summaryrefslogtreecommitdiff
path: root/src/resolve
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-01-15 21:07:21 +0100
committerLennart Poettering <lennart@poettering.net>2016-01-17 20:47:46 +0100
commit2e1bab34bdb1a5e849060afa8361b865ce39f87f (patch)
treefffb634dc781c97b4f4af882eee6dd52558b28a7 /src/resolve
parentc02cf2f41fc9b4c33a3c353b6181847733d65e8c (diff)
resolved: when switching between DNSSEC modes, possibly flush caches
If the networkd configuration changes during runtime, make sure to flush all caches when we switch from a less trusted to a more trusted mode.
Diffstat (limited to 'src/resolve')
-rw-r--r--src/resolve/resolved-link.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c
index 928307e004..1e8f88024b 100644
--- a/src/resolve/resolved-link.c
+++ b/src/resolve/resolved-link.c
@@ -279,6 +279,7 @@ clear:
static int link_update_dnssec_mode(Link *l) {
_cleanup_free_ char *m = NULL;
+ DnssecMode mode;
int r;
assert(l);
@@ -291,12 +292,23 @@ static int link_update_dnssec_mode(Link *l) {
if (r < 0)
goto clear;
- l->dnssec_mode = dnssec_mode_from_string(m);
- if (l->dnssec_mode < 0) {
+ mode = dnssec_mode_from_string(m);
+ if (mode < 0) {
r = -EINVAL;
goto clear;
}
+ if ((l->dnssec_mode == DNSSEC_NO && mode != DNSSEC_NO) ||
+ (l->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE && mode == DNSSEC_YES)) {
+
+ /* When switching from non-DNSSEC mode to DNSSEC mode, flush the cache. Also when switching from the
+ * allow-downgrade mode to full DNSSEC mode, flush it too. */
+ if (l->unicast_scope)
+ dns_cache_flush(&l->unicast_scope->cache);
+ }
+
+ l->dnssec_mode = mode;
+
return 0;
clear: