3396. [bug] OPT records were incorrectly removed from signed,

                        truncated responses. [RT #31439]

diff --git a/CHANGES b/CHANGES
index f6d4adff08b85ec441518073f5ce8df5e29e7567..c8d52260f81bf7e8b5b2e5f3321eaaad7f710ad5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3396.  [bug]           OPT records were incorrectly removed from signed,
+                       truncated responses. [RT #31439]
+
 3395.  [protocol]      Add RFC 6598 reverse zones to built in empty zones
                        list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA.
                        [RT #31336]

diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
index eaae896cfd50011dd9b007d909e79d1011971cfd..0e98b4047b8766b1c1d1a70f230db5d79118c55b 100644 (file)
--- a/bin/tests/system/tsig/clean.sh
+++ b/bin/tests/system/tsig/clean.sh
@@ -22,3 +22,4 @@
 
 rm -f dig.out.*
 rm -f */named.memstats
+rm -f */named.run

diff --git a/bin/tests/system/tsig/ns1/example.db b/bin/tests/system/tsig/ns1/example.db
index a9a0ec885aa5abdd363a594c5e64bfa05fbdd546..3151b721db19779dd1dc4c9430e7d6c5a1a7a4fe 100644 (file)
--- a/bin/tests/system/tsig/ns1/example.db
+++ b/bin/tests/system/tsig/ns1/example.db
@@ -149,3 +149,20 @@ wks01                      WKS     10.0.0.1 6 ( 0 1 2 21 23 )
 wks02                  WKS     10.0.0.1 17 ( 0 1 2 53 )
 wks03                  WKS     10.0.0.2 6 ( 65535 )
 x2501                  X25     "123456789"
+large                  TXT     ( 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890
+                                 1234567890 1234567890 1234567890 1234567890 )

diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
index ff53509422118ece6371c59f13dcafc468d8f273..50ac8d23e6b63d35457c0d01cdb03e4b00a68225 100644 (file)
--- a/bin/tests/system/tsig/tests.sh
+++ b/bin/tests/system/tsig/tests.sh
@@ -222,6 +222,17 @@ if [ $ret -eq 1 ] ; then
        echo "I: failed"; status=1
 fi
 
+echo "I:checking both OPT and TSIG records are returned when TC=1"
+ret=0
+$DIG +ignore +bufsize=512 large.example.nil \
+       -y "hmac-sha1:sha1:$sha1" @10.53.0.1 txt -p 5300 > dig.out.large 2>&1 || ret=1
+grep "flags:.* tc[ ;]" dig.out.large > /dev/null || ret=1
+grep "status: NOERROR" dig.out.large > /dev/null || ret=1
+grep "EDNS:" dig.out.large > /dev/null || ret=1
+grep -i "sha1.*TSIG.*NOERROR" dig.out.sha1 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+       echo "I: failed"; status=1
+fi
 exit $status
 
 

diff --git a/lib/dns/message.c b/lib/dns/message.c
index cb72afeefb1a08614dfb60aac5f24df33f1ffbc6..6fc3a27d07175e7e20cf3fce562db636173dd814 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -2111,6 +2111,30 @@ dns_message_renderend(dns_message_t *msg) {
                return (DNS_R_FORMERR);
        }
 
+       /*
+        * If we're adding a OPT, TSIG or SIG(0) to a truncated message,
+        * clear all rdatasets from the message except for the question
+        * before adding the OPT, TSIG or SIG(0).  If the question doesn't
+         * fit, don't include it.
+        */
+       if ((msg->tsigkey != NULL || msg->sig0key != NULL || msg->opt) &&
+           (msg->flags & DNS_MESSAGEFLAG_TC) != 0)
+       {
+               isc_buffer_t *buf;
+
+               msgresetnames(msg, DNS_SECTION_ANSWER);
+               buf = msg->buffer;
+               dns_message_renderreset(msg);
+               msg->buffer = buf;
+               isc_buffer_clear(msg->buffer);
+               isc_buffer_add(msg->buffer, DNS_MESSAGE_HEADERLEN);
+               dns_compress_rollback(msg->cctx, 0);
+               result = dns_message_rendersection(msg, DNS_SECTION_QUESTION,
+                                                  0);
+               if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
+                       return (result);
+       }
+
        /*
         * If we've got an OPT record, render it.
         */
@@ -2135,30 +2159,6 @@ dns_message_renderend(dns_message_t *msg) {
                        return (result);
        }
 
-       /*
-        * If we're adding a TSIG or SIG(0) to a truncated message,
-        * clear all rdatasets from the message except for the question
-        * before adding the TSIG or SIG(0).  If the question doesn't fit,
-        * don't include it.
-        */
-       if ((msg->tsigkey != NULL || msg->sig0key != NULL) &&
-           (msg->flags & DNS_MESSAGEFLAG_TC) != 0)
-       {
-               isc_buffer_t *buf;
-
-               msgresetnames(msg, DNS_SECTION_ANSWER);
-               buf = msg->buffer;
-               dns_message_renderreset(msg);
-               msg->buffer = buf;
-               isc_buffer_clear(msg->buffer);
-               isc_buffer_add(msg->buffer, DNS_MESSAGE_HEADERLEN);
-               dns_compress_rollback(msg->cctx, 0);
-               result = dns_message_rendersection(msg, DNS_SECTION_QUESTION,
-                                                  0);
-               if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
-                       return (result);
-       }
-
        /*
         * If we're adding a TSIG record, generate and render it.
         */
@@ -3488,4 +3488,3 @@ dns_message_logpacket(dns_message_t *message, const char *description,
        if (buf != NULL)
                isc_mem_put(mctx, buf, len);
 }
-