Add NSEC3-signed zone

Author: spevnev

src/resolve.cc

@@ -592,10 +592,10 @@ std::optional<std::vector<RR>> Resolver::resolve_rec(const std::string &domain,
                     case RCode::ServerError: throw std::runtime_error("Nameserver error"); break;
                     case RCode::NameError:
                         if (zone->enable_dnssec) {
-                            if (dnssec::authenticate_name_error(sname, nsec3_rrset, nsec_rrset, zone->domain)) {
-                                return std::vector<RR>{};
+                            if (!dnssec::authenticate_name_error(sname, nsec3_rrset, nsec_rrset, zone->domain)) {
+                                throw std::runtime_error("Failed to authenticate the denial of existence");
                             }
-                            throw std::runtime_error("Failed to authenticate the denial of existence");
+                            return std::vector<RR>{};
                         }
 
                         if (!response.is_authoritative) {

tests/bind/keys/Knsec3-signed.com.+013+32475.key

@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 32475, for nsec3-signed.com.
+; Created: 20250810215514 (Sun Aug 10 17:55:14 2025)
+; Publish: 20250810215514 (Sun Aug 10 17:55:14 2025)
+; Activate: 20250810215514 (Sun Aug 10 17:55:14 2025)
+nsec3-signed.com. IN DNSKEY 257 3 13 SsYbv1E5m1ULcFbrGrOHSt7EnTGBEQ2C8T4mloWfuBz7Jm81JL7ly4h1 BaoUDvJV9x7Ksmied+XzA2oGcntH/w==

tests/bind/keys/Knsec3-signed.com.+013+32475.private

@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: 1drFZIwi8ezb2pAjDWAQPe5OWhXpXJ/OK2kcOlxBeAQ=
+Created: 20250810215514
+Publish: 20250810215514
+Activate: 20250810215514

tests/bind/named.conf

@@ -34,3 +34,19 @@ dnssec-policy "nsec-policy" {
     zsk lifetime 60d algorithm ECDSAP256SHA256;
   };
 };
+
+zone "nsec3-signed.com" {
+  type primary;
+  file "nsec3-signed.com.db";
+  notify no;
+  dnssec-policy "nsec3-policy";
+  inline-signing yes;
+};
+
+dnssec-policy "nsec3-policy" {
+  keys {
+    ksk lifetime unlimited algorithm ECDSAP256SHA256;
+    zsk lifetime 60d algorithm ECDSAP256SHA256;
+  };
+  nsec3param optout no salt-length 8;
+};

tests/cases/bind/does_not_exist.cc

@@ -0,0 +1,20 @@
+#include "common.hh"
+#include "config.hh"
+#include "resolve.hh"
+
+namespace {
+void check_response(const std::optional<std::vector<RR>> &response) {
+    ASSERT(response.has_value());
+    ASSERT(response->empty());
+}
+}  // namespace
+
+int main() {
+    Resolver unsigned_resolver{UNSIGNED_RESOLVER_CONFIG};
+    Resolver signed_resolver{SIGNED_RESOLVER_CONFIG};
+    Resolver nsec3_signed_resolver{NSEC3_SIGNED_RESOLVER_CONFIG};
+    check_response(unsigned_resolver.resolve("name-error." UNSIGNED_DOMAIN, RRType::A));
+    check_response(signed_resolver.resolve("name-error." SIGNED_DOMAIN, RRType::A));
+    check_response(nsec3_signed_resolver.resolve("name-error." NSEC3_SIGNED_DOMAIN, RRType::A));
+    return EXIT_SUCCESS;
+}

tests/cases/bind/name_error.cc

@@ -0,0 +1,22 @@
+#include "common.hh"
+#include "config.hh"
+#include "resolve.hh"
+
+// no-data A 1.2.3.4
+
+namespace {
+void check_response(const std::optional<std::vector<RR>> &response) {
+    ASSERT(response.has_value());
+    ASSERT(response->empty());
+}
+}  // namespace
+
+int main() {
+    Resolver unsigned_resolver{UNSIGNED_RESOLVER_CONFIG};
+    Resolver signed_resolver{SIGNED_RESOLVER_CONFIG};
+    Resolver nsec3_signed_resolver{NSEC3_SIGNED_RESOLVER_CONFIG};
+    check_response(unsigned_resolver.resolve("no-data." UNSIGNED_DOMAIN, RRType::HINFO));
+    check_response(signed_resolver.resolve("no-data." SIGNED_DOMAIN, RRType::HINFO));
+    check_response(nsec3_signed_resolver.resolve("no-data." NSEC3_SIGNED_DOMAIN, RRType::HINFO));
+    return EXIT_SUCCESS;
+}

tests/cases/bind/no_data.cc

@@ -32,6 +32,28 @@ static const ResolverConfig SIGNED_RESOLVER_CONFIG{
     .dnssec = FeatureState::Require,
 };
 
+#define NSEC3_SIGNED_DOMAIN "nsec3-signed.com."
+static const ResolverConfig NSEC3_SIGNED_RESOLVER_CONFIG {
+    .timeout_ms = 500,
+    .nameserver = NameserverConfig{
+        .address = "127.0.0.1",
+        .zone_domain = NSEC3_SIGNED_DOMAIN,
+        .dss = {DS{
+            .key_tag = 32475,
+            .signing_algorithm = SigningAlgorithm::ECDSAP256SHA256,
+            .digest_algorithm = DigestAlgorithm::SHA256,
+            .digest = {0xA5, 0x29, 0xE5, 0x47, 0x63, 0xB5, 0x68, 0x6C, 0x25, 0x95, 0x16,
+                        0xB6, 0x0D, 0xEA, 0x46, 0xCB, 0x42, 0xC0, 0x14, 0x15, 0xDA, 0x5C,
+                        0xC6, 0xCB, 0xD1, 0x8B, 0x9C, 0x54, 0x1A, 0x99, 0x8C, 0x5D},
+            .data = {},
+        }},
+    },
+    .use_root_nameservers = false,
+    .use_resolve_config = false,
+    .port = 1053,
+    .dnssec = FeatureState::Require,
+};
+
 #define MOCK_DOMAIN "test.com."
 #define MOCK_NAMESERVER_ADDRESS "127.0.0.2"
 static const ResolverConfig MOCK_RESOLVER_CONFIG{

tests/common/config.hh

@@ -9,7 +9,7 @@ named_pid_path=$named_dir/named.pid
 keys_path=./tests/bind/keys
 named_config_path=./tests/bind/named.conf
 base_zone_path=./tests/bind/base.db
-zone_names=(unsigned.com signed.com)
+zone_names=(unsigned.com signed.com nsec3-signed.com)
 
 bind_cases_src_dir=./tests/cases/bind
 cases_out_dir=./build/tests/cases
@@ -51,6 +51,9 @@ fi
 # Terminate named before exiting
 trap "kill -- \$(cat $named_pid_path)" SIGINT SIGTERM EXIT
 
+# Wait for the named to sign the zones
+sleep 1
+
 # Run tests
 passed=0
 failed=0