lib/resolve: don't skip EDNS if failed

This was almost all done during the IETF 104 hackathon.

diff --git a/NEWS b/NEWS
index c3666772ef7300ffdaa92f34e3e72a430606cf47..dfc8bf61875b4c882eeb659ec487051a4a88b189 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,7 @@ Bugfixes
 --------
 - TCP to upstream: don't send wrong message length (unlikely, !816)
 - http module: fix problems around maintenance of ephemeral certs (!819)
+- send EDNS with SERVFAILs, e.g. on validation failures (#180, !827)
 
 
 Knot Resolver 4.0.0 (2019-04-18)

diff --git a/lib/resolve.c b/lib/resolve.c
index 594202385eb210b16c3b1ec787ad79a3b0ba7b36..c39eab41ad07e58eab938431701bcb3bfb0e012c 100644 (file)
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -555,15 +555,17 @@ static int answer_padding(struct kr_request *request)
 
 static int answer_fail(struct kr_request *request)
 {
+       /* Note: OPT in SERVFAIL response is still useful for cookies/additional info. */
        knot_pkt_t *answer = request->answer;
+       knot_rrset_t *opt_rr = answer->opt_rr; /* it gets NULLed below */
        int ret = kr_pkt_clear_payload(answer);
        knot_wire_clear_ad(answer->wire);
        knot_wire_clear_aa(answer->wire);
        knot_wire_set_rcode(answer->wire, KNOT_RCODE_SERVFAIL);
-       if (ret == 0 && answer->opt_rr) {
-               /* OPT in SERVFAIL response is still useful for cookies/additional info. */
+       if (ret == 0 && opt_rr) {
                knot_pkt_begin(answer, KNOT_ADDITIONAL);
                answer_padding(request); /* Ignore failed padding in SERVFAIL answer. */
+               answer->opt_rr = opt_rr;
                ret = edns_put(answer, false);
        }
        return ret;
@@ -1592,9 +1594,7 @@ int kr_resolve_finish(struct kr_request *request, int state)
 {
        /* Finalize answer and construct wire-buffer. */
        ITERATE_LAYERS(request, NULL, answer_finalize);
-       if (request->state & KR_STATE_FAIL) {
-               state = KR_STATE_FAIL;
-       } else if (answer_finalize(request, state) != 0) {
+       if (answer_finalize(request, state) != 0) {
                state = KR_STATE_FAIL;
        }