From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 29 Oct 2025 10:11:43 +0000 (+0100)
Subject: BUG/MINOR: resolvers: Apply dns-accept-family setting on additional records
X-Git-Tag: v3.3-dev11~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c84c15d3938aee6ec746cc06b4b5fdbfc37b0e16;p=thirdparty%2Fhaproxy.git

BUG/MINOR: resolvers: Apply dns-accept-family setting on additional records

dns-accept-family setting was only evaluated for responses to A / AAAA DNS
queries. It was ignored when additional records in SRV responses were
parsed.

With this patch, whena SRV responses is parsed, additional records not
matching the dns-accept-family setting are ignored, as expected.

This patch must be backported to 3.2.
---

diff --git a/src/resolvers.c b/src/resolvers.c
index 789007807..c8be0cd98 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -1480,31 +1480,26 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
 			goto invalid_resp;
 
 		/* Analyzing record content */
-		switch (answer_record->type) {
-			case DNS_RTYPE_A:
-				/* ipv4 is stored on 4 bytes */
-				if (answer_record->data_len != 4)
-					goto invalid_resp;
-
-				answer_record->data.in4.sin_family = AF_INET;
-				memcpy(&answer_record->data.in4.sin_addr, reader, answer_record->data_len);
-				break;
-
-			case DNS_RTYPE_AAAA:
-				/* ipv6 is stored on 16 bytes */
-				if (answer_record->data_len != 16)
-					goto invalid_resp;
-
-				answer_record->data.in6.sin6_family = AF_INET6;
-				memcpy(&answer_record->data.in6.sin6_addr, reader, answer_record->data_len);
-				break;
-
-			default:
-				pool_free(resolv_answer_item_pool, answer_record);
-				answer_record = NULL;
-				continue;
-
-		} /* switch (record type) */
+		if (answer_record->type == DNS_RTYPE_A && (resolv_active_families() & RSLV_ACCEPT_IPV4)) {
+			/* ipv4 is stored on 4 bytes */
+			if (answer_record->data_len != 4)
+				goto invalid_resp;
+			answer_record->data.in4.sin_family = AF_INET;
+			memcpy(&answer_record->data.in4.sin_addr, reader, answer_record->data_len);
+		}
+		else if (answer_record->type == DNS_RTYPE_AAAA && (resolv_active_families() & RSLV_ACCEPT_IPV6)) {
+			/* ipv6 is stored on 16 bytes */
+			if (answer_record->data_len != 16)
+				goto invalid_resp;
+			answer_record->data.in6.sin6_family = AF_INET6;
+			memcpy(&answer_record->data.in6.sin6_addr, reader, answer_record->data_len);
+			break;
+		}
+		else {
+			pool_free(resolv_answer_item_pool, answer_record);
+			answer_record = NULL;
+			continue;
+		}
 
 		/* Increment the counter for number of records saved into our
 		 * local response */