Truncate DNS replies >512 bytes that the client isn't expecting.

diff --git a/src/edns0.c b/src/edns0.c
index d1a11e788c1fbda948b2456566a970b6ed0b3ae7..e137992f806c0e74b8e5962ad05ba75b51d576c9 100644 (file)
--- a/src/edns0.c
+++ b/src/edns0.c
@@ -339,9 +339,8 @@ size_t add_do_bit(struct dns_header *header, size_t plen, char *limit)
 int check_source(struct dns_header *header, size_t plen, unsigned char *pseudoheader, union mysockaddr *peer)
 {
   /* Section 9.2, Check that subnet option in reply matches. */
-
-
- int len, calc_len;
+  
+  int len, calc_len;
   struct subnet_opt opt;
   unsigned char *p;
   int code, i, rdlen;

diff --git a/src/forward.c b/src/forward.c
index 2ca3c86f2d295e3d52d4deed3fd8e5612c99e868..e1766b939f53af834b30586472e0c2ca37df474c 100644 (file)
--- a/src/forward.c
+++ b/src/forward.c
@@ -485,8 +485,8 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
                     packet size to 512. But that won't provide space for the RRSIGS in many cases.
                     The RRSIGS will be stripped out before the answer goes back, so the packet should
                     shrink again. So, if we added a do-bit, bump the udp packet size to the value
-                    known to be OK for this server. Maybe check returned size after stripping and set
-                    the truncated bit? */                
+                    known to be OK for this server. We check returned size after stripping and set
+                    the truncated bit if it's still too big. */                  
                  unsigned char *pheader;
                  int is_sign;
                  if (find_pseudoheader(header, plen, NULL, &pheader, &is_sign, NULL) && !is_sign)
@@ -1028,6 +1028,19 @@ void reply_query(int fd, int family, time_t now)
        {
          header->id = htons(forward->orig_id);
          header->hb4 |= HB4_RA; /* recursion if available */
+#ifdef HAVE_DNSSEC
+         /* We added an EDNSO header for the purpose of getting DNSSEC RRs, and set the value of the UDP payload size
+            greater than the no-EDNS0-implied 512 to have if space for the RRSIGS. If, having stripped them and the EDNS0
+             header, the answer is still bigger than 512, truncate it and mark it so. The client then retries with TCP. */
+         if (option_bool(OPT_DNSSEC_VALID) && (forward->flags & FREC_ADDED_PHEADER) && (nn > PACKETSZ))
+           {
+             header->ancount = htons(0);
+             header->nscount = htons(0);
+             header->arcount = htons(0);
+             header->hb3 |= HB3_TC;
+             nn = resize_packet(header, nn, NULL, 0);
+           }
+#endif
          send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, 
                    &forward->source, &forward->dest, forward->iface);
        }