3487. [bug] Change 3444 was not complete. There was a additional

                        place where the NOQNAME proof needed to be saved.
                        [RT #32629]

Squashed commit of the following:

commit cdef844f57bd3eb30b1f77135b89b6f9360e8bee
Author: Mark Andrews <marka@isc.org>
Date:   Sat Feb 16 00:27:14 2013 +1100

    whitespace

commit 60eb7e3f6cdd102d6aaf0fb4ada8c552576e4502
Author: Mark Andrews <marka@isc.org>
Date:   Sat Feb 16 00:19:51 2013 +1100

    return noqname proof with +cd and dlv

diff --git a/CHANGES b/CHANGES
index 1d1e8b86a4d5040625e283d7f2e2f10e5ab97779..9b7b21cd8a6b500e035bb4d3dc1f27fc1d64041c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3487.  [bug]           Change 3444 was not complete.  There was a additional
+                       place where the NOQNAME proof needed to be saved.
+                        [RT #32629]
+
 3486.  [bug]           named could crash when using TKEY-negotiated keys
                        that had been deleted and then recreated. [RT #32506]
 

diff --git a/bin/tests/system/wildcard/clean.sh b/bin/tests/system/wildcard/clean.sh
index 4aa51d6380766d05d04ac6d1e26ddd4e0e780cc4..34cc9868d6c117d4df42528750abbcc3f5aa6985 100644 (file)
--- a/bin/tests/system/wildcard/clean.sh
+++ b/bin/tests/system/wildcard/clean.sh
@@ -22,6 +22,7 @@ rm -f ns1/K*
 rm -f ns1/*.db
 rm -f ns1/*.signed
 rm -f ns1/dsset-*
+rm -f ns1/keyset-*
 rm -f ns1/trusted.conf
 rm -f ns1/private.nsec.conf
 rm -f ns1/private.nsec3.conf

diff --git a/bin/tests/system/wildcard/ns1/dlv.db.in b/bin/tests/system/wildcard/ns1/dlv.db.in
new file mode 100644 (file)
index 0000000..9de4b7a
--- /dev/null
+++ b/bin/tests/system/wildcard/ns1/dlv.db.in
@@ -0,0 +1,19 @@
+; Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id$
+
+$TTL 120
+@      SOA a.root-servers.nil. hostmaster.root-servers.nil. 1 1800 900 604800 86400
+@      NS  a.root-servers.nil.

diff --git a/bin/tests/system/wildcard/ns1/named.conf b/bin/tests/system/wildcard/ns1/named.conf
index 8ad4206b6c682e4aa672a0ad5bf18258ff655cba..6e3564c8679cdf9dde1a812481b55984a513a152 100644 (file)
--- a/bin/tests/system/wildcard/ns1/named.conf
+++ b/bin/tests/system/wildcard/ns1/named.conf
@@ -33,6 +33,8 @@ options {
 
 zone "." { type master; file "root.db.signed"; };
 
+zone "dlv" { type master; file "dlv.db.signed"; };
+
 zone "nsec" { type master; file "nsec.db.signed"; };
 zone "private.nsec" { type master; file "private.nsec.db.signed"; };
 

diff --git a/bin/tests/system/wildcard/ns1/root.db.in b/bin/tests/system/wildcard/ns1/root.db.in
index 54cf2d2e0ae847d1a8e467ff90eaacb3be63d6e7..102eea811b51ae0eae181a6cf8bd82dc7ea89be9 100644 (file)
--- a/bin/tests/system/wildcard/ns1/root.db.in
+++ b/bin/tests/system/wildcard/ns1/root.db.in
@@ -18,5 +18,6 @@ $TTL 120
 @      SOA a.root-servers.nil hostmaster.root-servers.nil 1 1800 900 604800 86400
 @      NS  a.root-servers.nil
 a.root-servers.nil A 10.53.0.1
+dlv    NS  a.root-servers.nil
 nsec   NS  a.root-servers.nil
 nsec3  NS  a.root-servers.nil

diff --git a/bin/tests/system/wildcard/ns1/sign.sh b/bin/tests/system/wildcard/ns1/sign.sh
index 35269928ab9780b9b752787a953cb6045a30bdc0..bae0e43fbaf093beced9a5918e327d17e46fb639 100755 (executable)
--- a/bin/tests/system/wildcard/ns1/sign.sh
+++ b/bin/tests/system/wildcard/ns1/sign.sh
@@ -22,6 +22,20 @@ SYSTEMTESTTOP=../..
 RANDFILE=../random.data
 dssets=
 
