Postpone RRSIG processing after all DNSKEY/DS have been parsed.

src/dnssec.c

@@ -382,7 +382,22 @@ int dnssec_validate(struct dns_header *header, size_t pktlen)
           printf("DNSKEY found\n");
           dnssec_parsekey(header, pktlen, owner, ttl, rdlen, p);
         }
-      else if (qtype == T_RRSIG)
+      p += rdlen;
+    }
+
+  /* After we have parsed DNSKEY/DS records, start looking for RRSIGs.
+     We want to do this in a separate step because we want the cache
+     to be already populated with DNSKEYs before parsing signatures. */
+  p = reply;
+  for (i = 0; i < ntohs(header->ancount); i++)
+    {
+      if (!extract_name(header, pktlen, &p, owner, 1, 10))
+        return 0;
+      GETSHORT(qtype, p);
+      GETSHORT(qclass, p);
+      GETLONG(ttl, p);
+      GETSHORT(rdlen, p);
+      if (qtype == T_RRSIG)
         {
           printf("RRSIG found\n");
           /* TODO: missing logic. We should only validate RRSIGs for which we
@@ -394,5 +409,6 @@ int dnssec_validate(struct dns_header *header, size_t pktlen)
         }
       p += rdlen;
     }
+
   return 1;
 }