From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 5 Jan 2016 23:57:21 +0000 (+0100)
Subject: resolved: count unsupported dnssec algorithm as indeterminate RRset
X-Git-Tag: v231~802^2~6
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e497292abac908cae4f814bcdda2654ffb4bef0b;p=platform%2Fupstream%2Fsystemd.git

resolved: count unsupported dnssec algorithm as indeterminate RRset

After all, when we don't support the algorithm we cannot determine
validity.
---

diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c
index 7212fb9..8631afa 100644
--- a/src/resolve/resolved-dns-transaction.c
+++ b/src/resolve/resolved-dns-transaction.c
@@ -2404,10 +2404,9 @@ int dns_transaction_validate_dnssec(DnsTransaction *t) {
                                 if (IN_SET(result,
                                            DNSSEC_INVALID,
                                            DNSSEC_SIGNATURE_EXPIRED,
-                                           DNSSEC_NO_SIGNATURE,
-                                           DNSSEC_UNSUPPORTED_ALGORITHM))
+                                           DNSSEC_NO_SIGNATURE))
                                         t->scope->manager->n_dnssec_bogus++;
-                                else
+                                else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
                                         t->scope->manager->n_dnssec_indeterminate++;
 
                                 r = dns_transaction_is_primary_response(t, rr);