auth: first and last SOA in an AXFR must be identical

diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index 3473a4e461ee39483346241b46f4f0e465478e8c..a84e4976237772bc983cbb1fc2b0864e6d69d6fd 100644 (file)
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -284,7 +284,7 @@ uint32_t localtime_format_YYYYMMDDSS(time_t t, uint32_t seq);
 uint32_t calculateEditSOA(const DNSZoneRecord& rr, const string& kind);
 uint32_t calculateEditSOA(const SOAData& sd, const string& kind);
 bool editSOA(DNSSECKeeper& dk, const DNSName& qname, DNSPacket* dp);
-bool editSOARecord(DNSZoneRecord& rr, const string& kind, const DNSName& qname);
+bool editSOARecord(DNSZoneRecord& rr, const string& kind);
 // for SOA-EDIT-DNSUPDATE/API
 uint32_t calculateIncreaseSOA(SOAData sd, const string& increaseKind, const string& editKind);
 bool increaseSOARecord(DNSResourceRecord& rr, const string& increaseKind, const string& editKind);

diff --git a/pdns/serialtweaker.cc b/pdns/serialtweaker.cc
index f072c7a2be0ce69b7c6af68091b72431fabd3751..f55b5b6880659986bc3dde555c2c035707ace937 100644 (file)
--- a/pdns/serialtweaker.cc
+++ b/pdns/serialtweaker.cc
@@ -45,13 +45,13 @@ bool editSOA(DNSSECKeeper& dk, const DNSName& qname, DNSPacket* dp)
     if(rr.dr.d_type == QType::SOA && rr.dr.d_name == qname) {
       string kind;
       dk.getSoaEdit(qname, kind);
-      return editSOARecord(rr, kind, qname);
+      return editSOARecord(rr, kind);
     }
   }
   return false;
 }
 
-bool editSOARecord(DNSZoneRecord& rr, const string& kind, const DNSName& qname) {
+bool editSOARecord(DNSZoneRecord& rr, const string& kind) {
   if(kind.empty())
     return false;
   auto src = getRR<SOARecordContent>(rr.dr);

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 184b4993058f28ca8245908ce550c44334c00d32..d6f241b0701c6b84e3a8b6c64c8ad93cffe0ca6a 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -653,8 +653,12 @@ int TCPNameserver::doAXFR(const DNSName &target, shared_ptr<DNSPacket> q, int ou
   DNSZoneRecord dzrsoa;
   dzrsoa.auth=true;
   dzrsoa.dr=DNSRecord(soa);
+
+  string kind;
+  dk.getSoaEdit(sd.qname, kind);
+  editSOARecord(dzrsoa, kind);
+
   outpacket->addRecord(dzrsoa);
-  editSOA(dk, sd.qname, outpacket.get());
   if(securedZone) {
     set<DNSName> authSet;
     authSet.insert(target);
@@ -1046,7 +1050,6 @@ int TCPNameserver::doAXFR(const DNSName &target, shared_ptr<DNSPacket> q, int ou
   /* and terminate with yet again the SOA record */
   outpacket=getFreshAXFRPacket(q);
   outpacket->addRecord(dzrsoa);
-  editSOA(dk, sd.qname, outpacket.get());
   if(haveTSIGDetails && !tsigkeyname.empty())
     outpacket->setTSIGDetails(trc, tsigkeyname, tsigsecret, trc.d_mac, true);