From: Evan Hunt <each@isc.org>
Date: Sat, 1 Mar 2025 23:40:07 +0000 (-0800)
Subject: set ANSWERSIG flag when processing ANY responses
X-Git-Tag: v9.21.11~6^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b940d40635aff79ab176b988c9b0a0c945ecff75;p=thirdparty%2Fbind9.git

set ANSWERSIG flag when processing ANY responses

previously, rctx_answer_any() set the ANSWER flag for all
rdatasets in the answer section; it now sets ANSWERSIG for
RRSIG/SIG rdatasets and ANSWER for everything else.  this
error didn't cause any harm in the current code, but it
could have led to unexpected behavior in the future.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index cd44a0dbdf9..c5658007235 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -8416,7 +8416,11 @@ rctx_answer_any(respctx_t *rctx) {
 
 		rctx->aname->attributes.cache = true;
 		rctx->aname->attributes.answer = true;
-		rdataset->attributes.answer = true;
+		if (dns_rdatatype_issig(rdataset->type)) {
+			rdataset->attributes.answersig = true;
+		} else {
+			rdataset->attributes.answer = true;
+		}
 		rdataset->attributes.cache = true;
 		rdataset->trust = rctx->trust;
 	}