From: Lennart Poettering <lennart@poettering.net>
Date: Sun, 3 Jan 2016 16:57:44 +0000 (+0100)
Subject: resolved: refuse revoked DNSKEYs in trust anchor
X-Git-Tag: v229~170^2~14
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2a0d751be498be89e18f130ca02b2197f83b6baa;p=thirdparty%2Fsystemd.git

resolved: refuse revoked DNSKEYs in trust anchor
---

diff --git a/src/resolve/resolved-dns-trust-anchor.c b/src/resolve/resolved-dns-trust-anchor.c
index 03c5b9406e9..bcb31bd4265 100644
--- a/src/resolve/resolved-dns-trust-anchor.c
+++ b/src/resolve/resolved-dns-trust-anchor.c
@@ -188,6 +188,14 @@ static int dns_trust_anchor_load_positive(DnsTrustAnchor *d, const char *path, u
                 r = safe_atou16(flags, &f);
                 if (r < 0)
                         return log_warning_errno(r, "Failed to parse DNSKEY flags field %s on line %s:%u", flags, path, line);
+                if ((f & DNSKEY_FLAG_ZONE_KEY) == 0) {
+                        log_warning("DNSKEY lacks zone key bit set on line %s:%u", path, line);
+                        return -EINVAL;
+                }
+                if ((f & DNSKEY_FLAG_REVOKE)) {
+                        log_warning("DNSKEY is already revoked on line %s:%u", path, line);
+                        return -EINVAL;
+                }
 
                 a = dnssec_algorithm_from_string(algorithm);
                 if (a < 0) {