From 3da914b8ed4b6c9e8bfa122caf9cd31ab7ec46d1 Mon Sep 17 00:00:00 2001
From: Marc van der Wal <marc.vanderwal@afnic.fr>
Date: Mon, 10 Aug 2026 11:36:16 +0200
Subject: [PATCH] Override hints on undelegated tests of root zone
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the zone being tested is the root zone and undelegated data was
provided by the user, zonemaster-cli failed to discard all previously
loaded root hints before taking the undelegated data into account.
Instead, the undelegated data was simply merged with the existing hints.

For example, if doing an undelegated test of the root zone with
undelegated data calling the root name servers “ns1” and “ns2”,
previously, a test like Delegation01 erroneously reported 15
authoritative name servers in the child zone (13 from the built-in root
hints + 2 from the undelegated data), instead of just 2.
---
 MANIFEST                |   1 +
 lib/Zonemaster/CLI.pm   |   4 ++++
 t/usage.t               |  46 ++++++++++++++++++++++++++++++++++------
 t/usage.undel-root.data | Bin 0 -> 1034 bytes
 4 files changed, 44 insertions(+), 7 deletions(-)
 create mode 100644 t/usage.undel-root.data

diff --git a/MANIFEST b/MANIFEST
index 29e0fce..23891ef 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -37,4 +37,5 @@ t/usage.hints
 t/usage.normal.data
 t/usage.profile
 t/usage.t
+t/usage.undel-root.data
 t/usage.wrapper.pl
diff --git a/lib/Zonemaster/CLI.pm b/lib/Zonemaster/CLI.pm
index fc06df5..d8ad9ec 100644
--- a/lib/Zonemaster/CLI.pm
+++ b/lib/Zonemaster/CLI.pm
@@ -491,6 +491,10 @@ sub run {
     # This can generate early log messages.
     if ( @opt_ns ) {
         local $@;
+        if ( $domain eq '.' ) {
+            Zonemaster::Engine::Recursor->remove_fake_addresses( '.' );
+        }
+
         eval {
             add_fake_delegation( $domain, @opt_ns );
             1;
diff --git a/t/usage.t b/t/usage.t
index 2529da6..da49ea0 100644
--- a/t/usage.t
+++ b/t/usage.t
@@ -35,10 +35,11 @@ Readonly::Array my @SIG_NAMES => do {
     @sig_names;
 };
 
-Readonly::Scalar my $PATH_WRAPPER            => catfile( dirname( __FILE__ ), 'usage.wrapper.pl' );
-Readonly::Scalar my $PATH_NORMAL_DATAFILE    => catfile( dirname( __FILE__ ), 'usage.normal.data' );
-Readonly::Scalar my $PATH_FAKE_DATA_DATAFILE => catfile( dirname( __FILE__ ), 'usage.fake-data.data' );
-Readonly::Scalar my $PATH_FAKE_ROOT_DATAFILE => catfile( dirname( __FILE__ ), 'usage.fake-root.data' );
+Readonly::Scalar my $PATH_WRAPPER             => catfile( dirname( __FILE__ ), 'usage.wrapper.pl' );
+Readonly::Scalar my $PATH_NORMAL_DATAFILE     => catfile( dirname( __FILE__ ), 'usage.normal.data' );
+Readonly::Scalar my $PATH_FAKE_DATA_DATAFILE  => catfile( dirname( __FILE__ ), 'usage.fake-data.data' );
+Readonly::Scalar my $PATH_FAKE_ROOT_DATAFILE  => catfile( dirname( __FILE__ ), 'usage.fake-root.data' );
+Readonly::Scalar my $PATH_UNDEL_ROOT_DATAFILE => catfile( dirname( __FILE__ ), 'usage.undel-root.data' );
 Readonly::Array my @PERL => do {
     # Detect whether Devel::Cover is running
     my $is_covering = !!( eval 'Devel::Cover::get_coverage()' );
@@ -53,9 +54,10 @@ our $test_datafile;
 # SETUP
 
 if ( $ENV{ZONEMASTER_RECORD} ) {
-    write_file $PATH_NORMAL_DATAFILE,    '';
-    write_file $PATH_FAKE_DATA_DATAFILE, '';
-    write_file $PATH_FAKE_ROOT_DATAFILE, '';
+    write_file $PATH_NORMAL_DATAFILE,     '';
+    write_file $PATH_FAKE_DATA_DATAFILE,  '';
+    write_file $PATH_FAKE_ROOT_DATAFILE,  '';
+    write_file $PATH_UNDEL_ROOT_DATAFILE, '';
 }
 
 # HELPERS
@@ -707,6 +709,36 @@ do {
 
     check_success '--restore', [ "--restore=$PATH_NORMAL_DATAFILE", '--test=basic01', '--level=INFO', '--raw', '.' ],
       qr{B01_CHILD_FOUND};
+
+    check_success 'undelegated data for root NS overrides root hints',
+      [ "--restore=$PATH_UNDEL_ROOT_DATAFILE",
+        '--test=delegation01', '--level=INFO', '--raw',
+        '--ns=ns1/127.1.0.1', '--ns=ns1/fda1:b2:c3:0:127:1:0:1',
+        '--ns=ns2/127.1.0.2', '--ns=ns2/fda1:b2:c3:0:127:1:0:2',
+        '.' ],
+      sub {
+          my $stdout = $_[0];
+
+          my $lines_found = 0;
+
+          foreach my $line ( split /\n/, $stdout ) {
+              if ( $line =~ /ENOUGH_IPV[46]_NS_CHILD/ ) {
+                  $lines_found++;
+                  if ( $line !~ /\bcount=2;/ ) {
+                      diag "\"$line\": expected 'count=2'";
+                      return 0;
+                  }
+              }
+          }
+
+          if ( $lines_found != 2 ) {
+              diag "Expected 2 lines matching ENOUGH_IPV[46]_NS_CHILD, " .
+                  "got $lines_found instead";
+              return 0;
+          }
+
+          return 1;
+      };
 };
 
 done_testing;
diff --git a/t/usage.undel-root.data b/t/usage.undel-root.data
new file mode 100644
index 0000000000000000000000000000000000000000..d2285ac7cfe08899bb9e6e5507dcb04d36c54a58
GIT binary patch
literal 1034
zcmcb4^ZR1I)V%b}ywv!z)S}|d{5-cZOFaWU1NVZ&<m}Xv;+Cc+=e%M=PeUVfJwu>`
zVPjJu0|+pJNg%<*z}OPe$-vM85@P}iuz<y&1fKu{D>Kjlh(ZPiDBp<TfDBMM&=8;i
zOFfVU<by;&e1X3U88$H-2AZc15&_ETpr~a6@^PtULb&v|<E?qA6Q(~hW`Ou1EG;F`
z&??EuD%se|zzXOgD?<=H*gb^9*-+noz60@{5!~NKgWW?2mqPq7Lm&<62kc%oY8vE8
z4u`X$zEeEHfbM=aP?m{-W*JDPVE~FTKnP$CPzGli*2I+D%si%wB!-H%KROHyAqn8@
o!D-dNz!=zo$Y4ysyaURHNVyBIlcuk~%HWrlUzD3z0?YM`05g)Z_5c6?

literal 0
HcmV?d00001