Re: Recursor 5.4.0: RPZ matches on '.' root query, breaks DNSSEC validation (Indeterminate instead of Bogus)
Otto Moerbeek via Pdns-users <[email protected]> Mon, 20 Apr 2026 11:58:51 +0200
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
T24gTW9uLCBBcHIgMjAsIDIwMjYgYXQgMTE6NDU6MjVBTSArMDIwMCwgT3R0byBNb2VyYmVlayB2 aWEgUGRucy11c2VycyB3cm90ZToKCj4gT24gU3VuLCBBcHIgMTksIDIwMjYgYXQgMTA6NDg6MDlQ TSArMDEwMCwgQ2hyaXMgQnJvdWdoIHZpYSBQZG5zLXVzZXJzIHdyb3RlOgo+IAo+ID4gSGkgYWxs LAo+ID4gIAo+ID4gSSdtIHJ1bm5pbmcgaW50byBiZWhhdmlvdXIgSSBjYW4ndCBleHBsYWluIGFu ZCBJJ2QgYXBwcmVjaWF0ZSBhIHNlY29uZCBwYWlyIG9mIGV5ZXMgYmVmb3JlIEkgYXNzdW1lIGl0 J3MgYSBidWcuIEkgY291bGQgZWFzaWx5IGJlIGRvaW5nIHNvbWV0aGluZyBvYnZpb3VzIGFuZCB3 cm9uZy4KPiA+ICAKPiA+IFNldHVwCj4gPiAgICAgKiBQb3dlckROUyBSZWN1cnNvciA1LjQuMCBp biBEb2NrZXIgKGltYWdlOiBwb3dlcmRucy9wZG5zLXJlY3Vyc29yLTU0OmxhdGVzdCkKPiA+ICAg ICAqIEhvc3Q6IERlYmlhbiAxMyBWTSAoVW1icmVsT1MgLSB1c2luZyB0aGUgUG9ydGFpbmVyIGFw cCB0byBtYW5hZ2UgRG9ja2VyKSwgRG9ja2VyIGhvc3QgbmV0d29yayBtb2RlCj4gPiAgICAgKiBG dWxsIHJlY3Vyc2lvbiwgbm8gZm9yd2FyZGVycwo+ID4gICAgICogYGRuc3NlYy52YWxpZGF0aW9u OiB2YWxpZGF0ZWAsIGJ1aWx0LWluIHJvb3QgdHJ1c3QgYW5jaG9yCj4gPiAgICAgKiBSb290IHpv bmUgbG9hZGVkIHZpYSBgem9uZXRvY2FjaGVzYCBmcm9tIEludGVybmljIChaT05FTUQgdmFsaWRh dGVkIFNlY3VyZSBhdCBzdGFydHVwKQo+ID4gICAgICogNyBSUFogem9uZXMgbG9hZGVkIHZpYSBg cnB6UHJpbWFyeWAgZnJvbSBJUEZpcmUgREJMICh4ZnIuZGJsLmlwZmlyZS5vcmcpIOKAlCBhZHMs IGdhbWJsaW5nLCBtYWx3YXJlLCBwaGlzaGluZywgcGlyYWN5LCBzbWFydC10diwgdmlvbGVuY2Uu IE9wZW4gQVhGUiwgbm8gVFNJRy4KPiA+ICAgICAqIGBleHRlbmRlZF9yZXNvbHV0aW9uX2Vycm9y czogdHJ1ZWAsIHBlci1SUFogYGV4dGVuZGVkRXJyb3JDb2RlOiAxNWAgYW5kIGBleHRlbmRlZEVy cm9yRXh0cmFgIHNldAo+ID4gRnVsbCBZQU1MIGNvbmZpZyBhbmQgZG9ja2VyLWNvbXBvc2UueW1s IGF2YWlsYWJsZSBvbiByZXF1ZXN0Lgo+ID4gIAo+ID4gU3ltcHRvbQo+ID4gRE5TU0VDLWJvZ3Vz