From: Evan Hunt <each@isc.org>
Date: Wed, 12 Aug 2015 05:12:44 +0000 (-0700)
Subject: [v9_9] fix tsig class checks
X-Git-Tag: v9.9.8rc1~62
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=7d665f76667d98db3eb388affb62850ffefa653b;p=thirdparty%2Fbind9.git

[v9_9] fix tsig class checks

4171.	[bug]		Fixed incorrect class checks in TSIG RR
			implementation. [RT #40287]
---

diff --git a/CHANGES b/CHANGES
index 8ca8f5cac20..04340af0555 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4171.	[bug]		Fixed incorrect class checks in TSIG RR
+			implementation. [RT #40287]
+
 4170.	[security]	An incorrect boundary check in the OPENPGPKEY
 			rdatatype could trigger an assertion failure.
 			[RT #40286]
diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c
index 3f91f91c009..7c7bdce35ba 100644
--- a/lib/dns/rdata/any_255/tsig_250.c
+++ b/lib/dns/rdata/any_255/tsig_250.c
@@ -529,8 +529,8 @@ freestruct_any_tsig(ARGS_FREESTRUCT) {
 	dns_rdata_any_tsig_t *tsig = (dns_rdata_any_tsig_t *) source;
 
 	REQUIRE(source != NULL);
-	REQUIRE(tsig->common.rdclass == 255);
 	REQUIRE(tsig->common.rdtype == 250);
+	REQUIRE(tsig->common.rdclass == 255);
 
 	if (tsig->mctx == NULL)
 		return;
@@ -586,7 +586,7 @@ static inline isc_boolean_t
 checknames_any_tsig(ARGS_CHECKNAMES) {
 
 	REQUIRE(rdata->type == 250);
-	REQUIRE(rdata->rdclass == 250);
+	REQUIRE(rdata->rdclass == 255);
 
 	UNUSED(rdata);
 	UNUSED(owner);