mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

[master] fixed revoked key regression

Browse Source 
4436.	[bug]		Fixed a regression introduced in change #4337 which
			caused signed domains with revoked KSKs to fail
			validation. [RT #42147]
This commit is contained in:
Evan Hunt
2016-04-14 18:52:52 -07:00
parent fb7e1d0e71
commit 3cd204c4a4
9 changed files with 66 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
lib/dns/view.c
View File

@@ -1931,15 +1931,29 @@ dns_view_untrust(dns_view_t *view, dns_name_t *keyname,
isc_buffer_init(&buffer, data, sizeof(data));
dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
dns_rdatatype_dnskey, dnskey, &buffer);
result = dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &key);
if (result != ISC_R_SUCCESS)
return;
result = dns_view_getsecroots(view, &sr);
if (result == ISC_R_SUCCESS) {
dns_keytable_deletekeynode(sr, key);
dns_keytable_marksecure(sr, keyname);
result = dns_keytable_deletekeynode(sr, key);
/*
* If key was found in secroots, then it was a
* configured trust anchor, and we want to fail
* secure. If there are no other configured keys,
* then leave a null key so that we can't validate
* anymore.
*/
if (result == ISC_R_SUCCESS)
dns_keytable_marksecure(sr, keyname);
dns_keytable_detach(&sr);
}
dst_key_free(&key);
}