From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 14 Jan 2016 16:27:28 +0000 (+0100)
Subject: resolved: ignore DS RRs without generating an error if they use an unsupported digest... 
X-Git-Tag: v229~129^2~21
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=54b778e7d63ce0af0d5e9401b563c6dd28eff9d3;p=thirdparty%2Fsystemd.git

resolved: ignore DS RRs without generating an error if they use an unsupported digest algorithm
---

diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c
index 4aade4829e4..f39454b9f94 100644
--- a/src/resolve/resolved-dns-dnssec.c
+++ b/src/resolve/resolved-dns-dnssec.c
@@ -1117,8 +1117,8 @@ int dnssec_verify_dnskey_search(DnsResourceRecord *dnskey, DnsAnswer *validated_
                         continue;
 
                 r = dnssec_verify_dnskey(dnskey, ds, false);
-                if (r == -EKEYREJECTED)
-                        return 0; /* The DNSKEY is revoked or otherwise invalid, we won't bless it */
+                if (IN_SET(r, -EKEYREJECTED, -EOPNOTSUPP))
+                        return 0; /* The DNSKEY is revoked or otherwise invalid, or we don't support the digest algorithm */
                 if (r < 0)
                         return r;
                 if (r > 0)