From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Mon, 22 May 2017 16:25:55 +0000 (+0100)
Subject: rec: Don't follow CNAME when fetching DNSKEYs
X-Git-Tag: rec-4.1.0-alpha1~50^2~15
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c7385ddb695aeb562059bc7efad684a306f6ae7d;p=pdns

rec: Don't follow CNAME when fetching DNSKEYs
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 45a1551f8..c9070e3e5 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1596,7 +1596,11 @@ vState SyncRes::getDNSKeys(const DNSName& signer, skeyset_t& keys, unsigned int
   LOG("Retrieving DNSKeys for "<<signer<<endl);
 
   vState state = Indeterminate;
+  /* following CNAME might lead to us to the wrong DNSKEY */
+  bool oldSkipCNAME = d_skipCNAMECheck;
+  d_skipCNAMECheck = true;
   int rcode = doResolve(signer, QType(QType::DNSKEY), records, depth + 1, beenthere, state);
+  d_skipCNAMECheck = oldSkipCNAME;
 
   if (rcode == RCode::NoError) {
     if (state == Secure) {