Re: Recursor 5.4.0: RPZ matches on '.' root query, breaks DNSSEC validation (Indeterminate instead of Bogus)
Otto Moerbeek via Pdns-users <[email protected]> Mon, 20 Apr 2026 11:45:25 +0200
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
T24gU3VuLCBBcHIgMTksIDIwMjYgYXQgMTA6NDg6MDlQTSArMDEwMCwgQ2hyaXMgQnJvdWdoIHZp YSBQZG5zLXVzZXJzIHdyb3RlOgoKPiBIaSBhbGwsCj4gIAo+IEknbSBydW5uaW5nIGludG8gYmVo YXZpb3VyIEkgY2FuJ3QgZXhwbGFpbiBhbmQgSSdkIGFwcHJlY2lhdGUgYSBzZWNvbmQgcGFpciBv ZiBleWVzIGJlZm9yZSBJIGFzc3VtZSBpdCdzIGEgYnVnLiBJIGNvdWxkIGVhc2lseSBiZSBkb2lu ZyBzb21ldGhpbmcgb2J2aW91cyBhbmQgd3JvbmcuCj4gIAo+IFNldHVwCj4gICAgICogUG93ZXJE TlMgUmVjdXJzb3IgNS40LjAgaW4gRG9ja2VyIChpbWFnZTogcG93ZXJkbnMvcGRucy1yZWN1cnNv ci01NDpsYXRlc3QpCj4gICAgICogSG9zdDogRGViaWFuIDEzIFZNIChVbWJyZWxPUyAtIHVzaW5n IHRoZSBQb3J0YWluZXIgYXBwIHRvIG1hbmFnZSBEb2NrZXIpLCBEb2NrZXIgaG9zdCBuZXR3b3Jr IG1vZGUKPiAgICAgKiBGdWxsIHJlY3Vyc2lvbiwgbm8gZm9yd2FyZGVycwo+ICAgICAqIGBkbnNz ZWMudmFsaWRhdGlvbjogdmFsaWRhdGVgLCBidWlsdC1pbiByb290IHRydXN0IGFuY2hvcgo+ICAg ICAqIFJvb3Qgem9uZSBsb2FkZWQgdmlhIGB6b25ldG9jYWNoZXNgIGZyb20gSW50ZXJuaWMgKFpP TkVNRCB2YWxpZGF0ZWQgU2VjdXJlIGF0IHN0YXJ0dXApCj4gICAgICogNyBSUFogem9uZXMgbG9h ZGVkIHZpYSBgcnB6UHJpbWFyeWAgZnJvbSBJUEZpcmUgREJMICh4ZnIuZGJsLmlwZmlyZS5vcmcp IOKAlCBhZHMsIGdhbWJsaW5nLCBtYWx3YXJlLCBwaGlzaGluZywgcGlyYWN5LCBzbWFydC10diwg dmlvbGVuY2UuIE9wZW4gQVhGUiwgbm8gVFNJRy4KPiAgICAgKiBgZXh0ZW5kZWRfcmVzb2x1dGlv bl9lcnJvcnM6IHRydWVgLCBwZXItUlBaIGBleHRlbmRlZEVycm9yQ29kZTogMTVgIGFuZCBgZXh0 ZW5kZWRFcnJvckV4dHJhYCBzZXQKPiBGdWxsIFlBTUwgY29uZmlnIGFuZCBkb2NrZXItY29tcG9z ZS55bWwgYXZhaWxhYmxlIG9uIHJlcXVlc3QuCj4gIAo+IFN5bXB0b20KPiBETlNTRUMtYm9ndXMg ZG9tYWlucyByZXR1cm4gTk9FUlJPUiB3aXRoIGRhdGEgaW5zdGVhZCBvZiBTRVJWRkFJTDoKPiAg ICAgJCBkaWcgQDxob3N0X2lwPiBkbnNzZWMtZmFpbGVkLm9yZyArZG5zc2VjCj4gICAgIDs7IC0+ PkhFQURFUjw8LSBvcGNvZGU6IFFVRVJZLCBzdGF0dXM6IE5PRVJST1IsIGlkOiAxODUxNQo+ICAg ICA7OyBmbGFnczogcXIgcmQgcmE7IFFVRVJZOiAxLCBBTlNXRVI6IDIsIEFVVEhPUklUWTogMCwg