Skip to content

Several NSEC(3)-related bugs fixed

Ghost User requested to merge nonterminal-bug into master
  1. When replying NODATA response from empty non-terminals, NSECs for NXDOMAIN have to be added instead of NSECs for NODATA. (Does not apply for NSEC3.) This was not handled in the rewritten query processing.
  2. When adding RRSet to node, do not increase RRSet count of that node, if the RRSet is empty and contains only RRSIGs. Such RRSet was counted and it resulted in wrong behaviour when RRSet was removed but its RRSIG remained in the zone. (Note that in current implementation the RRSet count in node reflects only RRSets directly in the node, i.e. it does not count RRSIGs).
  3. In some cases, NSEC3 records were generated for empty non-terminals that were subsequently deleted after applying the DNSSEC changeset. See issue #210 (closed) for description and solution.

Merge request reports