- 5011 implementation does not insist on all algorithms, when

  harden-algo-downgrade is turned off.

git-svn-id: file:///svn/unbound/trunk@3471 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 4f813092b049f7a59118ef691f0419139483437c..b3ee0d765a5eee762108476815a1ffa346825e9f 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+13 August 2015: Wouter
+       - 5011 implementation does not insist on all algorithms, when
+         harden-algo-downgrade is turned off.
+
 11 August 2015: Wouter
        - Fix #694: configure script does not detect LibreSSL 2.2.2
 

diff --git a/validator/autotrust.c b/validator/autotrust.c
index c732e24e4bea20c2204c9d5dfbd9f099d23fdf45..1afaf61a361c99d04d83cfe403037e21660be6f8 100644 (file)
--- a/validator/autotrust.c
+++ b/validator/autotrust.c
@@ -1225,7 +1225,7 @@ verify_dnskey(struct module_env* env, struct val_env* ve,
 {
        char* reason = NULL;
        uint8_t sigalg[ALGO_NEEDS_MAX+1];
-       int downprot = 1;
+       int downprot = 0;
        enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
                tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason);
        /* sigalg is ignored, it returns algorithms signalled to exist, but