Le 01/09/2026 à 12:44 PM, Manu Nicolas a écrit :
The answer count is checked before the response question is parsed. Most DNS servers return a truncated response without answers, so such a response is classified as ANCOUNT_ZERO before the TC flag and question type are examined. It increments the wrong counter and hides the actual response status.Move the empty-answer check after question parsing and TC handling. Truncated SRV responses keep their existing partial-answer behavior. This should be backported as far as 2.4. --- src/resolvers.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/resolvers.c b/src/resolvers.c index 06fb19c41..9f4e5fc0d 100644 --- a/src/resolvers.c +++ b/src/resolvers.c @@ -1091,10 +1091,6 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe if (reader + 2 > bufend) goto invalid_resp; r_res->header.ancount = reader[0] * 256 + reader[1]; - if (r_res->header.ancount == 0) { - cause = RSLV_RESP_ANCOUNT_ZERO; - goto return_error; - }/* Check if too many records are announced */if (r_res->header.ancount > max_answer_records) @@ -1157,6 +1153,11 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe goto return_error; }+ if (r_res->header.ancount == 0) {+ cause = RSLV_RESP_ANCOUNT_ZERO; + goto return_error; + } + /* now parsing response records */ nb_saved_records = 0; for (i = 0; i < r_res->header.ancount; i++) {
This one was merged, thanks ! -- Christopher Faulet
