ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

4837. [bug] dns_update_signatures{inc} (add_sigs) was not

Browse Source 
properly determining if there were active KSK and
                        ZSK keys for a algorithm when update-check-ksk is
                        true (default) leaving records unsigned. [RT #46743]

(cherry picked from commit 196e01da5f)
(cherry picked from commit bf459d24a1)
(cherry picked from commit 5623f65cc4)
This commit is contained in:
Mark Andrews
2017-12-04 10:09:45 +11:00
parent 53495041f9
commit 5ed673c0d2
9 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/update.c
+6
View File
@@ -1112,6 +1112,8 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
if (!dst_key_isprivate(keys[i]))
continue;
if (dst_key_inactive(keys[i])) /* Should be redundant. */
continue;
if (check_ksk && !REVOKE(keys[i])) {
isc_boolean_t have_ksk, have_nonksk;
@@ -1125,6 +1127,10 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
for (j = 0; j < nkeys; j++) {
if (j == i || ALG(keys[i]) != ALG(keys[j]))
continue;
if (!dst_key_isprivate(keys[j]))
continue;
if (dst_key_inactive(keys[j])) /* SBR */
continue;
if (REVOKE(keys[j]))
continue;
if (KSK(keys[j]))