bugfix #1218: chase DS if owner is sub of signer

diff --git a/Changelog b/Changelog
index c7caf69f3afdd5457dd7816db2ffeb70bb0b7bd3..bb4aaca49e25128c63e894715b51cabc219f009d 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,8 @@
        * ldns-notify can use all supported hash algorithms with -y.
        * bugfix #1209: make install ldns.pc file
          Thanks Oleksandr Natalenko
+       * bugfix #1218: Only chase DS if signer is parent of owner.
+         Thanks Emil Natan
 
 1.7.0  2016-12-20
        * Fix lookup of relative names in ldns_resolver_search.

diff --git a/dnssec_verify.c b/dnssec_verify.c
index c554e4f4cb19ab618f5854e54b8575eafc969c8f..b1f1fce8c46e5c478d5d21c108050d97c935d518 100644 (file)
--- a/dnssec_verify.c
+++ b/dnssec_verify.c
@@ -415,14 +415,17 @@ ldns_dnssec_build_data_chain(ldns_resolver *res,
                                                              new_chain);
        }
        if (type != LDNS_RR_TYPE_DNSKEY) {
-               ldns_dnssec_build_data_chain_dnskey(res,
-                                                   qflags,
-                                                   pkt,
-                                                   signatures,
-                                                   new_chain,
-                                                   key_name,
-                                                   c
-                                                  );
+               if (type != LDNS_RR_TYPE_DS ||
+                               ldns_dname_is_subdomain(name, key_name)) {
+                       ldns_dnssec_build_data_chain_dnskey(res,
+                                                           qflags,
+                                                           pkt,
+                                                           signatures,
+                                                           new_chain,
+                                                           key_name,
+                                                           c
+                                                          );
+               }
        } else {
                ldns_dnssec_build_data_chain_other(res,
                                                   qflags,