QURESVRJT05BTDogMQo+ICAgICA7OyBBTlNXRVIgU0VDVElPTjoKPiAgICAgZG5zc2VjLWZhaWxl ZC5vcmcuICAyMTggIElOICBBICA5Ni45OS4yMjcuMjU1Cj4gICAgIGRuc3NlYy1mYWlsZWQub3Jn LiAgMjE4ICBJTiAgUlJTSUcgIEEgMTMgMiAzMDAgLi4uCj4gIAo+IENvbmZpcm1lZCB2YWxpZGF0 aW9uIG1vZGUgaXMgYWN0dWFsbHkgbG9hZGVkOgo+ICAgICAkIHJlY19jb250cm9sIGdldC1wYXJh bWV0ZXIgZG5zc2VjCj4gICAgIGRuc3NlYzoKPiAgICAgICB2YWxpZGF0aW9uOiB2YWxpZGF0ZQo+ ICAgICAgIGRpc2FibGVkX2FsZ29yaXRobXM6Cj4gICAgICAgLSAnMScKPiAgICAgICAtICczJwo+ ICAgICAgIC0gJzUnCj4gICAgICAgLSAnNicKPiAgICAgICAtICc3Jwo+ICAgICAgIC0gJzEyJwo+ ICAgICAgIGxvZ19ib2d1czogdHJ1ZQo+ICAKPiBRdWVyeSBsb2cgc2hvd3MgYHZhbGlkYXRpb25T dGF0ZT0iSW5kZXRlcm1pbmF0ZSJgIGZvciB0aGUgcXVlcnksIG5vdCBCb2d1cy4KPiAgCj4gUm9v dCBjYXVzZSAoYXMgZmFyIGFzIEkgY2FuIHRlbGwpCj4gQSByZWNfY29udHJvbCB0cmFjZS1yZWdl eCAnZG5zc2VjLWZhaWxlZC5vcmcnIHRyYWNlIHNob3dzIHZhbGlkYXRpb24gdHJpZXMgdG8gZmV0 Y2ggdGhlIHJvb3QgRE5TS0VZIGFuZCBoaXRzIHRoZSBmaXJzdCBSUFogaW4gdGhlIGNvbmZpZyBs aXN0Ogo+ICAgICAufEROU0tFWTo6IFJQWiBIaXQ7IFBvbGljeU5hbWU9YWRzLnJwei5pcGZpcmUu b3JnOyBUcmlnZ2VyPS47IEhpdD07IFR5cGU9UU5hbWU7IEtpbmQ9TG9jYWwgRGF0YQo+ICAgICAu OiBSZXRyaWV2ZWQgMCBETlNLZXlzLCBzdGF0ZSBpcyBJbmRldGVybWluYXRlCj4gICAgIG9yZzog VXBkYXRpbmcgdmFsaWRhdGlvbiBzdGF0ZSB3aXRoIGNhY2hlIGNvbnRlbnQgZm9yIG9yZyB0byBJ bmRldGVybWluYXRlCj4gICAgIGRuc3NlYy1mYWlsZWQub3JnOiBVcGRhdGluZyB2YWxpZGF0aW9u IHN0YXRlIHdpdGggY2FjaGUgY29udGVudCBmb3IgZG5zc2VjLWZhaWxlZC5vcmcgdG8gSW5kZXRl cm1pbmF0ZQo+ICAgICBkbnNzZWMtZmFpbGVkLm9yZzogVmFsaWRhdGlvbiBzdGF0dXMgaXMgSW5k ZXRlcm1pbmF0ZQo+ICAKPiBDb25maXJtaW5nIHRoaXMgZnJvbSBhIGNsaWVudDoKPiAgICAgJCBk aWcgQDxob3N0X2lwPiAuIE5TCj4gICAgIDs7IC0+PkhFQURFUjw8LSBvcGNvZGU6IFFVRVJZLCBz dGF0dXM6IE5PRVJST1IsIGlkOiAxNDc3Ngo+ICAgICA7OyBmbGFnczogcXIgcmQgcmE7IFFVRVJZ OiAxLCBBTlNXRVI6IDAsIEFVVEhPUklUWTogMCwgQURESVRJT05BTDogMQo+ICAgICA7IEVERTog MTUgKEJsb2NrZWQpOiAoQmxvY2tlZDogYWR2ZXJ0aXNpbmcpCj4gICAgIDs7IFFVRVNUSU9OIFNF Q1RJT046Cj4gICAgIDsuICAgIElOICAgIE5TCj4gIAo+IFplcm8tYW5zd2VyIE5PRVJST1Igb24g