WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-28 12:44:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix auth-zone NSEC3 response for wildcard nodata answers,

Browse Source 
include the closest encloser in the answer.


git-svn-id: file:///svn/unbound/trunk@5146 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards
2019-04-03 06:36:40 +00:00
parent 937523285a
commit ce8167a3bb
3 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/authzone.c
+6 -1
View File
@@ -2997,6 +2997,7 @@ az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo,
struct auth_data* wildcard, struct auth_data* node)
{
struct auth_rrset* rrset, *nsec;
int insert_ce = 0;
if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) {
/* wildcard has type, add it */
if(!msg_add_rrset_an(z, region, msg, wildcard, rrset))
@@ -3023,6 +3024,10 @@ az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo,
/* call other notype routine for dnssec notype denials */
if(!az_generate_notype_answer(z, region, msg, wildcard))
return 0;
/* because the notype, there is no positive data with an
* RRSIG that indicates the wildcard position. Thus the
* wildcard qname denial needs to have a CE nsec3. */
insert_ce = 1;
}
/* ce and node for dnssec denial of wildcard original name */
@@ -3034,7 +3039,7 @@ az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo,
dname_remove_label(&wildup, &wilduplen);
if(!az_add_nsec3_proof(z, region, msg, wildup,
wilduplen, msg->qinfo.qname,
msg->qinfo.qname_len, 0, 0, 1, 0))
msg->qinfo.qname_len, 0, insert_ce, 1, 0))
return 0;
}