From: Miod Vallat <miod.vallat@powerdns.com>
Date: Wed, 21 Jan 2026 14:13:55 +0000 (+0100)
Subject: For EXTEND operations, perform the RRSet check once computed.
X-Git-Tag: rec-5.4.0-beta1~17^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb97b64bf6293bcb3dc94f6750d0a42044e0f1a6;p=thirdparty%2Fpdns.git

For EXTEND operations, perform the RRSet check once computed.

The check was performed only on the record to add, and checkRRSet can't do
anything when passed a single record...

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 6ed1ecb6b6..fc00b560c7 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -2606,15 +2606,6 @@ static applyResult applyPruneOrExtend(const DomainInfo& domainInfo, const ZoneNa
       soa.edit_done = increaseSOARecord(new_record, soa.edit_api_kind, soa.edit_kind, zonename);
     }
 
-    Check::RRSetFlags flags{Check::RRSET_CHECK_TTL};
-    if (allowUnderscores) {
-      flags = static_cast<Check::RRSetFlags>(flags | Check::RRSET_ALLOW_UNDERSCORES);
-    }
-    if (!checkNewRecords(resp, new_records, zonename, flags)) {
-      // Proper error response has been set up, no need to do anything further.
-      return ABORT;
-    }
-
     // Check if this record exists in the RRSet
     bool seenRecord{false};
     for (auto iter = rrset.begin(); iter != rrset.end(); ++iter) {
@@ -2637,6 +2628,17 @@ static applyResult applyPruneOrExtend(const DomainInfo& domainInfo, const ZoneNa
     if (!submitChanges) {
       return NOP;
     }
+
+    // Check the updated RRSet for correctness
+    Check::RRSetFlags flags{Check::RRSET_CHECK_TTL};
+    if (allowUnderscores) {
+      flags = static_cast<Check::RRSetFlags>(flags | Check::RRSET_ALLOW_UNDERSCORES);
+    }
+    if (!checkNewRecords(resp, rrset, zonename, flags)) {
+      // Proper error response has been set up, no need to do anything further.
+      return ABORT;
+    }
+
     if (!domainInfo.backend->replaceRRSet(domainInfo.id, qname, qtype, rrset)) {
       throw ApiException("Hosting backend does not support editing records.");
     }