2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR

                        responses more gracefully. [RT #15941]

diff --git a/CHANGES b/CHANGES
index 62b9af9c2b631ba7237a4a291e0fe3173e104e85..2dd0c2c50dfd6c15bc17e96785363d38422c0368 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2013.  [bug]           Handle unexpected TSIGs on unsigned AXFR/IXFR
+                       responses more gracefully. [RT #15941]
+
 2012.  [func]          Don't insert new acache entries if acache is full.
                        [RT #15970]
 

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 005f07f364eb6e5ce8123d5f0c82685a2fcd4c6c..c5107b54c351636545e7eed16f01e892cf35348b 100644 (file)
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.117.18.8 2006/03/08 03:55:50 marka Exp $
+ * $Id: tsig.c,v 1.117.18.9 2006/05/02 04:23:12 marka Exp $
  */
 /*! \file */
 #include <config.h>
@@ -855,8 +855,11 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 
        msg->verify_attempted = 1;
 
-       if (msg->tcp_continuation)
+       if (msg->tcp_continuation) {
+               if (tsigkey == NULL || msg->querytsig == NULL)
+                       return (DNS_R_UNEXPECTEDTSIG);
                return (tsig_verify_tcp(source, msg));
+       }
 
        /*
         * There should be a TSIG record...