From: bert hubert <bert.hubert@netherlabs.nl>
Date: Mon, 22 Feb 2016 14:27:42 +0000 (+0100)
Subject: don't add NSEC/NSEC3 unless the packet asked for DNSSEC records
X-Git-Tag: rec-4.0.0-alpha2~62^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=51e1e6dd9e631b5e0000910dbd70d93b6a794a60;p=thirdparty%2Fpdns.git

don't add NSEC/NSEC3 unless the packet asked for DNSSEC records
---

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index ea0aadd085..4332fd714f 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1331,13 +1331,15 @@ int SyncRes::doResolveAt(map<DNSName, pair<ComboAddress, bool> > &nameservers, D
       if(lwr.d_rcode==RCode::NXDomain) {
         LOG(prefix<<qname.toString()<<": status=NXDOMAIN, we are done "<<(negindic ? "(have negative SOA)" : "")<<endl);
 
-	addNXNSECS(ret, lwr.d_records);
+        if(d_doDNSSEC)
+          addNXNSECS(ret, lwr.d_records);
 
         return RCode::NXDomain;
       }
       if(nsset.empty() && !lwr.d_rcode && (negindic || lwr.d_aabit || sendRDQuery)) {
         LOG(prefix<<qname.toString()<<": status=noerror, other types may exist, but we are done "<<(negindic ? "(have negative SOA) " : "")<<(lwr.d_aabit ? "(have aa bit) " : "")<<endl);
-	addNXNSECS(ret, lwr.d_records);
+        if(d_doDNSSEC)
+          addNXNSECS(ret, lwr.d_records);
         return 0;
       }
       else if(realreferral) {