WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-12 04:47:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix for zonemd, do not reject insecure result from trust anchor

Browse Source 
validation step in dnssec chain of trust.
This commit is contained in:
W.C.A. Wijngaards
2021-02-23 17:09:40 +01:00
parent c802298fca
commit 39a557833d
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Changelog
+2
View File
@@ -1,5 +1,7 @@
23 February 2021: Wouter
- Fix for zonemd, that domain-insecure zones work without dnssec.
- Fix for zonemd, do not reject insecure result from trust anchor
validation step in dnssec chain of trust.
22 February 2021: Wouter
- Fix #431: Squelch permission denied errors for tcp connect
services/authzone.c
+1 -1
View File
@@ -8259,7 +8259,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
dnskey = zonemd_get_dnskey_from_anchor(z, env, mods, anchor,
&is_insecure, &why_bogus, &keystorage);
lock_basic_unlock(&anchor->lock);
if(!dnskey && !reason) {
if(!dnskey && !reason && !is_insecure) {
reason = "verify DNSKEY RRset with trust anchor failed";
}
} else if(anchor) {