+zone=dlv.
+infile=dlv.db.in
+zonefile=dlv.db
+outfile=dlv.db.signed
+dssets="$dssets dsset-$zone"
+
+keyname1=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null` 
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+
+cat $infile $keyname1.key $keyname2.key > $zonefile
+
+$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+echo "I: signed $zone"
+
 zone=nsec.
 infile=nsec.db.in
 zonefile=nsec.db

diff --git a/bin/tests/system/wildcard/ns5/hints b/bin/tests/system/wildcard/ns5/hints
new file mode 100644 (file)
index 0000000..fed19b9
--- /dev/null
+++ b/bin/tests/system/wildcard/ns5/hints
@@ -0,0 +1,18 @@
+; Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: hints,v 1.1.2.1 2010/06/01 03:55:02 marka Exp $
+
+. 0 NS ns.root-servers.nil.
+ns.root-servers.nil. 0 A 10.53.0.1

diff --git a/bin/tests/system/wildcard/ns5/named.conf b/bin/tests/system/wildcard/ns5/named.conf
new file mode 100644 (file)
index 0000000..184546a
--- /dev/null
+++ b/bin/tests/system/wildcard/ns5/named.conf
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.1.2.1 2010/06/01 03:55:02 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+       query-source address 10.53.0.5;
+       notify-source 10.53.0.5;
+       transfer-source 10.53.0.5;
+       port 5300;
+       pid-file "named.pid";
+       listen-on { 10.53.0.5; };
+       listen-on-v6 { none; };
+       recursion yes;
+       notify yes;
+       dnssec-lookaside . trust-anchor dlv;
+};
+
+include "../ns1/trusted.conf";
+
+zone "." { type hint; file "hints"; };

diff --git a/bin/tests/system/wildcard/tests.sh b/bin/tests/system/wildcard/tests.sh
index 8dc97720c70d977c96f541d5c767f4ed7a1ca634..2ba525f062f6a7e425ddd2282b6a612c6b58c0b6 100644 (file)
--- a/bin/tests/system/wildcard/tests.sh
+++ b/bin/tests/system/wildcard/tests.sh
@@ -53,6 +53,15 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
+echo "I: checking that NSEC wildcard non-existance proof is returned validating + CD ($n)"
+ret=0
+$DIG $DIGOPTS +cd a b.wild.nsec @10.53.0.5 > dig.out.ns5.test$n || ret=1
+grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns5.test$n > /dev/null || ret=1
+grep -i 'flags:.* ad[ ;]'  dig.out.ns5.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+n=`expr $n + 1`
+
 echo "I: checking that returned NSEC wildcard non-existance proof validates ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -105,6 +114,15 @@ grep -i 'flags:.* ad[ ;]'  dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I: checking that NSEC3 wildcard non-existance proof is returned validating + CD ($n)"
+ret=0
+$DIG $DIGOPTS +cd a b.wild.nsec3 @10.53.0.5 > dig.out.ns5.test$n || ret=1
+grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns5.test$n > /dev/null || ret=1
+grep -i 'flags:.* ad[ ;]'  dig.out.ns5.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo "I: checking that returned NSEC3 wildcard non-existance proof validates ($n)"
 ret=0

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 97676b22f2a3667df210b6e1d636661e8dc6de1d..5453918493805ab0698e6677114c23f41bbb1065 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4502,13 +4502,12 @@ findnoqname(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
                        isc_boolean_t optout = ISC_FALSE, unknown = ISC_FALSE;
                        isc_boolean_t setclosest = ISC_FALSE;
                        isc_boolean_t setnearest = ISC_FALSE;
-                       char namebuf[DNS_NAME_FORMATSIZE];
 
                        next = ISC_LIST_NEXT(nrdataset, link);
                        if (nrdataset->type != dns_rdatatype_nsec &&
                            nrdataset->type != dns_rdatatype_nsec3)
                                continue;
-                       dns_name_format(nsec, namebuf, sizeof(namebuf));
+
                        if (nrdataset->type == dns_rdatatype_nsec &&
                            NXND(dns_nsec_noexistnodata(type, name, nsec,
                                                        nrdataset, &exists,
@@ -4736,6 +4735,22 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
                        if (sigrdataset != NULL)
                                sigrdataset->trust = trust;
                        if (!need_validation || !ANSWER(rdataset)) {
+                               if (ANSWER(rdataset) &&
+                                  rdataset->type != dns_rdatatype_rrsig) {
+                                       isc_result_t tresult;
+                                       dns_name_t *noqname = NULL;
+                                       tresult = findnoqname(fctx, name,
+                                                             rdataset->type,
+                                                             &noqname);
+                                       if (tresult == ISC_R_SUCCESS &&
+                                           noqname != NULL) {
+                                               tresult =
+                                                    dns_rdataset_addnoqname(
+                                                           rdataset, noqname);
+                                               RUNTIME_CHECK(tresult ==
+                                                             ISC_R_SUCCESS);
+                                       }
+                               }
                                addedrdataset = ardataset;
                                result = dns_db_addrdataset(fctx->cache, node,
                                                            NULL, now, rdataset,