7 files changed, 64 insertions, 7 deletions
diff --git a/vendor/github.com/miekg/dns/.travis.yml b/vendor/github.com/miekg/dns/.travis.yml
index 73eef5490..bb8b8d40b 100644
--- a/vendor/github.com/miekg/dns/.travis.yml
+++ b/vendor/github.com/miekg/dns/.travis.yml
@@ -1,8 +1,9 @@
 language: go
 sudo: false
 go:
-  - 1.7
-  - 1.8
+  - 1.7.x
+  - 1.8.x
+  - tip
 
 before_install:
   # don't use the miekg/dns when testing forks
diff --git a/vendor/github.com/miekg/dns/README.md b/vendor/github.com/miekg/dns/README.md
index cd5c1948e..32a49cbf5 100644
--- a/vendor/github.com/miekg/dns/README.md
+++ b/vendor/github.com/miekg/dns/README.md
@@ -13,7 +13,7 @@ can build servers and resolvers with it.
 
 We try to keep the "master" branch as sane as possible and at the bleeding edge
 of standards, avoiding breaking changes wherever reasonable. We support the last
-two versions of Go, currently: 1.6 and 1.7.
+two versions of Go, currently: 1.7 and 1.8.
 
 # Goals
 
@@ -58,6 +58,8 @@ A not-so-up-to-date-list-that-may-be-actually-current:
 * http://quilt.io
 * https://github.com/ipdcode/hades (JD.COM)
 * https://github.com/StackExchange/dnscontrol/
+* https://www.dnsperf.com/
+* https://dnssectest.net/
 
 Send pull request if you want to be listed here.
 
diff --git a/vendor/github.com/miekg/dns/defaults.go b/vendor/github.com/miekg/dns/defaults.go
index 3308ec838..c34890eec 100644
--- a/vendor/github.com/miekg/dns/defaults.go
+++ b/vendor/github.com/miekg/dns/defaults.go
@@ -13,9 +13,12 @@ const hexDigit = "0123456789abcdef"
 // SetReply creates a reply message from a request message.
 func (dns *Msg) SetReply(request *Msg) *Msg {
 	dns.Id = request.Id
-	dns.RecursionDesired = request.RecursionDesired // Copy rd bit
 	dns.Response = true
-	dns.Opcode = OpcodeQuery
+	dns.Opcode = request.Opcode
+	if dns.Opcode == OpcodeQuery {
+		dns.RecursionDesired = request.RecursionDesired // Copy rd bit
+		dns.CheckingDisabled = request.CheckingDisabled // Copy cd bit
+	}
 	dns.Rcode = RcodeSuccess
 	if len(request.Question) > 0 {
 		dns.Question = make([]Question, 1)
diff --git a/vendor/github.com/miekg/dns/parse_test.go b/vendor/github.com/miekg/dns/parse_test.go
index 2622318df..fc5bdaf5d 100644
--- a/vendor/github.com/miekg/dns/parse_test.go
+++ b/vendor/github.com/miekg/dns/parse_test.go
@@ -1527,3 +1527,14 @@ func TestParseAVC(t *testing.T) {
 		}
 	}
 }
+
+func TestUnbalancedParens(t *testing.T) {
+	sig := `example.com. 3600 IN RRSIG MX 15 2 3600 (
+              1440021600 1438207200 3613 example.com. (
+              oL9krJun7xfBOIWcGHi7mag5/hdZrKWw15jPGrHpjQeRAvTdszaPD+QLs3f
+              x8A4M3e23mRZ9VrbpMngwcrqNAg== )`
+	_, err := NewRR(sig)
+	if err == nil {
+		t.Fatalf("Failed to detect extra opening brace")
+	}
+}
diff --git a/vendor/github.com/miekg/dns/scan.go b/vendor/github.com/miekg/dns/scan.go
index de0db32f8..8d4773c3e 100644
--- a/vendor/github.com/miekg/dns/scan.go
+++ b/vendor/github.com/miekg/dns/scan.go
@@ -811,6 +811,12 @@ func zlexer(s *scan, c chan lex) {
 		debug.Printf("[%+v]", l.token)
 		c <- l
 	}
+	if brace != 0 {
+		l.token = "unbalanced brace"
+		l.tokenUpper = l.token
+		l.err = true
+		c <- l
+	}
 }
 
 // Extract the class number from CLASSxx
diff --git a/vendor/github.com/miekg/dns/xfr.go b/vendor/github.com/miekg/dns/xfr.go
index 7346deffb..576c5590a 100644
--- a/vendor/github.com/miekg/dns/xfr.go
+++ b/vendor/github.com/miekg/dns/xfr.go
@@ -1,6 +1,7 @@
 package dns
 
 import (
+	"fmt"
 	"time"
 )
 
@@ -81,6 +82,10 @@ func (t *Transfer) inAxfr(id uint16, c chan *Envelope) {
 			return
 		}
 		if first {
+			if in.Rcode != RcodeSuccess {
+				c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
+				return
+			}
 			if !isSOAFirst(in) {
 				c <- &Envelope{in.Answer, ErrSoa}
 				return
@@ -126,6 +131,10 @@ func (t *Transfer) inIxfr(id uint16, c chan *Envelope) {
 			return
 		}
 		if first {
+			if in.Rcode != RcodeSuccess {
+				c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
+				return
+			}
 			// A single SOA RR signals "no changes"
 			if len(in.Answer) == 1 && isSOAFirst(in) {
 				c <- &Envelope{in.Answer, nil}
@@ -242,3 +251,5 @@ func isSOALast(in *Msg) bool {
 	}
 	return false
 }
+
+const errXFR = "bad xfr rcode: %d"
diff --git a/vendor/github.com/miekg/dns/xfr_test.go b/vendor/github.com/miekg/dns/xfr_test.go
index 1337eec65..a478963a3 100644
--- a/vendor/github.com/miekg/dns/xfr_test.go
+++ b/vendor/github.com/miekg/dns/xfr_test.go
@@ -4,6 +4,7 @@ package dns
 
 import (
 	"net"
+	"strings"
 	"testing"
 	"time"
 )
@@ -16,8 +17,7 @@ func getIP(s string) string {
 	return a[0]
 }
 
-// flaky, need to setup local server and test from
-// that.
+// flaky, need to setup local server and test from that.
 func TestAXFR_Miek(t *testing.T) {
 	// This test runs against a server maintained by Miek
 	if testing.Short() {
@@ -159,3 +159,26 @@ func testAXFRSIDN(t *testing.T, host, alg string) {
 		}
 	}
 }
+
+func TestAXFRFailNotAuth(t *testing.T) {
+	// This tests run against a server maintained by SIDN labs, see:
+	// https://workbench.sidnlabs.nl/
+	if testing.Short() {
+		return
+	}
+	x := new(Transfer)
+
+	m := new(Msg)
+	m.SetAxfr("sidnlabs.nl.")
+	c, err := x.In(m, "yadifa.sidnlabs.nl:53")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for e := range c {
+		if e.Error != nil {
+			if !strings.HasPrefix(e.Error.Error(), "dns: bad xfr rcode:") {
+				t.Fatal(e.Error)
+			}
+		}
+	}
+}