- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.

git-svn-id: file:///svn/unbound/trunk@4322 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index bdd70102a10040d882933544764f7b0ab275a42f..e4c32367917e4d692c1548f5157dc6146f89597c 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,6 @@
 30 August 2017: Wouter
        - updated contrib/fastrpz.patch to apply with configparser changes.
+       - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
 
 29 August 2017: Wouter
        - Fix #1414: fix segfault on parse failure and log_replies.

diff --git a/validator/val_utils.c b/validator/val_utils.c
index e4eff1b2523b9677496749de7a2dc9a6070435ea..973473f9dc85e3aa854fdf0852dccb041eb9a5c4 100644 (file)
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -932,17 +932,24 @@ val_check_nonsecure(struct module_env* env, struct reply_info* rep)
                         * Therefore the message is bogus.
                         */
 
-                       /* check if authority consists of only an NS record
+                       /* check if authority has an NS record
                         * which is bad, and there is an answer section with
                         * data.  In that case, delete NS and additional to 
                         * be lenient and make a minimal response */
-                       if(rep->an_numrrsets != 0 && rep->ns_numrrsets == 1 &&
+                       if(rep->an_numrrsets != 0 &&
                                ntohs(rep->rrsets[i]->rk.type) 
                                == LDNS_RR_TYPE_NS) {
                                verbose(VERB_ALGO, "truncate to minimal");
-                               rep->ns_numrrsets = 0;
                                rep->ar_numrrsets = 0;
-                               rep->rrset_count = rep->an_numrrsets;
+                               rep->rrset_count = rep->an_numrrsets +
+                                       rep->ns_numrrsets;
+                               /* remove this unneeded authority rrset */
+                               memmove(rep->rrsets+i, rep->rrsets+i+1, 
+                                       sizeof(struct ub_packed_rrset_key*)*
+                                       (rep->rrset_count - i - 1));
+                               rep->ns_numrrsets--;
+                               rep->rrset_count--;
+                               i--;
                                return;
                        }