This monster-commit contains three weeks of work, mostly by Kees Monshouwer.

Contents:
- minor fixes to nsec3dig
- lower-boundary NSEC3 wraparound fix for bindbackend
- a bunch of additional tests for NSEC3 behaviour
- 4 new NSEC3 modes, presumably covering all NSEC3-sets we can possibly need
- minor fixes to the existing modes (we used to generate too many NSEC3s in some cases)
- a (non-DNSSEC) fix for wildcards wrongly synthesising responses when there were partially overlapping names
- perhaps some other minor fixes

git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@2687 d19b8d6e-7fed-0310-83ef-9ca221ded41b

diff --git a/modules/tinydnsbackend/data b/modules/tinydnsbackend/data
index 771ff7c1bf10f6a94f58daf5d86bfae1e49a1546..0ebeb97cd1fa536288e7be6b9d4bacf0eb7e4cc1 100644 (file)
--- a/modules/tinydnsbackend/data
+++ b/modules/tinydnsbackend/data
@@ -20153,10 +20153,17 @@ Zwtest.com:ns1.wtest.com.:ahu.example.com.:2005092501:28800:7200:604800:86400:36
 @wtest.com::smtp-servers.example.com.:10:3600
 @wtest.com::smtp-servers.wtest.com.:15:3600
 C\052.wtest.com:server1.wtest.com.:3600
+:e.wtest.com:16:\011non-empty:3600
+:d.e.wtest.com:16:\011non-empty:3600
+:c.d.e.wtest.com:16:\011non-empty:3600
+:b.c.d.e.wtest.com:16:\011non-empty:3600
+:a.b.c.d.e.wtest.com:16:\011non-empty:3600
++\052.a.b.c.d.e.wtest.com:6.7.8.9:3600
 @secure.wtest.com::server1.wtest.com.:10:3600
 +server1.wtest.com:1.2.3.4:3600
 :something.wtest.com:16:\045make\040the\040empty\040non-terminal\040non-empty:3600
 +\052.something.wtest.com:4.3.2.1:3600
++a.something.wtest.com:10.11.12.13:3600
 #2005092501 auto axfr-get
 Zdnssec-parent.com:ns1.dnssec-parent.com.:ahu.example.com.:2005092501:28800:7200:604800:86400:3600
 +dnssec-parent.com:9.9.9.9:3600

diff --git a/modules/tinydnsbackend/data.cdb b/modules/tinydnsbackend/data.cdb
index 5a2e5d2459ad2b5763c369e759dbf154daa309fb..42b54a758ec62ab34ec1c0b190f1f258441c5635 100644 (file)
Binary files a/modules/tinydnsbackend/data.cdb and b/modules/tinydnsbackend/data.cdb differ

diff --git a/pdns/backends/bind/bindbackend2.cc b/pdns/backends/bind/bindbackend2.cc
index e688136bf6b8b227fdc2430e8443124a4dcad871..b60b13c4f7cbbae3c445e46f109bed3e1ee3bc12 100644 (file)
--- a/pdns/backends/bind/bindbackend2.cc
+++ b/pdns/backends/bind/bindbackend2.cc
@@ -919,6 +919,11 @@ bool Bind2Backend::getBeforeAndAfterNamesAbsolute(uint32_t id, const std::string
       iter--;
     }
 
+    if(iter == hashindex.begin() && (iter->nsec3hash > lqname))
+    {
+      iter = hashindex.end();
+    }
+
     while(iter == hashindex.end() || !(iter->auth))
     {
       iter--;

diff --git a/pdns/nsec3dig.cc b/pdns/nsec3dig.cc
index f0f2a2d2a0fa8b2a4ecab0980d0d8ff9b5b949b2..8ac92a1b9be841316c6d8ceb8873745a94f68b12 100644 (file)
--- a/pdns/nsec3dig.cc
+++ b/pdns/nsec3dig.cc
@@ -17,7 +17,7 @@ string nsec3Hash(const string &qname, const string &salt, unsigned int iters)
   return toLower(toBase32Hex(hashQNameWithSalt(iters, salt, qname)));
 }
 
-string proveOrDeny(const nsec3set &nsec3s, const string &qname, const string &salt, unsigned int iters, set<string> &proven, set<string> &denied)
+void proveOrDeny(const nsec3set &nsec3s, const string &qname, const string &salt, unsigned int iters, set<string> &proven, set<string> &denied)
 {
   string hashed = nsec3Hash(qname, salt, iters);
 
@@ -29,21 +29,20 @@ string proveOrDeny(const nsec3set &nsec3s, const string &qname, const string &sa
     if(hashed == base)
     {
       proven.insert(qname);
-      return qname+" ("+hashed+") proven by base of "+base+".."+next;
+      cout<<qname<<" ("<<hashed<<") proven by base of "<<base<<".."<<next<<endl;
     }
     if(hashed == next)
     {
       proven.insert(qname);
-      return qname+" ("+hashed+") proven by next of "+base+".."+next;
+      cout<<qname<<" ("<<hashed<<") proven by next of "<<base<<".."<<next<<endl;
     }
     if((hashed > base && hashed < next) ||
        (next < base && (hashed < next || hashed > base)))
     {
       denied.insert(qname);
-      return qname+" ("+hashed+") denied by "+base+".."+next;
+      cout<<qname<<" ("<<hashed<<") denied by "<<base<<".."<<next<<endl;
     }
   }
-  return "";
 }
 
 int main(int argc, char** argv)
@@ -129,22 +128,18 @@ try
   cout<<"== nsec3 prove/deny report follows =="<<endl;
   set<string> proven;
   set<string> denied;
-  string r=proveOrDeny(nsec3s, qname, nsec3salt, nsec3iters, proven, denied);
   string shorter(qname);
   do {
-    string r;
-    r=proveOrDeny(nsec3s, shorter, nsec3salt, nsec3iters, proven, denied);
-    if(r.size()) cout<<r<<endl;
-    r=proveOrDeny(nsec3s, "*."+shorter, nsec3salt, nsec3iters, proven, denied);
-    if(r.size()) cout<<r<<endl;
+    proveOrDeny(nsec3s, shorter, nsec3salt, nsec3iters, proven, denied);
+    proveOrDeny(nsec3s, "*."+shorter, nsec3salt, nsec3iters, proven, denied);
   } while(chopOff(shorter));
 
   if(names.count(qname+"."))
   {
-    cout<<"== qname found in names, not investigating denial any further"<<endl;
-    exit(EXIT_SUCCESS);
+    cout<<"== qname found in names, investigating NSEC3s in case it's a wildcard"<<endl;
+    // exit(EXIT_SUCCESS);
   }
-  cout<<"== qname not found in names, investigating denial"<<endl;
+  // cout<<"== qname not found in names, investigating denial"<<endl;
   if(proven.count(qname))
   {
     cout<<"qname found proven, NODATA response?"<<endl;
@@ -180,9 +175,13 @@ try
     {
       cout<<"wildcard at encloser (*."<<encloser<<") is denied correctly"<<endl;
     }
+    else if(proven.count("*."+encloser))
+    {
+      cout<<"wildcard at encloser (*."<<encloser<<") is proven"<<endl;
+    }
     else
     {
-      cout<<"wildcard at encloser (*."<<encloser<<") is NOT denied"<<endl;
+      cout<<"wildcard at encloser (*."<<encloser<<") is NOT denied or proven"<<endl;
     }
   }
   exit(EXIT_SUCCESS);

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 0c51fe65f05dae8dd6929df761a856dcbe8e9dfc..fc4fa1d698b15f3e7f52afb548437fae2c676117 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -319,28 +319,37 @@ vector<DNSResourceRecord> PacketHandler::getBestReferralNS(DNSPacket *p, SOAData
   return ret;
 }
 
-bool PacketHandler::getBestWildcard(DNSPacket *p, SOAData& sd, const string &target, vector<DNSResourceRecord>* ret)
+// Return best matching wildcard or next closer name
+bool PacketHandler::getBestWildcard(DNSPacket *p, SOAData& sd, const string &target, string &wildcard, vector<DNSResourceRecord>* ret)
 {
   ret->clear();
   DNSResourceRecord rr;
   string subdomain(target);
-  while( chopOff( subdomain ))  {
+  bool haveSomething=false;
+
+  wildcard=subdomain;
+  while ( chopOff( subdomain ) && !haveSomething ) {
     B.lookup(QType(QType::ANY), "*."+subdomain, p, sd.domain_id);
-    bool haveSomething=false;
     while(B.get(rr)) {
       if(rr.qtype == p->qtype ||rr.qtype.getCode() == QType::CNAME || p->qtype.getCode() == QType::ANY)
         ret->push_back(rr);
+      wildcard="*."+subdomain;
       haveSomething=true;
     }
-    
-    if(haveSomething)
-      return true;
-    
-    if(subdomain == sd.qname) // stop at SOA
+
+    if ( subdomain == sd.qname || haveSomething ) // stop at SOA or result
       break;
-  } 
 
