSEC 
-sub.test.test.com.	86400	IN	NSEC	www.test.test.com. NS RRSIG NSEC 
-test.com.	86400	IN	NSEC	_underscore.test.com. NS SOA MX RRSIG NSEC DNSKEY 
-very-long-txt.test.com.	86400	IN	NSEC	within-server.test.com. TXT RRSIG NSEC 
-within-server.test.com.	86400	IN	NSEC	www.test.com. CNAME RRSIG NSEC 
-www.test.com.	86400	IN	NSEC	test.com. CNAME RRSIG NSEC 
-www.test.test.com.	86400	IN	NSEC	very-long-txt.test.com. A RRSIG NSEC 
+*.a.b.c.test.com.	IN	NSEC	86400	counter.test.com. A RRSIG NSEC
+*.test.test.com.	IN	NSEC	86400	sub.test.test.com. CNAME RRSIG NSEC
+_double._tcp.dc.test.com.	IN	NSEC	86400	_ldap._tcp.dc.test.com. SRV RRSIG NSEC
+_ldap._tcp.dc.test.com.	IN	NSEC	86400	_root._tcp.dc.test.com. SRV RRSIG NSEC
+_root._tcp.dc.test.com.	IN	NSEC	86400	enum.test.com. SRV RRSIG NSEC
+_underscore.test.com.	IN	NSEC	86400	aland.test.com. TXT RRSIG NSEC
+aland.test.com.	IN	NSEC	86400	blah.test.com. TXT RRSIG NSEC
+b.c.test.com.	IN	NSEC	86400	*.a.b.c.test.com. A RRSIG NSEC
+blah.test.com.	IN	NSEC	86400	b.c.test.com. NS RRSIG NSEC
+counter.test.com.	IN	NSEC	86400	_double._tcp.dc.test.com. A RRSIG NSEC
+enum.test.com.	IN	NSEC	86400	hightxt.test.com. NAPTR RRSIG NSEC
+hightxt.test.com.	IN	NSEC	86400	ns1.test.com. TXT RRSIG NSEC SPF
+ns1.test.com.	IN	NSEC	86400	ns2.test.com. A RRSIG NSEC
+ns2.test.com.	IN	NSEC	86400	server1.test.com. A RRSIG NSEC
+server1.test.com.	IN	NSEC	86400	*.test.test.com. A RP RRSIG NSEC
+sub.test.test.com.	IN	NSEC	86400	www.test.test.com. NS RRSIG NSEC
+test.com.	IN	NSEC	86400	_underscore.test.com. NS SOA MX RRSIG NSEC DNSKEY
+very-long-txt.test.com.	IN	NSEC	86400	within-server.test.com. TXT RRSIG NSEC
+within-server.test.com.	IN	NSEC	86400	www.test.com. CNAME RRSIG NSEC
+www.test.com.	IN	NSEC	86400	test.com. CNAME RRSIG NSEC
+www.test.test.com.	IN	NSEC	86400	very-long-txt.test.com. A RRSIG NSEC
diff --git a/regression-tests/tests/ent-axfr/expected_result.nsec3 b/regression-tests/tests/ent-axfr/expected_result.nsec3
index 3856c6d090..c7fd31997e 100644
--- a/regression-tests/tests/ent-axfr/expected_result.nsec3
+++ b/regression-tests/tests/ent-axfr/expected_result.nsec3
@@ -1,27 +1,27 @@
-0bh8di769i8vvtkdds8efjda19abigo5.test.com.	86400	IN	NSEC3	1 0 1 abcd  2eu2gulbu53h9uvhfalshpbo2a83t6l2 TXT RRSIG SPF 
-2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	86400	IN	NSEC3	1 0 1 abcd  2gks2n3jpqf62qohavfq1pholm3hr7ra NS SOA MX RRSIG DNSKEY NSEC3PARAM 
