mirror of
https://github.com/isc-projects/bind9.git
synced 2026-07-13 15:20:49 -04:00
2327277f90
A response that failed the signature check with a missing or unexpected TSIG used to set nextitem, so the resolver kept reading the dispatch for another response. When the response was truncated with the TSIG cut off the end of the wire, no further response ever arrived and the fetch stalled until resolver-query-timeout. Treat an unauthenticated response like every other signature-check failure and finish the fetch immediately. A response carrying a missing or bogus TSIG now yields SERVFAIL instead of being skipped in favour of a later one; the cookie system test that fed a spoofed TSIG response is updated to expect that. The unauthenticated data is still never returned. |
||
|---|---|---|
| .. | ||
| ans9 | ||
| ans10 | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns4 | ||
| ns5 | ||
| ns6 | ||
| ns7 | ||
| ns8 | ||
| bad-cookie-aes.conf | ||
| bad-cookie-badhex.conf | ||
| bad-cookie-badsiphash24.conf | ||
| bad-cookie-toolong.conf | ||
| cookie_ans.py | ||
| good-cookie-siphash24.conf | ||
| tests.sh | ||
| tests_sh_cookie.py | ||