|
 |
5fe83d |
From 02b8356a19b119d895d611c9ce17f24a207faa6d Mon Sep 17 00:00:00 2001
|
|
|
5fe83d |
From: Mark Andrews <marka@isc.org>
|
|
|
5fe83d |
Date: Tue, 23 Jun 2020 10:26:01 +1000
|
|
|
5fe83d |
Subject: [PATCH] The validator could fail when select_signing_key/get_dst_key
|
|
|
5fe83d |
failed
|
|
|
5fe83d |
|
|
|
5fe83d |
to select the signing key because the algorithm was not supported
|
|
|
5fe83d |
and the loop was prematurely aborted.
|
|
|
5fe83d |
|
|
|
5fe83d |
(cherry picked from commit d475f3aeedbb0dff940ff5bd25c71fcfc3a71f95)
|
|
|
5fe83d |
---
|
|
|
5fe83d |
lib/dns/validator.c | 33 ++++++++++++++++-----------------
|
|
|
5fe83d |
1 file changed, 16 insertions(+), 17 deletions(-)
|
|
|
5fe83d |
|
|
|
5fe83d |
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
|
|
|
5fe83d |
index 864301ba1b..092de65172 100644
|
|
|
5fe83d |
--- a/lib/dns/validator.c
|
|
|
5fe83d |
+++ b/lib/dns/validator.c
|
|
|
5fe83d |
@@ -1651,26 +1651,25 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
|
|
|
5fe83d |
INSIST(val->key == NULL);
|
|
|
5fe83d |
result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
|
|
|
5fe83d |
val->view->mctx, &val->key);
|
|
|
5fe83d |
- if (result != ISC_R_SUCCESS)
|
|
|
5fe83d |
- goto failure;
|
|
|
5fe83d |
- if (siginfo->algorithm ==
|
|
|
5fe83d |
- (dns_secalg_t)dst_key_alg(val->key) &&
|
|
|
5fe83d |
- siginfo->keyid ==
|
|
|
5fe83d |
- (dns_keytag_t)dst_key_id(val->key) &&
|
|
|
5fe83d |
- dst_key_iszonekey(val->key))
|
|
|
5fe83d |
- {
|
|
|
5fe83d |
- if (foundold)
|
|
|
5fe83d |
- /*
|
|
|
5fe83d |
- * This is the key we're looking for.
|
|
|
5fe83d |
- */
|
|
|
5fe83d |
- return (ISC_R_SUCCESS);
|
|
|
5fe83d |
- else if (dst_key_compare(oldkey, val->key) == ISC_TRUE)
|
|
|
5fe83d |
+ if (result == ISC_R_SUCCESS) {
|
|
|
5fe83d |
+ if (siginfo->algorithm ==
|
|
|
5fe83d |
+ (dns_secalg_t)dst_key_alg(val->key) &&
|
|
|
5fe83d |
+ siginfo->keyid ==
|
|
|
5fe83d |
+ (dns_keytag_t)dst_key_id(val->key) &&
|
|
|
5fe83d |
+ dst_key_iszonekey(val->key))
|
|
|
5fe83d |
{
|
|
|
5fe83d |
- foundold = ISC_TRUE;
|
|
|
5fe83d |
- dst_key_free(&oldkey);
|
|
|
5fe83d |
+ if (foundold) {
|
|
|
5fe83d |
+ /*
|
|
|
5fe83d |
+ * This is the key we're looking for.
|
|
|
5fe83d |
+ */
|
|
|
5fe83d |
+ return (ISC_R_SUCCESS);
|
|
|
5fe83d |
+ } else if (dst_key_compare(oldkey, val->key)) {
|
|
|
5fe83d |
+ foundold = ISC_TRUE;
|
|
|
5fe83d |
+ dst_key_free(&oldkey);
|
|
|
5fe83d |
+ }
|
|
|
5fe83d |
}
|
|
|
5fe83d |
+ dst_key_free(&val->key);
|
|
|
5fe83d |
}
|
|
|
5fe83d |
- dst_key_free(&val->key);
|
|
|
5fe83d |
dns_rdata_reset(&rdata);
|
|
|
5fe83d |
result = dns_rdataset_next(rdataset);
|
|
|
5fe83d |
} while (result == ISC_R_SUCCESS);
|
|
|
5fe83d |
--
|
|
|
5fe83d |
2.26.2
|
|
|
5fe83d |
|