Forward indeterminate status higher

Create a path where it can result in insecure.

diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 240156d014ce1791d8a9aa9ed392ecde35d0de3a..fb8bbb9117de8adaf94a4a9a31f1b35b55901196 100644 (file)
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -601,7 +601,7 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
        struct module_qstate* qstate)
 {
        enum sec_status sec;
-       size_t i, num, numchecked = 0;
+       size_t i, num, numchecked = 0, numindeterminate = 0;
        rbtree_type* sortree = NULL;
        int buf_canon = 0;
        uint16_t tag = dnskey_calc_keytag(dnskey, dnskey_idx);
@@ -627,9 +627,16 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
                if(sec == sec_status_secure)
                        return sec;
                numchecked ++;
+               if (sec == sec_status_indeterminate)
+                       numindeterminate ++;
+               
        }
        verbose(VERB_ALGO, "rrset failed to verify: all signatures are bogus");
        if(!numchecked) *reason = "signature missing";
+       else if (numchecked == numindeterminate) {
+               *reason = "algorithm refused by cryptolib";
+               return sec_status_indeterminate;
+       }
        return sec_status_bogus;
 }
 

diff --git a/validator/val_utils.c b/validator/val_utils.c
index bb366d33940087079ea61ae21caba3e335131097..7d7a35af784f90c3e7ee6c38450819b4f539e826 100644 (file)
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -457,7 +457,7 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
                }
                /* If it didn't validate with the DNSKEY, try the next one! */
        }
-       if(numsizesupp != 0) {
+       if(numsizesupp != 0 || sec == sec_status_indeterminate) {
                /* there is a working DS, but that DNSKEY is not supported */
                return sec_status_insecure;
        }