From: Ondřej Surý <ondrej@isc.org>
Date: Tue, 19 May 2026 13:00:39 +0000 (+0200)
Subject: fix: usr: Reject RRSIG records covering meta-types
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=78ececa6bd21fac7d327fd3801e76d567b6d9f2b;p=thirdparty%2Fbind9.git

fix: usr: Reject RRSIG records covering meta-types

A recursive resolver could accept and cache an RRSIG record whose
Type-Covered field names a meta-type (ANY, AXFR, IXFR, MAILA, MAILB),
even though no real RRset of those types ever exists. Such records
are now rejected by the DNS message parser.

Closes #6002

Merge branch '6002-reject-rrsig-covering-meta-types' into 'main'

See merge request isc-projects/bind9!12048
---

78ececa6bd21fac7d327fd3801e76d567b6d9f2b