From: JINMEI Tatuya <jinmei@isc.org>
Date: Wed, 19 Sep 2012 01:11:08 +0000 (-0700)
Subject: [2267] catch and reject RRSIGs that don't have a covered RRset.
X-Git-Tag: trac2351_base~51^2~9
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5a493720575e76a80ed6bba5cfcd2fac01364ce2;p=thirdparty%2Fkea.git

[2267] catch and reject RRSIGs that don't have a covered RRset.

the loadRRSIGFollowsNothing test now passes and is re-enabled.
the 'name unmatched' and 'type unmatched' tests are essentially the same
so are removed (so are their test zone files).
---

diff --git a/src/lib/datasrc/memory/memory_client.cc b/src/lib/datasrc/memory/memory_client.cc
index 4fea46a50f..709ce01c88 100644
--- a/src/lib/datasrc/memory/memory_client.cc
+++ b/src/lib/datasrc/memory/memory_client.cc
@@ -526,10 +526,11 @@ public:
     void flushNodeRRsets(const Name& zone_name, ZoneData* zone_data) {
         BOOST_FOREACH(NodeRRsetsVal val, node_rrsets_) {
             ConstRRsetPtr sig_rrset;
-            NodeRRsets::const_iterator sig_it =
+            NodeRRsets::iterator sig_it =
                 node_rrsigsets_.find(val.first);
             if (sig_it != node_rrsigsets_.end()) {
                 sig_rrset = sig_it->second;
+                node_rrsigsets_.erase(sig_it);
             }
             const result::Result result =
                 client_impl_->add(val.second, sig_rrset, zone_name,
@@ -537,6 +538,14 @@ public:
             assert(result == result::SUCCESS);
         }
 
+        // Right now, we don't accept RRSIG without covered RRsets (this
+        // should eventually allowed, but to do so we'll need to update the
+        // finder).
+        if (!node_rrsigsets_.empty()) {
+            isc_throw(AddError, "RRSIG is added without covered RRset for "
+                      << getCurrentName());
+        }
+
         node_rrsets_.clear();
         node_rrsigsets_.clear();
     }
diff --git a/src/lib/datasrc/memory/tests/memory_client_unittest.cc b/src/lib/datasrc/memory/tests/memory_client_unittest.cc
index 3d583d0746..da131ea69c 100644
--- a/src/lib/datasrc/memory/tests/memory_client_unittest.cc
+++ b/src/lib/datasrc/memory/tests/memory_client_unittest.cc
@@ -489,8 +489,9 @@ TEST_F(MemoryClientTest, loadDNAMEAndNSNonApex2) {
     // Teardown checks for memory segment leaks
 }
 
-// Disable for now: we should actually allow this case.
-TEST_F(MemoryClientTest, DISABLED_loadRRSIGFollowsNothing) {
+TEST_F(MemoryClientTest, loadRRSIGFollowsNothing) {
+    // This causes the situation where an RRSIG is added without a covered
+    // RRset.  Such cases are currently rejected.
     EXPECT_THROW(client_->load(Name("example.org"),
                                TEST_DATA_DIR
                                "/example.org-rrsig-follows-nothing.zone"),
@@ -498,24 +499,6 @@ TEST_F(MemoryClientTest, DISABLED_loadRRSIGFollowsNothing) {
     // Teardown checks for memory segment leaks
 }
 
-// Disable for now: we should actually allow this case.
-TEST_F(MemoryClientTest, DISABLED_loadRRSIGNameUnmatched) {
-    EXPECT_THROW(client_->load(Name("example.org"),
-                               TEST_DATA_DIR
-                               "/example.org-rrsig-name-unmatched.zone"),
-                 InMemoryClient::AddError);
-    // Teardown checks for memory segment leaks
-}
-
-// Disable for now: we should actually allow this case.
-TEST_F(MemoryClientTest, DISABLED_loadRRSIGTypeUnmatched) {
-    EXPECT_THROW(client_->load(Name("example.org"),
-                               TEST_DATA_DIR
-                               "/example.org-rrsig-type-unmatched.zone"),
-                 InMemoryClient::AddError);
-    // Teardown checks for memory segment leaks
-}
-
 TEST_F(MemoryClientTest, loadRRSIGs) {
     client_->load(Name("example.org"),
                   TEST_DATA_DIR "/example.org-rrsigs.zone");
diff --git a/src/lib/datasrc/memory/tests/testdata/Makefile.am b/src/lib/datasrc/memory/tests/testdata/Makefile.am
index 9fb99866a3..2d9226690c 100644
--- a/src/lib/datasrc/memory/tests/testdata/Makefile.am
+++ b/src/lib/datasrc/memory/tests/testdata/Makefile.am
@@ -24,8 +24,6 @@ EXTRA_DIST += example.org-nsec3-signed-no-param.zone
 EXTRA_DIST += example.org-nsec3-signed.zone
 EXTRA_DIST += example.org-out-of-zone.zone
 EXTRA_DIST += example.org-rrsig-follows-nothing.zone
-EXTRA_DIST += example.org-rrsig-name-unmatched.zone
-EXTRA_DIST += example.org-rrsig-type-unmatched.zone
 EXTRA_DIST += example.org-rrsigs.zone
 EXTRA_DIST += example.org-wildcard-dname.zone
 EXTRA_DIST += example.org-wildcard-ns.zone
diff --git a/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-name-unmatched.zone b/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-name-unmatched.zone
deleted file mode 100644
index dc1d72868e..0000000000
--- a/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-name-unmatched.zone
+++ /dev/null
@@ -1,6 +0,0 @@
-;; test zone file used for ZoneFinderContext tests.
-;; RRSIGs are (obviouslly) faked ones for testing.
-
-example.org. 3600 IN SOA	ns1.example.org. bugs.x.w.example.org. 70 3600 300 3600000 3600
-ns1.example.org.		      3600 IN A		192.0.2.1
-ns2.example.org.		      3600 IN RRSIG	A 7 3 3600 20150420235959 20051021000000 40430 example.org. FAKEFAKE
diff --git a/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-type-unmatched.zone b/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-type-unmatched.zone
deleted file mode 100644
index 300e124d04..0000000000
--- a/src/lib/datasrc/memory/tests/testdata/example.org-rrsig-type-unmatched.zone
+++ /dev/null
@@ -1,6 +0,0 @@
-;; test zone file used for ZoneFinderContext tests.
-;; RRSIGs are (obviouslly) faked ones for testing.
-
-example.org. 3600 IN SOA	ns1.example.org. bugs.x.w.example.org. 72 3600 300 3600000 3600
-ns1.example.org.		      3600 IN AAAA	2001:db8::1
-ns1.example.org.		      3600 IN RRSIG	A 7 3 3600 20150420235959 20051021000000 40430 example.org. FAKEFAKE