From ae727ae2b1b74a113175e58b5c5bcbc42d242cf1 Mon Sep 17 00:00:00 2001
From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 13 Jul 2021 18:29:50 +0200
Subject: [PATCH] rec: The root denies its own DS with a NSEC(3)s from the
 child zone

---
 pdns/recursordist/aggressive_nsec.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pdns/recursordist/aggressive_nsec.cc b/pdns/recursordist/aggressive_nsec.cc
index d6b72d81f4..6260c45cd2 100644
--- a/pdns/recursordist/aggressive_nsec.cc
+++ b/pdns/recursordist/aggressive_nsec.cc
@@ -558,7 +558,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
       return false;
     }
 
-    if (type == QType::DS && signer == name) {
+    if (type == QType::DS && !name.isRoot() && signer == name) {
       LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }
@@ -601,7 +601,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
         break;
       }
 
-      if (type == QType::DS && signer == name) {
+      if (type == QType::DS && !name.isRoot() && signer == name) {
         LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
         return false;
       }
@@ -645,7 +645,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
   }
 
   const DNSName nextCloserSigner = getSigner(nextCloserEntry.d_signatures);
-  if (type == QType::DS && nextCloserSigner == name) {
+  if (type == QType::DS && !name.isRoot() && nextCloserSigner == name) {
     LOG(" but this NSEC3 comes from the child zone and cannot be used to deny a DS");
     return false;
   }
@@ -685,7 +685,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
       return false;
     }
 
-    if (type == QType::DS && wcSigner == name) {
+    if (type == QType::DS && !name.isRoot() && wcSigner == name) {
       LOG(" but this wildcard NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }
@@ -711,7 +711,7 @@ bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr<AggressiveN
     }
 
     const DNSName wcSigner = getSigner(wcEntry.d_signatures);
-    if (type == QType::DS && wcSigner == name) {
+    if (type == QType::DS && !name.isRoot() && wcSigner == name) {
       LOG(" but this wildcard NSEC3 comes from the child zone and cannot be used to deny a DS");
       return false;
     }
-- 
2.47.2