resolved: fix DNSSEC missing-key error

Skip unsupport/invalid `DS` and `DNSKEY` combinations during verification.

Fixes: #12545
This commit is contained in:
Fabian Möller
2025-02-05 22:11:55 +01:00
committed by Lennart Poettering
parent e678a46f51
commit cac3b43eee
+1 -1
View File
@@ -1470,7 +1470,7 @@ int dnssec_verify_dnskey_by_ds_search(DnsResourceRecord *dnskey, DnsAnswer *vali
r = dnssec_verify_dnskey_by_ds(dnskey, ds, false);
if (IN_SET(r, -EKEYREJECTED, -EOPNOTSUPP))
return 0; /* The DNSKEY is revoked or otherwise invalid, or we don't support the digest algorithm */
continue; /* The DNSKEY is revoked or otherwise invalid, or we don't support the digest algorithm */
if (r < 0)
return r;
if (r > 0)