mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-09 16:52:43 +07:00
DL6ER
f031f5b4b3
A DS query answered with an unsigned NXDOMAIN which contains neither NSEC nor NSEC3 records leaves `dnssec_validate_reply()` without a proof of non-existence, so it falls back to `zone_status()` to find out whether the zone is unsigned. For a DS query, that returns `STAT_NEED_DS` for the very name whose DS we are resolving. The frec dependency graph then contains a cycle, the loop detection in `dnssec_validate()` catches it, and the query ends up `ABANDONED` without any log message explaining why. Treat this self-referential answer as insecure instead. It carries no information either way, and the existing handling of insecure DS replies already makes the right decision about it: unsigned is assumed for RFC-1918 reverse names when `--bogus-priv` is set, and for domains served by a `--server=/domain/...` directive, everything else stays BOGUS. This is what breaks reverse lookups when a private range is delegated with `--rev-server` and DNSSEC is enabled. Validating the answer walks the chain of trust down to `10.in-addr.arpa`, which is above the delegated zone and therefore goes to the public upstream, and the public resolvers serve the RFC 6303 empty reverse zones locally, without any DNSSEC records to prove that they are unsigned. The existing `--bogus-priv` workaround for exactly this behavior was never reached because validation was abandoned first. Signed-off-by: DL6ER <dl6er@dl6er.de>