SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolved: when matching up DNSKEY and DS RRs, it's fine if we don't support the DNSKEY's algorithm

Browse Source 
As long as we support the digest we are good.
This commit is contained in:
Lennart Poettering
2015-12-10 11:35:52 +01:00
parent 15accc2765
commit aa89931749
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/resolve/resolved-dns-dnssec.c
+3 -5
View File
@@ -654,16 +654,14 @@ int dnssec_verify_dnskey(DnsResourceRecord *dnskey, DnsResourceRecord *ds) {
if (dnskey->dnskey.protocol != 3)
return -EKEYREJECTED;
if (!dnssec_algorithm_supported(dnskey->dnskey.algorithm))
return -EOPNOTSUPP;
if (!dnssec_digest_supported(ds->ds.digest_type))
return -EOPNOTSUPP;
if (dnskey->dnskey.algorithm != ds->ds.algorithm)
return 0;
if (dnssec_keytag(dnskey) != ds->ds.key_tag)
return 0;
if (!dnssec_digest_supported(ds->ds.digest_type))
return -EOPNOTSUPP;
switch (ds->ds.digest_type) {
case DNSSEC_DIGEST_SHA1: