From ff53fd39517302a6a16ad41199560a5e3b716582 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Thu, 24 Oct 2024 16:02:19 +0200 Subject: [PATCH 1/2] Revert "Use a binary search to find the NSEC3 closest encloser" This reverts commit 94f665591546fb064acd30b58026af3d3e671b1f. --- lib/ns/query.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/lib/ns/query.c b/lib/ns/query.c index e906cbe946..58a9d436fc 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -11565,33 +11565,24 @@ again: * No NSEC proof available, return NSEC3 proofs instead. */ cname = dns_fixedname_initname(&cfixed); - /* - * Find the closest encloser using a binary search. - * maxlabels: suffix length of NXDOMAIN result - * minlabels: suffix length of non NXDOMAIN result + * Find the closest encloser. */ - unsigned int maxlabels = dns_name_countlabels(name); - unsigned int minlabels = dns_name_countlabels(fname); - bool search = result == DNS_R_NXDOMAIN; dns_name_copy(name, cname); - while (search) { - labels = (maxlabels + minlabels) / 2; - dns_name_split(name, labels, NULL, cname); - if (labels == minlabels) { - break; + while (result == DNS_R_NXDOMAIN) { + labels = dns_name_countlabels(cname) - 1; + /* + * Sanity check. + */ + if (labels == 0U) { + goto cleanup; } + dns_name_split(cname, labels, NULL, cname); result = dns_db_findext(qctx->db, cname, qctx->version, dns_rdatatype_nsec, options, 0, NULL, fname, &cm, &ci, NULL, NULL); - if (result == DNS_R_NXDOMAIN) { - maxlabels = labels; - } else { - minlabels = labels; - } } - /* * Add closest (provable) encloser NSEC3. */ From 30204d0b9dea7b04c73f5fe73fae479b7f9645d6 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Thu, 24 Oct 2024 16:02:31 +0200 Subject: [PATCH 2/2] Revert "Test that the correct NSEC3 closest encloser is returned" This reverts commit 74b6aa8dd2b4c0cb33159fa4d15f3de46256e9ca. --- bin/tests/system/dnssec/tests.sh | 30 ------------------------------ 1 file changed, 30 deletions(-) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index ed9dbfd93c..c7b1c3aab8 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -4468,35 +4468,5 @@ n=$((n + 1)) if [ "$ret" -ne 0 ]; then echo_i "failed"; fi status=$((status + ret)) -echo_i "checking NSEC3 nxdomain response closest encloser with 0 ENT ($n)" -ret=0 -dig_with_opts @10.53.0.3 b.b.b.b.b.a.nsec3.example. >dig.out.ns3.test$n -grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1 -pat="^6OVDUHTN094ML2PV8AN90U0DPU823GH2\.nsec3.example\..*NSEC3 1 0 0 - 7AT0S0RIDCJRFF2M5H5AAV22CSFJBUL4 A RRSIG\$" -grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1 -n=$((n + 1)) -if [ "$ret" -ne 0 ]; then echo_i "failed"; fi -status=$((status + ret)) - -echo_i "checking NSEC3 nxdomain response closest encloser with 1 ENTs ($n)" -ret=0 -dig_with_opts @10.53.0.3 b.b.b.b.b.a.a.nsec3.example. >dig.out.ns3.test$n -grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1 -pat="^NGCJFSOLJUUE27PFNQNJIME4TQ0OU2DH\.nsec3.example\..*NSEC3 1 0 0 - R8EVDMNIGNOKME4LH2H90OSP2PRSNJ1Q\$" -grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1 -n=$((n + 1)) -if [ "$ret" -ne 0 ]; then echo_i "failed"; fi -status=$((status + ret)) - -echo_i "checking NSEC3 nxdomain response closest encloser with 2 ENTs ($n)" -ret=0 -dig_with_opts @10.53.0.3 b.b.b.b.b.a.a.a.nsec3.example. >dig.out.ns3.test$n -grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1 -pat="^H7RHPDCHSVVRAND332F878C8AB6IBJQV\.nsec3.example\..*NSEC3 1 0 0 - K8IG76R2UPQ13IKFO49L7IB9JRVB6QJI\$" -grep "$pat" dig.out.ns3.test$n >/dev/null || ret=1 -n=$((n + 1)) -if [ "$ret" -ne 0 ]; then echo_i "failed"; fi -status=$((status + ret)) - echo_i "exit status: $status" [ $status -eq 0 ] || exit 1