From 860a9a57d6e74e70036a6219a291a4ffde19b436 Mon Sep 17 00:00:00 2001 From: Simon Kelley Date: Thu, 2 Sep 2021 10:07:08 +0100 Subject: [PATCH] Get logging of DNSSEC status right when Checking Disabled bit set. --- src/rfc1035.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rfc1035.c b/src/rfc1035.c index 9b87541..6fc4f26 100644 --- a/src/rfc1035.c +++ b/src/rfc1035.c @@ -629,7 +629,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t if (aqclass == C_IN && res != 2 && (aqtype == T_CNAME || aqtype == T_PTR)) { #ifdef HAVE_DNSSEC - if (option_bool(OPT_DNSSEC_VALID) && daemon->rr_status[j] != 0) + if (option_bool(OPT_DNSSEC_VALID) && !no_cache_dnssec && daemon->rr_status[j] != 0) { /* validated RR anywhere in CNAME chain, don't cache. */ if (cname_short || aqtype == T_CNAME) @@ -747,7 +747,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t } #ifdef HAVE_DNSSEC - if (option_bool(OPT_DNSSEC_VALID) && daemon->rr_status[j] != 0) + if (option_bool(OPT_DNSSEC_VALID) && !no_cache_dnssec && daemon->rr_status[j] != 0) { secflag = F_DNSSECOK;