Skip to content
Snippets Groups Projects

prevent bogus RRsets from leaking into answers

Merged prevent bogus RRsets from leaking into answers
bogus-clean-v3 into master
Merged Petr Špaček requested to merge bogus-clean-v3 into master
  1. Apr 15, 2020
    • Petr Špaček's avatar
      validator: use rank BOGUS where appropriate instead of MISSING · cce8d935
      Petr Špaček authored 
      MISSING triggers re-query to auth in attempt to find missing RRSIGs.
It causes reduntant queries and also puts some BOGUS RRsets in answers.
(It sounds bad but we were correctly setting rcode=SERVFAIL and AD=0
even before this commit.)

Formerly RRSIG ranks did not reflect results of validation.
Now we mark them as BOGUS and upgrade them to SECURE if they validate.

New validator phase answer_finalize prevents BOGUS RRsets from being
put even into SERVFAIL answers.

Closes: #396
      Verified
      cce8d935