-  return false;
+    B.lookup(QType(QType::ANY), subdomain, p, sd.domain_id);
+    if (B.get(rr)) {
+      DLOG(L<<"No wildcard match, ancestor exists"<<endl);
+      while (B.get(rr)) ;
+      break;
+    }
+    wildcard=subdomain;
+  }
+
+  return haveSomething;
 }
 
 
@@ -496,7 +505,7 @@ void PacketHandler::emitNSEC(const std::string& begin, const std::string& end, c
   // we can leave ttl untouched, either it is the default, or it is what we retrieved above
   rr.qtype=QType::NSEC;
   rr.content=nrc.getZoneRepresentation();
-  rr.d_place = (mode == 2 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
+  rr.d_place = (mode == 5 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
   rr.auth = true;
   
   r->addRecord(rr);
@@ -531,7 +540,7 @@ void emitNSEC3(DNSBackend& B, const NSEC3PARAMRecordContent& ns3prc, const SOADa
   rr.qtype=QType::NSEC3;
   rr.content=n3rc.getZoneRepresentation();
   
-  rr.d_place = (mode == 2 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
+  rr.d_place = (mode == 5 ) ? DNSResourceRecord::ANSWER: DNSResourceRecord::AUTHORITY;
   rr.auth = true;
   r->addRecord(rr);
 }
@@ -542,19 +551,22 @@ void PacketHandler::emitNSEC3(const NSEC3PARAMRecordContent& ns3prc, const SOADa
   
 }
 
-/* mode 0 = no error -> an NSEC that starts with 'target', in authority section
-   mode 1 = NXDOMAIN -> an NSEC from auth to first + a covering NSEC
-   mode 2 = ANY or direct NSEC request  -> an NSEC that starts with 'target'
-   mode 3 = a covering NSEC in the authority section (like 1, except for first)
+/*
+   mode 0 = No Data Responses, QTYPE is not DS
+   mode 1 = No Data Responses, QTYPE is DS (can we do this already?)
+   mode 2 = Wildcard No Data Responses
+   mode 3 = Wildcard Answer Responses
+   mode 4 = Name Error Responses
+   mode 5 = ANY or direct NSEC request
 */
-void PacketHandler::addNSECX(DNSPacket *p, DNSPacket *r, const string& target, const string& auth, int mode)
+void PacketHandler::addNSECX(DNSPacket *p, DNSPacket *r, const string& target, const string& target3, const string& auth, int mode)
 {
   NSEC3PARAMRecordContent ns3rc;
   // cerr<<"Doing NSEC3PARAM lookup for '"<<auth<<"', "<<p->qdomain<<"|"<<p->qtype.getName()<<": ";
   bool narrow;
   if(d_dk.getNSEC3PARAM(auth, &ns3rc, &narrow))  {
     // cerr<<"Present, narrow="<<narrow<<endl;
-    addNSEC3(p, r, target, auth, ns3rc, narrow, mode);
+    addNSEC3(p, r, target3, auth, ns3rc, narrow, mode);
   }
   else {
     // cerr<<"Not present"<<endl;
@@ -615,7 +627,7 @@ bool getNSEC3Hashes(bool narrow, DNSBackend* db, int id, const std::string& hash
 
 void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, const string& auth, const NSEC3PARAMRecordContent& ns3rc, bool narrow, int mode)
 {
-  string hashed;
+  // L<<"mode="<<mode<<" target="<<target<<" auth="<<auth<<endl;
   
   SOAData sd;
   sd.db = (DNSBackend*)-1;
@@ -624,30 +636,70 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
     return;
   }
   // cerr<<"salt in ph: '"<<makeHexDump(ns3rc.d_salt)<<"', narrow="<<narrow<<endl;
-  string unhashed, before,after;
-
-  // now add the closest encloser
-  unhashed=auth;
-  hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+  string unhashed, hashed, before, after;
+  string closest(target);
+  
+  if (mode == 2 || mode == 3 || mode == 4) {
+    chopOff(closest);
+  }
+  
+  if (mode == 1) {
+    DNSResourceRecord rr;
+    while( chopOff( closest ) && (closest != sd.qname))  { // stop at SOA
+      B.lookup(QType(QType::ANY), closest, p, sd.domain_id);
+      if (B.get(rr)) {
+        while(B.get(rr));
+        break;
+      }
+    }
+  }
   
-  getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after); 
-  DLOG(L<<"Done calling for closest encloser, before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"', unhashed: '"<<unhashed<<"'"<<endl);
-  emitNSEC3(ns3rc, sd, unhashed, before, after, target, r, mode);
-
-  // now add the main nsec3
-  unhashed = p->qdomain;
-  hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
-  getNSEC3Hashes(narrow, sd.db,sd.domain_id,  hashed, true, unhashed, before, after); 
-  DLOG(L<<"Done calling for main, before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"', unhashed: '"<<unhashed<<"'"<<endl);
-  emitNSEC3( ns3rc, sd, unhashed, before, after, target, r, mode);
+  // add matching NSEC3 RR
+  if (mode != 3) {
+    if (mode == 0 || mode == 5) {
+      unhashed=target;
+    }
+    else if (mode == 1 || mode == 2 || mode == 4) {
+      unhashed=closest;
+    }
+    else {
+      unhashed=auth;
+    }
+    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    // L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl;
   
-  // now add the *
-  unhashed=dotConcat("*", auth);
-  hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after);
+    DLOG(L<<"Done calling for matching, hashed: '"<<toBase32Hex(hashed)<<"' before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"'"<<endl);
+    emitNSEC3(ns3rc, sd, unhashed, before, after, target, r, mode);
+  }
+
+  // add covering NSEC3 RR
+  if (mode != 0 && mode != 5) {
+    string next(p->qdomain);
+    do {
+      unhashed=next;
+    }
+    while( chopOff( next ) && !pdns_iequals(next, closest));
+
+    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    // L<<"2 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl;
+
+    getNSEC3Hashes(narrow, sd.db,sd.domain_id,  hashed, true, unhashed, before, after);
+    DLOG(L<<"Done calling for covering, hashed: '"<<toBase32Hex(hashed)<<"' before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"'"<<endl);
+    emitNSEC3( ns3rc, sd, unhashed, before, after, target, r, mode);
+  }
   
-  getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, true, unhashed, before, after); 
-  DLOG(L<<"Done calling for '*', before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"', unhashed: '"<<unhashed<<"'"<<endl);
-  emitNSEC3( ns3rc, sd, unhashed, before, after, target, r, mode);
+  // wildcard denial
+  if (mode == 4) {
+    unhashed=dotConcat("*", closest);
+
+    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    // L<<"3 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl;
+    
+    getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, true, unhashed, before, after);
+    DLOG(L<<"Done calling for '*', hashed: '"<<toBase32Hex(hashed)<<"' before='"<<toBase32Hex(before)<<"', after='"<<toBase32Hex(after)<<"'"<<endl);
+    emitNSEC3( ns3rc, sd, unhashed, before, after, target, r, mode);
+  }
 }
 
 void PacketHandler::addNSEC(DNSPacket *p, DNSPacket *r, const string& target, const string& auth, int mode)
@@ -669,20 +721,31 @@ void PacketHandler::addNSEC(DNSPacket *p, DNSPacket *r, const string& target, co
 
   string before,after;
   //cerr<<"Calling getBeforeandAfter!"<<endl;
-  sd.db->getBeforeAndAfterNames(sd.domain_id, auth, target, before, after);
+  if (mode == 2) {
+    sd.db->getBeforeAndAfterNames(sd.domain_id, auth, p->qdomain, before, after);
+  }
+  else {
+    sd.db->getBeforeAndAfterNames(sd.domain_id, auth, target, before, after);
+  }
   // cerr<<"Done calling, before='"<<before<<"', after='"<<after<<"'"<<endl;
 
   // this stuff is wrong (but it appears to work)
   
-  if(mode ==0 || mode==2)
+  if(mode == 0 || mode == 1 || mode == 5)
     emitNSEC(target, after, target, sd, r, mode);
   
-  if(mode == 1)  {
+  if(mode == 2 || mode == 4)  {
     emitNSEC(before, after, target, sd, r, mode);
 
