From: W.C.A. Wijngaards Date: Tue, 23 Feb 2021 16:09:40 +0000 (+0100) Subject: - Fix for zonemd, do not reject insecure result from trust anchor X-Git-Tag: release-1.13.2rc1~261 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39a557833da80a95b2fd9754bf9d283b52abe050;p=thirdparty%2Funbound.git - Fix for zonemd, do not reject insecure result from trust anchor validation step in dnssec chain of trust. --- diff --git a/doc/Changelog b/doc/Changelog index c7fecffdd..2b8475efb 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,5 +1,7 @@ 23 February 2021: Wouter - Fix for zonemd, that domain-insecure zones work without dnssec. + - Fix for zonemd, do not reject insecure result from trust anchor + validation step in dnssec chain of trust. 22 February 2021: Wouter - Fix #431: Squelch permission denied errors for tcp connect diff --git a/services/authzone.c b/services/authzone.c index c1f3d6978..196fe6693 100644 --- a/services/authzone.c +++ b/services/authzone.c @@ -8259,7 +8259,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env, dnskey = zonemd_get_dnskey_from_anchor(z, env, mods, anchor, &is_insecure, &why_bogus, &keystorage); lock_basic_unlock(&anchor->lock); - if(!dnskey && !reason) { + if(!dnskey && !reason && !is_insecure) { reason = "verify DNSKEY RRset with trust anchor failed"; } } else if(anchor) {