-2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	86400	IN	NSEC3	1 0 1 abcd  53l445r26rg1csbi4ts1k3i3el1f30vm TXT RRSIG 
-53l445r26rg1csbi4ts1k3i3el1f30vm.test.com.	86400	IN	NSEC3	1 0 1 abcd  79ra8k3g5kai1hg9jlhbr6p0tp933m7v SRV RRSIG 
-79ra8k3g5kai1hg9jlhbr6p0tp933m7v.test.com.	86400	IN	NSEC3	1 0 1 abcd  79u3das6ucctns1br3tvd8qkanni351l A RRSIG 
-79u3das6ucctns1br3tvd8qkanni351l.test.com.	86400	IN	NSEC3	1 0 1 abcd  7mmura8h40be5n4koan7rnmkursamh99
-7mmura8h40be5n4koan7rnmkursamh99.test.com.	86400	IN	NSEC3	1 0 1 abcd  88f1bqrb2iscvfel2sqqcksvflnekap6
-88f1bqrb2iscvfel2sqqcksvflnekap6.test.com.	86400	IN	NSEC3	1 0 1 abcd  a5labagjjevr86gh0hf3jg7nufhga5ar CNAME RRSIG 
-a5labagjjevr86gh0hf3jg7nufhga5ar.test.com.	86400	IN	NSEC3	1 0 1 abcd  aovp95mr44hqefrqus6nomsd944bm3vb A RRSIG 
-aovp95mr44hqefrqus6nomsd944bm3vb.test.com.	86400	IN	NSEC3	1 0 1 abcd  b022o9dksaj737fh77e7kqqtj3om56ki A RRSIG 
-b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	86400	IN	NSEC3	1 0 1 abcd  dafc69cv5n2tfcf6ovbvtv94drgmqjo5
-dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	86400	IN	NSEC3	1 0 1 abcd  de592k86u3hevdj57jpbt7j5kv7doo78 TXT RRSIG 
-de592k86u3hevdj57jpbt7j5kv7doo78.test.com.	86400	IN	NSEC3	1 0 1 abcd  eban51bjgugorb20unp5peec7s5d2eka NS 
-eban51bjgugorb20unp5peec7s5d2eka.test.com.	86400	IN	NSEC3	1 0 1 abcd  h5855rvon2aasm8qv1nk49i1b2mkbejp SRV RRSIG 
-h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	86400	IN	NSEC3	1 0 1 abcd  iai9hin25meh689r5v5gtifk8om5di0e A RRSIG 
-iai9hin25meh689r5v5gtifk8om5di0e.test.com.	86400	IN	NSEC3	1 0 1 abcd  igf4m7otecach14p0a6ingi7dbuas5b2 A RRSIG 
-igf4m7otecach14p0a6ingi7dbuas5b2.test.com.	86400	IN	NSEC3	1 0 1 abcd  o1l0fb73hi3qp4a3fnqjsleanlc883i3 A RP RRSIG 
-o1l0fb73hi3qp4a3fnqjsleanlc883i3.test.com.	86400	IN	NSEC3	1 0 1 abcd  plud9qqecuril62gcfp8br44i7eoq7c9 TXT RRSIG 
-plud9qqecuril62gcfp8br44i7eoq7c9.test.com.	86400	IN	NSEC3	1 0 1 abcd  qd81ag9inqts1ocs7api0pji94k27btr SRV RRSIG 
-qd81ag9inqts1ocs7api0pji94k27btr.test.com.	86400	IN	NSEC3	1 0 1 abcd  s6g5shc1jvovl5fl9e943adlonqln7g4 CNAME RRSIG 
-s6g5shc1jvovl5fl9e943adlonqln7g4.test.com.	86400	IN	NSEC3	1 0 1 abcd  s96h2qicbt8d9i5aa43kp8sjjresq4kb
-s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.	86400	IN	NSEC3	1 0 1 abcd  sa5vvpqn1coejgj3hbkfekdnii8kksqa NS 
