From: Alexander V. Buev <san@zzz.spb.ru>
Date: Tue, 17 Oct 2023 15:35:42 +0000 (+0300)
Subject: fix ipset wrong behavior
X-Git-Tag: release-1.19.0rc1~14^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F955%2Fhead;p=thirdparty%2Funbound.git

fix ipset wrong behavior

  Issue description:

    If local zone directive is assigned as following:

      "local-zone domain.com ipset"

    then any answers for query with names such as
    "anytext1domain.com" or "example2domain.com"
    will be added to ipset.

  This commit fixes this issue.
---

diff --git a/ipset/ipset.c b/ipset/ipset.c
index c61ebc205..af55de8d6 100644
--- a/ipset/ipset.c
+++ b/ipset/ipset.c
@@ -158,10 +158,10 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		qs = NULL;
 		plen = strlen(p->str);
 
-		if (dlen >= plen) {
+		if (dlen == plen || (dlen > plen && dname[dlen - plen - 1] == '.' )) {
 			ds = dname + (dlen - plen);
 		}
-		if (qlen >= plen) {
+		if (qlen == plen || (qlen > plen && qname[qlen - plen - 1] == '.' )) {
 			qs = qname + (qlen - plen);
 		}
 		if ((ds && strncasecmp(p->str, ds, plen) == 0)