diff options
Diffstat (limited to 'services/cache')
| -rw-r--r-- | services/cache/dns.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/services/cache/dns.c b/services/cache/dns.c index 47611ac5aef5..aa4efec73f41 100644 --- a/services/cache/dns.c +++ b/services/cache/dns.c @@ -40,6 +40,7 @@ */ #include "config.h" #include "iterator/iter_delegpt.h" +#include "iterator/iter_utils.h" #include "validator/val_nsec.h" #include "validator/val_utils.h" #include "services/cache/dns.h" @@ -728,6 +729,8 @@ fill_any(struct module_env* env, if(!msg) { return NULL; } + /* set NOTIMPL for RFC 8482 */ + msg->rep->flags |= LDNS_RCODE_NOTIMPL; msg->rep->security = sec_status_indeterminate; return msg; } @@ -912,12 +915,15 @@ dns_cache_lookup(struct module_env* env, struct dns_msg* msg; if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN && data->security == sec_status_secure + && (data->an_numrrsets == 0 || + ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME) && (msg=tomsg(env, &k, data, region, now, scratch))){ lock_rw_unlock(&e->lock); msg->qinfo.qname=qname; msg->qinfo.qname_len=qnamelen; /* check that DNSSEC really works out */ msg->rep->security = sec_status_unchecked; + iter_scrub_nxdomain(msg); return msg; } lock_rw_unlock(&e->lock); |