- Fix #596: only unset RA when NXDOMAIN is signalled.

diff --git a/doc/Changelog b/doc/Changelog
index 5b8eb1658a9a14118d9f3fa55ea7930c8ba5e804..c843a3f06239f4b7276b4737a7b2cae05f9336ea 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -4,6 +4,7 @@
          signal that a domain is externally blocked to clients when it
          is blocked with NXDOMAIN by unsetting RA.
        - Fix to add test for rpz-signal-nxdomain-ra.
+       - Fix #596: only unset RA when NXDOMAIN is signalled.
 
 22 December 2021: George
        - contrib/aaaa-filter-iterator.patch file renewed diff content to

diff --git a/services/rpz.c b/services/rpz.c
index cb05b830c4a95eb48682354e0e8afa8817a77a85..383440a233c141b7e711f7f439affe51ded23e06 100644 (file)
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -1927,7 +1927,8 @@ rpz_synthesize_qname_localdata(struct module_env* env, struct rpz* r,
 
        ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
                0 /* no local data used */, lzt);
-       if(r->signal_nxdomain_ra)
+       if(r->signal_nxdomain_ra && LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
+               == LDNS_RCODE_NXDOMAIN)
                LDNS_RA_CLR(sldns_buffer_begin(buf));
        if(r->log) {
                log_rpz_apply("qname", z->name, NULL, localzone_type_to_rpz_action(lzt),