upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 20:25:55 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Skip revoked keys when selecting DNSKEY in the validation loop

Browse source 
Don't select revoked keys when iterating through DNSKEYs in the DNSSEC
validation routines.
This commit is contained in:
Mark Andrews 2023-11-22 16:59:03 +11:00 committed by Michał Kępień
parent 1b3b0cef22
commit 439e16e4de
No known key found for this signature in database
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/dns/validator.c
View file

@ -1144,6 +1144,8 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
(dns_secalg_t)dst_key_alg(val->key) &&
siginfo->keyid ==
(dns_keytag_t)dst_key_id(val->key) &&
(dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
0 &&
dst_key_iszonekey(val->key))
{
if (foundold) {