4405. [bug] Change 4342 introduced a regression where you could

                        not remove a delegation in a NSEC3 signed zone using
                        OPTOUT via nsupdate. [RT #42702]

diff --git a/CHANGES b/CHANGES
index 3c0fe87f7ea4b81cdd2a85dbdc6c398781f39867..47b2208adcf902f731bbe84d0a398a97929cc123 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4405.  [bug]           Change 4342 introduced a regression where you could
+                       not remove a delegation in a NSEC3 signed zone using
+                       OPTOUT via nsupdate. [RT #42702]
+
 4404.  [misc]          Allow krb5-config to be used when configuring gssapi.
                        [RT #42580]
 

diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index dd25f1367d05b4e51c8250bf1bbe1963cf6b166b..73dca2d0bdeb828e022797ed14f1ce0c0b86a14a 100644 (file)
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -10,24 +10,26 @@
 # Clean up after zone transfer tests.
 #
 
-rm -f ns1/*.jnl ns2/*.jnl
+rm -f */named.memstats
+rm -f */named.run
+rm -f Kxxx.*
+rm -f dig.out.*
+rm -f jp.out.ns3.*
+rm -f ns*/named.lock
+rm -f ns1/*.jnl ns2/*.jnl ns3/*.jnl
 rm -f ns1/example.db ns1/unixtime.db ns1/yyyymmddvv.db ns1/update.db ns1/other.db ns1/keytests.db
+rm -f ns1/many.test.db
 rm -f ns1/md5.key ns1/sha1.key ns1/sha224.key ns1/sha256.key ns1/sha384.key
 rm -f ns1/sha512.key ns1/ddns.key
-rm -f nsupdate.out
 rm -f ns2/example.bk
 rm -f ns2/update.bk ns2/update.alt.bk
-rm -f */named.memstats
-rm -f */named.run
-rm -f nsupdate.out*
-rm -f ns3/example.db.jnl ns3/example.db
-rm -f ns3/nsec3param.test.db.signed.jnl ns3/nsec3param.test.db ns3/nsec3param.test.db.signed ns3/dsset-nsec3param.test.
-rm -f ns3/dnskey.test.db.signed.jnl ns3/dnskey.test.db ns3/dnskey.test.db.signed ns3/dsset-dnskey.test.
+rm -f ns3/*.signed
 rm -f ns3/K*
-rm -f dig.out.*
-rm -f jp.out.ns3.*
-rm -f Kxxx.*
+rm -f ns3/delegation.test.db
+rm -f ns3/dnskey.test.db
+rm -f ns3/dsset-*
+rm -f ns3/example.db
+rm -f ns3/many.test.bk
+rm -f ns3/nsec3param.test.db
+rm -f nsupdate.out*
 rm -f typelist.out.*
-rm -f ns1/many.test.db ns3/many.test.db.jnl
-rm -f ns3/many.test.bk ns3/many.test.bk.jnl
-rm -f ns*/named.lock

diff --git a/bin/tests/system/nsupdate/ns3/delegation.test.db.in b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
new file mode 100644 (file)
index 0000000..674a7ed
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
@@ -0,0 +1,10 @@
+; Copyright (C) 2011, 2016  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+$TTL 10
+delegation.test. IN SOA delegation.test. hostmaster.delegation.test. 1 3600 900 2419200 3600
+delegation.test. IN NS delegation.test.
+delegation.test. IN A 10.53.0.3

diff --git a/bin/tests/system/nsupdate/ns3/named.conf b/bin/tests/system/nsupdate/ns3/named.conf
index 30b52eb83cf8b534453e97a833bab7acc914f08a..679735401ca506e1948325cd6a21d54fe60b43d8 100644 (file)
--- a/bin/tests/system/nsupdate/ns3/named.conf
+++ b/bin/tests/system/nsupdate/ns3/named.conf
@@ -59,3 +59,9 @@ zone "many.test" {
        allow-update-forwarding { any; };
        file "many.test.bk";
 };
+
+zone "delegation.test" {
+       type master;
+       allow-update { any; };
+       file "delegation.test.db.signed";
+};

