From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Fri, 6 May 2016 11:07:22 +0000 (+0200)
Subject: Don't allow other values than '1' for the NSEC3PARAM algorithm
X-Git-Tag: auth-4.0.0-alpha3^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=265a7bbc8ad88d5d217b4af4c23b14a4c1be3909;p=thirdparty%2Fpdns.git

Don't allow other values than '1' for the NSEC3PARAM algorithm
---

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 83a766a225..1283930d54 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -2424,6 +2424,10 @@ loadMainConfig(g_vm["config-dir"].as<string>());
       cerr<<"Cannot enable NSEC3 for " << zone.toString() << " as it is too long (" << zone.wirelength() << " bytes, maximum is 222 bytes)"<<endl;
       return 1;
     }
+    if(ns3pr.d_algorithm != 1) {
+      cerr<<"NSEC3PARAM algorithm set to '"<<std::to_string(ns3pr.d_algorithm)<<"', but '1' is the only valid value"<<endl;
+      return EXIT_FAILURE;
+    }
     if (! dk.setNSEC3PARAM(zone, ns3pr, narrow)) {
       cerr<<"Cannot set NSEC3 param for " << zone.toString() << endl;
       return 1;