From: Mark Andrews <marka@isc.org>
Date: Mon, 10 Aug 2026 04:37:50 +0000 (+1000)
Subject: dns_ssu_external_match was called with an address for UDP
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b0d5b9231b1707c2e8204665f7eae8d2c3b243f2;p=thirdparty%2Fbind9.git

dns_ssu_external_match was called with an address for UDP

Addresses are only supposed to be passed to dns_ssu_external_match
when the connection comes from TCP or another mechanism which verifies
the source address.  This has been fixed.
---

diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index 321fdacaab0..4a9c1dc59ae 100644
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -893,8 +893,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			break;
 		case dns_ssumatchtype_external:
 			if (!dns_ssu_external_match(rule->identity, signer,
-						    name, addr, type, key,
-						    table->mctx))
+						    name, tcp ? addr : NULL,
+						    type, key, table->mctx))
 			{
 				if (logit) {
 					isc_log_write(