mirror of
https://github.com/NLnetLabs/unbound.git
synced 2025-12-20 23:00:56 -05:00
nsec3 negative cache works.
git-svn-id: file:///svn/unbound/trunk@1292 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards
parent
bfb4e20f43
commit
b6696c1342
6 changed files with 438 additions and 3 deletions
|
|
@ -1,5 +1,6 @@
|
|||
9 October 2008: Wouter
|
||||
- negative cache caps max iterations of NSEC3 done.
|
||||
- NSEC3 negative cache for qtype DS works.
|
||||
|
||||
8 October 2008: Wouter
|
||||
- NSEC negative cache for DS.
|
||||
|
|
|
|||
4
doc/plan
4
doc/plan
|
|
@ -64,13 +64,13 @@ not stats on SIGUSR1. perhaps also see which slow auth servers cause >1sec value
|
|||
*** Improvements
|
||||
+ fallback to noEDNS if all queries are dropped.
|
||||
+ dnssec lameness fixen. Check to make sure.
|
||||
* negative caching to avoid DS queries, NSEC, NSEC3 (w params).
|
||||
+ negative caching to avoid DS queries, NSEC, NSEC3 (w params).
|
||||
+ SHA256 supported fully.
|
||||
+ Make stub to localhost on different port work.
|
||||
+ IPv6 reverse, IP4 reverse local-data shorthand for PTR records (?).
|
||||
cumbersome to reverse notate by hand for the operator. For local-data.
|
||||
local-data-ptr: "1.2.3.4 mypc.example.com"
|
||||
* dns-0x20 fallback TODO item. Consider.
|
||||
+ dns-0x20 fallback TODO item. Consider.
|
||||
|
||||
*** from draft resolver-mitigation
|
||||
* Should be an option? (Not right now)
|
||||
|
|
|
|||
|
|
@ -1365,6 +1365,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
|
|||
if(!iter_dns_store(qstate->env, &iq->response->qinfo,
|
||||
iq->response->rep, 1))
|
||||
return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
|
||||
if(qstate->env->neg_cache)
|
||||
val_neg_addreferral(qstate->env->neg_cache,
|
||||
iq->response->rep, iq->dp->name);
|
||||
|
||||
/* Reset the event state, setting the current delegation
|
||||
* point to the referral. */
|
||||
|
|
|
|||
212
testdata/val_nsec3_b3_optout_negcache.rpl
vendored
Normal file
212
testdata/val_nsec3_b3_optout_negcache.rpl
vendored
Normal file
|
|
@ -0,0 +1,212 @@
|
|||
; config options
|
||||
server:
|
||||
trust-anchor: "example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
|
||||
val-override-date: "20120420235959"
|
||||
|
||||
stub-zone:
|
||||
name: "."
|
||||
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
|
||||
CONFIG_END
|
||||
|
||||
SCENARIO_BEGIN Test validator NSEC3 B.3 referral optout with negative cache.
|
||||
|
||||
; K.ROOT-SERVERS.NET.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 193.0.14.129
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
. IN NS
|
||||
SECTION ANSWER
|
||||
. IN NS K.ROOT-SERVERS.NET.
|
||||
SECTION ADDITIONAL
|
||||
K.ROOT-SERVERS.NET. IN A 193.0.14.129
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode
|
||||
ADJUST copy_id copy_query
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
. IN A
|
||||
SECTION AUTHORITY
|
||||
example. IN NS ns1.example.
