From 9af87b82ffcbd5311cd37ae1c3a81a013bf26c22 Mon Sep 17 00:00:00 2001 From: IReclaimer Date: Mon, 7 Sep 2026 10:37:50 +0100 Subject: [PATCH] Fix Filter AAAA: preserve AuthoritativeAnswer on synthesized NODATA response The synthesized NODATA response always hardcoded authoritativeAnswer to false, even when the original response was authoritative. This is correct when filtering a recursively-resolved/forwarded answer (AA=0 is right there anyway), but wrong when the server is authoritative for the zone being filtered. The confirmed negative answer gets downgraded to non-authoritative for no reason. This matters beyond protocol correctness: a resolver forwarding to this server (e.g. Unbound with a forward-zone) treats a non-authoritative NODATA as inconclusive and falls back to real recursive resolution instead of trusting it, silently defeating the filter for anyone running this behind a forwarding resolver for their own authoritative zones. RecursionDesired/RecursionAvailable a few arguments later were already being carried over correctly from the original response; this just extends the same treatment to AuthoritativeAnswer. --- Apps/FilterAaaaApp/App.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Apps/FilterAaaaApp/App.cs b/Apps/FilterAaaaApp/App.cs index 10d224011..35cd9f598 100644 --- a/Apps/FilterAaaaApp/App.cs +++ b/Apps/FilterAaaaApp/App.cs @@ -213,7 +213,7 @@ public async Task InitializeAsync(IDnsServer dnsServer, string? config) DnsResourceRecord[] authority = [new DnsResourceRecord(qname, DnsResourceRecordType.SOA, DnsClass.IN, _defaultTtl, new DnsSOARecordData(_dnsServer.ServerDomain, _dnsServer.ResponsiblePerson.Address, 1, 3600, 900, 86400, _defaultTtl))]; - return new DnsDatagram(response.Identifier, true, response.OPCODE, false, false, response.RecursionDesired, response.RecursionAvailable, false, false, DnsResponseCode.NoError, response.Question, answer, authority) { Tag = response.Tag }; + return new DnsDatagram(response.Identifier, true, response.OPCODE, response.AuthoritativeAnswer, false, response.RecursionDesired, response.RecursionAvailable, false, false, DnsResponseCode.NoError, response.Question, answer, authority) { Tag = response.Tag }; } }