Commit 4e1d8e6a92 for bind
commit 4e1d8e6a923f831edd876c93ff6e3a120ebf411b
Author: Mark Andrews <marka@isc.org>
Date: Mon Sep 7 16:36:21 2026 +1000
Add dns_nsec3_activex tests
This add tests for dns_nsec3_activex which exercises various
combinations of NSEC3PARAM records and private records with
the CREATE flag set.
diff --git a/tests/dns/nsec3_test.c b/tests/dns/nsec3_test.c
index 957237e5cb..87002c973e 100644
--- a/tests/dns/nsec3_test.c
+++ b/tests/dns/nsec3_test.c
@@ -110,6 +110,111 @@ nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
assert_int_equal(result, ISC_R_SUCCESS);
}
+ISC_RUN_TEST_IMPL(activex) {
+ isc_result_t result;
+ bool answer;
+ dns_db_t *db = NULL;
+
+ /*
+ * Test a zone with only a NSEC3PARAM record with flags 0 and
+ * no private type records. All three scenarios should return
+ * true.
+ */
+ result = dns_test_loaddb(&db, dns_dbtype_zone, "test.test",
+ TESTS_DIR "/testdata/nsec3/activex-1.db");
+ assert_int_equal(result, ISC_R_SUCCESS);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, false, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, true, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, false, 0, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ dns_db_detach(&db);
+
+ /*
+ * Test a zone with no NSEC3PARAM records and no private type records.
+ * All three scenarios should return false.
+ */
+ result = dns_test_loaddb(&db, dns_dbtype_zone, "test.test",
+ TESTS_DIR "/testdata/nsec3/activex-2.db");
+ assert_int_equal(result, ISC_R_SUCCESS);
+
+ answer = true;
+ result = dns_nsec3_activex(db, NULL, false, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_false(answer);
+
+ answer = true;
+ result = dns_nsec3_activex(db, NULL, true, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_false(answer);
+
+ answer = true;
+ result = dns_nsec3_activex(db, NULL, false, 0, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_false(answer);
+
+ dns_db_detach(&db);
+
+ /*
+ * Test a zone with no NSEC3PARAM records and a private CREATE record.
+ */
+ result = dns_test_loaddb(&db, dns_dbtype_zone, "test.test",
+ TESTS_DIR "/testdata/nsec3/activex-3.db");
+ assert_int_equal(result, ISC_R_SUCCESS);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, false, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ answer = true;
+ result = dns_nsec3_activex(db, NULL, true, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_false(answer);
+
+ answer = true;
+ result = dns_nsec3_activex(db, NULL, false, 0, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_false(answer);
+
+ dns_db_detach(&db);
+
+ /*
+ * Test a zone with an NSEC3PARAM record and a private CREATE record.
+ */
+ result = dns_test_loaddb(&db, dns_dbtype_zone, "test.test",
+ TESTS_DIR "/testdata/nsec3/activex-4.db");
+ assert_int_equal(result, ISC_R_SUCCESS);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, false, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, true, 65534, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ answer = false;
+ result = dns_nsec3_activex(db, NULL, false, 0, &answer);
+ assert_int_equal(result, ISC_R_SUCCESS);
+ assert_true(answer);
+
+ dns_db_detach(&db);
+}
+
/*
* check that appropriate max iterations is returned for different
* key size mixes
@@ -150,6 +255,7 @@ ISC_RUN_TEST_IMPL(nsec3param_salttotext) {
}
ISC_TEST_LIST_START
+ISC_TEST_ENTRY(activex)
ISC_TEST_ENTRY(max_iterations)
ISC_TEST_ENTRY(nsec3param_salttotext)
ISC_TEST_LIST_END
diff --git a/tests/dns/testdata/nsec3/activex-1.db b/tests/dns/testdata/nsec3/activex-1.db
new file mode 100644
index 0000000000..5692f456bf
--- /dev/null
+++ b/tests/dns/testdata/nsec3/activex-1.db
@@ -0,0 +1,4 @@
+@ 0 IN SOA . . 0 0 0 0 0
+@ 0 IN NS .
+; a zone with only a NSEC3PARAM with flags set to 0
+@ 0 IN NSEC3PARAM 0 0 0 -
diff --git a/tests/dns/testdata/nsec3/activex-2.db b/tests/dns/testdata/nsec3/activex-2.db
new file mode 100644
index 0000000000..cb55e54cfb
--- /dev/null
+++ b/tests/dns/testdata/nsec3/activex-2.db
@@ -0,0 +1,3 @@
+@ 0 IN SOA . . 0 0 0 0 0
+@ 0 IN NS .
+; a zone without a NSEC3PARAM record and no private signing records
diff --git a/tests/dns/testdata/nsec3/activex-3.db b/tests/dns/testdata/nsec3/activex-3.db
new file mode 100644
index 0000000000..95161881ef
--- /dev/null
+++ b/tests/dns/testdata/nsec3/activex-3.db
@@ -0,0 +1,4 @@
+@ 0 IN SOA . . 0 0 0 0 0
+@ 0 IN NS .
+; a zone without a NSEC3PARAM record and a create private record
+@ 0 IN TYPE65534 \# 6 00 00 80 00 00 00
diff --git a/tests/dns/testdata/nsec3/activex-4.db b/tests/dns/testdata/nsec3/activex-4.db
new file mode 100644
index 0000000000..c777f3f8e8
--- /dev/null
+++ b/tests/dns/testdata/nsec3/activex-4.db
@@ -0,0 +1,5 @@
+@ 0 IN SOA . . 0 0 0 0 0
+@ 0 IN NS .
+; a zone with a NSEC3PARAM record and a create private record
+@ 0 IN NSEC3PARAM 0 0 0 -
+@ 0 IN TYPE65534 \# 6 00 00 80 00 00 00