3173. [port] Correctly validate root DS responses. [RT #25726]

diff --git a/CHANGES b/CHANGES
index a1652d8bae20f61ac62433196af8d68dc9106982..a463707ded9d67b7441621ed2275954c05c7404e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3173.  [port]          Correctly validate root DS responses. [RT #25726]
+
 3169.  [func]          Catch db/version mis-matches when call dns_db_*().
                        [RT #26017]
 

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index f3a05fa94869bb53150fe9f7d0aba61c883a9bc1..805c93e63d4c96a0bd73e4a11571283b886beb13 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.53.48.20 2011/09/02 21:53:54 each Exp $
+# $Id: tests.sh,v 1.53.48.21 2011/10/15 05:13:39 marka Exp $
 
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -1037,6 +1037,17 @@ else
     echo "I:The DNSSEC update test requires the Net::DNS library." >&2
 fi
 
+echo "I:checking that root DS queries validate ($n)"
+ret=0
+$DIG $DIGOPTS +noauth . @10.53.0.1 ds > dig.out.ns1.test$n || ret=1
+$DIG $DIGOPTS +noauth . @10.53.0.4 ds > dig.out.ns4.test$n || ret=1
+$PERL ../digcomp.pl dig.out.ns1.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)"
 ret=0
 $DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index df662612f0a25213dad61ae620137e356fc60faa..42b2e3b643c59217d55de61ec3d46cbe292d724f 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.164.12.29 2011/06/09 00:16:37 each Exp $ */
+/* $Id: validator.c,v 1.164.12.30 2011/10/15 05:13:39 marka Exp $ */
 
 #include <config.h>
 
@@ -837,7 +837,7 @@ cnamevalidated(isc_task_t *task, isc_event_t *event) {
  * Return ISC_R_IGNORE when the NSEC is not the appropriate one.
  */
 static isc_result_t
-nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
+nsecnoexistnodata(dns_validator_t *val, dns_name_t *name, dns_name_t *nsecname,
                  dns_rdataset_t *nsecset, isc_boolean_t *exists,
                  isc_boolean_t *data, dns_name_t *wild)
 {
@@ -878,9 +878,11 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 
        if (order == 0) {
                /*
-                * The names are the same.
+                * The names are the same.   If we are validating "."
+                * then atparent should not be set as there is no parent.
                 */
-               atparent = dns_rdatatype_atparent(val->event->type);
+               atparent = (olabels != 1) &&
+                          dns_rdatatype_atparent(val->event->type);
                ns = dns_nsec_typepresent(&rdata, dns_rdatatype_ns);
                soa = dns_nsec_typepresent(&rdata, dns_rdatatype_soa);
                if (ns && !soa) {