From: Mark Andrews <marka@isc.org>
Date: Wed, 25 Mar 2020 06:46:26 +0000 (+1100)
Subject: Only look at tsig.error in responses
X-Git-Tag: v9.14.12~3^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=58199e954a67b798a858ddac5380628be4ee2959;p=thirdparty%2Fbind9.git

Only look at tsig.error in responses
---

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index c89d3996328..929de8166e4 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1338,8 +1338,9 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 			goto cleanup_context;
 		}
 		msg->verified_sig = 1;
-	} else if (tsig.error != dns_tsigerror_badsig &&
-		   tsig.error != dns_tsigerror_badkey) {
+	} else if (!response || (tsig.error != dns_tsigerror_badsig &&
+				 tsig.error != dns_tsigerror_badkey))
+	{
 		tsig_log(msg->tsigkey, 2, "signature was empty");
 		return (DNS_R_TSIGVERIFYFAILURE);
 	}
@@ -1388,7 +1389,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		}
 	}
 
-	if (tsig.error != dns_rcode_noerror) {
+	if (response && tsig.error != dns_rcode_noerror) {
 		msg->tsigstatus = tsig.error;
 		if (tsig.error == dns_tsigerror_badtime)
 			ret = DNS_R_CLOCKSKEW;