-    // this one does wildcard denial, if applicable
-    sd.db->getBeforeAndAfterNames(sd.domain_id, auth, auth, before, after);
-    emitNSEC(before, after, auth, sd, r, mode);
+    if (mode == 2) {
+      sd.db->getBeforeAndAfterNames(sd.domain_id, auth, target, before, after);
+      emitNSEC(target, after, auth, sd, r, mode);
+    }
+    else {
+      // this one does wildcard denial, if applicable
+      sd.db->getBeforeAndAfterNames(sd.domain_id, auth, auth, before, after);
+      emitNSEC(auth, after, auth, sd, r, mode);
+    }
   }
 
   if(mode == 3)
@@ -944,7 +1007,7 @@ void PacketHandler::synthesiseRRSIGs(DNSPacket* p, DNSPacket* r)
   }
 }
 
-void PacketHandler::makeNXDomain(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd)
+void PacketHandler::makeNXDomain(DNSPacket* p, DNSPacket* r, const std::string& target, const std::string& nextcloser, SOAData& sd)
 {
   DNSResourceRecord rr;
   rr.qname=sd.qname;
@@ -958,13 +1021,13 @@ void PacketHandler::makeNXDomain(DNSPacket* p, DNSPacket* r, const std::string&
   r->addRecord(rr);
   
   if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname))
-    addNSECX(p, r, target, sd.qname, 1);
+    addNSECX(p, r, target, nextcloser, sd.qname, 4);
   
   r->setRcode(RCode::NXDomain);  
   S.ringAccount("nxdomain-queries",p->qdomain+"/"+p->qtype.getName());
 }
 
-void PacketHandler::makeNOError(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd)
+void PacketHandler::makeNOError(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd, int mode)
 {
   DNSResourceRecord rr;
   rr.qname=sd.qname;
@@ -977,7 +1040,7 @@ void PacketHandler::makeNOError(DNSPacket* p, DNSPacket* r, const std::string& t
   r->addRecord(rr);
 
   if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname))
-    addNSECX(p, r, target, sd.qname, 0);
+    addNSECX(p, r, target, target, sd.qname, mode);
 
   S.ringAccount("noerror-queries",p->qdomain+"/"+p->qtype.getName());
 }
@@ -1013,7 +1076,7 @@ bool PacketHandler::tryReferral(DNSPacket *p, DNSPacket*r, SOAData& sd, const st
   r->setA(false);
 
   if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname) && !addDSforNS(p, r, sd, rrset.begin()->qname))
-    addNSECX(p, r, rrset.begin()->qname, sd.qname, 0);
+    addNSECX(p, r, rrset.begin()->qname, rrset.begin()->qname, sd.qname, 1);
   
   return true;
 }
@@ -1027,7 +1090,7 @@ void PacketHandler::completeANYRecords(DNSPacket *p, DNSPacket*r, SOAData& sd, c
   if(!d_dk.isSecuredZone(sd.qname))
     return;
     
-  addNSECX(p, r, target, sd.qname, 2); 
+  addNSECX(p, r, target, target, sd.qname, 5); 
   if(pdns_iequals(sd.qname, p->qdomain)) {
     DNSSECKeeper::keyset_t zskset = d_dk.getKeys(p->qdomain);
     DNSResourceRecord rr;
@@ -1042,12 +1105,12 @@ void PacketHandler::completeANYRecords(DNSPacket *p, DNSPacket*r, SOAData& sd, c
   }
 }
 
-bool PacketHandler::tryWildcard(DNSPacket *p, DNSPacket*r, SOAData& sd, string &target, bool& retargeted, bool& nodata)
+bool PacketHandler::tryWildcard(DNSPacket *p, DNSPacket*r, SOAData& sd, string &target, string &wildcard, bool& retargeted, bool& nodata)
 {
   retargeted = nodata = false;
 
   vector<DNSResourceRecord> rrset;
-  if(!getBestWildcard(p, sd, target, &rrset))
+  if(!getBestWildcard(p, sd, target, wildcard, &rrset))
     return false;
 
   if(rrset.empty()) {
@@ -1070,8 +1133,8 @@ bool PacketHandler::tryWildcard(DNSPacket *p, DNSPacket*r, SOAData& sd, string &
       r->addRecord(rr);
     }
   }
-  if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname)) {
-    addNSECX(p, r, p->qdomain, sd.qname, 3);
+  if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname) && !nodata) {
+    addNSECX(p, r, p->qdomain, wildcard, sd.qname, 3);
   }
   return true;
 }
@@ -1228,7 +1291,7 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
 
     // this TRUMPS a cname!
     if(p->qtype.getCode() == QType::NSEC && p->d_dnssecOk && d_dk.isSecuredZone(sd.qname) && !d_dk.getNSEC3PARAM(sd.qname, 0)) {
-      addNSEC(p, r, target, sd.qname, 2); // only NSEC please
+      addNSEC(p, r, target, sd.qname, 5); // only NSEC please
       goto sendit;
     }
 
@@ -1275,12 +1338,12 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
     DLOG(L<<"After first ANY query for '"<<target<<"', id="<<sd.domain_id<<": weDone="<<weDone<<", weHaveUnauth="<<weHaveUnauth<<", weRedirected="<<weRedirected<<endl);
     if(p->qtype.getCode() == QType::DS && weHaveUnauth &&  !weDone && !weRedirected && d_dk.isSecuredZone(sd.qname)) {
       DLOG(L<<"Q for DS of a name for which we do have NS, but for which we don't have on a zone with DNSSEC need to provide an AUTH answer that proves we don't"<<endl);
-      makeNOError(p, r, target, sd);
+      makeNOError(p, r, target, sd, 1);
       goto sendit;
     }
 
     if(rrset.empty()) {
-      DLOG(L<<"checking qtype.getCode() ["<<(p->qtype.getCode())<<"] against QType::DS ["<<(QType::DS)<<endl);
+      DLOG(L<<"checking qtype.getCode() ["<<(p->qtype.getCode())<<"] against QType::DS ["<<(QType::DS)<<"]"<<endl);
       if(p->qtype.getCode() == QType::DS)
       {
         DLOG(L<<"DS query found no direct result, trying referral now"<<endl);
@@ -1293,18 +1356,21 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
 
       DLOG(L<<Logger::Warning<<"Found nothing in the by-name ANY, but let's try wildcards.."<<endl);
       bool wereRetargeted(false), nodata(false);
-      if(tryWildcard(p, r, sd, target, wereRetargeted, nodata)) {
+      string wildcard;
+      if(tryWildcard(p, r, sd, target, wildcard, wereRetargeted, nodata)) {
         if(wereRetargeted) {
           retargetcount++;
           goto retargeted;
         }
-        if(nodata)
-          makeNOError(p, r, target, sd);
+        if(nodata) {
+          target=wildcard;
+          makeNOError(p, r, target, sd, 2);
+        }
         goto sendit;
       }
       else
       {        
-        makeNXDomain(p, r, target, sd);
+        makeNXDomain(p, r, target, wildcard, sd);
       }
       
       goto sendit;
@@ -1340,7 +1406,7 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
     }
     else {
       DLOG(L<<"Have some data, but not the right data"<<endl);
-      makeNOError(p, r, target, sd);
+      makeNOError(p, r, target, sd, 0);
     }
     
   sendit:;

diff --git a/pdns/packethandler.hh b/pdns/packethandler.hh
index e62cbf6051741c07e36bb7b86371a0685be1a142..946f1bf413ac3dd8ef02c120982e90d352b11275 100644 (file)
--- a/pdns/packethandler.hh
+++ b/pdns/packethandler.hh
@@ -99,7 +99,7 @@ private:
   bool getTLDAuth(DNSPacket *p, SOAData *sd, const string &target, int *zoneId);
   int doAdditionalProcessingAndDropAA(DNSPacket *p, DNSPacket *r, const SOAData& sd);
   bool doDNSSECProcessing(DNSPacket* p, DNSPacket *r);
-  void addNSECX(DNSPacket *p, DNSPacket* r, const string &target, const std::string& auth, int mode);
+  void addNSECX(DNSPacket *p, DNSPacket* r, const string &target, const string& target3, const std::string& auth, int mode);
   void addNSEC(DNSPacket *p, DNSPacket* r, const string &target, const std::string& auth, int mode);
   void addNSEC3(DNSPacket *p, DNSPacket* r, const string &target, const std::string& auth, const NSEC3PARAMRecordContent& nsec3param, bool narrow, int mode);
   void emitNSEC(const std::string& before, const std::string& after, const std::string& toNSEC, const SOAData& sd, DNSPacket *r, int mode);
@@ -107,13 +107,13 @@ private:
   
 
   void synthesiseRRSIGs(DNSPacket* p, DNSPacket* r);
-  void makeNXDomain(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd);
-  void makeNOError(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd);
+  void makeNXDomain(DNSPacket* p, DNSPacket* r, const std::string& target, const std::string& nextcloser, SOAData& sd);
+  void makeNOError(DNSPacket* p, DNSPacket* r, const std::string& target, SOAData& sd, int mode);
   vector<DNSResourceRecord> getBestReferralNS(DNSPacket *p, SOAData& sd, const string &target);
   bool tryReferral(DNSPacket *p, DNSPacket*r, SOAData& sd, const string &target);
 
