don't accidentally increase repttl if it was small because of another (short-ttl) RRset in the reply.  There would be cache replies trying to work with expired RRsets if this extra if wasn't there.
@@ -337,6 +337,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
for(i=0; i<rrset_data->count+rrset_data->rrsig_count; i++)
rrset_data->rr_ttl[i] = qstate->env->cfg->ipsecmod_max_ttl;
/* Also update reply_info's TTL */
+ if(qstate->return_msg->rep->ttl > (time_t)qstate->env->cfg->ipsecmod_max_ttl) {
qstate->return_msg->rep->ttl =
qstate->env->cfg->ipsecmod_max_ttl;
qstate->return_msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(
@@ -344,6 +345,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
}
}
}
+ }
/* Store A/AAAA in cache. */
if(!dns_cache_store(qstate->env, &qstate->qinfo,
qstate->return_msg->rep, 0, qstate->prefetch_leeway,
