From: Evan Hunt <each@isc.org>
Date: Tue, 17 Mar 2026 20:24:43 +0000 (-0700)
Subject: Skip "deny-answer-address" for non-IN addresses
X-Git-Tag: v9.21.22~5^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=787b9bc45097b59812b0128cf6172d70105d9d18;p=thirdparty%2Fbind9.git

Skip "deny-answer-address" for non-IN addresses

Ensure that we don't attempt an ACL match for answer addresses
when handling a class-CHAOS zone. This is an additional line of
defense for YWH-PGM40640-74.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 50f88209ddd..74104312847 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6825,6 +6825,13 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 		return true;
 	}
 
+	/*
+	 * deny-answer-address doesn't apply to non-IN classes.
+	 */
+	if (rdataset->rdclass != dns_rdataclass_in) {
+		return true;
+	}
+
 	/*
 	 * Otherwise, search the filter list for a match for each
 	 * address record.  If a match is found, the address should be