-  bool getBestWildcard(DNSPacket *p, SOAData& sd, const string &target, vector<DNSResourceRecord>* ret);
-  bool tryWildcard(DNSPacket *p, DNSPacket*r, SOAData& sd, string &target, bool& retargeted, bool& nodata);
+  bool getBestWildcard(DNSPacket *p, SOAData& sd, const string &target, string &wildcard, vector<DNSResourceRecord>* ret);
+  bool tryWildcard(DNSPacket *p, DNSPacket*r, SOAData& sd, string &target, string &wildcard, bool& retargeted, bool& nodata);
   bool addDSforNS(DNSPacket* p, DNSPacket* r, SOAData& sd, const string& dsname);
   void completeANYRecords(DNSPacket *p, DNSPacket*r, SOAData& sd, const string &target);
   

diff --git a/regression-tests.nobackend/tinydns-data-check/expected_result b/regression-tests.nobackend/tinydns-data-check/expected_result
index 741291902441aaf3ba9128ad9e55b4a53566db9d..fa7a2eecc8b559248eaf9d6d0274363f0324e662 100644 (file)
--- a/regression-tests.nobackend/tinydns-data-check/expected_result
+++ b/regression-tests.nobackend/tinydns-data-check/expected_result
@@ -1,6 +1,6 @@
 9235756d96b6ad0af7936419248c3ed5  ../regression-tests/example.com
 33e43585aeed4eb9af10a83c72a04d14  ../regression-tests/test.com
-350bd2a9e2a106b51d05049a2b98ad04  ../regression-tests/wtest.com
+7d726bc367bf5e6ee5f1689994c6b6d4  ../regression-tests/wtest.com
 a0670eef8fba3e16908057af8de2c2f2  ../regression-tests/dnssec-parent.com
 42dd3a56c7d268e75836371878819ec4  ../regression-tests/delegated.dnssec-parent.com
-2e15e42b6b1e4e4e6496b805af1c60b0  ../modules/tinydnsbackend/data.cdb
+cdae946deaa8801a4c5796bb6d554065  ../modules/tinydnsbackend/data.cdb

diff --git a/regression-tests/any-query/expected_result.narrow b/regression-tests/any-query/expected_result.narrow
new file mode 100644 (file)
index 0000000..49e3c0d
--- /dev/null
+++ b/regression-tests/any-query/expected_result.narrow
@@ -0,0 +1,9 @@
+0      example.com.    IN      DNSKEY  120     256 3 5 AwEAAarTiHhPgvD28WCN8UBXcEcf8f+OF+d/bEoN6zTuHl/oVra5/qfonhYK/RjI74RzHc2wli9TpXOWycQV3YSfpFZ9z+GB/bbsvBon1XMyNf5KXuOwRdHZXIZh1cku3AcIyNroD26MPkbFLHY0+xRI+7u7OsQ6nYcPBpqDiJnB2BMh
+0      example.com.    IN      MX      120     10 smtp-servers.example.com.
+0      example.com.    IN      MX      120     15 smtp-servers.test.com.
+0      example.com.    IN      NS      120     ns1.example.com.
+0      example.com.    IN      NS      120     ns2.example.com.
+0      example.com.    IN      SOA     120     ns1.example.com. ahu.example.com. 2000081501 28800 7200 604800 86400
+0      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM
+Rcode: 0, RD: 0, QR: 1, TC: 1, AA: 1, opcode: 0
+Reply to question for qname='example.com.', qtype=ANY

diff --git a/regression-tests/any-query/expected_result.nsec3 b/regression-tests/any-query/expected_result.nsec3
index 0d24984b8eef7d46647cf26b9a47b1e69c654831..300c3aaba2d476531009681b0f0f3387ecc63676 100644 (file)
--- a/regression-tests/any-query/expected_result.nsec3
+++ b/regression-tests/any-query/expected_result.nsec3
@@ -1,4 +1,3 @@
-0      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
 0      example.com.    IN      DNSKEY  120     256 3 5 AwEAAarTiHhPgvD28WCN8UBXcEcf8f+OF+d/bEoN6zTuHl/oVra5/qfonhYK/RjI74RzHc2wli9TpXOWycQV3YSfpFZ9z+GB/bbsvBon1XMyNf5KXuOwRdHZXIZh1cku3AcIyNroD26MPkbFLHY0+xRI+7u7OsQ6nYcPBpqDiJnB2BMh
 0      example.com.    IN      MX      120     10 smtp-servers.example.com.
 0      example.com.    IN      MX      120     15 smtp-servers.test.com.

diff --git a/regression-tests/cleandig b/regression-tests/cleandig
index 8ceaadeb59bc08a77555c0f7821b34e329331109..bd6916631dc1253142d3c6c068d8de5de9c18d82 100755 (executable)
--- a/regression-tests/cleandig
+++ b/regression-tests/cleandig
@@ -1,5 +1,6 @@
 #!/bin/sh
 ../pdns/sdig $nameserver $port $1 $2 $3 | LC_ALL=C sort
+../pdns/nsec3dig $nameserver $port $1 $2 > $testname/nsec3dig.out 2>&1
 drill -a -p $port -o rd -D -S -k trustedkeys $1 $2 @$nameserver > $testname/drillchase.out 2>&1 
 echo RETVAL: $? >> $testname/drillchase.out
 drill -a -p $port -o rd -D -k trustedkeys $1 $2 @$nameserver > $testname/drill.out 2>&1

diff --git a/regression-tests/ds-at-unsecure-delegation/expected_result.narrow b/regression-tests/ds-at-unsecure-delegation/expected_result.narrow
new file mode 100644 (file)
index 0000000..b298af0
--- /dev/null
+++ b/regression-tests/ds-at-unsecure-delegation/expected_result.narrow
@@ -0,0 +1,2 @@
+1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      NSEC3   120     1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1 NS RRSIG
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3 b/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
index d3ea3db6b6620d0980503ef9775a6ba857dfb80e..9b0397ac9db81b4ecce1a7276d8cefd268c4d2cb 100644 (file)
--- a/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
+++ b/regression-tests/ds-at-unsecure-delegation/expected_result.nsec3
@@ -1,3 +1,2 @@
-1      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
 1      t66sektb7egvs7s57m1qged4h6809g8s.example.com.   IN      NSEC3   120     1 1 1 abcd T6A44A7N1B90T5RIS4IBQKT51MMDL0LO A RRSIG
 1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/ds-at-unsecure-zone-cut/command b/regression-tests/ds-at-unsecure-zone-cut/command
index db2923d6602c3b290a7ef57622ed608f13237954..2523f9b50cf4be78735919634bc6815527d51094 100755 (executable)
--- a/regression-tests/ds-at-unsecure-zone-cut/command
+++ b/regression-tests/ds-at-unsecure-zone-cut/command
@@ -1,3 +1,3 @@
 #!/bin/sh
-cleandig delegated.dnssec-parent.com DS
+cleandig delegated.dnssec-parent.com DS dnssec | egrep 'IN[[:space:]]+NSEC'
 

diff --git a/regression-tests/ds-at-unsecure-zone-cut/description b/regression-tests/ds-at-unsecure-zone-cut/description
index 3e2f4122d0fffd46033050653b3ed8f833bb12e2..3ff2bd29a251c2dd6e7d8c1abba69080fcf50436 100644 (file)
--- a/regression-tests/ds-at-unsecure-zone-cut/description
+++ b/regression-tests/ds-at-unsecure-zone-cut/description
@@ -1,3 +1,4 @@
 This test tries to resolve a DS question at an unsecure zone-cut, thus
 testing RFC 4035 3.1.4.1 and B.8.
-
+(Test currently skipped for bind-dnssec - it is in fact broken there.
+FIXME)

