From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 2 Jun 2020 15:19:42 +0000 (+0200)
Subject: rec: Refuse DS records received from child zones
X-Git-Tag: rec-4.3.3~3^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=689d95d0b6133a7801fadffb699e76e5b00eacf3;p=thirdparty%2Fpdns.git

rec: Refuse DS records received from child zones

(cherry picked from commit 3b8b3a7760b655d078aed24c42b0c48e1115eb55)
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index cd86a67f9f..5942b81989 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2653,10 +2653,13 @@ RCode::rcodes_ SyncRes::updateCacheFromRecords(unsigned int depth, LWResult& lwr
     }
 
     if(rec.d_name.isPartOf(auth)) {
-      if(rec.d_type == QType::RRSIG) {
+      if (rec.d_type == QType::RRSIG) {
         LOG("RRSIG - separate"<<endl);
       }
-      else if(lwr.d_aabit && lwr.d_rcode==RCode::NoError && rec.d_place==DNSResourceRecord::ANSWER && ((rec.d_type != QType::DNSKEY && rec.d_type != QType::DS) || rec.d_name != auth) && s_delegationOnly.count(auth)) {
+      else if (rec.d_type == QType::DS && rec.d_name == auth) {
+        LOG("NO - DS provided by child zone"<<endl);
+      }
+      else if (lwr.d_aabit && lwr.d_rcode==RCode::NoError && rec.d_place==DNSResourceRecord::ANSWER && ((rec.d_type != QType::DNSKEY && rec.d_type != QType::DS) || rec.d_name != auth) && s_delegationOnly.count(auth)) {
         LOG("NO! Is from delegation-only zone"<<endl);
         s_nodelegated++;
         return RCode::NXDomain;