Fix DNSSEC caching problems: incomplete RRSIG RRsets.

src/cache.c

@@ -460,7 +460,7 @@ struct crec *cache_insert(char *name, struct all_addr *addr,
     return NULL;
   
   /* First remove any expired entries and entries for the name/address we
-     are currently inserting. Fail is we attempt to delete a name from
+     are currently inserting. Fail if we attempt to delete a name from
      /etc/hosts or DHCP. */
   if (!cache_scan_free(name, addr, now, flags))
     {

src/dnssec.c

@@ -1168,6 +1168,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 			       type_covered == T_DNSKEY || type_covered == T_PTR)) 
 			    {
 			      a.addr.dnssec.type = type_covered;
+			      a.addr.dnssec.class = class1;
 			      
 			      algo = *p2++;
 			      p2 += 13; /* labels, orig_ttl, expiration, inception */

src/rfc1035.c

@@ -1551,33 +1551,29 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
 	}
 
 #ifdef HAVE_DNSSEC
-      if (option_bool(OPT_DNSSEC_VALID) && (qtype == T_DNSKEY || qtype == T_DS || qtype == T_RRSIG))
+      if (option_bool(OPT_DNSSEC_VALID) && (qtype == T_DNSKEY || qtype == T_DS))
 	{
-	  int gotone = 0, have_rrsig = 0;
+	  int gotone = 0;
 	  struct blockdata *keydata;
 
 	  /* Do we have RRSIG? Can't do DS or DNSKEY otherwise. */
+	  if (sec_reqd)
+	    {
 	      crecp = NULL;
 	      while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY | F_DS)))
-	    if (crecp->uid == qclass && (qtype == T_RRSIG || crecp->addr.sig.type_covered == qtype))
-	      {
-		have_rrsig = 1;
+		if (crecp->uid == qclass && crecp->addr.sig.type_covered == qtype)
 		  break;
 	    }
 	  
-	  if (qtype == T_RRSIG && have_rrsig)
+	  if (!sec_reqd || crecp)
 	    {
-	      ans = gotone = 1;
-	      auth = 0;
-	    }
-	  else if (qtype == T_DS && have_rrsig)
+	      if (qtype == T_DS)
 		{
-	      auth = 0;
 		  crecp = NULL;
 		  while ((crecp = cache_find_by_name(crecp, name, now, F_DS)))
 		    if (crecp->uid == qclass)
 		      {
-		    ans = gotone = 1;
+			gotone = 1;
 			if (!dryrun && (keydata = blockdata_retrieve(crecp->addr.ds.keydata, crecp->addr.ds.keylen, NULL)))
 			  {			     			      
 			    struct all_addr a;
@@ -1592,17 +1588,15 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
 			  } 
 		      }
 		}
-	  else if (qtype == T_DNSKEY)
+	      else /* DNSKEY */
 		{
 		  crecp = NULL;
 		  while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY)))
 		    if (crecp->uid == qclass)
 		      {
-		    if ((crecp->flags & F_CONFIG) || have_rrsig) /* Return configured keys without an RRISG */
+			if (!(crecp->flags & F_CONFIG)) /* Don't return configured keys - send upstream instead */
 			  {
-			if (!(crecp->flags & F_CONFIG))
-			  auth = 0, gotone = 1;
-			ans = 1;
+			    gotone = 1;
 			    if (!dryrun && (keydata = blockdata_retrieve(crecp->addr.key.keydata, crecp->addr.key.keylen, NULL)))
 			      {			     			      
 				struct all_addr a;
@@ -1617,26 +1611,28 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
 			  }
 		      }
 		}
+	    }
 	  
 	  /* Now do RRSIGs */
 	  if (gotone)
+	    {
+	      ans = 1;
+	      auth = 0;
+	      if (!dryrun && sec_reqd)
 		{
 		  crecp = NULL;
 		  while ((crecp = cache_find_by_name(crecp, name, now, F_DNSKEY | F_DS)))
-		if (crecp->uid == qclass && (qtype == T_RRSIG || (sec_reqd && crecp->addr.sig.type_covered == qtype)) &&
-		    !dryrun &&
+		    if (crecp->uid == qclass && crecp->addr.sig.type_covered == qtype &&
 			(keydata = blockdata_retrieve(crecp->addr.sig.keydata, crecp->addr.sig.keylen, NULL)))
 		      {
-		    if (qtype == T_RRSIG)
-		      log_query(F_RRNAME, name, NULL, querystr("rrsig", crecp->addr.sig.type_covered));
-		    if ((keydata = blockdata_retrieve(crecp->addr.sig.keydata, crecp->addr.sig.keylen, NULL)) &&
 			add_resource_record(header, limit, &trunc, nameoffset, &ansp, 
 					    crec_ttl(crecp, now), &nameoffset,
-					    T_RRSIG, qclass, "t", crecp->addr.sig.keylen, keydata))
+					    T_RRSIG, qclass, "t", crecp->addr.sig.keylen, keydata);
 			anscount++;
 		      }
 		}
 	    }
+	}
 #endif	     
       
       if (qclass == C_IN)