From 798c8f57d440cb5f9739cef86ad781ad3dfcb3bc Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Wed, 14 Dec 2022 11:41:10 +0100 Subject: [PATCH] Don't set EDE in ns_client_aclchecksilent The ns_client_aclchecksilent is used to check multiple ACLs before the decision is made that a query is denied. It is also used to determine if recursion is available. In those cases we should not set the extended DNS error "Prohibited". --- lib/ns/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ns/client.c b/lib/ns/client.c index 0bab7dbb51..ea94e45427 100644 --- a/lib/ns/client.c +++ b/lib/ns/client.c @@ -2525,7 +2525,6 @@ allow: return (ISC_R_SUCCESS); deny: - ns_client_extendederror(client, DNS_EDE_PROHIBITED, NULL); return (DNS_R_REFUSED); } @@ -2548,6 +2547,7 @@ ns_client_checkacl(ns_client_t *client, isc_sockaddr_t *sockaddr, NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3), "%s approved", opname); } else { + ns_client_extendederror(client, DNS_EDE_PROHIBITED, NULL); ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT, log_level, "%s denied", opname);