IGRvbWFpbnMgcmV0dXJuIE5PRVJST1Igd2l0aCBkYXRhIGluc3RlYWQgb2YgU0VSVkZBSUw6Cj4g PiAgICAgJCBkaWcgQDxob3N0X2lwPiBkbnNzZWMtZmFpbGVkLm9yZyArZG5zc2VjCj4gPiAgICAg OzsgLT4+SEVBREVSPDwtIG9wY29kZTogUVVFUlksIHN0YXR1czogTk9FUlJPUiwgaWQ6IDE4NTE1 Cj4gPiAgICAgOzsgZmxhZ3M6IHFyIHJkIHJhOyBRVUVSWTogMSwgQU5TV0VSOiAyLCBBVVRIT1JJ VFk6IDAsIEFERElUSU9OQUw6IDEKPiA+ICAgICA7OyBBTlNXRVIgU0VDVElPTjoKPiA+ICAgICBk bnNzZWMtZmFpbGVkLm9yZy4gIDIxOCAgSU4gIEEgIDk2Ljk5LjIyNy4yNTUKPiA+ICAgICBkbnNz ZWMtZmFpbGVkLm9yZy4gIDIxOCAgSU4gIFJSU0lHICBBIDEzIDIgMzAwIC4uLgo+ID4gIAo+ID4g Q29uZmlybWVkIHZhbGlkYXRpb24gbW9kZSBpcyBhY3R1YWxseSBsb2FkZWQ6Cj4gPiAgICAgJCBy ZWNfY29udHJvbCBnZXQtcGFyYW1ldGVyIGRuc3NlYwo+ID4gICAgIGRuc3NlYzoKPiA+ICAgICAg IHZhbGlkYXRpb246IHZhbGlkYXRlCj4gPiAgICAgICBkaXNhYmxlZF9hbGdvcml0aG1zOgo+ID4g ICAgICAgLSAnMScKPiA+ICAgICAgIC0gJzMnCj4gPiAgICAgICAtICc1Jwo+ID4gICAgICAgLSAn NicKPiA+ICAgICAgIC0gJzcnCj4gPiAgICAgICAtICcxMicKPiA+ICAgICAgIGxvZ19ib2d1czog dHJ1ZQo+ID4gIAo+ID4gUXVlcnkgbG9nIHNob3dzIGB2YWxpZGF0aW9uU3RhdGU9IkluZGV0ZXJt aW5hdGUiYCBmb3IgdGhlIHF1ZXJ5LCBub3QgQm9ndXMuCj4gPiAgCj4gPiBSb290IGNhdXNlIChh cyBmYXIgYXMgSSBjYW4gdGVsbCkKPiA+IEEgcmVjX2NvbnRyb2wgdHJhY2UtcmVnZXggJ2Ruc3Nl Yy1mYWlsZWQub3JnJyB0cmFjZSBzaG93cyB2YWxpZGF0aW9uIHRyaWVzIHRvIGZldGNoIHRoZSBy b290IEROU0tFWSBhbmQgaGl0cyB0aGUgZmlyc3QgUlBaIGluIHRoZSBjb25maWcgbGlzdDoKPiA+ ICAgICAufEROU0tFWTo6IFJQWiBIaXQ7IFBvbGljeU5hbWU9YWRzLnJwei5pcGZpcmUub3JnOyBU cmlnZ2VyPS47IEhpdD07IFR5cGU9UU5hbWU7IEtpbmQ9TG9jYWwgRGF0YQo+ID4gICAgIC46IFJl dHJpZXZlZCAwIEROU0tleXMsIHN0YXRlIGlzIEluZGV0ZXJtaW5hdGUKPiA+ICAgICBvcmc6IFVw ZGF0aW5nIHZhbGlkYXRpb24gc3RhdGUgd2l0aCBjYWNoZSBjb250ZW50IGZvciBvcmcgdG8gSW5k ZXRlcm1pbmF0ZQo+ID4gICAgIGRuc3NlYy1mYWlsZWQub3JnOiBVcGRhdGluZyB2YWxpZGF0aW9u IHN0YXRlIHdpdGggY2FjaGUgY29udGVudCBmb3IgZG5zc2VjLWZhaWxlZC5vcmcgdG8gSW5kZXRl cm1pbmF0ZQo+ID4gICAgIGRuc3NlYy1mYWlsZWQub3JnOiBWYWxpZGF0aW9uIHN0YXR1cyBpcyBJ bmRldGVybWluYXRlCj4gPiAgCj4gPiBDb25maXJtaW5nIHRoaXMgZnJvbSBhIGNsaWVudDoKPiA+ ICAgICAkIGRpZyBAPGhvc3RfaXA+IC4gTlMKPiA+ICAgICA7OyAtPj5IRUFERVI8PC0gb3Bjb2Rl OiBRVUVSWSwgc3RhdHVzOiBOT0VSUk9SLCBpZDogMTQ3NzYKPiA+ICAgICA7OyBmbGFnczogcXIg cmQgcmE7IFFVRVJZOiAxLCBBTlNXRVI6IDAsIEFVVEhPUklUWTogMCwgQURESVRJT05BTDogMQo+ ID4gICAgIDsgRURFOiAxNSAoQmxvY2tlZCk6IChCbG9ja2VkOiBhZHZlcnRpc2luZykKPiA+ICAg ICA7OyBRVUVTVElPTiBTRUNUSU9OOgo+ID4gICAgIDsuICAgIElOICAgIE5TCj4gPiAgCj4gPiBa ZXJvLWFuc3dlciBOT0VSUk9SIG9uIGAuIE5TYCwgdGFnZ2VkIGJ5IHRoZSBmaXJzdCBSUFouIFRo aXMgaXMgbm90IHNwZWNpZmljIHRvIHRoZSBhZHMgbGlzdCDigJQgSSB0ZXN0ZWQgYnkgcmVtb3Zp bmcgYWRzLnJwei5pcGZpcmUub3JnIGZyb20gY29uZmlnLCBhbmQgd2hpY2hldmVyIFJQWiBtb3Zl ZCBpbnRvIGZpcnN0IHBvc2l0aW9uIHRoZW4gc2hvd3MgdGhlIHNhbWUgYmVoYXZpb3VyIG9uIHJv b3QgcXVlcmllcy4gU28gZXZlcnkgSVBGaXJlIFJQWiBJJ20gbG9hZGluZyBleGhpYml0cyB0aGlz LCB3aGljaCBtYWtlcyBtZSB0aGluayBpdCdzIHNvbWV0aGluZyBhYm91dCB0aGUgd2F5IHRoZXkn cmUgc3RydWN0dXJlZCBvciB0aGUgd2F5IFBETlMgbG9hZHMvZXZhbHVhdGVzIHRoZW0sIHJhdGhl ciB0aGFuIGEgc3BlY2lmaWMgem9uZSBiZWluZyBwb2lzb25lZC4KPiA+ICAKPiA+IFdoYXQgZHVt cC1ycHogc2hvd3M6Cj4gPiAgICAgJCByZWNfY29udHJvbCBkdW1wLXJweiBhZHMucnB6LmlwZmly ZS5vcmcgL3RtcC9hZHMudHh0Cj4gPiAgICAgJCBoZWFkIC01IC90bXAvYWRzLnR4dAo+ID4gICAg IGFkcy5ycHouaXBmaXJlLm9yZy4gSU4gU09BIHByaW1hcnkuZGJsLmlwZmlyZS5vcmcuIGhvc3Rt YXN0ZXIuaXBmaXJlLm9yZy4gMTc3NjYzMDYwNiAzNjAwIDYwMCAzNjAwMDAwIDYwCj4gPiAgICAg c3RiZy5zdGFuYmljYmFuay5jby56dy5hZHMucnB6LmlwZmlyZS5vcmcuIDYwIElOIENOQU1FIC4K PiA+ICAgICBzdGF0cy56cGwuem9uZS5hZHMucnB6LmlwZmlyZS5vcmcuIDYwIElOIENOQU1FIC4K PiA+ICAgICAqLmEudXNlcnNjcmlwdC56b25lLmFkcy5ycHouaXBmaXJlLm9yZy4gNjAgSU4gQ05B TUUgLgo+ID4gICAgIGEudXNlcnNjcmlwdC56b25lLmFkcy5ycHouaXBmaXJlLm9yZy4gNjAgSU4g Q05BTUUgLgo+ID4gIAo+ID4gQXBleCBoYXMgb25seSBTT0EgKE5TIHN0cmlwcGVkKS4gTm90aGlu