From: Alessio Podda <alessio@isc.org>
Date: Tue, 25 Feb 2025 10:29:00 +0000 (+0000)
Subject: chg: usr: Drop malformed notify messages early instead of decompressing them
X-Git-Tag: ondrej/lock-free-qpzone-reads-v1~32
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7fce7707db6b7f15c48b6e208ae5f49a5516f7f6;p=thirdparty%2Fbind9.git

chg: usr: Drop malformed notify messages early instead of decompressing them

The DNS header shows if a message has multiple questions or invalid
NOTIFY sections. We can drop these messages early, right after parsing
the question. This matches RFC 9619 for multi-question messages and
Unbound's handling of NOTIFY. We still parse the question to include it in
our FORMERR response.

Add drop_msg_early() function to check for these conditions:
- Messages with more than one question, as required by RFC 9619
- NOTIFY query messages containing answer sections (like Unbound)
- NOTIFY messages containing authority sections (like Unbound)

Closes #5158, #3656

Merge branch '5158-early-formerr-on-bad-notify-or-bad-qdcount' into 'main'

See merge request isc-projects/bind9!10056
---

7fce7707db6b7f15c48b6e208ae5f49a5516f7f6