Skip to content

Commit b50efd6

Browse files
mind04mind04
committed
don't add superfluous nsec3 for old bind
1 parent b81ff68 commit b50efd6

File tree

16 files changed

+1
-55
lines changed

16 files changed

+1
-55
lines changed

‎debian/config/pdns.conf‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,4 @@
11
# Autogenerated configuration file template
2-
#################################
3-
# add-superfluous-nsec3-for-old-bind Add superfluous NSEC3 record to positive wildcard response
4-
#
5-
# add-superfluous-nsec3-for-old-bind=yes
6-
72
#################################
83
# allow-axfr-ips Allow zonetransfers only to these subnets
94
#

‎pdns/common_startup.cc‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,6 @@ void declareArguments()
156156

157157
::arg().setSwitch("traceback-handler","Enable the traceback handler (Linux only)")="yes";
158158
::arg().setSwitch("direct-dnskey","Fetch DNSKEY RRs from backend during DNSKEY synthesis")="no";
159-
::arg().setSwitch("add-superfluous-nsec3-for-old-bind","Add superfluous NSEC3 record to positive wildcard response")="yes";
160159
::arg().set("default-ksk-algorithms","Default KSK algorithms")="rsasha256";
161160
::arg().set("default-ksk-size","Default KSK size (0 means default)")="0";
162161
::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256";
@@ -356,7 +355,6 @@ void mainthread()
356355
newuid=Utility::makeUidNumeric(::arg()["setuid"]);
357356

358357
g_anyToTcp = ::arg().mustDo("any-to-tcp");
359-
g_addSuperfluousNSEC3 = ::arg().mustDo("add-superfluous-nsec3-for-old-bind");
360358

361359
DNSPacket::s_udpTruncationThreshold = std::max(512, ::arg().asNum("udp-truncation-threshold"));
362360
DNSPacket::s_doEDNSSubnetProcessing = ::arg().mustDo("edns-subnet-processing");

‎pdns/packethandler.cc‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -642,9 +642,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
642642
closest=target;
643643

644644
// add matching NSEC3 RR
645-
// we used to skip this one for mode 3, but old BIND needs it
646-
// see https://github.com/PowerDNS/pdns/issues/814
647-
if (mode != 3 || g_addSuperfluousNSEC3) {
645+
if (mode != 3) {
648646
unhashed=(mode == 0 || mode == 1 || mode == 5) ? target : closest;
649647
hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
650648
DLOG(L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);

‎pdns/pdns.conf-dist‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,4 @@
11
# Autogenerated configuration file template
2-
#################################
3-
# add-superfluous-nsec3-for-old-bind Add superfluous NSEC3 record to positive wildcard response
4-
#
5-
# add-superfluous-nsec3-for-old-bind=yes
6-
72
#################################
83
# allow-2136-from A global setting to allow RFC2136 from these IP ranges.
94
#

‎regression-tests/tests/any-wildcard-dnssec/expected_result.narrow‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
0 www.something.wtest.com. IN A 3600 4.3.2.1
22
0 www.something.wtest.com. IN RRSIG 3600 A 8 3 3600 [expiry] [inception] [keytag] wtest.com. ...
3-
1 54njs65s8u96tkffrft6l7j1t1556vik.wtest.com. IN NSEC3 86400 1 [flags] 1 abcd 54NJS65S8U96TKFFRFT6L7J1T1556VIL TXT RRSIG
4-
1 54njs65s8u96tkffrft6l7j1t1556vik.wtest.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] wtest.com. ...
53
1 7q60llva2bt9ucubvn553q9s2pf8ho38.wtest.com. IN NSEC3 86400 1 [flags] 1 abcd 7Q60LLVA2BT9UCUBVN553Q9S2PF8HO3A
64
1 7q60llva2bt9ucubvn553q9s2pf8ho38.wtest.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] wtest.com. ...
75
2 . IN OPT 32768

‎regression-tests/tests/any-wildcard-dnssec/expected_result.nsec3‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
0 www.something.wtest.com. IN A 3600 4.3.2.1
22
0 www.something.wtest.com. IN RRSIG 3600 A 8 3 3600 [expiry] [inception] [keytag] wtest.com. ...
3-
1 54njs65s8u96tkffrft6l7j1t1556vik.wtest.com. IN NSEC3 86400 1 [flags] 1 abcd 67I2ESLUBOJ7DPG4263L3T8DV19G6D0G TXT RRSIG
4-
1 54njs65s8u96tkffrft6l7j1t1556vik.wtest.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] wtest.com. ...
53
1 7k2dfhl64f0ndftst8u5rr5euminddvb.wtest.com. IN NSEC3 86400 1 [flags] 1 abcd 95QOQ246KN3VM7HL8KVG8O45JIHMNLNG A RRSIG
64
1 7k2dfhl64f0ndftst8u5rr5euminddvb.wtest.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] wtest.com. ...
75
2 . IN OPT 32768

