rec: do not use DNSKEYs found below an apex for validation

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 4c34384137d08f433e2db5a803070f024a98148e..bf5b439e180d349ecd95f8ae4bf3e5f33292a92a 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -3269,7 +3269,7 @@ RCode::rcodes_ SyncRes::updateCacheFromRecords(unsigned int depth, LWResult& lwr
       LOG(d_prefix<<": got initial zone status "<<initialState<<" for record "<<i->first.name<<"|"<<DNSRecordContent::NumberToType(i->first.type)<<endl);
 
       if (initialState == vState::Secure) {
-        if (i->first.type == QType::DNSKEY && i->first.place == DNSResourceRecord::ANSWER) {
+        if (i->first.type == QType::DNSKEY && i->first.place == DNSResourceRecord::ANSWER && i->first.name == getSigner(i->second.signatures)) {
           LOG(d_prefix<<"Validating DNSKEY for "<<i->first.name<<endl);
           recordState = validateDNSKeys(i->first.name, i->second.records, i->second.signatures, depth);
         }

diff --git a/regression-tests.recursor-dnssec/recursortests.py b/regression-tests.recursor-dnssec/recursortests.py
index 2f895c2ff38e561fd5ac65fa423aab80e97cf14b..8ab62558bceb55645acddd08b5460935e5901939 100644 (file)
--- a/regression-tests.recursor-dnssec/recursortests.py
+++ b/regression-tests.recursor-dnssec/recursortests.py
@@ -181,6 +181,8 @@ cname-to-formerr.secure.example. 3600 IN CNAME host1.insecure-formerr.example.
 dname-secure.secure.example. 3600 IN DNAME dname-secure.example.
 dname-insecure.secure.example. 3600 IN DNAME insecure.example.
 dname-bogus.secure.example. 3600 IN DNAME bogus.example.
+
+non-apex-dnskey.secure.example. 3600 IN DNSKEY 257 3 13 CT6AJ4MEOtNDgj0+xLtTLGHf1WbLsKWZI8ONHOt/6q7hTjeWSnY/SGig1dIKZrHg+pJFUSPaxeShv48SYVRKEg==
         """,
         'dname-secure.example': """
 dname-secure.example. 3600 IN SOA {soa}

diff --git a/regression-tests.recursor-dnssec/test_Interop.py b/regression-tests.recursor-dnssec/test_Interop.py
index 44c172d19f2d21a686e5ef661f9a14f9ea7e3614..799633eac9c66e7dac936b7a0e8bc85b63704c64 100644 (file)
--- a/regression-tests.recursor-dnssec/test_Interop.py
+++ b/regression-tests.recursor-dnssec/test_Interop.py
@@ -121,6 +121,23 @@ forward-zones+=undelegated.insecure.example=%s.12
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
         self.assertMessageHasFlags(res, ['QR', 'RD', 'RA', 'AD'], [])
 
+
+    def testNonApexDNSKEY(self):
+        """
+        a DNSKEY not at the apex of a zone should not be treated as a DNSKEY in validation
+        """
+        query = dns.message.make_query('non-apex-dnskey.secure.example.', 'DNSKEY')
+        query.flags |= dns.flags.AD
+
+        res = self.sendUDPQuery(query)
+        print(res)
+        expectedDNSKEY = dns.rrset.from_text('non-apex-dnskey.secure.example.', 0, dns.rdataclass.IN, 'DNSKEY', '257 3 13 CT6AJ4MEOtNDgj0+xLtTLGHf1WbLsKWZI8ONHOt/6q7hTjeWSnY/SGig1dIKZrHg+pJFUSPaxeShv48SYVRKEg==')
+
+        self.assertRRsetInAnswer(res, expectedDNSKEY)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+        self.assertMessageHasFlags(res, ['QR', 'RD', 'RA', 'AD'], [])
+
+
     @classmethod
     def startResponders(cls):
         print("Launching responders..")