From: Simon Kelley <simon@thekelleys.org.uk>
Date: Thu, 16 Jul 2015 21:37:37 +0000 (+0100)
Subject: Small tweak to DNSSEC fix.
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d3699bb6bc97172a98b013ce2b53e70ae5f43e83;p=people%2Fms%2Fdnsmasq.git

Small tweak to DNSSEC fix.
---

diff --git a/src/dnssec.c b/src/dnssec.c
index 5fb375c..39b6b51 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -2172,6 +2172,10 @@ int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char
 
 		  rc = validate_rrset(now, header, plen, class, nsec_type, daemon->workspacename, keyname, NULL, NULL, 0, 0, 0);
 
+		  /* NSECs can't be wildcards. */
+		  if (rc == STAT_SECURE_WILDCARD)
+		    rc = STAT_BOGUS;
+
 		  if (rc != STAT_SECURE)
 		    return rc;
 		}