ZyBpbiB0aGUgZHVtcGVkIHpvbmUgc2hvdWxkIHByb2R1Y2UgYSBgLmAgUU5hbWUgdHJpZ2dlciBh cyBmYXIgYXMgSSBjYW4gcmVhZCBpdCDigJQgYnV0IHRoZSB0cmFjZSBjbGVhcmx5IHNob3dzIG9u ZSBtYXRjaGluZywgd2l0aCBgSGl0PWAgZW1wdHkuCj4gPiAgCj4gPiBUaGUgSVBGaXJlIHNvdXJj ZSB6b25lIGF0IHhmci5kYmwuaXBmaXJlLm9yZyBjb250YWlucyBhdCBpdHMgYXBleDogU09BLCBO UywgYW5kIGFuIGBfaW5mbyBJTiBUWFRgIHJlY29yZCBvbmUgbGFiZWwgYmVsb3cgdGhlIGFwZXgu IE5vdGhpbmcgZWxzZSB1bnVzdWFsIHRoYXQgSSBjYW4gc2VlLgo+ID4gIAo+ID4gUlBaIGNvbmZp ZyAoYWJicmV2aWF0ZWQpCj4gPiAgICAgcmVjdXJzb3I6Cj4gPiAgICAgICBycHpzOgo+ID4gICAg ICAgICAtIG5hbWU6IGFkcy5ycHouaXBmaXJlLm9yZwo+ID4gICAgICAgICAgIGFkZHJlc3Nlczog WyAneGZyLmRibC5pcGZpcmUub3JnOjUzJyBdCj4gPiAgICAgICAgICAgcG9saWN5TmFtZTogYWRz LnJwei5pcGZpcmUub3JnCj4gPiAgICAgICAgICAgZXh0ZW5kZWRFcnJvckNvZGU6IDE1Cj4gPiAg ICAgICAgICAgZXh0ZW5kZWRFcnJvckV4dHJhOiAnQmxvY2tlZDogYWR2ZXJ0aXNpbmcnCj4gPiAg ICAgICAgIC0gbmFtZTogZ2FtYmxpbmcucnB6LmlwZmlyZS5vcmcKPiA+ICAgICAgICAgICBhZGRy ZXNzZXM6IFsgJ3hmci5kYmwuaXBmaXJlLm9yZzo1MycgXQo+ID4gICAgICAgICAgIHBvbGljeU5h bWU6IGdhbWJsaW5nLnJwei5pcGZpcmUub3JnCj4gPiAgICAgICAgICAgZXh0ZW5kZWRFcnJvckNv ZGU6IDE1Cj4gPiAgICAgICAgICAgZXh0ZW5kZWRFcnJvckV4dHJhOiAnQmxvY2tlZDogZ2FtYmxp bmcnCj4gPiAgICAgICAgICMgLi4uIDUgbW9yZSBpbiBzYW1lIHBhdHRlcm4KPiA+ICAgICAgIHN5 c3RlbV9yZXNvbHZlcl90dGw6IDMwMAo+ID4gICAgICAgZXh0ZW5kZWRfcmVzb2x1dGlvbl9lcnJv cnM6IHRydWUKPiA+ICAKPiA+IE5vIGBkZWZwb2xgIGlzIHNldCBvbiBhbnkgem9uZS4KPiA+ICAK PiA+IEFtIEkgY29uZmlndXJpbmcgdGhlc2UgUlBacyB3cm9uZyBpbiBhIHdheSB0aGF0IGNhdXNl cyBgLmAgdG8gbWF0Y2ggYXMgYSBRTmFtZSB0cmlnZ2VyPyBJIGNhbid0IGZpbmQgYW55dGhpbmcg aW4gZG9jcyBvciB0aGUgUkZDIHRoYXQgd291bGQgcG9pbnQgdGhlcmUuCj4gPiAgCj4gPiBIYXBw eSB0byBwcm92aWRlIHRoZSBmdWxsIFlBTUwsIGZ1bGwgdHJhY2UgbG9nLCBmdWxsIHpvbmUgZHVt cCwgb3IgYW55dGhpbmcgZWxzZSB1c2VmdWwuIEkgZGlkbid0IGF0dGFjaCB0aGVtIGhlcmUgdG8g a2VlcCB0aGUgZW1haWwgcmVhZGFibGUuCj4gPiAgCj4gPiBUaGFua3MsCj4gPiBDaHJpcwo+IAo+ IAo+IEkgY2FuIHJlcHJlZHVjZSwgdGhlIGlzc3VlIGlzIGluY2x1c2lvbiBvZiBhIFpPTkVNRCBy ZWNvcmQgb24gdGhlCj4gYXBleDoKPiAKPiBhZHMucnB6LmlwZmlyZS5vcmcuIFpPTkVNRCAxNzc2 NjU3NjA2IDEgMSBlYjVhNmNiMGMzYmYyZDFhYjFmNTRkNzYxNGM4ZWRhNzRjMmJkZmU1YTc0NzQ1 MDZiOWM1YTJiYWE0MWQ5ZTAxODQyZWNhZDdjZjE0YTBhNGQ3Yjc4OWY2N2I2MjllZDUKPiAKPiBX aGljaCBnZXRzIGludGVycHJldGVkIGFzIGN1c3RvbSBkYXRhIGZvciByb290LCBjYXVzaW5nIGFs bCBvdGhlcgo+IHF0eXBlcyB0byByZXR1cm4gTk9EQVRBLiBOUyByZWNvcmRzIGFyZSBza2lwcGVk Cj4gZm9yIHRoYXQgcmVhc29uLCBaT05FTUQgc2hvdWxkIGFzIHdlbGwgKG9yIHZhbGlkYXRlZCBh bmQgdGhlbiBza2lwcGVkKS4KPiAKPiBXb3VsZCBpdCBiZSBwb3NzaWJsZSB0byBpbnN0cnVjdCB5 b3VyIFJQWiBwcm92aWRlciB0byBub3QgaW5jbHVkZQo+IFpPTkVNRCByZWNvcmRzPwo+IAoKQlRX LCB0aGVyZSBhcmUgYWxzbyBzb21lIFRYVCByZWNvcmQgdW5kZXIgdGhlIF9pbmZvLnJwem5hbWUg bmFtZToKCl9pbmZvLmFkcy5ycHouaXBmaXJlLm9yZy4gNjAgICAgSU4gICAgICBUWFQgICAgICJs aWNlbnNlPUNDIEJZLVNBIDQuMCIKX2luZm8uYWRzLnJwei5pcGZpcmUub3JnLiA2MCAgICBJTiAg ICAgIFRYVCAgICAgInRvdGFsLWRvbWFpbnM9MTUwNjM5IgpfaW5mby5hZHMucnB6LmlwZmlyZS5v cmcuIDYwICAgIElOICAgICAgVFhUICAgICAidXBkYXRlZC1hdD0yMDI2LTA0LTIwVDA0OjAwOjA1 LjI5OTg3OSswMDowMCIKX2luZm8uYWRzLnJwei5pcGZpcmUub3JnLiA2MCAgICBJTiAgICAgIFRY VCAgICAgImRlc2NyaXB0aW9uPUJsb2NrcyBkb21haW5zIHVzZWQgZm9yIGFkcywgdHJhY2tpbmcs IGFuCgp3aGljaCBjb3VsZCBsZWFkIHRvIHVuZXhwZWN0ZWQgbWF0Y2hlcyBhcyB3ZWxsLiAgSSBo YXZlIHRvIHRoaW5rIGlmIGl0CmlzIHBvc3NpYmxlIHRvIHNraXAgdGhvc2UgYXMgd2VsbCwgdGhv dWdoIHRoaXMgaXMgZGFuZ2Vyb3VzIHRlcnJpdG9yeSwKYXMgYWZhaWsgd2UgaGF2ZSBubyBkZWZp bmVkIHdheSB0byBkaXN0aW5ndWlzaCBhY3R1YWwgY3VzdG9tIHJlY29yZHMKZnJvbSB0aGVzZSBr aW5kIG9mICJtZXRhIiByZWNvcmRzLgoKCS1PdHRvCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fClBkbnMtdXNlcnMgbWFpbGluZyBsaXN0ClBkbnMtdXNlcnNA bWFpbG1hbi5wb3dlcmRucy5jb20KaHR0cHM6Ly9tYWlsbWFuLnBvd2VyZG5zLmNvbS9tYWlsbWFu L2xpc3RpbmZvL3BkbnMtdXNlcnMK