BUG/MINOR: resolvers: classify empty truncated responses

The answer count is checked before the response question is parsed.
Most DNS servers return a truncated response without answers, so such
a response is classified as ANCOUNT_ZERO before the TC flag and
question type are examined. It increments the wrong counter and hides
the actual response status.

Move the empty-answer check after question parsing and TC handling.
Truncated SRV responses keep their existing partial-answer behavior.

This should be backported as far as 2.4.

diff --git a/src/resolvers.c b/src/resolvers.c
index b4812f3a0363f6df57d7de7ade917befbd33bcee..92c4567a06e64871ec6deb2c37dc0d512caeddf7 100644 (file)
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -1091,10 +1091,6 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
        if (reader + 2 > bufend)
                goto invalid_resp;
        r_res->header.ancount = reader[0] * 256 + reader[1];
-       if (r_res->header.ancount == 0) {
-               cause = RSLV_RESP_ANCOUNT_ZERO;
-               goto return_error;
-       }
 
        /* Check if too many records are announced */
        if (r_res->header.ancount > max_answer_records)
@@ -1157,6 +1153,11 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
                goto return_error;
        }
 
+       if (r_res->header.ancount == 0) {
+               cause = RSLV_RESP_ANCOUNT_ZERO;
+               goto return_error;
+       }
+
        /* now parsing response records */
        nb_saved_records = 0;
        for (i = 0; i < r_res->header.ancount; i++) {