From: JINMEI Tatuya <jinmei@isc.org>
Date: Tue, 14 Feb 2012 01:21:50 +0000 (-0800)
Subject: [1583] added a test case of run time collision for wildcard no data + NSEC3
X-Git-Tag: trac2351_base~97^2~30^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9b1d96cccb6572d7ebdeed0ac9c59fa3059a3db3;p=thirdparty%2Fkea.git

[1583] added a test case of run time collision for wildcard no data + NSEC3
case.
---

diff --git a/src/bin/auth/query.cc b/src/bin/auth/query.cc
index 874cdaa516..ec29041bea 100644
--- a/src/bin/auth/query.cc
+++ b/src/bin/auth/query.cc
@@ -252,6 +252,11 @@ Query::addNXRRsetProof(ZoneFinder& finder,
         // Case for RFC5155 Section 7.2.5
         const ZoneFinder::FindNSEC3Result result(finder.findNSEC3(qname_,
                                                                   true));
+        // We know there's no exact match for the qname, so findNSEC3() should
+        // return both closest and next proofs.  If the latter is NULL, it
+        // means a run time collision (or the zone is broken in other way).
+        // In that case addRRset() will throw, and it will be converted to
+        // SERVFAIL.
         response_.addRRset(Message::SECTION_AUTHORITY,
                            boost::const_pointer_cast<AbstractRRset>(
                                result.closest_proof), dnssec_);
diff --git a/src/bin/auth/tests/query_unittest.cc b/src/bin/auth/tests/query_unittest.cc
index 5bff619b69..fd8d9021a2 100644
--- a/src/bin/auth/tests/query_unittest.cc
+++ b/src/bin/auth/tests/query_unittest.cc
@@ -1369,6 +1369,21 @@ TEST_F(QueryTest, wildcardNxrrsetWithNSEC3) {
                   NULL, mock_finder->getOrigin());
 }
 
+TEST_F(QueryTest, wildcardNxrrsetWithNSEC3Collision) {
+    // Similar to the previous case, but emulating run time collision by
+    // returning NULL in the next closer proof for the closest encloser
+    // proof.
+    mock_finder->setNSEC3Flag(true);
+    ZoneFinder::FindNSEC3Result nsec3(true, 0, textToRRset(nsec3_apex_txt),
+                                      ConstRRsetPtr());
+    mock_finder->setNSEC3Result(&nsec3);
+
+    // Message::addRRset() will detect it and throw InvalidParameter.
+    EXPECT_THROW(Query(memory_client, Name("www1.uwild.example.com"),
+                       RRType::TXT(), response, true).process(),
+                 isc::InvalidParameter);
+}
+
 TEST_F(QueryTest, wildcardEmptyWithNSEC) {
     // Empty WILDCARD with DNSSEC proof.  We should have SOA, NSEC that proves
     // the NXDOMAIN and their RRSIGs. In this case we need two NSEC RRs,