Move onto the next RRSIG on DNS_R_SIGEXPIRED or DNS_R_SIGFUTURE

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index a71e52f25fe9520c652d97379ff3a7406b24b828..62647270a075064c4b0a17daf21525c764fb25e7 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1590,6 +1590,10 @@ validate_answer(dns_validator_t *val, bool resume) {
                }
 
                vresult = verify(val, val->key, &rdata, val->siginfo->keyid);
+               if (vresult == DNS_R_SIGEXPIRED || vresult == DNS_R_SIGFUTURE) {
+                       resume = false;
+                       continue;
+               }
                if (vresult != ISC_R_SUCCESS) {
                        val->failed = true;
                        validator_log(val, ISC_LOG_DEBUG(3),