diff --git a/regression-tests/ds-at-unsecure-zone-cut/expected_result b/regression-tests/ds-at-unsecure-zone-cut/expected_result
index 05ad3f021a4a305351f4cff67545aef0ec2178f2..c95077d876682d6fe58e474ca50159a56b8da709 100644 (file)
--- a/regression-tests/ds-at-unsecure-zone-cut/expected_result
+++ b/regression-tests/ds-at-unsecure-zone-cut/expected_result
@@ -1,3 +1 @@
-1      dnssec-parent.com.      IN      SOA     3600    ns1.dnssec-parent.com. ahu.example.com. 2005092501 28800 7200 604800 86400
-Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
-Reply to question for qname='delegated.dnssec-parent.com.', qtype=DS
+1      delegated.dnssec-parent.com.    IN      NSEC    3600    ns1.dnssec-parent.com. NS RRSIG NSEC

diff --git a/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow b/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow
new file mode 100644 (file)
index 0000000..ebef2be
--- /dev/null
+++ b/regression-tests/ds-at-unsecure-zone-cut/expected_result.narrow
@@ -0,0 +1,2 @@
+1      be6iqh4fjrtdhacqk7g3iq96qcvf2qoi.dnssec-parent.com.     IN      NSEC3   3600    1 1 1 abcd BE6IQH4FJRTDHACQK7G3IQ96QCVF2QOK A NS SOA RRSIG
+1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      NSEC3   3600    1 1 1 abcd DVKUO8KJA65GCSQ600E6DI9U719LSJ8V A NS SOA RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3 b/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3
new file mode 100644 (file)
index 0000000..1fe1947
--- /dev/null
+++ b/regression-tests/ds-at-unsecure-zone-cut/expected_result.nsec3
@@ -0,0 +1,2 @@
+1      29ceqcf4ekgl2gr9i0vjjtk62h5lqs40.dnssec-parent.com.     IN      NSEC3   3600    1 1 1 abcd DVKUO8KJA65GCSQ600E6DI9U719LSJ8U A RRSIG
+1      dvkuo8kja65gcsq600e6di9u719lsj8u.dnssec-parent.com.     IN      NSEC3   3600    1 1 1 abcd 1SCAQA30LQ0DO5EIRNE4KPJFBEBFGR54 A NS SOA RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/ds-at-unsecure-zone-cut/skip.bind-dnssec b/regression-tests/ds-at-unsecure-zone-cut/skip.bind-dnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/ds-inside-delegation/command b/regression-tests/ds-inside-delegation/command
index e24d146c40730b0e25a0796feca48ea019fff3a0..2a43d64923b62a6cf192c852e8fc96a9e27d603c 100755 (executable)
--- a/regression-tests/ds-inside-delegation/command
+++ b/regression-tests/ds-inside-delegation/command
@@ -1,2 +1,2 @@
 #!/bin/sh
-cleandig sub.usa.example.com DS dnssec | egrep -v 'IN[[:space:]]+(NSEC|RRSIG)'
+cleandig sub.usa.example.com DS dnssec | egrep -v 'IN[[:space:]]+RRSIG'

diff --git a/regression-tests/ds-inside-delegation/expected_result.dnssec b/regression-tests/ds-inside-delegation/expected_result.dnssec
new file mode 100644 (file)
index 0000000..ffe373a
--- /dev/null
+++ b/regression-tests/ds-inside-delegation/expected_result.dnssec
@@ -0,0 +1,8 @@
+1      usa.example.com.        IN      NS      120     usa-ns1.usa.example.com.
+1      usa.example.com.        IN      NS      120     usa-ns2.usa.example.com.
+1      usa.example.com.        IN      NSEC    120     www.example.com. NS RRSIG NSEC
+2      .       IN      OPT     32768   
+2      usa-ns1.usa.example.com.        IN      A       120     192.168.4.1
+2      usa-ns2.usa.example.com.        IN      A       120     192.168.4.2
+Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0
+Reply to question for qname='sub.usa.example.com.', qtype=DS

diff --git a/regression-tests/ds-inside-delegation/expected_result.narrow b/regression-tests/ds-inside-delegation/expected_result.narrow
new file mode 100644 (file)
index 0000000..4c1fb8f
--- /dev/null
+++ b/regression-tests/ds-inside-delegation/expected_result.narrow
@@ -0,0 +1,9 @@
+1      t67rqvqprigd7rtb5fah6c3o7g9th3iv.example.com.   IN      NSEC3   120     1 1 1 abcd T67RQVQPRIGD7RTB5FAH6C3O7G9TH3J1 NS RRSIG
+1      usa.example.com.        IN      NS      120     usa-ns1.usa.example.com.
+1      usa.example.com.        IN      NS      120     usa-ns2.usa.example.com.
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM
+2      .       IN      OPT     32768   
+2      usa-ns1.usa.example.com.        IN      A       120     192.168.4.1
+2      usa-ns2.usa.example.com.        IN      A       120     192.168.4.2
+Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0
+Reply to question for qname='sub.usa.example.com.', qtype=DS

diff --git a/regression-tests/ds-inside-delegation/expected_result.nsec3 b/regression-tests/ds-inside-delegation/expected_result.nsec3
new file mode 100644 (file)
index 0000000..d62c2f1
--- /dev/null
+++ b/regression-tests/ds-inside-delegation/expected_result.nsec3
@@ -0,0 +1,9 @@
+1      t66sektb7egvs7s57m1qged4h6809g8s.example.com.   IN      NSEC3   120     1 1 1 abcd T6A44A7N1B90T5RIS4IBQKT51MMDL0LO A RRSIG
+1      usa.example.com.        IN      NS      120     usa-ns1.usa.example.com.
+1      usa.example.com.        IN      NS      120     usa-ns2.usa.example.com.
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM
+2      .       IN      OPT     32768   
+2      usa-ns1.usa.example.com.        IN      A       120     192.168.4.1
+2      usa-ns2.usa.example.com.        IN      A       120     192.168.4.2
+Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 0, opcode: 0
+Reply to question for qname='sub.usa.example.com.', qtype=DS

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/command b/regression-tests/five-levels-wildcard-one-below-apex/command
new file mode 100644 (file)
index 0000000..a6030fd
--- /dev/null
+++ b/regression-tests/five-levels-wildcard-one-below-apex/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig www.a.b.c.d.e.something.wtest.com A dnssec | egrep 'IN[[:space:]]+NSEC'

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/description b/regression-tests/five-levels-wildcard-one-below-apex/description
new file mode 100644 (file)
index 0000000..706fc1a
--- /dev/null
+++ b/regression-tests/five-levels-wildcard-one-below-apex/description
@@ -0,0 +1,2 @@
+A wildcard synthesizing 5 levels of non-empty terminals with the closets
+encloser one level below the apex.

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/expected_result b/regression-tests/five-levels-wildcard-one-below-apex/expected_result
new file mode 100644 (file)
index 0000000..cbcb94c
--- /dev/null
+++ b/regression-tests/five-levels-wildcard-one-below-apex/expected_result
@@ -0,0 +1 @@
+1      a.something.wtest.com.  IN      NSEC    3600    wtest.com. A RRSIG NSEC

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/expected_result.narrow b/regression-tests/five-levels-wildcard-one-below-apex/expected_result.narrow
new file mode 100644 (file)
index 0000000..23f649b
--- /dev/null
+++ b/regression-tests/five-levels-wildcard-one-below-apex/expected_result.narrow
@@ -0,0 +1 @@
+1      pqgjjrj5si55uc1208gt1hp1k217fhqu.wtest.com.     IN      NSEC3   86400   1 1 1 abcd PQGJJRJ5SI55UC1208GT1HP1K217FHR0 RRSIG

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/expected_result.nsec3 b/regression-tests/five-levels-wildcard-one-below-apex/expected_result.nsec3
new file mode 100644 (file)
index 0000000..f5e0f61
--- /dev/null
+++ b/regression-tests/five-levels-wildcard-one-below-apex/expected_result.nsec3
@@ -0,0 +1 @@
+1      pd15qdsjjbfosu5fg2oqrnlb8r8oifl6.wtest.com.     IN      NSEC3   3600    1 1 1 abcd SHEGK154N8362AG22AR9VDDRF3127M6I A RRSIG

diff --git a/regression-tests/five-levels-wildcard-one-below-apex/skip.nodnssec b/regression-tests/five-levels-wildcard-one-below-apex/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/five-levels-wildcard/command b/regression-tests/five-levels-wildcard/command
new file mode 100644 (file)
index 0000000..5037adf
--- /dev/null
+++ b/regression-tests/five-levels-wildcard/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig www.a.b.c.d.e.wtest.com A dnssec | egrep 'IN[[:space:]]+NSEC'

diff --git a/regression-tests/five-levels-wildcard/description b/regression-tests/five-levels-wildcard/description
new file mode 100644 (file)
index 0000000..eea0449
--- /dev/null
+++ b/regression-tests/five-levels-wildcard/description
@@ -0,0 +1,2 @@
+A wildcard, 5 levels deep, with all non-empty terminals in between
+explicitly marked as TXT in the zone.