‎regression-tests/tests/cname-wildcard-chain/expected_result.narrow‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,10 @@
1212
0 x.y.z.w5.example.com. IN RRSIG 120 A 8 3 120 [expiry] [inception] [keytag] example.com. ...
1313
1 6jmrie0v0hnp2flflt36lur7c08n9h45.example.com. IN NSEC3 86400 1 [flags] 1 abcd 6JMRIE0V0HNP2FLFLT36LUR7C08N9H47
1414
1 6jmrie0v0hnp2flflt36lur7c08n9h45.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
15-
1 936eebq7jr1uc4bn1maa69a3aupeitfc.example.com. IN NSEC3 86400 1 [flags] 1 abcd 936EEBQ7JR1UC4BN1MAA69A3AUPEITFD
16-
1 936eebq7jr1uc4bn1maa69a3aupeitfc.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
17-
1 a376dj0hnucs849r3dp2evrvbg967oeu.example.com. IN NSEC3 86400 1 [flags] 1 abcd A376DJ0HNUCS849R3DP2EVRVBG967OEV
18-
1 a376dj0hnucs849r3dp2evrvbg967oeu.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
19-
1 akad2jtk186u143vhl92en81u06ljna5.example.com. IN NSEC3 86400 1 [flags] 1 abcd AKAD2JTK186U143VHL92EN81U06LJNA6
20-
1 akad2jtk186u143vhl92en81u06ljna5.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2115
1 atcf56s7ucntm82nht67p3g2nqteplou.example.com. IN NSEC3 86400 1 [flags] 1 abcd ATCF56S7UCNTM82NHT67P3G2NQTEPLP0
2216
1 atcf56s7ucntm82nht67p3g2nqteplou.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
23-
1 b3mj2rag3tfrk0cbk5uvlm9hnt6k6tmj.example.com. IN NSEC3 86400 1 [flags] 1 abcd B3MJ2RAG3TFRK0CBK5UVLM9HNT6K6TMK
24-
1 b3mj2rag3tfrk0cbk5uvlm9hnt6k6tmj.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2517
1 b6drqdikagd74fa5eme4sdiek1s06343.example.com. IN NSEC3 86400 1 [flags] 1 abcd B6DRQDIKAGD74FA5EME4SDIEK1S06345
2618
1 b6drqdikagd74fa5eme4sdiek1s06343.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
27-
1 bi61d8htvrnfktnig400n722d2v3lq1i.example.com. IN NSEC3 86400 1 [flags] 1 abcd BI61D8HTVRNFKTNIG400N722D2V3LQ1J
28-
1 bi61d8htvrnfktnig400n722d2v3lq1i.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2919
1 lr0g3vnj9r0nvtlsjnf8eqa68sqj06qg.example.com. IN NSEC3 86400 1 [flags] 1 abcd LR0G3VNJ9R0NVTLSJNF8EQA68SQJ06QI
3020
1 lr0g3vnj9r0nvtlsjnf8eqa68sqj06qg.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
3121
1 vsfa79vv78gd61567bkcai646ta0p276.example.com. IN NSEC3 86400 1 [flags] 1 abcd VSFA79VV78GD61567BKCAI646TA0P278

