Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
resolved: probe for dnssec support in allow-downgrade mode
Previously, sd-resolved unnecessarily requested SOA records for each dns label in the query, even though they are not needed for the chain of trust. Since 4769063, only the necessary records are queried when validating. This is actually a problem in allow-downgrade mode, since we will no longer attempt a query for a record that we know is signed a priori, and will therefore never update our belief about the state of dnssec support in the recursive resolver. Rectify this by reintroducing a query for the the root zone SOA in the allow-downgrade case, specifically to test that the resolver attaches the RRSIGs which we know must exist. Fixes: 4769063 ("resolved: don't request the SOA for every dns label")
- Loading branch information