diff --git a/regression-tests/five-levels-wildcard/expected_result b/regression-tests/five-levels-wildcard/expected_result
new file mode 100644 (file)
index 0000000..27b688b
--- /dev/null
+++ b/regression-tests/five-levels-wildcard/expected_result
@@ -0,0 +1 @@
+1      *.a.b.c.d.e.wtest.com.  IN      NSEC    3600    secure.wtest.com. A RRSIG NSEC

diff --git a/regression-tests/five-levels-wildcard/expected_result.narrow b/regression-tests/five-levels-wildcard/expected_result.narrow
new file mode 100644 (file)
index 0000000..7bc473d
--- /dev/null
+++ b/regression-tests/five-levels-wildcard/expected_result.narrow
@@ -0,0 +1 @@
+1      pet5iqbgccga60p2n38nmuanrk50papg.wtest.com.     IN      NSEC3   86400   1 1 1 abcd PET5IQBGCCGA60P2N38NMUANRK50PAPI RRSIG

diff --git a/regression-tests/five-levels-wildcard/expected_result.nsec3 b/regression-tests/five-levels-wildcard/expected_result.nsec3
new file mode 100644 (file)
index 0000000..f5e0f61
--- /dev/null
+++ b/regression-tests/five-levels-wildcard/expected_result.nsec3
@@ -0,0 +1 @@
+1      pd15qdsjjbfosu5fg2oqrnlb8r8oifl6.wtest.com.     IN      NSEC3   3600    1 1 1 abcd SHEGK154N8362AG22AR9VDDRF3127M6I A RRSIG

diff --git a/regression-tests/five-levels-wildcard/skip.nodnssec b/regression-tests/five-levels-wildcard/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/nsec-bitmap/expected_result.narrow b/regression-tests/nsec-bitmap/expected_result.narrow
new file mode 100644 (file)
index 0000000..f7bc732
--- /dev/null
+++ b/regression-tests/nsec-bitmap/expected_result.narrow
@@ -0,0 +1 @@
+1      3v4it454kfh142bi7afagnuvigrpfptt.example.com.   IN      NSEC3   120     1 1 1 abcd 3V4IT454KFH142BI7AFAGNUVIGRPFPTU A RRSIG TYPE65534

diff --git a/regression-tests/nsec-bitmap/expected_result.nsec3 b/regression-tests/nsec-bitmap/expected_result.nsec3
index 2882793d3d30429b7d2aa36e0f71c39f3fae9a2f..bd037df2151d388bebc791ac99fea480f8dd8c4f 100644 (file)
--- a/regression-tests/nsec-bitmap/expected_result.nsec3
+++ b/regression-tests/nsec-bitmap/expected_result.nsec3
@@ -1,3 +1 @@
 1      3v4it454kfh142bi7afagnuvigrpfptt.example.com.   IN      NSEC3   120     1 1 1 abcd 3V4S43RV1GT28N0F2PPJ8I8482ESMUOB A RRSIG TYPE65534
-1      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-glue/expected_result.narrow b/regression-tests/nsec-glue/expected_result.narrow
new file mode 100644 (file)
index 0000000..f47c66a
--- /dev/null
+++ b/regression-tests/nsec-glue/expected_result.narrow
@@ -0,0 +1,3 @@
+1      9fag9508oqu3m22qac0u5eqgg45v8cf0.example.com.   IN      NSEC3   86400   1 1 1 abcd 9FAG9508OQU3M22QAC0U5EQGG45V8CF2 RRSIG
+1      kt3ll2fgp7p2s71mk7frk5igi8pc8gl1.example.com.   IN      NSEC3   86400   1 1 1 abcd KT3LL2FGP7P2S71MK7FRK5IGI8PC8GL3 RRSIG
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-middle/expected_result.narrow b/regression-tests/nsec-middle/expected_result.narrow
new file mode 100644 (file)
index 0000000..6a57917
--- /dev/null
+++ b/regression-tests/nsec-middle/expected_result.narrow
@@ -0,0 +1,3 @@
+1      9fag9508oqu3m22qac0u5eqgg45v8cf0.example.com.   IN      NSEC3   86400   1 1 1 abcd 9FAG9508OQU3M22QAC0U5EQGG45V8CF2 RRSIG
+1      sthvu2kihc96kc1tu8v3curr8og5dghn.example.com.   IN      NSEC3   86400   1 1 1 abcd STHVU2KIHC96KC1TU8V3CURR8OG5DGHP RRSIG
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-wildcard/command b/regression-tests/nsec-wildcard/command
new file mode 100644 (file)
index 0000000..bb6730d
--- /dev/null
+++ b/regression-tests/nsec-wildcard/command
@@ -0,0 +1,3 @@
+#!/bin/sh
+cleandig t.something.wtest.com TXT dnssec | egrep 'IN[[:space:]]+NSEC'
+

diff --git a/regression-tests/nsec-wildcard/description b/regression-tests/nsec-wildcard/description
new file mode 100644 (file)
index 0000000..7a68de2
--- /dev/null
+++ b/regression-tests/nsec-wildcard/description
@@ -0,0 +1,4 @@
+We would sometimes synthesize an NSEC from a wildcard. This test
+makes sure we have stopped doing that.
+(I have a feeling unbound only accepts our output because of the
+opt-out flags. FIXME?)

diff --git a/regression-tests/nsec-wildcard/expected_result b/regression-tests/nsec-wildcard/expected_result
new file mode 100644 (file)
index 0000000..e144b08
--- /dev/null
+++ b/regression-tests/nsec-wildcard/expected_result
@@ -0,0 +1,2 @@
+1      *.something.wtest.com.  IN      NSEC    3600    a.something.wtest.com. A RRSIG NSEC
+1      a.something.wtest.com.  IN      NSEC    3600    wtest.com. A RRSIG NSEC

diff --git a/regression-tests/nsec-wildcard/expected_result.narrow b/regression-tests/nsec-wildcard/expected_result.narrow
new file mode 100644 (file)
index 0000000..3d3b5b5
--- /dev/null
+++ b/regression-tests/nsec-wildcard/expected_result.narrow
@@ -0,0 +1,2 @@
+1      368r0s1q794jmkdrcpf6f85v316hd9ak.wtest.com.     IN      NSEC3   86400   1 1 1 abcd 368R0S1Q794JMKDRCPF6F85V316HD9AM RRSIG
+1      54njs65s8u96tkffrft6l7j1t1556vik.wtest.com.     IN      NSEC3   3600    1 1 1 abcd 54NJS65S8U96TKFFRFT6L7J1T1556VIL TXT RRSIG

diff --git a/regression-tests/nsec-wildcard/expected_result.nsec3 b/regression-tests/nsec-wildcard/expected_result.nsec3
new file mode 100644 (file)
index 0000000..34342e9
--- /dev/null
+++ b/regression-tests/nsec-wildcard/expected_result.nsec3
@@ -0,0 +1,2 @@
+1      54njs65s8u96tkffrft6l7j1t1556vik.wtest.com.     IN      NSEC3   3600    1 1 1 abcd 67I2ESLUBOJ7DPG4263L3T8DV19G6D0G TXT RRSIG
+1      shegk154n8362ag22ar9vddrf3127m6i.wtest.com.     IN      NSEC3   3600    1 1 1 abcd 53I5J7TGM8QG2GBV716RVQVARQCIJUE2 A NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-wildcard/skip.nodnssec b/regression-tests/nsec-wildcard/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/nsec-wraparound/skip.narrow b/regression-tests/nsec-wraparound/skip.narrow
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/nsec-wraparound/skip.nsec3 b/regression-tests/nsec-wraparound/skip.nsec3
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/nsec-wrong-type-at-apex/expected_result.narrow b/regression-tests/nsec-wrong-type-at-apex/expected_result.narrow
new file mode 100644 (file)
index 0000000..30d271e
--- /dev/null
+++ b/regression-tests/nsec-wrong-type-at-apex/expected_result.narrow
@@ -0,0 +1 @@
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-wrong-type-at-apex/expected_result.nsec3 b/regression-tests/nsec-wrong-type-at-apex/expected_result.nsec3
index 223539028ce33d3d913b03ada1c8f04d6964f0c9..ea63946bb816cb9d9cdeec76aedac725df042aa3 100644 (file)
--- a/regression-tests/nsec-wrong-type-at-apex/expected_result.nsec3
+++ b/regression-tests/nsec-wrong-type-at-apex/expected_result.nsec3
@@ -1,2 +1 @@
-1      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
 1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nsec-wrong-type/expected_result.narrow b/regression-tests/nsec-wrong-type/expected_result.narrow
new file mode 100644 (file)
index 0000000..168b425
--- /dev/null
+++ b/regression-tests/nsec-wrong-type/expected_result.narrow
@@ -0,0 +1 @@
+1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5UVGFM2VJCJE09SVS7LFB22I1UUQJF99 A RRSIG

