For EXTEND operations, perform the RRSet check once computed.

The check was performed only on the record to add, and checkRRSet can't do
anything when passed a single record...

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 6ed1ecb6b6ed6ed5286a92ec35ca6e32c59d970e..fc00b560c7f8005f0e1aaaae54a93265ebf0849f 100644 (file)
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -2606,15 +2606,6 @@ static applyResult applyPruneOrExtend(const DomainInfo& domainInfo, const ZoneNa
       soa.edit_done = increaseSOARecord(new_record, soa.edit_api_kind, soa.edit_kind, zonename);
     }
 
-    Check::RRSetFlags flags{Check::RRSET_CHECK_TTL};
-    if (allowUnderscores) {
-      flags = static_cast<Check::RRSetFlags>(flags | Check::RRSET_ALLOW_UNDERSCORES);
-    }
-    if (!checkNewRecords(resp, new_records, zonename, flags)) {
-      // Proper error response has been set up, no need to do anything further.
-      return ABORT;
-    }
-
     // Check if this record exists in the RRSet
     bool seenRecord{false};
     for (auto iter = rrset.begin(); iter != rrset.end(); ++iter) {
@@ -2637,6 +2628,17 @@ static applyResult applyPruneOrExtend(const DomainInfo& domainInfo, const ZoneNa
     if (!submitChanges) {
       return NOP;
     }
+
+    // Check the updated RRSet for correctness
+    Check::RRSetFlags flags{Check::RRSET_CHECK_TTL};
+    if (allowUnderscores) {
+      flags = static_cast<Check::RRSetFlags>(flags | Check::RRSET_ALLOW_UNDERSCORES);
+    }
+    if (!checkNewRecords(resp, rrset, zonename, flags)) {
+      // Proper error response has been set up, no need to do anything further.
+      return ABORT;
+    }
+
     if (!domainInfo.backend->replaceRRSet(domainInfo.id, qname, qtype, rrset)) {
       throw ApiException("Hosting backend does not support editing records.");
     }