From 3b400190830c5ed9b99e616d23eb8f52937f10e8 Mon Sep 17 00:00:00 2001 From: Manu Nicolas Date: Tue, 1 Sep 2026 10:44:42 +0000 Subject: [PATCH] BUG/MINOR: resolvers: classify empty truncated responses The answer count is checked before the response question is parsed. Most DNS servers return a truncated response without answers, so such a response is classified as ANCOUNT_ZERO before the TC flag and question type are examined. It increments the wrong counter and hides the actual response status. Move the empty-answer check after question parsing and TC handling. Truncated SRV responses keep their existing partial-answer behavior. This should be backported as far as 2.4. --- src/resolvers.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/resolvers.c b/src/resolvers.c index b4812f3a0..92c4567a0 100644 --- a/src/resolvers.c +++ b/src/resolvers.c @@ -1091,10 +1091,6 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe if (reader + 2 > bufend) goto invalid_resp; r_res->header.ancount = reader[0] * 256 + reader[1]; - if (r_res->header.ancount == 0) { - cause = RSLV_RESP_ANCOUNT_ZERO; - goto return_error; - } /* Check if too many records are announced */ if (r_res->header.ancount > max_answer_records) @@ -1157,6 +1153,11 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe goto return_error; } + if (r_res->header.ancount == 0) { + cause = RSLV_RESP_ANCOUNT_ZERO; + goto return_error; + } + /* now parsing response records */ nb_saved_records = 0; for (i = 0; i < r_res->header.ancount; i++) { -- 2.47.3