From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Thu, 20 Apr 2017 15:47:52 +0000 (+0200)
Subject: rec: Make sure the received SOA comes from a "." auth
X-Git-Tag: rec-4.1.0-alpha1~133^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F5252%2Fhead;p=thirdparty%2Fpdns.git

rec: Make sure the received SOA comes from a "." auth
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 6d49dbf740..d9d09c1023 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1235,7 +1235,7 @@ bool SyncRes::processRecords(const std::string& prefix, const DNSName& qname, co
         ne.d_auth = rec.d_name;
         harvestNXRecords(lwr.d_records, ne);
         t_sstorage->negcache.add(ne);
-        if(s_rootNXTrust && ne.d_auth.isRoot()) { // We should check if it was forwarded here, see issue #5107
+        if(s_rootNXTrust && ne.d_auth.isRoot() && auth.isRoot()) {
           ne.d_name = ne.d_name.getLastLabel();
           t_sstorage->negcache.add(ne);
         }