-sa5vvpqn1coejgj3hbkfekdnii8kksqa.test.com.	86400	IN	NSEC3	1 0 1 abcd  sra2sm4pl136bultass7qqnlblipe8am NAPTR RRSIG 
-sra2sm4pl136bultass7qqnlblipe8am.test.com.	86400	IN	NSEC3	1 0 1 abcd  u02utt5q2bhjcq986f05mbap0pgamt5o CNAME RRSIG 
-test.com.	86400	IN	NSEC3PARAM	1 0 1 abcd 
-u02utt5q2bhjcq986f05mbap0pgamt5o.test.com.	86400	IN	NSEC3	1 0 1 abcd  vlvujatanof6feajoesti9kq4s0crst3 A RRSIG 
-vlvujatanof6feajoesti9kq4s0crst3.test.com.	86400	IN	NSEC3	1 0 1 abcd  0bh8di769i8vvtkdds8efjda19abigo5
+0bh8di769i8vvtkdds8efjda19abigo5.test.com.	IN	NSEC3	86400	1 0 1 abcd 2EU2GULBU53H9UVHFALSHPBO2A83T6L2 TXT RRSIG SPF
+2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	IN	NSEC3	86400	1 0 1 abcd 2GKS2N3JPQF62QOHAVFQ1PHOLM3HR7RA NS SOA MX RRSIG DNSKEY NSEC3PARAM
+2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	IN	NSEC3	86400	1 0 1 abcd 53L445R26RG1CSBI4TS1K3I3EL1F30VM TXT RRSIG
+53l445r26rg1csbi4ts1k3i3el1f30vm.test.com.	IN	NSEC3	86400	1 0 1 abcd 79RA8K3G5KAI1HG9JLHBR6P0TP933M7V SRV RRSIG
+79ra8k3g5kai1hg9jlhbr6p0tp933m7v.test.com.	IN	NSEC3	86400	1 0 1 abcd 79U3DAS6UCCTNS1BR3TVD8QKANNI351L A RRSIG
+79u3das6ucctns1br3tvd8qkanni351l.test.com.	IN	NSEC3	86400	1 0 1 abcd 7MMURA8H40BE5N4KOAN7RNMKURSAMH99
+7mmura8h40be5n4koan7rnmkursamh99.test.com.	IN	NSEC3	86400	1 0 1 abcd 88F1BQRB2ISCVFEL2SQQCKSVFLNEKAP6
+88f1bqrb2iscvfel2sqqcksvflnekap6.test.com.	IN	NSEC3	86400	1 0 1 abcd A5LABAGJJEVR86GH0HF3JG7NUFHGA5AR CNAME RRSIG
+a5labagjjevr86gh0hf3jg7nufhga5ar.test.com.	IN	NSEC3	86400	1 0 1 abcd AOVP95MR44HQEFRQUS6NOMSD944BM3VB A RRSIG
+aovp95mr44hqefrqus6nomsd944bm3vb.test.com.	IN	NSEC3	86400	1 0 1 abcd B022O9DKSAJ737FH77E7KQQTJ3OM56KI A RRSIG
+b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	IN	NSEC3	86400	1 0 1 abcd DAFC69CV5N2TFCF6OVBVTV94DRGMQJO5
+dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	IN	NSEC3	86400	1 0 1 abcd DE592K86U3HEVDJ57JPBT7J5KV7DOO78 TXT RRSIG
+de592k86u3hevdj57jpbt7j5kv7doo78.test.com.	IN	NSEC3	86400	1 0 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA NS
+eban51bjgugorb20unp5peec7s5d2eka.test.com.	IN	NSEC3	86400	1 0 1 abcd H5855RVON2AASM8QV1NK49I1B2MKBEJP SRV RRSIG
+h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	IN	NSEC3	86400	1 0 1 abcd IAI9HIN25MEH689R5V5GTIFK8OM5DI0E A RRSIG
+iai9hin25meh689r5v5gtifk8om5di0e.test.com.	IN	NSEC3	86400	1 0 1 abcd IGF4M7OTECACH14P0A6INGI7DBUAS5B2 A RRSIG