diff --git a/bin/tests/system/nsupdate/ns3/sign.sh b/bin/tests/system/nsupdate/ns3/sign.sh
index 5a40bd8a855766ca210b0fc8b194f296bdad8151..a7fd81220a9c8c4824b97f5d90cafae0422d4b12 100644 (file)
--- a/bin/tests/system/nsupdate/ns3/sign.sh
+++ b/bin/tests/system/nsupdate/ns3/sign.sh
@@ -30,3 +30,14 @@ keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
 $SIGNER -P -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+
+zone=delegation.test.
+infile=delegation.test.db.in
+zonefile=delegation.test.db
+
+keyname1=`$KEYGEN -q -r $RANDFILE -3 -f KSK $zone`
+keyname2=`$KEYGEN -q -r $RANDFILE -3 $zone`
+
+cat $infile $keyname1.key $keyname2.key >$zonefile
+
+$SIGNER -A -3 - -P -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 20e1de81464c84bd792c980136564c19c3c2428f..672a292fde8e8b00ece7e5d5b2b417769aeba717 100755 (executable)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -647,5 +647,34 @@ grep "bad name" nsupdate.out4-$n > /dev/null && ret=1
 
 [ $ret = 0 ] || { echo I:failed; status=1; }
 
+n=`expr $n + 1`
+echo "I:check adding of delegating NS records processing ($n)"
+ret=0
+$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+server 10.53.0.3 5300
+zone delegation.test.
+update add child.delegation.test. 3600 NS foo.example.net.
+update add child.delegation.test. 3600 NS bar.example.net.
+send
+EOF
+$DIG +tcp @10.53.0.3 -p 5300 ns child.delegation.test > dig.out.ns1.test$n
+grep "status: NOERROR" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+grep "AUTHORITY: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }
+
+n=`expr $n + 1`
+echo "I:check deleting of delegating NS records processing ($n)"
+ret=0
+$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+server 10.53.0.3 5300
+zone delegation.test.
+update del child.delegation.test. 3600 NS foo.example.net.
+update del child.delegation.test. 3600 NS bar.example.net.
+send
+EOF
+$DIG +tcp @10.53.0.3 -p 5300 ns child.delegation.test > dig.out.ns1.test$n
+grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo I:failed; status=1; }
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 8d67376bdd70bd14252dc9a807888887186cc72f..9a8210511efaae9fac305a62f26b9d60483cd78c 100644 (file)
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1330,7 +1330,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
        CHECK(dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbit));
 
        result = dns_dbiterator_seek(dbit, hashname);
-       if (result == ISC_R_NOTFOUND)
+       if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH)
                goto success;
        if (result != ISC_R_SUCCESS)
                goto failure;
@@ -1435,7 +1435,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
                                         &empty, origin, hash, iterations,
                                         salt, salt_length));
                result = dns_dbiterator_seek(dbit, hashname);
-               if (result == ISC_R_NOTFOUND)
+               if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH)
                        goto success;
                if (result != ISC_R_SUCCESS)
                        goto failure;

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 4b4b610f91fc905af2246d663ec8ff9fcbff74db..aa15c884200d3f9c169a6a2c8cc8d497dbef2f34 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -9082,6 +9082,8 @@ dbiterator_first(dns_dbiterator_t *iterator) {
        dns_name_t *name, *origin;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -9135,6 +9137,8 @@ dbiterator_last(dns_dbiterator_t *iterator) {
        dns_name_t *name, *origin;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -9185,6 +9189,7 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
            rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);
 
@@ -9410,6 +9415,8 @@ dbiterator_pause(dns_dbiterator_t *iterator) {
        rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
 
        if (rbtdbiter->result != ISC_R_SUCCESS &&
+           rbtdbiter->result != ISC_R_NOTFOUND &&
+           rbtdbiter->result != DNS_R_PARTIALMATCH &&
            rbtdbiter->result != ISC_R_NOMORE)
                return (rbtdbiter->result);