fixed validation of root DS

The root DS exists outside of DNS hierarchy, so its NSEC proving non-existence always contains the SOA, as that's the root of DNS and there's nothing above it.

It's reproducible by asking for DS .

assigned to @vcunat

Eww, well, I guess . DS doesn't exist by definition, even without any proof, but this patch might be the easiest approach. The standards imply so many exceptions...

We need a Deckard test for this as well, we are fixing this second time now.

I think that will be easy in Deckard – one authoritative query/reply pair and the same recursor query/reply pair.

mentioned in merge request deckard!107 (merged)

mentioned in commit deckard@2cdd349b

added 9 commits

• dc7dc8c3...71d1dab1 - 8 commits from branch master
• 825da321 - fixed validation of root DS

Compare with previous version

assigned to @pspacek

added 9 commits

• 603cced7...8171aa26 - 7 commits from branch master
• b3785d71 - fixed validation of root DS
• 3c2e9cfe - validate: avoid DNSSEC_NODS for . DS queries

Compare with previous version

merged

mentioned in commit defe4a70

mentioned in commit deckard@9b7c1809