- Fix #1474: DoQ responses are never padded - pad-responses

  does not apply to comm_doq (RFC 9250 §5.4 MUST).

diff --git a/doc/Changelog b/doc/Changelog
index 795ea371b50fbbfe9eb1872d894357bfa7fc5877..c16730f49df8d81f506df684e857cccfdff7b02a 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 20 July 2026: Wouter
        - Merge #1475 from petrvaganoff: ipsecmod: fix deref on null
          in ipsecmod-whitelist after OOM.
+       - Fix #1474: DoQ responses are never padded - pad-responses
+         does not apply to comm_doq (RFC 9250 §5.4 MUST).
 
 9 July 2026: Wouter
        - Merge #1383 from jdek: Fix randomness generation on

diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 9239f8fe396a8dcf9cd6e321f8c86265354c081f..5ff5a82ae58953691fb04e0535649547fe7e08b4 100644 (file)
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -1030,8 +1030,11 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
                        break;
 
                case LDNS_EDNS_PADDING:
-                       if(!cfg || !cfg->pad_responses ||
-                                       !c || c->type != comm_tcp ||!c->ssl || padding_seen)
+                       if(!cfg || !cfg->pad_responses || !c || padding_seen)
+                               break;
+                       if(!((c->type == comm_tcp && c->ssl) ||
+                               (c->type == comm_http && c->ssl) ||
+                               c->type == comm_doq))
                                break;
                        padding_seen = 1;
                        if(!edns_opt_list_append(&edns->opt_list_out,