upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-03 22:08:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Check key tag range when matching dnssec keys to kasp keys

Browse source
This commit is contained in:
Mark Andrews 2024-08-07 16:57:45 +10:00
parent c5bc0a1805
commit 035289be71
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/dns/kasp.c
View file

@ -544,6 +544,16 @@ dns_kasp_key_match(dns_kasp_key_t *key, dns_dnsseckey_t *dkey) {
if (ret != ISC_R_SUCCESS || role != dns_kasp_key_zsk(key)) {
return (false);
}
/* Valid key tag range? */
uint16_t id = dst_key_id(dkey->key);
uint16_t rid = dst_key_rid(dkey->key);
if (id < key->tag_min || id > key->tag_max) {
return (false);
}
if (rid < key->tag_min || rid > key->tag_max) {
return (false);
}
/* Found a match. */
return (true);
}