From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Fri, 8 May 2026 08:09:41 +0000 (+0200)
Subject: - Fix to relax assertions after the TTL 0 handling change.
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=8ada1bd88d2bc406c7a674d0e949ef5c63d648bd;p=thirdparty%2Funbound.git

- Fix to relax assertions after the TTL 0 handling change.
  This relaxes an assertion in cachedb (it fails instead),
  and for packet_rrset_copy_region.
---

diff --git a/cachedb/cachedb.c b/cachedb/cachedb.c
index fd9f04e3d..c062d8274 100644
--- a/cachedb/cachedb.c
+++ b/cachedb/cachedb.c
@@ -863,6 +863,11 @@ cachedb_handle_query(struct module_qstate* qstate,
 				return;
 		}
 		/* No 0TTL answers escaping from external cache. */
+		if(qstate->return_msg->rep->ttl == 0) {
+			qstate->return_msg = NULL;
+			qstate->ext_state[id] = module_wait_module;
+			return;
+		}
 		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
diff --git a/doc/Changelog b/doc/Changelog
index 19841b004..705013b20 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+8 May 2026: Wouter
+	- Fix to relax assertions after the TTL 0 handling change.
+	  This relaxes an assertion in cachedb (it fails instead),
+	  and for packet_rrset_copy_region.
+
 7 May 2026: Wouter
 	- Fix for Heap Out-of-Bounds Write via size_t-to-int Truncation
 	  in setup_if() - outside_network_create(). This fixes that
diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
index 89ece3c03..753b49475 100644
--- a/util/data/packed_rrset.c
+++ b/util/data/packed_rrset.c
@@ -362,8 +362,11 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 		 * of the novel ghost attack mitigation i.e., using the
 		 * qstarttime for NS RRSets. In that case make sure that the
 		 * returned TTL is not higher than the original one. */
-		log_assert(d->ttl_add <= now ||
-			(ntohs(key->rk.type) == LDNS_RR_TYPE_NS));
+		/* For types other than type NS, auth zone and rpz code
+		 * can have ttl_add values. Also time could conceivably move
+		 * in reverse, due to operator action, and it is prudent
+		 * to not assert on that here.
+		 * So there is no assertion d->ttl_add <= now || type==NS */
 		now_control = SERVE_ORIGINAL_TTL ? data->ttl_add
 			: (d->ttl_add > now ? d->ttl_add : now );
 		for(i=0; i<d->count + d->rrsig_count; i++) {