Fixup TTL too large bug for bogus responses.

git-svn-id: file:///svn/unbound/trunk@1822 be551aaa-1e26-0410-a405-d3ace91eadb9

doc/Changelog

@@ -1,3 +1,9 @@
+9 September 2009: Wouter
+	- Fix bug where DNSSEC-bogus messages were marked with too high TTL.
+	  The RRsets would still expire at the normal time, but this would
+	  keep messages bogus in the cache for too long.
+	- regression test for that bug.
+
 8 September 2009: Wouter
 	- fixup printing errors when load_cache, they were printed to the
 	  SSL connection which broke, now to the log.

services/cache/dns.c

@@ -673,6 +673,8 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 	rep = reply_info_copy(msgrep, env->alloc, NULL);
 	if(!rep)
 		return 0;
+	/* ttl must be relative ;i.e. 0..86400 not  time(0)+86400. 
+	 * the env->now is added to message and RRsets in this routine. */
 
 	if(is_referral) {
 		/* store rrsets */

validator/validator.c

@@ -1825,7 +1825,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	/* if the result is bogus - set message ttl to bogus ttl to avoid
 	 * endless bogus revalidation */
 	if(vq->orig_msg->rep->security == sec_status_bogus) {
-		vq->orig_msg->rep->ttl = *qstate->env->now + ve->bogus_ttl;
+		vq->orig_msg->rep->ttl = ve->bogus_ttl;
 		if(qstate->env->cfg->val_log_level >= 1) {
 			log_query_info(0, "validation failure", &qstate->qinfo);
 		}