72 lines
2.4 KiB
Diff
72 lines
2.4 KiB
Diff
|
Description: fix assertion failure when a trust anchor rolls over to an
|
||
|
|
unsupported key algorithm when using managed-keys
|
||
|
|
Origin: provided by ISC
|
||
|
|
|
||
|
|
Index: bind9-9.11.4+dfsg/lib/dns/include/dst/dst.h
|
||
|
|
===================================================================
|
||
|
|
--- bind9-9.11.4+dfsg.orig/lib/dns/include/dst/dst.h 2019-02-20 09:01:27.450680701 +0100
|
||
|
|
+++ bind9-9.11.4+dfsg/lib/dns/include/dst/dst.h 2019-02-20 09:01:27.446680698 +0100
|
||
|
|
@@ -67,8 +67,7 @@ typedef struct dst_context dst_context_
|
||
|
|
#define DST_ALG_HMACSHA512 165 /* XXXMPA */
|
||
|
|
#define DST_ALG_INDIRECT 252
|
||
|
|
#define DST_ALG_PRIVATE 254
|
||
|
|
-#define DST_ALG_EXPAND 255
|
||
|
|
-#define DST_MAX_ALGS 255
|
||
|
|
+#define DST_MAX_ALGS 256
|
||
|
|
|
||
|
|
/*% A buffer of this size is large enough to hold any key */
|
||
|
|
#define DST_KEY_MAXSIZE 1280
|
||
|
|
Index: bind9-9.11.4+dfsg/lib/dns/zone.c
|
||
|
|
===================================================================
|
||
|
|
--- bind9-9.11.4+dfsg.orig/lib/dns/zone.c 2019-02-20 09:01:27.450680701 +0100
|
||
|
|
+++ bind9-9.11.4+dfsg/lib/dns/zone.c 2019-02-20 09:01:27.450680701 +0100
|
||
|
|
@@ -3873,9 +3873,10 @@ compute_tag(dns_name_t *name, dns_rdata_
|
||
|
|
dns_rdatatype_dnskey, dnskey, &buffer);
|
||
|
|
|
||
|
|
result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &dstkey);
|
||
|
|
- if (result == ISC_R_SUCCESS)
|
||
|
|
+ if (result == ISC_R_SUCCESS) {
|
||
|
|
*tag = dst_key_id(dstkey);
|
||
|
|
- dst_key_free(&dstkey);
|
||
|
|
+ dst_key_free(&dstkey);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
return (result);
|
||
|
|
}
|
||
|
|
@@ -9315,6 +9316,17 @@ keyfetch_done(isc_task_t *task, isc_even
|
||
|
|
|
||
|
|
dns_keydata_todnskey(&keydata, &dnskey, NULL);
|
||
|
|
result = compute_tag(keyname, &dnskey, mctx, &keytag);
|
||
|
|
+ if (result != ISC_R_SUCCESS) {
|
||
|
|
+ /*
|
||
|
|
+ * Skip if we cannot compute the key tag.
|
||
|
|
+ * This may happen if the algorithm is unsupported
|
||
|
|
+ */
|
||
|
|
+ dns_zone_log(zone, ISC_LOG_ERROR,
|
||
|
|
+ "Cannot compute tag for key in zone %s: %s "
|
||
|
|
+ "(skipping)",
|
||
|
|
+ namebuf, dns_result_totext(result));
|
||
|
|
+ continue;
|
||
|
|
+ }
|
||
|
|
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||
|
|
|
||
|
|
/*
|
||
|
|
@@ -9426,6 +9438,17 @@ keyfetch_done(isc_task_t *task, isc_even
|
||
|
|
continue;
|
||
|
|
|
||
|
|
result = compute_tag(keyname, &dnskey, mctx, &keytag);
|
||
|
|
+ if (result != ISC_R_SUCCESS) {
|
||
|
|
+ /*
|
||
|
|
+ * Skip if we cannot compute the key tag.
|
||
|
|
+ * This may happen if the algorithm is unsupported
|
||
|
|
+ */
|
||
|
|
+ dns_zone_log(zone, ISC_LOG_ERROR,
|
||
|
|
+ "Cannot compute tag for key in zone %s: %s "
|
||
|
|
+ "(skipping)",
|
||
|
|
+ namebuf, dns_result_totext(result));
|
||
|
|
+ continue;
|
||
|
|
+ }
|
||
|
|
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||
|
|
|
||
|
|
revoked = ISC_TF(dnskey.flags & DNS_KEYFLAG_REVOKE);
|