|
||||
; leave out to make unbound take ns1
|
||||
;example. IN NS ns2.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.example. IN A 192.0.2.1
|
||||
; leave out to make unbound take ns1
|
||||
;ns2.example. IN A 192.0.2.2
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
; ns1.example.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 192.0.2.1
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id copy_query
|
||||
REPLY QR REFUSED
|
||||
SECTION QUESTION
|
||||
example. IN NS
|
||||
SECTION ANSWER
|
||||
ENTRY_END
|
||||
|
||||
; response to DNSKEY priming query
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
example. IN DNSKEY
|
||||
SECTION ANSWER
|
||||
example. DNSKEY 256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
|
||||
example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
|
||||
example. RRSIG DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example. AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR AA DO NOERROR
|
||||
SECTION QUESTION
|
||||
mc.c.example. IN MX
|
||||
SECTION AUTHORITY
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
|
||||
;; NSEC3 RR that covers the "next closer" name (c.example)
|
||||
;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
|
||||
35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
|
||||
35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
|
||||
|
||||
;; NSEC3 RR that matches the closest encloser (example)
|
||||
;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
|
||||
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
|
||||
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
|
||||
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
|
||||
ENTRY_END
|
||||
|
||||
|
||||
; DS must be gotten from neg cache
|
||||
; ENTRY_BEGIN
|
||||
; MATCH opcode qtype qname
|
||||
; ADJUST copy_id
|
||||
; REPLY QR AA DO NOERROR
|
||||
; SECTION QUESTION
|
||||
; c.example. IN DS
|
||||
; SECTION AUTHORITY
|
||||
; ;; NSEC3 RR that covers the "next closer" name (c.example)
|
||||
; ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
|
||||
; 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
|
||||
; 35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
|
||||
;
|
||||
; ;; NSEC3 RR that matches the closest encloser (example)
|
||||
; ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
|
||||
; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
|
||||
; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
|
||||
; ENTRY_END
|
||||
|
||||
RANGE_END
|
||||
|
||||
; ns1.c.example.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 192.0.2.7
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR AA NOERROR
|
||||
SECTION QUESTION
|
||||
c.example. IN NS
|
||||
SECTION ANSWER
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR AA NOERROR
|
||||
SECTION QUESTION
|
||||
mc.c.example. IN MX
|
||||
SECTION ANSWER
|
||||
mc.c.example. IN MX 50 mx.c.example.
|
||||
SECTION AUTHORITY
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
; ns2.c.example.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 192.0.2.8
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR AA NOERROR
|
||||
SECTION QUESTION
|
||||
c.example. IN NS
|
||||
SECTION ANSWER
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR AA NOERROR
|
||||
SECTION QUESTION
|
||||
mc.c.example. IN MX
|
||||
SECTION ANSWER
|
||||
mc.c.example. IN MX 50 mx.c.example.
|
||||
SECTION AUTHORITY
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
|
||||
STEP 1 QUERY
|
||||
ENTRY_BEGIN
|
||||
REPLY RD DO
|
||||
SECTION QUESTION
|
||||
mc.c.example. IN MX
|
||||
ENTRY_END
|
||||
|
||||
; recursion happens here.
|
||||
STEP 10 CHECK_ANSWER
|
||||
ENTRY_BEGIN
|
||||
MATCH all
|
||||
REPLY QR RD RA NOERROR
|
||||
SECTION QUESTION
|
||||
mc.c.example. IN MX
|
||||
SECTION ANSWER
|
||||
mc.c.example. IN MX 50 mx.c.example.
|
||||
SECTION AUTHORITY
|
||||
c.example. NS ns1.c.example.
|
||||
c.example. NS ns2.c.example.
|
||||
SECTION ADDITIONAL
|
||||
ns1.c.example. A 192.0.2.7
|
||||
ns2.c.example. A 192.0.2.8
|
||||
ENTRY_END
|
||||
|
||||
SCENARIO_END
|
||||
218
testdata/val_nsec3_nods_negcache.rpl
vendored
Normal file
218
testdata/val_nsec3_nods_negcache.rpl
vendored
Normal file
|
|
@ -0,0 +1,218 @@
|
|||
; config options
|
||||
; The island of trust is at example.com
|
||||
server:
|
||||
trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
|
||||
val-override-date: "20070916134226"
|
||||
|
||||
stub-zone:
|
||||
name: "."
|
||||
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
|
||||
CONFIG_END
|
||||
|
||||
SCENARIO_BEGIN Test validator with NSEC3 with no DS referral from neg cache.
