From: Mark Andrews <marka@isc.org>
Date: Mon, 10 Aug 2026 04:13:16 +0000 (+1000)
Subject: Return the maximum permitted KASP key tag
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eb509b62146113586dfd5d95f3d0b4601aba5dab;p=thirdparty%2Fbind9.git

Return the maximum permitted KASP key tag

DNSSEC tools read the minimum tag for both bounds of a policy's key tag
range, so generated keys could be accepted outside the configured
range. Return the correct bound and assert the collision check's range
contract so invalid bounds fail instead of disabling validation.
---

diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 7dc8db1d5b1..c01a75d3410 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -453,6 +453,8 @@ check_keyversion(dst_key_t *key, char *keystr) {
 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+	REQUIRE((min == 0 && max == 0) || min < max);
+
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c
index 528c3d7c215..68028a6ae08 100644
--- a/lib/dns/kasp.c
+++ b/lib/dns/kasp.c
@@ -502,7 +502,7 @@ dns_kasp_key_tagmin(dns_kasp_key_t *key) {
 uint16_t
 dns_kasp_key_tagmax(dns_kasp_key_t *key) {
 	REQUIRE(key != NULL);
-	return key->tag_min;
+	return key->tag_max;
 }
 
 bool