From d768d7f2ad094b089e4f99aa4f9a20271da9b40b Mon Sep 17 00:00:00 2001 From: Kees Monshouwer Date: Thu, 12 Mar 2015 17:38:51 +0100 Subject: [PATCH] NSEC3 and related RRSIGS are not part of the dnstree --- pdns/packethandler.cc | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc index 12760ec8b..2a85cdfed 100644 --- a/pdns/packethandler.cc +++ b/pdns/packethandler.cc @@ -1159,12 +1159,10 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse) weDone = weRedirected = weHaveUnauth = 0; while(B.get(rr)) { - if (p->qtype.getCode() == QType::ANY) { - if (rr.qtype.getCode() == QType::RRSIG) // RRSIGS are added later any way. - continue; // TODO: this actually means addRRSig should check if the RRSig is already there. - if (!p->d_dnssecOk && (rr.qtype.getCode() == QType:: DNSKEY || rr.qtype.getCode() == QType::NSEC3PARAM)) - continue; // Don't send dnssec info to non validating resolvers. - } + if (p->qtype.getCode() == QType::ANY && !p->d_dnssecOk && (rr.qtype.getCode() == QType:: DNSKEY || rr.qtype.getCode() == QType::NSEC3PARAM)) + continue; // Don't send dnssec info to non validating resolvers. + if (rr.qtype.getCode() == QType::RRSIG) // RRSIGS are added later any way. + continue; // TODO: this actually means addRRSig should check if the RRSig is already there // cerr<<"Auth: "<qtype)<<", "<qtype.getCode() == QType::ANY || rr.qtype == p->qtype) && rr.auth) -- 2.40.0