From 39a557833da80a95b2fd9754bf9d283b52abe050 Mon Sep 17 00:00:00 2001 From: "W.C.A. Wijngaards" Date: Tue, 23 Feb 2021 17:09:40 +0100 Subject: [PATCH] - Fix for zonemd, do not reject insecure result from trust anchor validation step in dnssec chain of trust. --- doc/Changelog | 2 ++ services/authzone.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/doc/Changelog b/doc/Changelog index c7fecffdd..2b8475efb 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,5 +1,7 @@ 23 February 2021: Wouter - Fix for zonemd, that domain-insecure zones work without dnssec. + - Fix for zonemd, do not reject insecure result from trust anchor + validation step in dnssec chain of trust. 22 February 2021: Wouter - Fix #431: Squelch permission denied errors for tcp connect diff --git a/services/authzone.c b/services/authzone.c index c1f3d6978..196fe6693 100644 --- a/services/authzone.c +++ b/services/authzone.c @@ -8259,7 +8259,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env, dnskey = zonemd_get_dnskey_from_anchor(z, env, mods, anchor, &is_insecure, &why_bogus, &keystorage); lock_basic_unlock(&anchor->lock); - if(!dnskey && !reason) { + if(!dnskey && !reason && !is_insecure) { reason = "verify DNSKEY RRset with trust anchor failed"; } } else if(anchor) { -- 2.47.2