Take configured minimum TTL into consideration when reducing TTL to original

TTL from RRSIG.

git-svn-id: file:///svn/unbound/trunk@3849 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index aff2078439ab5d47f5a97b5cc8f344bc8919a40a..248ed13b12449093f2fd397e273b07b9e1c0e167 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+5 September 2016: Ralph
+       - Take configured minimum TTL into consideration when reducing TTL
+         to original TTL from RRSIG.
+
 5 September 2016: Wouter
        - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
          off-by-one typo, from Jinmei Tatuya (Infoblox).

diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 1dd07b420bd5c3fedbc4e67b35683c0dda13d450..e60f3f9369c65b768469f89a0e1f63dba889346d 100644 (file)
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1283,15 +1283,23 @@ adjust_ttl(struct val_env* ve, uint32_t unow,
        /* so now:
         * d->ttl: rrset ttl read from message or cache. May be reduced
         * origttl: original TTL from signature, authoritative TTL max.
+        * MIN_TTL: minimum TTL from config.
         * expittl: TTL until the signature expires.
         *
-        * Use the smallest of these.
+        * Use the smallest of these, but don't let origttl set the TTL
+        * below the minimum.
         */
-       if(d->ttl > (time_t)origttl) {
-               verbose(VERB_QUERY, "rrset TTL larger than original TTL,"
-                       " adjusting TTL downwards");
+       if(MIN_TTL > (time_t)origttl && d->ttl > MIN_TTL) {
+               verbose(VERB_QUERY, "rrset TTL larger than original and minimum"
+                       " TTL, adjusting TTL downwards to mimimum ttl");
+               d->ttl = MIN_TTL;
+       }
+       else if(MIN_TTL <= origttl && d->ttl > (time_t)origttl) {
+               verbose(VERB_QUERY, "rrset TTL larger than original TTL, "
+               "adjusting TTL downwards to original ttl");
                d->ttl = origttl;
        }
+
        if(expittl > 0 && d->ttl > (time_t)expittl) {
                verbose(VERB_ALGO, "rrset TTL larger than sig expiration ttl,"
                        " adjusting TTL downwards");