Do not follow CNAME records for ANY or CNAME queries.

The existing logic was only preventing this for CNAME queries. Fixes #5769
PowerDNS · Jan 20, 2025 · d83d2c2 · d83d2c2
1 parent f7822a3
commit d83d2c2
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
@@ -1660,8 +1660,9 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
       if((rr.dr.d_type == p.qtype.getCode() && !rr.auth) || (rr.dr.d_type == QType::NS && (!rr.auth || !(d_sd.qname==rr.dr.d_name))))
         weHaveUnauth=true;
 
-      if(rr.dr.d_type == QType::CNAME && p.qtype.getCode() != QType::CNAME)
-        weRedirected=true;
+      if (rr.dr.d_type == QType::CNAME && (p.qtype.getCode() != QType::ANY && p.qtype.getCode() != QType::CNAME)) {
+        weRedirected = true;
+      }
 
       if (DP && rr.dr.d_type == QType::ALIAS && (p.qtype.getCode() == QType::A || p.qtype.getCode() == QType::AAAA || p.qtype.getCode() == QType::ANY) && !d_dk.isPresigned(d_sd.qname)) {
         if (!d_doExpandALIAS) {