From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Fri, 21 Oct 2016 10:48:10 +0000 (+0200)
Subject: Add an RFC quote in the right place
X-Git-Tag: dnsdist-1.1.0-beta2~77^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=43c04e77cd202cbfccce5dde84252b836e9564f0;p=pdns

Add an RFC quote in the right place
---

diff --git a/pdns/validate.cc b/pdns/validate.cc
index 3445baf97..2c78123c7 100644
--- a/pdns/validate.cc
+++ b/pdns/validate.cc
@@ -69,6 +69,13 @@ static dState getDenial(const cspmap_t &validrrsets, const DNSName& qname, const
         // If the name exists, check if the qtype is denied
         if(beginHash == h && !nsec3->d_set.count(qtype)) {
           LOG("Denies existence of type "<<QType(qtype).getName()<<" for name "<<qname<<"  (not opt-out).");
+          /*
+           * RFC 5155 section 8.9:
+           * If there is an NSEC3 RR present in the response that matches the
+           * delegation name, then the validator MUST ensure that the NS bit is
+           * set and that the DS bit is not set in the Type Bit Maps field of the
+           * NSEC3 RR.
+           */
           if (qtype == QType::DS && !nsec3->d_set.count(QType::NS)) {
             LOG("However, no NS record exists at this level!"<<endl);
             return INSECURE;