From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Fri, 5 Mar 2021 16:18:09 +0000 (+0100)
Subject: rec: We can't validate a record signed by a DNSKEY we are retrieving
X-Git-Tag: rec-4.5.0-beta1~4^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d886c01d8d7b749b655c6057b8d2863e059f637;p=thirdparty%2Fpdns.git

rec: We can't validate a record signed by a DNSKEY we are retrieving
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 3694571d89..ef093d0a27 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2752,6 +2752,12 @@ vState SyncRes::validateRecordsWithSigs(unsigned int depth, const DNSName& qname
           LOG(d_prefix<<"The DS for "<<qname<<" is signed by itself, going Bogus"<<endl);
           return vState::BogusSelfSignedDS;
         }
+        if (qtype == QType::DNSKEY && signer == qname) {
+          /* that actually does happen when a server returns NS records in authority
+             along with the DNSKEY, leading us to trying to validate the RRSIGs for
+             the NS with the DNSKEY that we are about to process. */
+          return vState::Indeterminate;
+        }
       }
       vState state = getDNSKeys(signer, keys, depth);
       if (state != vState::Secure) {