+igf4m7otecach14p0a6ingi7dbuas5b2.test.com.	IN	NSEC3	86400	1 0 1 abcd O1L0FB73HI3QP4A3FNQJSLEANLC883I3 A RP RRSIG
+o1l0fb73hi3qp4a3fnqjsleanlc883i3.test.com.	IN	NSEC3	86400	1 0 1 abcd PLUD9QQECURIL62GCFP8BR44I7EOQ7C9 TXT RRSIG
+plud9qqecuril62gcfp8br44i7eoq7c9.test.com.	IN	NSEC3	86400	1 0 1 abcd QD81AG9INQTS1OCS7API0PJI94K27BTR SRV RRSIG
+qd81ag9inqts1ocs7api0pji94k27btr.test.com.	IN	NSEC3	86400	1 0 1 abcd S6G5SHC1JVOVL5FL9E943ADLONQLN7G4 CNAME RRSIG
+s6g5shc1jvovl5fl9e943adlonqln7g4.test.com.	IN	NSEC3	86400	1 0 1 abcd S96H2QICBT8D9I5AA43KP8SJJRESQ4KB
+s96h2qicbt8d9i5aa43kp8sjjresq4kb.test.com.	IN	NSEC3	86400	1 0 1 abcd SA5VVPQN1COEJGJ3HBKFEKDNII8KKSQA NS
+sa5vvpqn1coejgj3hbkfekdnii8kksqa.test.com.	IN	NSEC3	86400	1 0 1 abcd SRA2SM4PL136BULTASS7QQNLBLIPE8AM NAPTR RRSIG
+sra2sm4pl136bultass7qqnlblipe8am.test.com.	IN	NSEC3	86400	1 0 1 abcd U02UTT5Q2BHJCQ986F05MBAP0PGAMT5O CNAME RRSIG
+test.com.	IN	NSEC3PARAM	86400	1 0 1 abcd
+u02utt5q2bhjcq986f05mbap0pgamt5o.test.com.	IN	NSEC3	86400	1 0 1 abcd VLVUJATANOF6FEAJOESTI9KQ4S0CRST3 A RRSIG
+vlvujatanof6feajoesti9kq4s0crst3.test.com.	IN	NSEC3	86400	1 0 1 abcd 0BH8DI769I8VVTKDDS8EFJDA19ABIGO5
diff --git a/regression-tests/tests/ent-axfr/expected_result.nsec3-optout b/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
index 561cf08557..4088b798d5 100644
--- a/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
+++ b/regression-tests/tests/ent-axfr/expected_result.nsec3-optout
@@ -1,25 +1,25 @@
-0bh8di769i8vvtkdds8efjda19abigo5.test.com.	86400	IN	NSEC3	1 1 1 abcd  2eu2gulbu53h9uvhfalshpbo2a83t6l2 TXT RRSIG SPF 
-2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	86400	IN	NSEC3	1 1 1 abcd  2gks2n3jpqf62qohavfq1pholm3hr7ra NS SOA MX RRSIG DNSKEY NSEC3PARAM 
-2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	86400	IN	NSEC3	1 1 1 abcd  53l445r26rg1csbi4ts1k3i3el1f30vm TXT RRSIG 
-53l445r26rg1csbi4ts1k3i3el1f30vm.test.com.	86400	IN	NSEC3	1 1 1 abcd  79ra8k3g5kai1hg9jlhbr6p0tp933m7v SRV RRSIG 
-79ra8k3g5kai1hg9jlhbr6p0tp933m7v.test.com.	86400	IN	NSEC3	1 1 1 abcd  79u3das6ucctns1br3tvd8qkanni351l A RRSIG 
-79u3das6ucctns1br3tvd8qkanni351l.test.com.	86400	IN	NSEC3	1 1 1 abcd  7mmura8h40be5n4koan7rnmkursamh99
-7mmura8h40be5n4koan7rnmkursamh99.test.com.	86400	IN	NSEC3	1 1 1 abcd  88f1bqrb2iscvfel2sqqcksvflnekap6
-88f1bqrb2iscvfel2sqqcksvflnekap6.test.com.	86400	IN	NSEC3	1 1 1 abcd  a5labagjjevr86gh0hf3jg7nufhga5ar CNAME RRSIG 