YC4gTlNgLCB0YWdnZWQgYnkgdGhlIGZpcnN0IFJQWi4gVGhpcyBpcyBub3Qgc3BlY2lmaWMgdG8g dGhlIGFkcyBsaXN0IOKAlCBJIHRlc3RlZCBieSByZW1vdmluZyBhZHMucnB6LmlwZmlyZS5vcmcg ZnJvbSBjb25maWcsIGFuZCB3aGljaGV2ZXIgUlBaIG1vdmVkIGludG8gZmlyc3QgcG9zaXRpb24g dGhlbiBzaG93cyB0aGUgc2FtZSBiZWhhdmlvdXIgb24gcm9vdCBxdWVyaWVzLiBTbyBldmVyeSBJ UEZpcmUgUlBaIEknbSBsb2FkaW5nIGV4aGliaXRzIHRoaXMsIHdoaWNoIG1ha2VzIG1lIHRoaW5r IGl0J3Mgc29tZXRoaW5nIGFib3V0IHRoZSB3YXkgdGhleSdyZSBzdHJ1Y3R1cmVkIG9yIHRoZSB3 YXkgUEROUyBsb2Fkcy9ldmFsdWF0ZXMgdGhlbSwgcmF0aGVyIHRoYW4gYSBzcGVjaWZpYyB6b25l IGJlaW5nIHBvaXNvbmVkLgo+ICAKPiBXaGF0IGR1bXAtcnB6IHNob3dzOgo+ICAgICAkIHJlY19j b250cm9sIGR1bXAtcnB6IGFkcy5ycHouaXBmaXJlLm9yZyAvdG1wL2Fkcy50eHQKPiAgICAgJCBo ZWFkIC01IC90bXAvYWRzLnR4dAo+ICAgICBhZHMucnB6LmlwZmlyZS5vcmcuIElOIFNPQSBwcmlt YXJ5LmRibC5pcGZpcmUub3JnLiBob3N0bWFzdGVyLmlwZmlyZS5vcmcuIDE3NzY2MzA2MDYgMzYw MCA2MDAgMzYwMDAwMCA2MAo+ICAgICBzdGJnLnN0YW5iaWNiYW5rLmNvLnp3LmFkcy5ycHouaXBm aXJlLm9yZy4gNjAgSU4gQ05BTUUgLgo+ICAgICBzdGF0cy56cGwuem9uZS5hZHMucnB6LmlwZmly ZS5vcmcuIDYwIElOIENOQU1FIC4KPiAgICAgKi5hLnVzZXJzY3JpcHQuem9uZS5hZHMucnB6Lmlw ZmlyZS5vcmcuIDYwIElOIENOQU1FIC4KPiAgICAgYS51c2Vyc2NyaXB0LnpvbmUuYWRzLnJwei5p cGZpcmUub3JnLiA2MCBJTiBDTkFNRSAuCj4gIAo+IEFwZXggaGFzIG9ubHkgU09BIChOUyBzdHJp cHBlZCkuIE5vdGhpbmcgaW4gdGhlIGR1bXBlZCB6b25lIHNob3VsZCBwcm9kdWNlIGEgYC5gIFFO YW1lIHRyaWdnZXIgYXMgZmFyIGFzIEkgY2FuIHJlYWQgaXQg4oCUIGJ1dCB0aGUgdHJhY2UgY2xl YXJseSBzaG93cyBvbmUgbWF0Y2hpbmcsIHdpdGggYEhpdD1gIGVtcHR5Lgo+ICAKPiBUaGUgSVBG aXJlIHNvdXJjZSB6b25lIGF0IHhmci5kYmwuaXBmaXJlLm9yZyBjb250YWlucyBhdCBpdHMgYXBl eDogU09BLCBOUywgYW5kIGFuIGBfaW5mbyBJTiBUWFRgIHJlY29yZCBvbmUgbGFiZWwgYmVsb3cg dGhlIGFwZXguIE5vdGhpbmcgZWxzZSB1bnVzdWFsIHRoYXQgSSBjYW4gc2VlLgo+ICAKPiBSUFog Y29uZmlnIChhYmJyZXZpYXRlZCkKPiAgICAgcmVjdXJzb3I6Cj4gICAgICAgcnB6czoKPiAgICAg ICAgIC0gbmFtZTogYWRzLnJwei5pcGZpcmUub3JnCj4gICAgICAgICAgIGFkZHJlc3NlczogWyAn eGZyLmRibC5pcGZpcmUub3JnOjUzJyBdCj4gICAgICAgICAgIHBvbGljeU5hbWU6IGFkcy5ycHou