[Dnsmasq-discuss] [PATCH] Don't loop when a DS reply carries no proof of non-existence

[Dominik Derigs]

Hi Simon,

DNSSEC together with --rev-server for a private range is currently 
broken on master.

Validating the reverse answer walks the chain of trust down to 
10.in-addr.arpa,
the public resolvers answer that from their local RFC 6303 zone with an
unsigned NXDOMAIN and no NSEC, and dnssec_validate_reply() is left without a
proof of non-existence. It falls back to zone_status(), which for a DS query
asks for the very DS we are resolving, so the frec graph gains a cycle 
and the
query ends as ABANDONED without a log line saying why.

This is a 2.93 regression - 2.91 and 2.92 handle the same config fine, 
my git
bisect landed on cb32170, which dropped the "Empty DS without NSECS -> 
INSECURE"
shortcut. It is also the case 57f0489 meant to cover ("This should just 
work in
all cases now"), and it did in 2.92.

The attached patch restores that shortcut for the self-referential case 
only,
so the CNAME handling from cb32170 stays as it is. Reproducer, with a second
dnsmasq on 127.0.0.1#5454 serving
--ptr-record=99.1.0.10.in-addr.arpa,client.fritz.box:

   dnsmasq -d --port=5453 --no-resolv --bogus-priv --dnssec 
--log-queries=extra \
--trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D 
\
     --rev-server=10.0.1.0/24,127.0.0.1#5454 --server=9.9.9.10

   dig -p 5453 @127.0.0.1 PTR 99.1.0.10.in-addr.arpa

Signed zones still validate, dnssec-failed.org still comes back BOGUS.

Best regards,
DL6ER
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Don-t-loop-when-a-DS-reply-carries-no-proof-of-non-e.patch
Type: text/x-patch
Size: 2590 bytes
Desc: not available
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20260805/f010eb94/attachment.bin>