‎regression-tests/tests/cname-wildcard-chain/expected_result.nsec3‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,10 @@
1212
0 x.y.z.w5.example.com. IN RRSIG 120 A 8 3 120 [expiry] [inception] [keytag] example.com. ...
1313
1 6jljjg5vg8ab1latv5khfq52jjpdlp9t.example.com. IN NSEC3 86400 1 [flags] 1 abcd 6JNMPRJN08RFG8QRUMBN91V2UURTV527 A RRSIG
1414
1 6jljjg5vg8ab1latv5khfq52jjpdlp9t.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
15-
1 936eebq7jr1uc4bn1maa69a3aupeitfc.example.com. IN NSEC3 86400 1 [flags] 1 abcd 938CRGVGJ6PEHDHT49EJCEIIRMH75IJ8
16-
1 936eebq7jr1uc4bn1maa69a3aupeitfc.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
17-
1 a376dj0hnucs849r3dp2evrvbg967oeu.example.com. IN NSEC3 86400 1 [flags] 1 abcd A37U32P0GF09BE4EHU7VTEESS1GU45UB
18-
1 a376dj0hnucs849r3dp2evrvbg967oeu.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
19-
1 akad2jtk186u143vhl92en81u06ljna5.example.com. IN NSEC3 86400 1 [flags] 1 abcd AKATF5BN9NMCT00E5PLMMOJM196CHN71
20-
1 akad2jtk186u143vhl92en81u06ljna5.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2115
1 atbcoh7l1gr1cbifhkt3ikmv2o60g8sc.example.com. IN NSEC3 86400 1 [flags] 1 abcd ATEJUO2QMEO1FORSEB6KH9B0DMVFRK08 A RRSIG
2216
1 atbcoh7l1gr1cbifhkt3ikmv2o60g8sc.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
23-
1 b3mj2rag3tfrk0cbk5uvlm9hnt6k6tmj.example.com. IN NSEC3 86400 1 [flags] 1 abcd B3ONOQ30J349UAJOB6H2FM1FIT3TOJKR
24-
1 b3mj2rag3tfrk0cbk5uvlm9hnt6k6tmj.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2517
1 b6cdleeregn514pnp2jgmtd67ig3q4qs.example.com. IN NSEC3 86400 1 [flags] 1 abcd B6J68ESSIMG1HC5MGJ3B3OQUKL9PKEQB A RRSIG
2618
1 b6cdleeregn514pnp2jgmtd67ig3q4qs.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
27-
1 bi61d8htvrnfktnig400n722d2v3lq1i.example.com. IN NSEC3 86400 1 [flags] 1 abcd BI7NGLVDS01SK3172JRF6UPDINT4OEDL
28-
1 bi61d8htvrnfktnig400n722d2v3lq1i.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
2919
1 lqu3s8oae1ipc1iobnslma8igo1335a4.example.com. IN NSEC3 86400 1 [flags] 1 abcd LR1LEP75CII4P0CLER3MLLQBO1TGKHDO A RRSIG
3020
1 lqu3s8oae1ipc1iobnslma8igo1335a4.example.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] example.com. ...
3121
1 vscvfu442fdlbq07jpd7bdocd3ig7fo8.example.com. IN NSEC3 86400 1 [flags] 1 abcd VSGNH606MUV7BFQFN3TRH1D5FKP1IPIV A RRSIG

‎regression-tests/tests/ent-wildcard-below-ent/expected_result.narrow‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
0 something.a.b.c.test.com. IN RRSIG 3600 A 8 5 3600 [expiry] [inception] [keytag] test.com. ...
33
1 qjeirdhb04ir4vbs5pbbhbue69dlq9nr.test.com. IN NSEC3 86400 1 [flags] 1 abcd QJEIRDHB04IR4VBS5PBBHBUE69DLQ9NT
44
1 qjeirdhb04ir4vbs5pbbhbue69dlq9nr.test.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
5-
1 vlvujatanof6feajoesti9kq4s0crst3.test.com. IN NSEC3 86400 1 [flags] 1 abcd VLVUJATANOF6FEAJOESTI9KQ4S0CRST4
6-
1 vlvujatanof6feajoesti9kq4s0crst3.test.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
75
2 . IN OPT 32768
86
Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
97
Reply to question for qname='something.a.b.c.test.com.', qtype=A

‎regression-tests/tests/ent-wildcard-below-ent/expected_result.nsec3‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
0 something.a.b.c.test.com. IN RRSIG 3600 A 8 5 3600 [expiry] [inception] [keytag] test.com. ...
33
1 qd81ag9inqts1ocs7api0pji94k27btr.test.com. IN NSEC3 86400 1 [flags] 1 abcd S6G5SHC1JVOVL5FL9E943ADLONQLN7G4 CNAME RRSIG
44
1 qd81ag9inqts1ocs7api0pji94k27btr.test.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
5-
1 vlvujatanof6feajoesti9kq4s0crst3.test.com. IN NSEC3 86400 1 [flags] 1 abcd 0BH8DI769I8VVTKDDS8EFJDA19ABIGO5
6-
1 vlvujatanof6feajoesti9kq4s0crst3.test.com. IN RRSIG 86400 NSEC3 8 3 86400 [expiry] [inception] [keytag] test.com. ...
75
2 . IN OPT 32768
86
Rcode: 0, RD: 0, QR: 1, TC: 0, AA: 1, opcode: 0
97
Reply to question for qname='something.a.b.c.test.com.', qtype=A

0 commit comments

Comments
 (0)