From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 5 Sep 2017 14:27:03 +0000 (+0200)
Subject: rec: Add NSEC records on nx-trust cache hits
X-Git-Tag: rec-4.1.0-rc1~50^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F5672%2Fhead;p=thirdparty%2Fpdns.git

rec: Add NSEC records on nx-trust cache hits
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 7a9c781c07..a4c0fdb63f 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -960,17 +960,16 @@ bool SyncRes::doCacheCheck(const DNSName &qname, const QType &qtype, vector<DNSR
       LOG(prefix<<qname<<": Entire name '"<<qname<<"', is negatively cached via '"<<ne.d_auth<<"' for another "<<sttl<<" seconds"<<endl);
       res = RCode::NXDomain;
     }
-    if(d_doDNSSEC) {
-      addTTLModifiedRecords(ne.DNSSECRecords.records, sttl, ret);
-      addTTLModifiedRecords(ne.DNSSECRecords.signatures, sttl, ret);
-    }
   }
 
   if (giveNegative) {
     // Transplant SOA to the returned packet
     addTTLModifiedRecords(ne.authoritySOA.records, sttl, ret);
-    if(d_doDNSSEC)
+    if(d_doDNSSEC) {
       addTTLModifiedRecords(ne.authoritySOA.signatures, sttl, ret);
+      addTTLModifiedRecords(ne.DNSSECRecords.records, sttl, ret);
+      addTTLModifiedRecords(ne.DNSSECRecords.signatures, sttl, ret);
+    }
 
     LOG(prefix<<qname<<": updating validation state with negative cache content for "<<qname<<" to "<<vStates[cachedState]<<endl);
     state = cachedState;