GitLab

Reported to us in Support ticket #20670

An RPZ response's SOA record TTL is set to 1 instead of the SOA TTL, due to what seems to be incorrectly modified code (from the difference in types). A bool value is passed to query_addsoa() in an argument that expects unsigned int. The diff below is from the BIND 9.16.23-S1 tree:

9.16.23-S1 (main)]$ git diff
diff --git a/lib/ns/query.c b/lib/ns/query.c
index ca1ffe4..f9e0f2b 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7454,9 +7454,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
* Add SOA record to additional section
*/
if (qctx->rpz_st->m.rpz->addsoa) {
- bool override_ttl =
- dns_rdataset_isassociated(qctx->rdataset);
- rresult = query_addsoa(qctx, override_ttl,
+ rresult = query_addsoa(qctx, UINT32_MAX,
DNS_SECTION_ADDITIONAL);
if (rresult != ISC_R_SUCCESS) {
QUERY_ERROR(qctx, result);