ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Fix bug in keymgr_key_has_successor

Browse Source 
The logic in `keymgr_key_has_successor(key, keyring)` is flawed, it
returns true if there is any key in the keyring that has a successor,
while what we really want here is to make sure that the given key
has a successor in the given keyring.

Rather than relying on `keymgr_key_exists_with_state`, walk the
list of keys in the keyring and check if the key is a successor of
the given predecessor key.

(cherry picked from commit 0d578097ef)
This commit is contained in:
Matthijs Mekking
2020-05-14 15:06:54 +02:00
parent f20420c3de
commit 168d362b54
4 changed files with 26 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lib/dns/keymgr.c
View File

@@ -633,11 +633,16 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
* Check if a key has a successor.
*/
static bool
keymgr_key_has_successor(dns_dnsseckey_t *key, dns_dnsseckeylist_t *keyring) {
/* Don't worry about key states. */
dst_key_state_t na[4] = { NA, NA, NA, NA };
return (keymgr_key_exists_with_state(keyring, key, DST_KEY_DNSKEY, NA,
na, na, true, true));
keymgr_key_has_successor(dns_dnsseckey_t *predecessor,
dns_dnsseckeylist_t *keyring) {
for (dns_dnsseckey_t *successor = ISC_LIST_HEAD(*keyring);
successor != NULL; successor = ISC_LIST_NEXT(successor, link))
{
if (keymgr_key_is_successor(predecessor->key, successor->key)) {
return (true);
}
}
return (false);
}
/*