-a5labagjjevr86gh0hf3jg7nufhga5ar.test.com.	86400	IN	NSEC3	1 1 1 abcd  aovp95mr44hqefrqus6nomsd944bm3vb A RRSIG 
-aovp95mr44hqefrqus6nomsd944bm3vb.test.com.	86400	IN	NSEC3	1 1 1 abcd  b022o9dksaj737fh77e7kqqtj3om56ki A RRSIG 
-b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	86400	IN	NSEC3	1 1 1 abcd  dafc69cv5n2tfcf6ovbvtv94drgmqjo5
-dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	86400	IN	NSEC3	1 1 1 abcd  eban51bjgugorb20unp5peec7s5d2eka TXT RRSIG 
-eban51bjgugorb20unp5peec7s5d2eka.test.com.	86400	IN	NSEC3	1 1 1 abcd  h5855rvon2aasm8qv1nk49i1b2mkbejp SRV RRSIG 
-h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	86400	IN	NSEC3	1 1 1 abcd  iai9hin25meh689r5v5gtifk8om5di0e A RRSIG 
-iai9hin25meh689r5v5gtifk8om5di0e.test.com.	86400	IN	NSEC3	1 1 1 abcd  igf4m7otecach14p0a6ingi7dbuas5b2 A RRSIG 
-igf4m7otecach14p0a6ingi7dbuas5b2.test.com.	86400	IN	NSEC3	1 1 1 abcd  o1l0fb73hi3qp4a3fnqjsleanlc883i3 A RP RRSIG 
-o1l0fb73hi3qp4a3fnqjsleanlc883i3.test.com.	86400	IN	NSEC3	1 1 1 abcd  plud9qqecuril62gcfp8br44i7eoq7c9 TXT RRSIG 
-plud9qqecuril62gcfp8br44i7eoq7c9.test.com.	86400	IN	NSEC3	1 1 1 abcd  qd81ag9inqts1ocs7api0pji94k27btr SRV RRSIG 
-qd81ag9inqts1ocs7api0pji94k27btr.test.com.	86400	IN	NSEC3	1 1 1 abcd  s6g5shc1jvovl5fl9e943adlonqln7g4 CNAME RRSIG 
-s6g5shc1jvovl5fl9e943adlonqln7g4.test.com.	86400	IN	NSEC3	1 1 1 abcd  sa5vvpqn1coejgj3hbkfekdnii8kksqa
-sa5vvpqn1coejgj3hbkfekdnii8kksqa.test.com.	86400	IN	NSEC3	1 1 1 abcd  sra2sm4pl136bultass7qqnlblipe8am NAPTR RRSIG 
-sra2sm4pl136bultass7qqnlblipe8am.test.com.	86400	IN	NSEC3	1 1 1 abcd  u02utt5q2bhjcq986f05mbap0pgamt5o CNAME RRSIG 
-test.com.	86400	IN	NSEC3PARAM	1 0 1 abcd 
-u02utt5q2bhjcq986f05mbap0pgamt5o.test.com.	86400	IN	NSEC3	1 1 1 abcd  vlvujatanof6feajoesti9kq4s0crst3 A RRSIG 
-vlvujatanof6feajoesti9kq4s0crst3.test.com.	86400	IN	NSEC3	1 1 1 abcd  0bh8di769i8vvtkdds8efjda19abigo5
+0bh8di769i8vvtkdds8efjda19abigo5.test.com.	IN	NSEC3	86400	1 1 1 abcd 2EU2GULBU53H9UVHFALSHPBO2A83T6L2 TXT RRSIG SPF
+2eu2gulbu53h9uvhfalshpbo2a83t6l2.test.com.	IN	NSEC3	86400	1 1 1 abcd 2GKS2N3JPQF62QOHAVFQ1PHOLM3HR7RA NS SOA MX RRSIG DNSKEY NSEC3PARAM
+2gks2n3jpqf62qohavfq1pholm3hr7ra.test.com.	IN	NSEC3	86400	1 1 1 abcd 53L445R26RG1CSBI4TS1K3I3EL1F30VM TXT RRSIG
+53l445r26rg1csbi4ts1k3i3el1f30vm.test.com.	IN	NSEC3	86400	1 1 1 abcd 79RA8K3G5KAI1HG9JLHBR6P0TP933M7V SRV RRSIG
