From: Mark Andrews <marka@isc.org>
Date: Thu, 18 Oct 2012 02:25:06 +0000 (+1100)
Subject: 3396.   [bug]           OPT records were incorrectly removed from signed,
X-Git-Tag: v9.10.0a1~791
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0fbd29837a5911e0f0a83fca93aa4453200a8ccf;p=thirdparty%2Fbind9.git

3396.   [bug]           OPT records were incorrectly removed from signed,
                        truncated responses. [RT #31439]
---

diff --git a/CHANGES b/CHANGES
index f6d4adff08b..c8d52260f81 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3396.	[bug]		OPT records were incorrectly removed from signed,
+			truncated responses. [RT #31439]
+
 3395.	[protocol]	Add RFC 6598 reverse zones to built in empty zones
 			list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA.
 			[RT #31336]
diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
index eaae896cfd5..0e98b4047b8 100644
--- a/bin/tests/system/tsig/clean.sh
+++ b/bin/tests/system/tsig/clean.sh
@@ -22,3 +22,4 @@
 
 rm -f dig.out.*
 rm -f */named.memstats
+rm -f */named.run
diff --git a/bin/tests/system/tsig/ns1/example.db b/bin/tests/system/tsig/ns1/example.db
index a9a0ec885aa..3151b721db1 100644
--- a/bin/tests/system/tsig/ns1/example.db
+++ b/bin/tests/system/tsig/ns1/example.db
@@ -149,3 +149,20 @@ wks01			WKS	10.0.0.1 6 ( 0 1 2 21 23 )
 wks02			WKS	10.0.0.1 17 ( 0 1 2 53 )
 wks03			WKS	10.0.0.2 6 ( 65535 )
 x2501			X25	"123456789"
+large			TXT	( 1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890
+				  1234567890 1234567890 1234567890 1234567890 )
diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
index ff535094221..50ac8d23e6b 100644
--- a/bin/tests/system/tsig/tests.sh
+++ b/bin/tests/system/tsig/tests.sh
@@ -222,6 +222,17 @@ if [ $ret -eq 1 ] ; then
 	echo "I: failed"; status=1
 fi
 
+echo "I:checking both OPT and TSIG records are returned when TC=1"
+ret=0
+$DIG +ignore +bufsize=512 large.example.nil \
+	-y "hmac-sha1:sha1:$sha1" @10.53.0.1 txt -p 5300 > dig.out.large 2>&1 || ret=1
+grep "flags:.* tc[ ;]" dig.out.large > /dev/null || ret=1
+grep "status: NOERROR" dig.out.large > /dev/null || ret=1
+grep "EDNS:" dig.out.large > /dev/null || ret=1
+grep -i "sha1.*TSIG.*NOERROR" dig.out.sha1 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo "I: failed"; status=1
+fi
 exit $status
 
 
diff --git a/lib/dns/message.c b/lib/dns/message.c
index cb72afeefb1..6fc3a27d071 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -2111,6 +2111,30 @@ dns_message_renderend(dns_message_t *msg) {
 		return (DNS_R_FORMERR);
 	}
 
+	/*
+	 * If we're adding a OPT, TSIG or SIG(0) to a truncated message,
+	 * clear all rdatasets from the message except for the question
+	 * before adding the OPT, TSIG or SIG(0).  If the question doesn't
+         * fit, don't include it.
+	 */
+	if ((msg->tsigkey != NULL || msg->sig0key != NULL || msg->opt) &&
+	    (msg->flags & DNS_MESSAGEFLAG_TC) != 0)
+	{
+		isc_buffer_t *buf;
+
+		msgresetnames(msg, DNS_SECTION_ANSWER);
+		buf = msg->buffer;
+		dns_message_renderreset(msg);
+		msg->buffer = buf;
+		isc_buffer_clear(msg->buffer);
+		isc_buffer_add(msg->buffer, DNS_MESSAGE_HEADERLEN);
+		dns_compress_rollback(msg->cctx, 0);
+		result = dns_message_rendersection(msg, DNS_SECTION_QUESTION,
+						   0);
+		if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
+			return (result);
+	}
+
 	/*
 	 * If we've got an OPT record, render it.
 	 */
@@ -2135,30 +2159,6 @@ dns_message_renderend(dns_message_t *msg) {
 			return (result);
 	}
 
-	/*
-	 * If we're adding a TSIG or SIG(0) to a truncated message,
-	 * clear all rdatasets from the message except for the question
-	 * before adding the TSIG or SIG(0).  If the question doesn't fit,
-	 * don't include it.
-	 */
-	if ((msg->tsigkey != NULL || msg->sig0key != NULL) &&
-	    (msg->flags & DNS_MESSAGEFLAG_TC) != 0)
-	{
-		isc_buffer_t *buf;
-
-		msgresetnames(msg, DNS_SECTION_ANSWER);
-		buf = msg->buffer;
-		dns_message_renderreset(msg);
-		msg->buffer = buf;
-		isc_buffer_clear(msg->buffer);
-		isc_buffer_add(msg->buffer, DNS_MESSAGE_HEADERLEN);
-		dns_compress_rollback(msg->cctx, 0);
-		result = dns_message_rendersection(msg, DNS_SECTION_QUESTION,
-						   0);
-		if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
-			return (result);
-	}
-
 	/*
 	 * If we're adding a TSIG record, generate and render it.
 	 */
@@ -3488,4 +3488,3 @@ dns_message_logpacket(dns_message_t *message, const char *description,
 	if (buf != NULL)
 		isc_mem_put(mctx, buf, len);
 }
-