- Fix to relax assertions after the TTL 0 handling change.

  This relaxes an assertion in cachedb (it fails instead),
  and for packet_rrset_copy_region.

diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index fd9f04e3d6564665d94c747039cebd2f54f1354f..c062d8274a62db3bd004e9ce6a0fcf73f18efc6a 100644 (file)
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -863,6 +863,11 @@ cachedb_handle_query(struct module_qstate* qstate,
                                return;
                }
                /* No 0TTL answers escaping from external cache. */
+               if(qstate->return_msg->rep->ttl == 0) {
+                       qstate->return_msg = NULL;
+                       qstate->ext_state[id] = module_wait_module;
+                       return;
+               }
                log_assert(qstate->return_msg->rep->ttl > 0);
                qstate->is_cachedb_answer = 1;
                /* we are done with the query */

diff --git a/doc/Changelog b/doc/Changelog
index 19841b004d00bda85eed01cf9c10af2317bd0a50..705013b2038f72e8659de127d475f5e401abb698 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+8 May 2026: Wouter
+       - Fix to relax assertions after the TTL 0 handling change.
+         This relaxes an assertion in cachedb (it fails instead),
+         and for packet_rrset_copy_region.
+
 7 May 2026: Wouter
        - Fix for Heap Out-of-Bounds Write via size_t-to-int Truncation
          in setup_if() - outside_network_create(). This fixes that

diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index 89ece3c031f565c4e4c666d2c79afd06c7603bc1..753b494750ee86572fef75f2ca2be12fca660b3d 100644 (file)
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -362,8 +362,11 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
                 * of the novel ghost attack mitigation i.e., using the
                 * qstarttime for NS RRSets. In that case make sure that the
                 * returned TTL is not higher than the original one. */
-               log_assert(d->ttl_add <= now ||
-                       (ntohs(key->rk.type) == LDNS_RR_TYPE_NS));
+               /* For types other than type NS, auth zone and rpz code
+                * can have ttl_add values. Also time could conceivably move
+                * in reverse, due to operator action, and it is prudent
+                * to not assert on that here.
+                * So there is no assertion d->ttl_add <= now || type==NS */
                now_control = SERVE_ORIGINAL_TTL ? data->ttl_add
                        : (d->ttl_add > now ? d->ttl_add : now );
                for(i=0; i<d->count + d->rrsig_count; i++) {