Return the maximum permitted KASP key tag

DNSSEC tools read the minimum tag for both bounds of a policy's key tag
range, so generated keys could be accepted outside the configured
range. Return the correct bound and assert the collision check's range
contract so invalid bounds fail instead of disabling validation.

diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 7dc8db1d5b1b5abef6c2fa2f777489aacb14a636..c01a75d3410ba81c5529d1b0e2622d83c15af873 100644 (file)
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -453,6 +453,8 @@ check_keyversion(dst_key_t *key, char *keystr) {
 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
              isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+       REQUIRE((min == 0 && max == 0) || min < max);
+
        isc_result_t result;
        bool conflict = false;
        dns_dnsseckeylist_t matchkeys;

diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c
index 528c3d7c215fec5cd1c1e0d197e18965e9a945e2..68028a6ae08256922870cc6e63ad6010c6e7a004 100644 (file)
--- a/lib/dns/kasp.c
+++ b/lib/dns/kasp.c
@@ -502,7 +502,7 @@ dns_kasp_key_tagmin(dns_kasp_key_t *key) {
 uint16_t
 dns_kasp_key_tagmax(dns_kasp_key_t *key) {
        REQUIRE(key != NULL);
-       return key->tag_min;
+       return key->tag_max;
 }
 
 bool