Ignore the closing SOA record in IXFR-turned-AXFR.

Fixes: #12984
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

diff --git a/pdns/auth-secondarycommunicator.cc b/pdns/auth-secondarycommunicator.cc
index 4e9036cd059ed3f22b9d46abe8c374a178630cbe..48044df86ed5b7caaf28d6747f12fd34f3941676 100644 (file)
--- a/pdns/auth-secondarycommunicator.cc
+++ b/pdns/auth-secondarycommunicator.cc
@@ -887,7 +887,8 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
           if (!g_slogStructured) {
             ctx.logPrefix[0] = 'A'; // IXFR -> AXFR
           }
-          bool firstNSEC3 = true;
+          bool firstNSEC3{true};
+          bool soa_received{false};
           rrs.reserve(axfr.size());
           for (const auto& dr : axfr) { // NOLINT(readability-identifier-length)
             auto rr = DNSResourceRecord::fromWire(dr); // NOLINT(readability-identifier-length)
@@ -898,8 +899,12 @@ void CommunicatorClass::suck(const ZoneName& domain, const ComboAddress& remote,
               continue;
             }
             if (dr.d_type == QType::SOA) {
+              if (soa_received) {
+                continue; // skip the last SOA
+              }
               auto sd = getRR<SOARecordContent>(dr); // NOLINT(readability-identifier-length)
               ctx.soa_serial = sd->d_st.serial;
+              soa_received = true;
             }
             rrs.emplace_back(std::move(rr));
           }