|
||||
|
||||
; K.ROOT-SERVERS.NET.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 193.0.14.129
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
. IN NS
|
||||
SECTION ANSWER
|
||||
. IN NS K.ROOT-SERVERS.NET.
|
||||
SECTION ADDITIONAL
|
||||
K.ROOT-SERVERS.NET. IN A 193.0.14.129
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
SECTION AUTHORITY
|
||||
com. IN NS a.gtld-servers.net.
|
||||
SECTION ADDITIONAL
|
||||
a.gtld-servers.net. IN A 192.5.6.30
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
; a.gtld-servers.net.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 192.5.6.30
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
com. IN NS
|
||||
SECTION ANSWER
|
||||
com. IN NS a.gtld-servers.net.
|
||||
SECTION ADDITIONAL
|
||||
a.gtld-servers.net. IN A 192.5.6.30
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
SECTION AUTHORITY
|
||||
example.com. IN NS ns.example.com.
|
||||
SECTION ADDITIONAL
|
||||
ns.example.com. IN A 1.2.3.4
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
; ns.example.com.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 1.2.3.4
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
example.com. IN NS
|
||||
SECTION ANSWER
|
||||
example.com. IN NS ns.example.com.
|
||||
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
|
||||
SECTION ADDITIONAL
|
||||
ns.example.com. IN A 1.2.3.4
|
||||
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
|
||||
ENTRY_END
|
||||
|
||||
; response to DNSKEY priming query
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
example.com. IN DNSKEY
|
||||
SECTION ANSWER
|
||||
example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
|
||||
example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
|
||||
SECTION AUTHORITY
|
||||
example.com. IN NS ns.example.com.
|
||||
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
|
||||
SECTION ADDITIONAL
|
||||
ns.example.com. IN A 1.2.3.4
|
||||
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
|
||||
ENTRY_END
|
||||
|
||||
; response to query of interest
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
www.example.com. IN A
|
||||
SECTION AUTHORITY
|
||||
example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000
|
||||
example.com. 3600 IN RRSIG SOA 3 2 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCM6lsu9byZIQ1yYjJmyYfFWM2RWAIUcR5t84r2La824oWCkLjmHXRQlco= ;{id = 2854}
|
||||
|
||||
; NODATA response. H(www.example.com.) = s1unhcti19bkdr98fegs0v46mbu3t4m3
|
||||
s1unhcti19bkdr98fegs0v46mbu3t4m3.example.com. IN NSEC3 1 1 123 aabb00123456bbccdd s1unhcti19bkdr98fegs0v46mbu3t4m4 MX RRSIG
|
||||
s1unhcti19bkdr98fegs0v46mbu3t4m3.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFE/a24nsY2luhQmZjY/ObAIgNSMkAhQWd4MUOUVK55bD6AbMHWrDA0yvEA== ;{id = 2854}
|
||||
|
||||
ENTRY_END
|
||||
|
||||
; refer to server one down
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
SECTION AUTHORITY
|
||||
sub.example.com. IN NS ns.sub.example.com.
|
||||
; proof that there is no DS here.
|
||||
;sub.example.com. 3600 IN DS 2854 DSA 1 be4d46cd7489cce25a31af0dff2968ce0425dd31
|
||||
;sub.example.com. 3600 IN RRSIG DS 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQC1WMTfb25sTgeUEXCFR4+YiJqecwIUc2R/jrO4amyQxovSnld2reg8eyo= ;{id = 2854}
|
||||
; sub.example.com. -> 8r1f0ieoutlnjc03meng9e3bn2n0o9pd.
|
||||
8r1f0ieoutlnjc03meng9e3bn2n0o9pd.example.com. IN NSEC3 1 1 123 aabb00123456bbccdd 8r1f0ieoutlnjc03meng9e3bn3n0o9pd NS RRSIG
|
||||
8r1f0ieoutlnjc03meng9e3bn2n0o9pd.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFEC78oZJjqlV6kVyQb4X0o6tsUpUAhUAk+bgth7eeN+aO8ts2+yLSyzSX9g= ;{id = 2854}
|
||||
|
||||
SECTION ADDITIONAL
|
||||
ns.sub.example.com. IN A 1.2.3.10
|
||||
ENTRY_END
|
||||
|
||||
; get DS proof from neg cache
|
||||
; ENTRY_BEGIN
|
||||
; MATCH opcode qtype qname
|
||||
; ADJUST copy_id
|
||||
; REPLY QR NOERROR
|
||||
; SECTION QUESTION
|
||||
; sub.example.com. IN DS
|
||||
; SECTION AUTHORITY
|
||||
; ; proof that there is no DS here.
