d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge upstream r4302 to support multiple concurrently valid anchors.

Browse Source 
If an unpatched unbound-anchor is run without a preexisting root anchor
between 2017-09-11 and 2017-10-11, it will fail and Unbound will not be
able to start unless the validator is disabled.  An EN will be issued
with patches for existing systems and information on how to work around
the issue on new installations.
This commit is contained in:
Dag-Erling Smørgrav 2017-08-31 12:02:14 +00:00
commit e8a699bb6e
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
contrib/unbound/validator/autotrust.c
View File

@ -1571,6 +1571,11 @@ key_matches_a_ds(struct module_env* env, struct val_env* ve,
verbose(VERB_ALGO, "DS match attempt failed");
continue;
}
/* match of hash is sufficient for bootstrap of trust point */
(void)reason;
(void)ve;
return 1;
/* no need to check RRSIG, DS hash already matched with source
if(dnskey_verify_rrset(env, ve, dnskey_rrset,
dnskey_rrset, key_idx, &reason) == sec_status_secure) {
return 1;
@ -1578,6 +1583,7 @@ key_matches_a_ds(struct module_env* env, struct val_env* ve,
verbose(VERB_ALGO, "DS match failed because the key "
"does not verify the keyset: %s", reason);
}
*/
}
return 0;
}