From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 13 Jul 2021 16:29:50 +0000 (+0200)
Subject: rec: The root denies its own DS with a NSEC(3)s from the child zone
X-Git-Tag: dnsdist-1.7.0-alpha1~83^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae727ae2b1b74a113175e58b5c5bcbc42d242cf1;p=thirdparty%2Fpdns.git

rec: The root denies its own DS with a NSEC(3)s from the child zone
---

diff --git a/pdns/recursordist/aggressive_nsec.cc b/pdns/recursordist/aggressive_nsec.cc
index d6b72d81f4..6260c45cd2 100644
--- a/pdns/recursordist/aggressive_nsec.cc
+++ b/pdns/recursordist/aggressive_nsec.cc
@@ -558,7 +558,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
       return false;
     }
 
-    if (type == QType::DS && signer == name) {
+    if (type == QType::DS && !name.isRoot() && signer == name) {
       LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }
@@ -601,7 +601,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
         break;
       }
 
-      if (type == QType::DS && signer == name) {
+      if (type == QType::DS && !name.isRoot() && signer == name) {
         LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
         return false;
       }
@@ -645,7 +645,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
   }
 
   const DNSName nextCloserSigner = getSigner(nextCloserEntry.d_signatures);
-  if (type == QType::DS && nextCloserSigner == name) {
+  if (type == QType::DS && !name.isRoot() && nextCloserSigner == name) {
     LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
     return false;
   }
@@ -685,7 +685,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
       return false;
     }
 
-    if (type == QType::DS && wcSigner == name) {
+    if (type == QType::DS && !name.isRoot() && wcSigner == name) {
       LOG(" but this wildcard NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }
@@ -711,7 +711,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
     }
 
     const DNSName wcSigner = getSigner(wcEntry.d_signatures);
-    if (type == QType::DS && wcSigner == name) {
+    if (type == QType::DS && !name.isRoot() && wcSigner == name) {
       LOG(" but this wildcard NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }