rec: NSEC3 aggressive cache does not work (for empty zones?)

[pspacek]

• This is not a support question, I have read about opensource and will send support questions to the IRC channel, Github Discussions or the mailing list.

• I have read and understood the 'out in the open' support policy

• Program: Recursor

• Issue type: Bug report

Short description

NSEC3 aggressive cache does not work for zones which have only apex and are otherwise empty.

Environment

• Operating system: Arch Linux, x86_64
• Software version: powerdns-recursor 4.9.1-3
• Software source: Operating system repository

Steps to reproduce

1. Recursor config:

dnssec=validate
dont-query=
local-address=127.0.0.1,::1
security-poll-suffix=
socket-dir=/tmp

2. Test auth config:

• local.testiscorg.ch.zone.signed.txt
• BIND auth server:
  auth.conf.txt

3. Add test IP address: sudo ip addr add 10.53.0.2 dev lo
4. Run auth: named -g -c auth.conf
5. Observe traffic to the test auth: tcpdump -n -i lo 'host 10.53.0.2 and port 53'
6. Query for random names in the zone: dig @127.0.0.1 $RANDOM$RANDOM.local.testiscorg.ch.

Expected behaviour

Queries stop going out as soon as NSEC3 chain is received. (I.e. first NSEC3 answer because there is just one NSEC3 RR in the whole zone.)

Actual behaviour

Individual queries hit the auth.

Other information

Insane config like this does not help:

aggressive-nsec-cache-size=1G
aggressive-cache-min-nsec3-hit-ratio=100000

[pspacek]

Hmm, maybe I'm confusing myself. It thought it works for non-empty zones, but now I can't get it to work even for testiscorg.ch domain which has ~ 11 names in it. Weird.

[omoerbeek]

1G is not interpreted as 1 gig (shame on us).

[omoerbeek]

Thanks for the report! Fix in linked PR.