+79ra8k3g5kai1hg9jlhbr6p0tp933m7v.test.com.	IN	NSEC3	86400	1 1 1 abcd 79U3DAS6UCCTNS1BR3TVD8QKANNI351L A RRSIG
+79u3das6ucctns1br3tvd8qkanni351l.test.com.	IN	NSEC3	86400	1 1 1 abcd 7MMURA8H40BE5N4KOAN7RNMKURSAMH99
+7mmura8h40be5n4koan7rnmkursamh99.test.com.	IN	NSEC3	86400	1 1 1 abcd 88F1BQRB2ISCVFEL2SQQCKSVFLNEKAP6
+88f1bqrb2iscvfel2sqqcksvflnekap6.test.com.	IN	NSEC3	86400	1 1 1 abcd A5LABAGJJEVR86GH0HF3JG7NUFHGA5AR CNAME RRSIG
+a5labagjjevr86gh0hf3jg7nufhga5ar.test.com.	IN	NSEC3	86400	1 1 1 abcd AOVP95MR44HQEFRQUS6NOMSD944BM3VB A RRSIG
+aovp95mr44hqefrqus6nomsd944bm3vb.test.com.	IN	NSEC3	86400	1 1 1 abcd B022O9DKSAJ737FH77E7KQQTJ3OM56KI A RRSIG
+b022o9dksaj737fh77e7kqqtj3om56ki.test.com.	IN	NSEC3	86400	1 1 1 abcd DAFC69CV5N2TFCF6OVBVTV94DRGMQJO5
+dafc69cv5n2tfcf6ovbvtv94drgmqjo5.test.com.	IN	NSEC3	86400	1 1 1 abcd EBAN51BJGUGORB20UNP5PEEC7S5D2EKA TXT RRSIG
+eban51bjgugorb20unp5peec7s5d2eka.test.com.	IN	NSEC3	86400	1 1 1 abcd H5855RVON2AASM8QV1NK49I1B2MKBEJP SRV RRSIG
+h5855rvon2aasm8qv1nk49i1b2mkbejp.test.com.	IN	NSEC3	86400	1 1 1 abcd IAI9HIN25MEH689R5V5GTIFK8OM5DI0E A RRSIG
+iai9hin25meh689r5v5gtifk8om5di0e.test.com.	IN	NSEC3	86400	1 1 1 abcd IGF4M7OTECACH14P0A6INGI7DBUAS5B2 A RRSIG
+igf4m7otecach14p0a6ingi7dbuas5b2.test.com.	IN	NSEC3	86400	1 1 1 abcd O1L0FB73HI3QP4A3FNQJSLEANLC883I3 A RP RRSIG
+o1l0fb73hi3qp4a3fnqjsleanlc883i3.test.com.	IN	NSEC3	86400	1 1 1 abcd PLUD9QQECURIL62GCFP8BR44I7EOQ7C9 TXT RRSIG
+plud9qqecuril62gcfp8br44i7eoq7c9.test.com.	IN	NSEC3	86400	1 1 1 abcd QD81AG9INQTS1OCS7API0PJI94K27BTR SRV RRSIG
+qd81ag9inqts1ocs7api0pji94k27btr.test.com.	IN	NSEC3	86400	1 1 1 abcd S6G5SHC1JVOVL5FL9E943ADLONQLN7G4 CNAME RRSIG
+s6g5shc1jvovl5fl9e943adlonqln7g4.test.com.	IN	NSEC3	86400	1 1 1 abcd SA5VVPQN1COEJGJ3HBKFEKDNII8KKSQA
+sa5vvpqn1coejgj3hbkfekdnii8kksqa.test.com.	IN	NSEC3	86400	1 1 1 abcd SRA2SM4PL136BULTASS7QQNLBLIPE8AM NAPTR RRSIG
+sra2sm4pl136bultass7qqnlblipe8am.test.com.	IN	NSEC3	86400	1 1 1 abcd U02UTT5Q2BHJCQ986F05MBAP0PGAMT5O CNAME RRSIG
+test.com.	IN	NSEC3PARAM	86400	1 0 1 abcd
+u02utt5q2bhjcq986f05mbap0pgamt5o.test.com.	IN	NSEC3	86400	1 1 1 abcd VLVUJATANOF6FEAJOESTI9KQ4S0CRST3 A RRSIG
+vlvujatanof6feajoesti9kq4s0crst3.test.com.	IN	NSEC3	86400	1 1 1 abcd 0BH8DI769I8VVTKDDS8EFJDA19ABIGO5
diff --git a/regression-tests/tests/ent-axfr/use.drill b/regression-tests/tests/ent-axfr/use.drill
deleted file mode 100644
index e69de29bb2..0000000000