diff options
| -rw-r--r-- | src/resolve/resolved-link.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c index 928307e004..1e8f88024b 100644 --- a/src/resolve/resolved-link.c +++ b/src/resolve/resolved-link.c @@ -279,6 +279,7 @@ clear: static int link_update_dnssec_mode(Link *l) { _cleanup_free_ char *m = NULL; + DnssecMode mode; int r; assert(l); @@ -291,12 +292,23 @@ static int link_update_dnssec_mode(Link *l) { if (r < 0) goto clear; - l->dnssec_mode = dnssec_mode_from_string(m); - if (l->dnssec_mode < 0) { + mode = dnssec_mode_from_string(m); + if (mode < 0) { r = -EINVAL; goto clear; } + if ((l->dnssec_mode == DNSSEC_NO && mode != DNSSEC_NO) || + (l->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE && mode == DNSSEC_YES)) { + + /* When switching from non-DNSSEC mode to DNSSEC mode, flush the cache. Also when switching from the + * allow-downgrade mode to full DNSSEC mode, flush it too. */ + if (l->unicast_scope) + dns_cache_flush(&l->unicast_scope->cache); + } + + l->dnssec_mode = mode; + return 0; clear: |