diff --git a/regression-tests/nsec-wrong-type/expected_result.nsec3 b/regression-tests/nsec-wrong-type/expected_result.nsec3
index fa12aa2b42d9a03ddc1b97714de3362d0532d8da..729d87c2fa27030da9d78bdd6fb28039bee78887 100644 (file)
--- a/regression-tests/nsec-wrong-type/expected_result.nsec3
+++ b/regression-tests/nsec-wrong-type/expected_result.nsec3
@@ -1,3 +1 @@
 1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5V0S7HPRC5IAFH3C3RO0HHNH543D3UIU A RRSIG
-1      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
-1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/command b/regression-tests/nxdomain-below-nonempty-terminal/command
new file mode 100644 (file)
index 0000000..3ab6314
--- /dev/null
+++ b/regression-tests/nxdomain-below-nonempty-terminal/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig nx1.nx2.outpost.example.com A dnssec | egrep 'IN[[:space:]]+NSEC'

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/description b/regression-tests/nxdomain-below-nonempty-terminal/description
new file mode 100644 (file)
index 0000000..e3f3967
--- /dev/null
+++ b/regression-tests/nxdomain-below-nonempty-terminal/description
@@ -0,0 +1,2 @@
+Make sure a name that is two labels beneath an existing name within a zone,
+generates a correct NSEC(3) denial.

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/expected_result b/regression-tests/nxdomain-below-nonempty-terminal/expected_result
new file mode 100644 (file)
index 0000000..b9a61fa
--- /dev/null
+++ b/regression-tests/nxdomain-below-nonempty-terminal/expected_result
@@ -0,0 +1,2 @@
+1      example.com.    IN      NSEC    120     escapedtext.example.com. NS SOA MX RRSIG NSEC DNSKEY
+1      outpost.example.com.    IN      NSEC    120     semi-external.example.com. A RRSIG NSEC

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/expected_result.narrow b/regression-tests/nxdomain-below-nonempty-terminal/expected_result.narrow
new file mode 100644 (file)
index 0000000..c043e7f
--- /dev/null
+++ b/regression-tests/nxdomain-below-nonempty-terminal/expected_result.narrow
@@ -0,0 +1,3 @@
+1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5UVGFM2VJCJE09SVS7LFB22I1UUQJF99 A RRSIG
+1      sdgbafmjek5v4t8c89q9u0n03qmcslor.example.com.   IN      NSEC3   86400   1 1 1 abcd SDGBAFMJEK5V4T8C89Q9U0N03QMCSLOT RRSIG
+1      tsdp8hajlfgr90cv4ib634g1m25nc5up.example.com.   IN      NSEC3   86400   1 1 1 abcd TSDP8HAJLFGR90CV4IB634G1M25NC5UR RRSIG

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/expected_result.nsec3 b/regression-tests/nxdomain-below-nonempty-terminal/expected_result.nsec3
new file mode 100644 (file)
index 0000000..560cf17
--- /dev/null
+++ b/regression-tests/nxdomain-below-nonempty-terminal/expected_result.nsec3
@@ -0,0 +1,3 @@
+1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5V0S7HPRC5IAFH3C3RO0HHNH543D3UIU A RRSIG
+1      sdeu4ba3b451gf8ijikm2tphu3bugl4g.example.com.   IN      NSEC3   120     1 1 1 abcd SDH8FVJ6LQLSVCQCO8QP82I6JTR574H2 A RRSIG
+1      tsbl3ev9tces1kjgto3qtn36ltlu0te1.example.com.   IN      NSEC3   120     1 1 1 abcd TSIKPRKTT53V9ILUK08SMR9KADQ44TR1 A RRSIG

diff --git a/regression-tests/nxdomain-below-nonempty-terminal/skip.nodnssec b/regression-tests/nxdomain-below-nonempty-terminal/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/obscured-wildcard/command b/regression-tests/obscured-wildcard/command
new file mode 100644 (file)
index 0000000..d47822a
--- /dev/null
+++ b/regression-tests/obscured-wildcard/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig www.a.something.wtest.com A

diff --git a/regression-tests/obscured-wildcard/description b/regression-tests/obscured-wildcard/description
new file mode 100644 (file)
index 0000000..61ba1a9
--- /dev/null
+++ b/regression-tests/obscured-wildcard/description
@@ -0,0 +1,2 @@
+If there is a more-specific subtree that matches part of a name,
+a less-specific wildcard cannot match it.

diff --git a/regression-tests/obscured-wildcard/expected_result b/regression-tests/obscured-wildcard/expected_result
new file mode 100644 (file)
index 0000000..ae536da
--- /dev/null
+++ b/regression-tests/obscured-wildcard/expected_result
@@ -0,0 +1,3 @@
+1      wtest.com.      IN      SOA     3600    ns1.wtest.com. ahu.example.com. 2005092501 28800 7200 604800 86400
+Rcode: 3, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
+Reply to question for qname='www.a.something.wtest.com.', qtype=A

diff --git a/regression-tests/runtests b/regression-tests/runtests
index 73e127089c7fe9328033e932294dde055f6197ae..bbb8ed8d8cc3ef9b8c6d8971ffe628f6a372ae1b 100755 (executable)
--- a/regression-tests/runtests
+++ b/regression-tests/runtests
@@ -1,7 +1,7 @@
 #!/bin/bash
 PATH=.:$PATH
 
-make -C ../pdns sdig || exit 1
+make -C ../pdns sdig nsec3dig || exit 1
 
 rm -f test-results failed_tests passed_tests skipped_tests */real_result */diff */*.out
 
@@ -31,7 +31,7 @@ do
                SKIPIT=1
                result="        Skipped test $a"
        else
-               for reason in "$skipreasons"
+               for reason in "$skipreasons" "$context"
                do
                        if [ -e $a/skip.$reason ]
                        then

diff --git a/regression-tests/second-level-nxdomain/command b/regression-tests/second-level-nxdomain/command
new file mode 100644 (file)
index 0000000..11949f8
--- /dev/null
+++ b/regression-tests/second-level-nxdomain/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig nx.outpost.example.com A dnssec | egrep 'IN[[:space:]]+NSEC'

diff --git a/regression-tests/second-level-nxdomain/description b/regression-tests/second-level-nxdomain/description
new file mode 100644 (file)
index 0000000..1a8525d
--- /dev/null
+++ b/regression-tests/second-level-nxdomain/description
@@ -0,0 +1,2 @@
+Make sure a name that is two labels beneath an apex, with the first label
+existing but the second absent, generates a correct NSEC(3) denial.

diff --git a/regression-tests/second-level-nxdomain/expected_result b/regression-tests/second-level-nxdomain/expected_result
new file mode 100644 (file)
index 0000000..b9a61fa
--- /dev/null
+++ b/regression-tests/second-level-nxdomain/expected_result
@@ -0,0 +1,2 @@
+1      example.com.    IN      NSEC    120     escapedtext.example.com. NS SOA MX RRSIG NSEC DNSKEY
+1      outpost.example.com.    IN      NSEC    120     semi-external.example.com. A RRSIG NSEC

diff --git a/regression-tests/second-level-nxdomain/expected_result.narrow b/regression-tests/second-level-nxdomain/expected_result.narrow
new file mode 100644 (file)
index 0000000..20aee9d
--- /dev/null
+++ b/regression-tests/second-level-nxdomain/expected_result.narrow
@@ -0,0 +1,3 @@
+1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5UVGFM2VJCJE09SVS7LFB22I1UUQJF99 A RRSIG
+1      k6ta8mhi455hk3jskn0b2st81j6fa1l0.example.com.   IN      NSEC3   86400   1 1 1 abcd K6TA8MHI455HK3JSKN0B2ST81J6FA1L2 RRSIG
+1      tsdp8hajlfgr90cv4ib634g1m25nc5up.example.com.   IN      NSEC3   86400   1 1 1 abcd TSDP8HAJLFGR90CV4IB634G1M25NC5UR RRSIG