aXBmaXJlLm9yZwo+ICAgICAgICAgICBleHRlbmRlZEVycm9yQ29kZTogMTUKPiAgICAgICAgICAg ZXh0ZW5kZWRFcnJvckV4dHJhOiAnQmxvY2tlZDogYWR2ZXJ0aXNpbmcnCj4gICAgICAgICAtIG5h bWU6IGdhbWJsaW5nLnJwei5pcGZpcmUub3JnCj4gICAgICAgICAgIGFkZHJlc3NlczogWyAneGZy LmRibC5pcGZpcmUub3JnOjUzJyBdCj4gICAgICAgICAgIHBvbGljeU5hbWU6IGdhbWJsaW5nLnJw ei5pcGZpcmUub3JnCj4gICAgICAgICAgIGV4dGVuZGVkRXJyb3JDb2RlOiAxNQo+ICAgICAgICAg ICBleHRlbmRlZEVycm9yRXh0cmE6ICdCbG9ja2VkOiBnYW1ibGluZycKPiAgICAgICAgICMgLi4u IDUgbW9yZSBpbiBzYW1lIHBhdHRlcm4KPiAgICAgICBzeXN0ZW1fcmVzb2x2ZXJfdHRsOiAzMDAK PiAgICAgICBleHRlbmRlZF9yZXNvbHV0aW9uX2Vycm9yczogdHJ1ZQo+ICAKPiBObyBgZGVmcG9s YCBpcyBzZXQgb24gYW55IHpvbmUuCj4gIAo+IEFtIEkgY29uZmlndXJpbmcgdGhlc2UgUlBacyB3 cm9uZyBpbiBhIHdheSB0aGF0IGNhdXNlcyBgLmAgdG8gbWF0Y2ggYXMgYSBRTmFtZSB0cmlnZ2Vy PyBJIGNhbid0IGZpbmQgYW55dGhpbmcgaW4gZG9jcyBvciB0aGUgUkZDIHRoYXQgd291bGQgcG9p bnQgdGhlcmUuCj4gIAo+IEhhcHB5IHRvIHByb3ZpZGUgdGhlIGZ1bGwgWUFNTCwgZnVsbCB0cmFj ZSBsb2csIGZ1bGwgem9uZSBkdW1wLCBvciBhbnl0aGluZyBlbHNlIHVzZWZ1bC4gSSBkaWRuJ3Qg YXR0YWNoIHRoZW0gaGVyZSB0byBrZWVwIHRoZSBlbWFpbCByZWFkYWJsZS4KPiAgCj4gVGhhbmtz LAo+IENocmlzCgoKSSBjYW4gcmVwcmVkdWNlLCB0aGUgaXNzdWUgaXMgaW5jbHVzaW9uIG9mIGEg Wk9ORU1EIHJlY29yZCBvbiB0aGUKYXBleDoKCmFkcy5ycHouaXBmaXJlLm9yZy4gWk9ORU1EIDE3 NzY2NTc2MDYgMSAxIGViNWE2Y2IwYzNiZjJkMWFiMWY1NGQ3NjE0YzhlZGE3NGMyYmRmZTVhNzQ3 NDUwNmI5YzVhMmJhYTQxZDllMDE4NDJlY2FkN2NmMTRhMGE0ZDdiNzg5ZjY3YjYyOWVkNQoKV2hp Y2ggZ2V0cyBpbnRlcnByZXRlZCBhcyBjdXN0b20gZGF0YSBmb3Igcm9vdCwgY2F1c2luZyBhbGwg b3RoZXIKcXR5cGVzIHRvIHJldHVybiBOT0RBVEEuIE5TIHJlY29yZHMgYXJlIHNraXBwZWQKZm9y IHRoYXQgcmVhc29uLCBaT05FTUQgc2hvdWxkIGFzIHdlbGwgKG9yIHZhbGlkYXRlZCBhbmQgdGhl biBza2lwcGVkKS4KCldvdWxkIGl0IGJlIHBvc3NpYmxlIHRvIGluc3RydWN0IHlvdXIgUlBaIHBy b3ZpZGVyIHRvIG5vdCBpbmNsdWRlClpPTkVNRCByZWNvcmRzPwoKCS1PdHRvCgoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KUGRucy11c2VycyBtYWlsaW5n IGxpc3QKUGRucy11c2Vyc0BtYWlsbWFuLnBvd2VyZG5zLmNvbQpodHRwczovL21haWxtYW4ucG93 ZXJkbnMuY29tL21haWxtYW4vbGlzdGluZm8vcGRucy11c2Vycwo=