From: Libor Peltan <libor.peltan@nic.cz>
Date: Mon, 17 May 2021 16:04:35 +0000 (+0200)
Subject: dnssec: don't involve public-only keys in algorithm usage checks
X-Git-Tag: v3.3.dev~351
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d0937668d55adc3eabb65f9fb378ffbbd30a2fda;p=thirdparty%2Fknot-dns.git

dnssec: don't involve public-only keys in algorithm usage checks
---

diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index 76a1f63f12..16689feb54 100644
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -386,6 +386,9 @@ static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset)
 
 	for (size_t i = 0; i < keyset->count; i++) {
 		zone_key_t *key = &keyset->keys[i];
+		if (key->is_pub_only) {
+			continue;
+		}
 		uint8_t alg = dnssec_key_get_algorithm(key->key);
 
 		if (ctx->policy->nsec3_enabled && !is_nsec3_allowed(alg)) {