From: Kees Monshouwer <mind04@monshouwer.org>
Date: Mon, 6 May 2019 21:56:13 +0000 (+0200)
Subject: auth: fix, missing insecure zones in authSet #7785
X-Git-Tag: rec-4.2.0-rc1~25^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=926321a8d991374879f0ba3aba10ac4ad9c5f72f;p=pdns

auth: fix, missing insecure zones in authSet #7785
---

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 9d686a69f..267b1344f 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1108,7 +1108,7 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
   set<DNSName> authSet;
 
   vector<DNSZoneRecord> rrset;
-  bool weDone=0, weRedirected=0, weHaveUnauth=0;
+  bool weDone=0, weRedirected=0, weHaveUnauth=0, doSigs=0;
   DNSName haveAlias;
   uint8_t aliasScopeMask;
 
@@ -1274,10 +1274,9 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
     }
     DLOG(g_log<<Logger::Error<<"We have authority, zone='"<<sd.qname<<"', id="<<sd.domain_id<<endl);
 
+    authSet.insert(sd.qname);
     d_dnssec=(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname));
-    if(d_dnssec) {
-      authSet.insert(sd.qname);
-    }
+    doSigs |= d_dnssec;
 
     if(!retargetcount) r->qdomainzone=sd.qname;
 
@@ -1569,7 +1568,7 @@ DNSPacket *PacketHandler::doQuestion(DNSPacket *p)
         break;
       }
     }
-    if(authSet.size())
+    if(doSigs)
       addRRSigs(d_dk, B, authSet, r->getRRS());
       
     r->wrapup(); // needed for inserting in cache