From b93be4a01192dcfb3ab7f5a830be8606bc6f89c8 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Thu, 11 Jan 2018 15:05:00 +0100 Subject: [PATCH] rec: Add unit tests for ancestor delegation check in denial (cherry picked from commit af37c3062fe016121867e68693d7b9e1ca9f60f2) --- pdns/recursordist/test-syncres_cc.cc | 34 ++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc index 730edb867..515df2882 100644 --- a/pdns/recursordist/test-syncres_cc.cc +++ b/pdns/recursordist/test-syncres_cc.cc @@ -8373,6 +8373,10 @@ BOOST_AUTO_TEST_CASE(test_nsec_ancestor_nxqtype_denial) { delegation NSEC can only deny the DS */ BOOST_CHECK_EQUAL(denialState, NODATA); + /* it can not be used to deny any RRs below that owner name either */ + denialState = getDenial(denialMap, DNSName("sub.a."), QType::A, false, false); + BOOST_CHECK_EQUAL(denialState, NODATA); + denialState = getDenial(denialMap, DNSName("a."), QType::DS, true, true); BOOST_CHECK_EQUAL(denialState, NXQTYPE); } @@ -8636,6 +8640,36 @@ BOOST_AUTO_TEST_CASE(test_nsec3_ancestor_nxqtype_denial) { denialState = getDenial(denialMap, DNSName("a."), QType::DS, true, true); BOOST_CHECK_EQUAL(denialState, NXQTYPE); + + /* it can not be used to deny any RRs below that owner name either */ + /* Add NSEC3 for the next closer */ + recordContents.clear(); + signatureContents.clear(); + records.clear(); + addNSEC3NarrowRecordToLW(DNSName("sub.a."), DNSName("."), { QType::A, QType::TXT, QType::RRSIG, QType::NSEC3 }, 600, records); + recordContents.push_back(records.at(0).d_content); + addRRSIG(keys, records, DNSName("."), 300); + signatureContents.push_back(getRR(records.at(1))); + + pair.records = recordContents; + pair.signatures = signatureContents; + denialMap[std::make_pair(records.at(0).d_name, records.at(0).d_type)] = pair; + + /* add wildcard denial */ + recordContents.clear(); + signatureContents.clear(); + records.clear(); + addNSEC3NarrowRecordToLW(DNSName("*.a."), DNSName("."), { QType::A, QType::TXT, QType::RRSIG, QType::NSEC3 }, 600, records); + recordContents.push_back(records.at(0).d_content); + addRRSIG(keys, records, DNSName("."), 300); + signatureContents.push_back(getRR(records.at(1))); + + pair.records = recordContents; + pair.signatures = signatureContents; + denialMap[std::make_pair(records.at(0).d_name, records.at(0).d_type)] = pair; + + denialState = getDenial(denialMap, DNSName("sub.a."), QType::A, false, true); + BOOST_CHECK_EQUAL(denialState, NODATA); } BOOST_AUTO_TEST_CASE(test_nsec3_denial_too_many_iterations) { -- 2.49.0