Ignore attempts to add DS records at zone apex

DS records belong in the parent zone at a zone cut and
are not retrievable with modern recursive servers.

(cherry picked from commit ae55fbbe9cacb1a2c275bab48a611a0e174410d9)

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index fb1617509b7abffb0832e7f5d800c4de3b968fe9..a8a093fa3d5823b463cf55b1f76a09850197f8c7 100755 (executable)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -33,6 +33,8 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=0
 
+nextpartreset ns3/named.run
+
 # wait for zone transfer to complete
 tries=0
 while true; do
@@ -1029,6 +1031,25 @@ grep "UPDATE, status: NOERROR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 grep "UPDATE, status: FORMERR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
+echo_i "check that DS to the zone apex is ignored ($n)"
+$DIG $DIGOPTS +tcp +norec example DS @10.53.0.3 > dig.out.pre.test$n || ret=1
+grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
+nextpart ns3/named.run > /dev/null
+# specify zone to override the default of adding to parent zone
+$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 || ret=1
+server 10.53.0.3 ${PORT}
+zone example
+update add example 0 in DS 14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
+send
+END
+msg=": attempt to add a DS record at zone apex ignored"
+nextpart ns3/named.run | grep "$msg" > /dev/null || ret=1
+$DIG $DIGOPTS +tcp +norec example DS @10.53.0.3 > dig.out.post.test$n || ret=1
+grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
 if $FEATURETEST --gssapi ; then
   n=`expr $n + 1`
   ret=0

diff --git a/lib/ns/update.c b/lib/ns/update.c
index 5cb67d852e625b5f3a935cf4f354ad31f8712f20..2105a3dd886090c41be10a7ca058d0eea75b469f 100644 (file)
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -2939,6 +2939,19 @@ update_action(isc_task_t *task, isc_event_t *event) {
                                soa_serial_changed = true;
                        }
 
+                       if (dns_rdatatype_atparent(rdata.type) &&
+                           dns_name_equal(name, zonename)) {
+                               char typebuf[DNS_RDATATYPE_FORMATSIZE];
+
+                               dns_rdatatype_format(rdata.type, typebuf,
+                                                    sizeof(typebuf));
+                               update_log(client, zone, LOGLEVEL_PROTOCOL,
+                                          "attempt to add a %s record at "
+                                          "zone apex ignored",
+                                          typebuf);
+                               continue;
+                       }
+
                        if (rdata.type == privatetype) {
                                update_log(client, zone, LOGLEVEL_PROTOCOL,
                                           "attempt to add a private type "