mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 05:57:52 +00:00
Code Issues Releases Wiki Activity

2720. [bug] RFC 5011 trust anchor updates could trigger an

Browse Source 
assert if the DNSKEY record was unsigned. [RT #20406]
This commit is contained in:
Evan Hunt 2009-10-20 04:13:38 +00:00
parent 859cfb24bf
commit bfbd69c43f
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@ -1,3 +1,6 @@
2720. [bug] RFC 5011 trust anchor updates could trigger an
assert if the DNSKEY record was unsigned. [RT #20406]
2719. [func] Skip trusted/managed keys for unsupported algorithms.
[RT #20392]

14
lib/dns/zone.c
View File

@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: zone.c,v 1.518 2009/10/20 02:45:06 marka Exp $ */
/* $Id: zone.c,v 1.519 2009/10/20 04:13:38 each Exp $ */
/*! \file */
@ -7042,7 +7042,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
dns_diff_init(zone->mctx, &diff);
/* Fetch failed */
if (eresult != ISC_R_SUCCESS) {
if (eresult != ISC_R_SUCCESS ||
!dns_rdataset_isassociated(&kfetch->dnskeyset)) {
dns_zone_log(zone, ISC_LOG_WARNING,
"Unable to fetch DNSKEY set "
"'%s': %s", namebuf, dns_result_totext(eresult));
@ -7050,6 +7051,15 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
goto failure;
}
/* No RRSIGs found */
if (!dns_rdataset_isassociated(&kfetch->dnskeysigset)) {
dns_zone_log(zone, ISC_LOG_WARNING,
"No DNSKEY RRSIGs found for "
"'%s': %s", namebuf, dns_result_totext(eresult));
CHECK(minimal_update(kfetch, ver, &diff));
goto failure;
}
/*
* Validate the dnskeyset against the current trusted keys.
* (Note, if a key has been revoked and isn't RSAMD5, then