- Fix to use tls-port after referral if tls-upstream is set.

diff --git a/doc/Changelog b/doc/Changelog
index 995040ef3f3250e30bbbac7c8faefbfbc754e65b..9f75cbdca7fd61ffc8803bd2b4f729db9a0b0cf7 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -24,6 +24,7 @@
        - Fix to guard access to shared ports interface array during
          set up, for analyzer.
        - Fix sign of comparison warning in shared ports setup.
+       - Fix to use tls-port after referral if tls-upstream is set.
 
 23 July 2026: Wouter
        - Updated credits for Xuanchao Xie in 22 july changelog.

diff --git a/iterator/iter_delegpt.c b/iterator/iter_delegpt.c
index 6ba12c443ba8eccd492bf9055ef88c15190a7e23..f0f94cadd219b52fb4696f18d5bb10ca0928b267 100644 (file)
--- a/iterator/iter_delegpt.c
+++ b/iterator/iter_delegpt.c
@@ -412,7 +412,7 @@ find_NS(struct reply_info* rep, size_t from, size_t to, uint16_t qclass)
 }
 
 struct delegpt* 
-delegpt_from_message(struct dns_msg* msg, struct regional* region)
+delegpt_from_message(struct dns_msg* msg, struct regional* region, int port)
 {
        struct ub_packed_rrset_key* ns_rrset = NULL;
        struct delegpt* dp;
@@ -441,7 +441,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
        dp->has_parent_side_NS = 1; /* created from message */
        if(!delegpt_set_name(dp, region, ns_rrset->rk.dname))
                return NULL;
-       if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0))
+       if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0, port))
                return NULL;
 
        /* add glue, A and AAAA in answer and additional section */
@@ -467,7 +467,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 
 int 
 delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* ns_rrset, uint8_t lame)
+        struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port)
 {
        struct packed_rrset_data* nsdata = (struct packed_rrset_data*)
                ns_rrset->entry.data;
@@ -482,7 +482,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
                        continue; /* bad format */
                /* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
                if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame,
-                       NULL, UNBOUND_DNS_PORT))
+                       NULL, (port==-1?UNBOUND_DNS_PORT:port)))
                        return 0;
        }
        return 1;
@@ -541,7 +541,7 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
        if(!rrset)
                return 1;
        if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
-               return delegpt_rrset_add_ns(dp, region, rrset, lame);
+               return delegpt_rrset_add_ns(dp, region, rrset, lame, -1);
        else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
                return delegpt_add_rrset_A(dp, region, rrset, lame, additions);
        else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)

diff --git a/iterator/iter_delegpt.h b/iterator/iter_delegpt.h
index 287bf92134d2856f3376dc6d022e9353789e0f7c..db15277fca18bc36068b10845406fb2f34cf7e82 100644 (file)
--- a/iterator/iter_delegpt.h
+++ b/iterator/iter_delegpt.h
@@ -221,10 +221,11 @@ int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
  * @param regional: where to allocate the info.
  * @param ns_rrset: NS rrset.
  * @param lame: rrset is lame, disprefer it.
+ * @param port: port or -1 if not set.
  * @return 0 on alloc error.
  */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
-       struct ub_packed_rrset_key* ns_rrset, uint8_t lame);
+       struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port);
 
 /**
  * Add target address to the delegation point.
@@ -365,11 +366,12 @@ size_t delegpt_count_targets(struct delegpt* dp);
  *
  * @param msg: the dns message, referral.
  * @param regional: where to allocate delegation point.
+ * @param port: if not -1 specifies a port number.
  * @return new delegation point or NULL on alloc error, or if the
  *         message was not appropriate.
  */
 struct delegpt* delegpt_from_message(struct dns_msg* msg, 
-       struct regional* regional);
+       struct regional* regional, int port);
 
 /**
  * Mark negative return in delegation point for specific nameserver.

diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index cc09fa52461e9fc56efb6f12845375fb6e02c0d9..e848e83ba812f73a6ef9aa905d7e97dc04faad24 100644 (file)
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -1313,7 +1313,8 @@ iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
                log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
                dp->has_parent_side_NS = 1;
                /* and mark the new names as lame */
-               if(!delegpt_rrset_add_ns(dp, region, akey, 1)) {
+               if(!delegpt_rrset_add_ns(dp, region, akey, 1,
+                       deleg_port_number(env))) {
                        lock_rw_unlock(&akey->entry.lock);
                        return 0;
                }
@@ -1703,3 +1704,11 @@ iter_make_minimal(struct reply_info* rep)
        rep->ar_numrrsets = 0;
        rep->rrset_count -= rem;
 }
+
+int
+deleg_port_number(struct module_env* env)
+{
+       if(env->cfg->ssl_upstream)
+               return env->cfg->ssl_port;
+       return -1;
+}

diff --git a/iterator/iter_utils.h b/iterator/iter_utils.h
index f7f3747428036285effe8263ea6c1e4793c5f2c1..9fb361ab52983e9c2db479d52bd22b72ed3124c4 100644 (file)
--- a/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@ -483,4 +483,7 @@ void limit_nsec_ttl(struct dns_msg* msg);
  */
 void iter_make_minimal(struct reply_info* rep);
 
+/** See if we need a different port number */
+int deleg_port_number(struct module_env* env);
+
 #endif /* ITERATOR_ITER_UTILS_H */

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 1f95039c8834f948f5e35bb3b13c381f7c4ce5d0..cadb95ebd0ab33093f303b2bfe96e0bb3c9f5542 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -3147,7 +3147,6 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
        return NULL;
 }
 
-
 /** 
  * Process the query response. All queries end up at this state first. This
  * process generally consists of analyzing the response and routing the
@@ -3474,7 +3473,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
                        infra_ratelimit_dec(qstate->env->infra_cache,
                                old_dp->name, old_dp->namelen,
                                *qstate->env->now);
-               iq->dp = delegpt_from_message(iq->response, qstate->region);
+               iq->dp = delegpt_from_message(iq->response, qstate->region,
+                       deleg_port_number(qstate->env));
                if (qstate->env->cfg->qname_minimisation)
                        iq->minimisation_state = INIT_MINIMISE_STATE;
                if(!iq->dp) {
@@ -3751,7 +3751,8 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
        log_assert(qstate->is_priming || foriq->wait_priming_stub);
        log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR);
        /* Convert our response to a delegation point */
-       dp = delegpt_from_message(qstate->return_msg, forq->region);
+       dp = delegpt_from_message(qstate->return_msg, forq->region,
+               deleg_port_number(forq->env));
        if(!dp) {
                /* if there is no convertible delegation point, then 
                 * the ANSWER type was (presumably) a negative answer. */
@@ -3967,7 +3968,8 @@ processDSNSResponse(struct module_qstate* qstate, int id,
 
        /* else, store as DP and continue at querytargets */
        foriq->state = QUERYTARGETS_STATE;
-       foriq->dp = delegpt_from_message(qstate->return_msg, forq->region);
+       foriq->dp = delegpt_from_message(qstate->return_msg, forq->region,
+               deleg_port_number(forq->env));
        if(!foriq->dp) {
                log_err("out of memory in dsns dp alloc");
                errinf(qstate, "malloc failure, in DS search");

diff --git a/services/cache/dns.c b/services/cache/dns.c
index 7100b1ce8c326f540cff5896aea080e7372343d1..04d5ae2d6302f4c9095819d417248cd89f36c356 100644 (file)
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -43,6 +43,7 @@
 #include "iterator/iter_utils.h"
 #include "validator/val_nsec.h"
 #include "validator/val_utils.h"
+#include "iterator/iter_utils.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "util/data/msgparse.h"
@@ -586,7 +587,8 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
                        return NULL;
                }
        }
-       if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) {
+       if(!delegpt_rrset_add_ns(dp, region, nskey, 0,
+               deleg_port_number(env))) {
                lock_rw_unlock(&nskey->entry.lock);
                log_err("find_delegation: addns out of memory");
                return NULL;