Don't cache secure replies which we've messsed with.

d1fbb77e · Simon Kelley · 1fbe4d2f · d1fbb77e
Commit d1fbb77e authored Mar 01, 2014 by Simon Kelley
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 5 deletions

src/rfc1035.c src/rfc1035.c +4 -5

No files found.
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -917,8 +917,8 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
      searched_soa = 1;
      ttl = find_soa(header, qlen, name, doctored);
 #ifdef HAVE_DNSSEC
-      if (*doctored)
+      if (*doctored && secure)
-	secure = 0;
+	return 0;
 #endif
    }
@@ -988,9 +988,8 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
 		      if (aqtype == T_CNAME)
 			{
-			  if (!cname_count--)
+			  if (!cname_count-- || secure)
-			    return 0; /* looped CNAMES */
+			    return 0; /* looped CNAMES, or DNSSEC, which we can't cache. */
-			  secflag = 0; /* no longer DNSSEC */
 			  goto cname_loop;
 			}