Problem
While validating DNSSEC chains, Validator::validateChain() verifies the RRSIG(DS) using the “immediate label parent” as the signer zone and stops at the first matching signature/key path. This can produce false bogus results in two real-world situations:
-
Reverse trees / non-immediate zone cuts (notably under ip6.arpa): the DS RRset can be signed by a parent zone that is not equal to the immediate label parent. The actual signer zone is indicated by RRSIG.signname.
-
KSK rollovers: multiple RRSIG(DNSKEY) candidates may validate locally, but only some of them chain to a configured trust anchor via a parent DS. The current logic may fail early and not try other valid candidates.
Changes in the patch
-
Use the actual DS signer zone
For RRSIG(DS) verification, derive the parent zone from RRSIG.signname (normalized) instead of assuming the immediate label parent. Fetch parent DNSKEY for that signer zone and validate the DS signature against it.
-
Try all DS RRSIG candidates
Collect all covering RRSIG(DS) records for the DS RRset and try them until one both:
- verifies the DS RRset signature, and
- successfully validates the parent DNSKEY chain up to a trust anchor.
- Tolerate KSK rollovers in validateChainViaKSK()
Wrap the recursive validateChain() call in try/catch so that if one KSK candidate fails to chain (e.g., published but not yet anchored by DS), the validator proceeds to the next candidate instead of immediately failing.
Why this is correct
-
RRSIG.signname represents the signer’s zone apex and is the correct authority to use for locating the signing DNSKEY set for DS verification.
-
During transitions/rollovers, “first valid signature” is not sufficient; the chain must be validated against a trust anchor, and trying multiple candidates is necessary to avoid false negatives.
Impact
-
Fixes false bogus outcomes for zones where DS is signed by a non-immediate ancestor (common in reverse DNS delegations).
-
Prevents premature failures during KSK rollovers by trying multiple valid candidate signers.
netdns2-dnssec-validator.patch
Problem
While validating DNSSEC chains, Validator::validateChain() verifies the RRSIG(DS) using the “immediate label parent” as the signer zone and stops at the first matching signature/key path. This can produce false bogus results in two real-world situations:
Reverse trees / non-immediate zone cuts (notably under ip6.arpa): the DS RRset can be signed by a parent zone that is not equal to the immediate label parent. The actual signer zone is indicated by RRSIG.signname.
KSK rollovers: multiple RRSIG(DNSKEY) candidates may validate locally, but only some of them chain to a configured trust anchor via a parent DS. The current logic may fail early and not try other valid candidates.
Changes in the patch
Use the actual DS signer zone
For RRSIG(DS) verification, derive the parent zone from RRSIG.signname (normalized) instead of assuming the immediate label parent. Fetch parent DNSKEY for that signer zone and validate the DS signature against it.
Try all DS RRSIG candidates
Collect all covering RRSIG(DS) records for the DS RRset and try them until one both:
Wrap the recursive validateChain() call in try/catch so that if one KSK candidate fails to chain (e.g., published but not yet anchored by DS), the validator proceeds to the next candidate instead of immediately failing.
Why this is correct
RRSIG.signname represents the signer’s zone apex and is the correct authority to use for locating the signing DNSKEY set for DS verification.
During transitions/rollovers, “first valid signature” is not sufficient; the chain must be validated against a trust anchor, and trying multiple candidates is necessary to avoid false negatives.
Impact
Fixes false bogus outcomes for zones where DS is signed by a non-immediate ancestor (common in reverse DNS delegations).
Prevents premature failures during KSK rollovers by trying multiple valid candidate signers.
netdns2-dnssec-validator.patch