From: W.C.A. Wijngaards Date: Mon, 20 Jul 2026 08:14:26 +0000 (+0200) Subject: - Fix #1474: DoQ responses are never padded - pad-responses X-Git-Tag: release-1.26.0rc1~42 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=fac75848306108f6ef8206e7c48ce8f13d8b808f;p=thirdparty%2Funbound.git - Fix #1474: DoQ responses are never padded - pad-responses does not apply to comm_doq (RFC 9250 §5.4 MUST). --- diff --git a/doc/Changelog b/doc/Changelog index 795ea371b..c16730f49 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,6 +1,8 @@ 20 July 2026: Wouter - Merge #1475 from petrvaganoff: ipsecmod: fix deref on null in ipsecmod-whitelist after OOM. + - Fix #1474: DoQ responses are never padded - pad-responses + does not apply to comm_doq (RFC 9250 §5.4 MUST). 9 July 2026: Wouter - Merge #1383 from jdek: Fix randomness generation on diff --git a/util/data/msgparse.c b/util/data/msgparse.c index 9239f8fe3..5ff5a82ae 100644 --- a/util/data/msgparse.c +++ b/util/data/msgparse.c @@ -1030,8 +1030,11 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, break; case LDNS_EDNS_PADDING: - if(!cfg || !cfg->pad_responses || - !c || c->type != comm_tcp ||!c->ssl || padding_seen) + if(!cfg || !cfg->pad_responses || !c || padding_seen) + break; + if(!((c->type == comm_tcp && c->ssl) || + (c->type == comm_http && c->ssl) || + c->type == comm_doq)) break; padding_seen = 1; if(!edns_opt_list_append(&edns->opt_list_out,