Ignore revoked keys when looking for predecessors

An rrset signed with a revoked key is not properly signed. Ignore revoked keys with looking for predecessors.
2025-02-24 17:58:49 +11:00
1 changed files with 4 additions and 0 deletions
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -750,6 +750,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				 * - Have the ZSK type (iszsk).
 				 * - Have key ID equal to the predecessor id.
 				 * - Have a successor that matches 'key' id.
+				 * - Must not be revoked.
 				 */
 				for (curr = ISC_LIST_HEAD(keylist);
 				     curr != NULL;
@@ -764,6 +765,9 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 					{
 						continue;
 					}
+					if (REVOKE(curr->key)) {
+						continue;
+					}
 					ret = dst_key_getnum(curr->key,
 							     DST_NUM_SUCCESSOR,
 							     &suc);