From 2df646e05f135c45348dc71ef1722aca0c906287 Mon Sep 17 00:00:00 2001 From: "W.C.A. Wijngaards" Date: Fri, 4 Sep 2026 17:20:15 +0200 Subject: [PATCH] - Fix to not change the action override in rpz_config, before the cname override has succeeded. --- doc/Changelog | 2 ++ services/rpz.c | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/doc/Changelog b/doc/Changelog index 04373cbc5..12adccc8c 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -2,6 +2,8 @@ - Fix to make rpz_config leave the rpz with correct set up on failure. The struct is not half configured on exit. Thanks to Qifan Zhang, Palo Alto Networks, for the report. + - Fix to not change the action override in rpz_config, before + the cname override has succeeded. 3 September 2026: Wouter - Fix to match NSEC3 hash length to the NSEC3 algorithm, diff --git a/services/rpz.c b/services/rpz.c index 64921396d..35c88bfc0 100644 --- a/services/rpz.c +++ b/services/rpz.c @@ -506,6 +506,7 @@ delete_cname_override(struct rpz* r) static int rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p) { + enum rpz_action action_override; if(p->rpz_taglist && p->rpz_taglistlen) { uint8_t* taglist = memdup(p->rpz_taglist, p->rpz_taglistlen); if(!taglist) { @@ -526,12 +527,12 @@ rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p) } if(p->rpz_action_override) { - r->action_override = rpz_config_to_action(p->rpz_action_override); + action_override = rpz_config_to_action(p->rpz_action_override); } else - r->action_override = RPZ_NO_OVERRIDE_ACTION; + action_override = RPZ_NO_OVERRIDE_ACTION; - if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) { + if(action_override == RPZ_CNAME_OVERRIDE_ACTION) { uint8_t nm[LDNS_MAX_DOMAINLEN+1]; size_t nmlen = sizeof(nm); struct regional* newr; @@ -564,6 +565,7 @@ rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p) } else { delete_cname_override(r); } + r->action_override = action_override; r->log = p->rpz_log; r->signal_nxdomain_ra = p->rpz_signal_nxdomain_ra; if(p->rpz_log_name) {