diff --git a/regression-tests/second-level-nxdomain/expected_result.nsec3 b/regression-tests/second-level-nxdomain/expected_result.nsec3
new file mode 100644 (file)
index 0000000..1f72d46
--- /dev/null
+++ b/regression-tests/second-level-nxdomain/expected_result.nsec3
@@ -0,0 +1,3 @@
+1      5uvgfm2vjcje09svs7lfb22i1uuqjf98.example.com.   IN      NSEC3   120     1 1 1 abcd 5V0S7HPRC5IAFH3C3RO0HHNH543D3UIU A RRSIG
+1      k6r6482mfo4upme9n407c2grb6opp1ip.example.com.   IN      NSEC3   120     1 1 1 abcd K6TDMVV7BP54FEFUIVR0BVABIBUN0AV9 A RRSIG
+1      tsbl3ev9tces1kjgto3qtn36ltlu0te1.example.com.   IN      NSEC3   120     1 1 1 abcd TSIKPRKTT53V9ILUK08SMR9KADQ44TR1 A RRSIG

diff --git a/regression-tests/second-level-nxdomain/skip.nodnssec b/regression-tests/second-level-nxdomain/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/start-test-stop b/regression-tests/start-test-stop
index aa3047bcc4dd41caeb9a328463d49019967240f4..dfb4c8be84726bfab4dd0ef6cb8b3738a45dc55a 100755 (executable)
--- a/regression-tests/start-test-stop
+++ b/regression-tests/start-test-stop
@@ -22,7 +22,7 @@ Usage: ./start-test-stop <port> [<context>] [wait]
 
 context is one of:
 bind bind-dnssec bind-dnssec-nsec3
-gmysql-nodnssec gmysql gmysql-nsec3
+gmysql-nodnssec gmysql gmysql-nsec3 gmysql-nsec3-narrow
 gpgsql-nodnssec gpgsql gpgsql-nsec3
 gsqlite3-nodnssec gsqlite3 gsqlite3-nsec3
 opendbx-sqlite3
@@ -86,7 +86,7 @@ case $context in
                        skipreasons=nodnssec
                        ;;
 
-               gmysql | gmysql-nsec3)
+               gmysql | gmysql-nsec3 | gmysql-nsec3-narrow)
                        [ -z "$GMYSQLDB" ] && GMYSQLDB=pdnstest
                        [ -z "$GMYSQLUSER" ] && GMYSQLUSER=root
                        [ -z "$GMYSQLHOST" ] && GMYSQLHOST=localhost
@@ -118,7 +118,13 @@ __EOF__
                                then
                                        ../pdns/pdnssec --config-dir=. --config-name=gmysql set-nsec3 $zone '1 1 1 abcd' 2>&1
                                        ../pdns/pdnssec --config-dir=. --config-name=gmysql rectify-zone $zone 2>&1
+                               elif [ $context = gmysql-nsec3-narrow ]
+                               then
+                                       ../pdns/pdnssec --config-dir=. --config-name=gmysql set-nsec3 $zone '1 1 1 abcd' narrow 2>&1
+                                       ../pdns/pdnssec --config-dir=. --config-name=gmysql rectify-zone $zone 2>&1
                                fi
+                               
+
                        done
 
                        $RUNWRAPPER ../pdns/pdns_server --daemon=no --local-port=$port --socket-dir=./  \
@@ -132,6 +138,11 @@ __EOF__
                        if [ $context = gmysql-nsec3 ]
                        then
                                extracontexts="dnssec nsec3"
+                               skipreasons="nsec3"
+                       elif [ $context = gmysql-nsec3-narrow ]
+                       then
+                               extracontexts="dnssec narrow"
+                               skipreasons="narrow"
                        else
                                extracontexts="dnssec"
                        fi
@@ -173,11 +184,14 @@ __EOF__
                        if [ $context = gpgsql-nsec3 ]
                        then
                                extracontexts="dnssec nsec3"
+                       elif [ $context = gpgsql-nsec3-narrow ]
+                       then
+                               extracontexts="dnssec narrow"
                        else
                                extracontexts="dnssec"
                        fi
 
-                       ;;      
+                       ;;
                gpgsql-nodnssec)
                        [ -z "$GPGSQLDB" ] && GPGSQLDB=pdnstest
                        [ -z "$GPGSQLUSER" ] && GPGSQLUSER=$(whoami)

diff --git a/regression-tests/two-level-nxdomain/command b/regression-tests/two-level-nxdomain/command
new file mode 100644 (file)
index 0000000..a848cc1
--- /dev/null
+++ b/regression-tests/two-level-nxdomain/command
@@ -0,0 +1,2 @@
+#!/bin/sh
+cleandig nx1.nx2.example.com A dnssec | egrep 'IN[[:space:]]+NSEC'

diff --git a/regression-tests/two-level-nxdomain/description b/regression-tests/two-level-nxdomain/description
new file mode 100644 (file)
index 0000000..16fd462
--- /dev/null
+++ b/regression-tests/two-level-nxdomain/description
@@ -0,0 +1,2 @@
+Make sure a name that is two labels beneath an apex, with even the first label
+not existing, generates a correct NSEC(3) denial.

diff --git a/regression-tests/two-level-nxdomain/expected_result b/regression-tests/two-level-nxdomain/expected_result
new file mode 100644 (file)
index 0000000..54d4073
--- /dev/null
+++ b/regression-tests/two-level-nxdomain/expected_result
@@ -0,0 +1,2 @@
+1      example.com.    IN      NSEC    120     escapedtext.example.com. NS SOA MX RRSIG NSEC DNSKEY
+1      ns2.example.com.        IN      NSEC    120     outpost.example.com. A RRSIG NSEC

diff --git a/regression-tests/two-level-nxdomain/expected_result.narrow b/regression-tests/two-level-nxdomain/expected_result.narrow
new file mode 100644 (file)
index 0000000..311f92e
--- /dev/null
+++ b/regression-tests/two-level-nxdomain/expected_result.narrow
@@ -0,0 +1,3 @@
+1      9fag9508oqu3m22qac0u5eqgg45v8cf0.example.com.   IN      NSEC3   86400   1 1 1 abcd 9FAG9508OQU3M22QAC0U5EQGG45V8CF2 RRSIG
+1      ectnliqstqsjnnrpuhjj5h0j3c3odkk3.example.com.   IN      NSEC3   86400   1 1 1 abcd ECTNLIQSTQSJNNRPUHJJ5H0J3C3ODKK5 RRSIG
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTNQ6OCN2VKUIV3NJU14OQTAEN2MT5SL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/two-level-nxdomain/expected_result.nsec3 b/regression-tests/two-level-nxdomain/expected_result.nsec3
new file mode 100644 (file)
index 0000000..6101ba3
--- /dev/null
+++ b/regression-tests/two-level-nxdomain/expected_result.nsec3
@@ -0,0 +1,3 @@
+1      9f8hti7cc7oqnqjv84klnp89glqrss3r.example.com.   IN      NSEC3   120     1 1 1 abcd 9FDAOFPLLN0FQFU9DP274GOU59QFHSLD A RRSIG
+1      ecskkg9s6f7lap5qjrnns1bf8pjunshj.example.com.   IN      NSEC3   120     1 1 1 abcd ECTPI4N8UNDE9GNVKHG28NJR512JBD4O A RRSIG
+1      vtnq6ocn2vkuiv3nju14oqtaen2mt5sk.example.com.   IN      NSEC3   120     1 1 1 abcd VTP9NUQBEH436S7J0K8TI2A32MMKCUUL NS SOA MX RRSIG DNSKEY NSEC3PARAM

diff --git a/regression-tests/two-level-nxdomain/skip.nodnssec b/regression-tests/two-level-nxdomain/skip.nodnssec
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/regression-tests/wtest.com b/regression-tests/wtest.com
index cfe71a6bec2ac39cc5ec204e4158a1ec1fd5597a..adcc71a3c7e0a1630443b38dc5d16638f26923bf 100644 (file)
--- a/regression-tests/wtest.com
+++ b/regression-tests/wtest.com
@@ -17,3 +17,10 @@ secure                       IN      MX      10 server1
 server1                        IN      A       1.2.3.4
 something              IN      TXT     "make the empty non-terminal non-empty"
 *.something            IN      A       4.3.2.1
+*.a.b.c.d.e            IN      A       6.7.8.9
+e                      IN      TXT     "non-empty"
+d.e                    IN      TXT     "non-empty"
+c.d.e                  IN      TXT     "non-empty"
+b.c.d.e                        IN      TXT     "non-empty"
+a.b.c.d.e                      IN      TXT     "non-empty"
+a.something            IN      A       10.11.12.13