Only active secure data should block negative cache entries

Expired secure headers linger in the node's header list until they
are reaped, so the secure-data check could match a header already
past its TTL, reject the new negative entry, and hand the expired
data back to the caller. Require the matching header to be active.

diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index ad0768d36f9480ad78ec64754ddb2a34833f99e9..f99989421dc82328091a3188837f35b245b9e1eb 100644 (file)
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -2329,7 +2329,9 @@ add(qpcache_t *qpdb, qpcnode_t *qpnode, dns_slabheader_t *newheader,
            rdtype == dns_rdatatype_any && trust < dns_trust_secure)
        {
                DNS_SLABHEADER_FOREACH(header, &qpnode->headers) {
-                       if (header_trust(header) >= dns_trust_secure) {
+                       if (ACTIVE(header, now) &&
+                           header_trust(header) >= dns_trust_secure)
+                       {
                                qpcache_hit(qpdb, header);
                                bindrdataset(qpdb, qpnode, header, now,
                                             nlocktype, tlocktype,