|
||||
; ;sub.example.com. 3600 IN DS 2854 DSA 1 be4d46cd7489cce25a31af0dff2968ce0425dd31
|
||||
; ;sub.example.com. 3600 IN RRSIG DS 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQC1WMTfb25sTgeUEXCFR4+YiJqecwIUc2R/jrO4amyQxovSnld2reg8eyo= ;{id = 2854}
|
||||
; ; sub.example.com. -> 8r1f0ieoutlnjc03meng9e3bn2n0o9pd.
|
||||
; 8r1f0ieoutlnjc03meng9e3bn2n0o9pd.example.com. IN NSEC3 1 1 123 aabb00123456bbccdd 8r1f0ieoutlnjc03meng9e3bn3n0o9pd NS RRSIG
|
||||
; 8r1f0ieoutlnjc03meng9e3bn2n0o9pd.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFEC78oZJjqlV6kVyQb4X0o6tsUpUAhUAk+bgth7eeN+aO8ts2+yLSyzSX9g= ;{id = 2854}
|
||||
; ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
; ns.sub.example.com.
|
||||
RANGE_BEGIN 0 100
|
||||
ADDRESS 1.2.3.10
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR REFUSED
|
||||
SECTION QUESTION
|
||||
sub.example.com. IN NS
|
||||
SECTION ANSWER
|
||||
ENTRY_END
|
||||
|
||||
|
||||
; response to DNSKEY priming query
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
sub.example.com. IN DNSKEY
|
||||
SECTION ANSWER
|
||||
sub.example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
|
||||
sub.example.com. 3600 IN RRSIG DNSKEY 3 3 3600 20070926135752 20070829135752 2854 sub.example.com. MCwCFBznBTYM/SrdUnjQdBnLtRO79KAaAhQReG5nRuL7Xsdf6D0KKwPa1GpWyQ== ;{id = 2854}
|
||||
|
||||
ENTRY_END
|
||||
|
||||
ENTRY_BEGIN
|
||||
MATCH opcode qtype qname
|
||||
ADJUST copy_id
|
||||
REPLY QR NOERROR
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
SECTION ANSWER
|
||||
www.sub.example.com. IN A 1.2.3.123
|
||||
www.sub.example.com. 3600 IN RRSIG A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
|
||||
ENTRY_END
|
||||
RANGE_END
|
||||
|
||||
STEP 1 QUERY
|
||||
ENTRY_BEGIN
|
||||
REPLY RD DO
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
ENTRY_END
|
||||
|
||||
; recursion happens here.
|
||||
STEP 10 CHECK_ANSWER
|
||||
ENTRY_BEGIN
|
||||
MATCH all
|
||||
REPLY QR RD RA NOERROR
|
||||
SECTION QUESTION
|
||||
www.sub.example.com. IN A
|
||||
SECTION ANSWER
|
||||
www.sub.example.com. IN A 1.2.3.123
|
||||
www.sub.example.com. 3600 IN RRSIG A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
|
||||
SECTION AUTHORITY
|
||||
SECTION ADDITIONAL
|
||||
ENTRY_END
|
||||
|
||||
SCENARIO_END
|
||||
|
|
@ -1094,7 +1094,8 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
|
|||
|
||||
/* insert the NSECs */
|
||||
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
|
||||
if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC)
|
||||
if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC &&
|
||||
ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC3)
|
||||
continue;
|
||||
if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
|
||||
zone->name)) continue;
|
||||
|
|
|
|||
Loading…
Reference in a new issue