TrueCloudLab/coredns
16
0
Fork 2
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

plugin/dnssec: fix NSEC-records (#1138)

Browse source 
* add NSEC-records if entry exists but the requested type is missing

* added test for dnssec fix
This commit is contained in:
Isolus 2017-10-08 13:28:35 +02:00 • committed by Miek Gieben
parent c9bf91f1a7
commit c1b9f74f98
2 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
plugin/dnssec/dnssec.go
View file

@ -49,7 +49,7 @@ func (d Dnssec) Sign(state request.Request, zone string, now time.Time) *dns.Msg
incep, expir := incepExpir(now)
if mt == response.NameError {
if mt == response.NameError || mt == response.NoData {
if req.Ns[0].Header().Rrtype != dns.TypeSOA || len(req.Ns) > 1 {
return req
}

21
plugin/dnssec/dnssec_test.go
View file

@ -127,6 +127,20 @@ func TestSigningDname(t *testing.T) {
}
}
func TestSigningEmpty(t *testing.T) {
d, rm1, rm2 := newDnssec(t, []string{"miek.nl."})
defer rm1()
defer rm2()
m := testEmptyMsg()
m.SetQuestion("a.miek.nl.", dns.TypeA)
state := request.Request{Req: m}
m = d.Sign(state, "miek.nl.", time.Now().UTC())
if !section(m.Ns, 2) {
t.Errorf("authority section should have 2 sig")
}
}
func section(rss []dns.RR, nrSigs int) bool {
i := 0
for _, r := range rss {
@ -181,6 +195,13 @@ func testMsgDname() *dns.Msg {
}
}
func testEmptyMsg() *dns.Msg {
// don't care about the message header
return &dns.Msg{
Ns: []dns.RR{test.SOA("miek.nl. 1800 IN SOA ns.miek.nl. dnsmaster.miek.nl. 2017100301 200 100 604800 3600")},
}
}
func newDnssec(t *testing.T, zones []string) (Dnssec, func(), func()) {
k, rm1, rm2 := newKey(t)
c := cache.New(defaultCap)