From 2a0d751be498be89e18f130ca02b2197f83b6baa Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sun, 3 Jan 2016 17:57:44 +0100 Subject: resolved: refuse revoked DNSKEYs in trust anchor --- src/resolve/resolved-dns-trust-anchor.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src') diff --git a/src/resolve/resolved-dns-trust-anchor.c b/src/resolve/resolved-dns-trust-anchor.c index 03c5b9406e..bcb31bd426 100644 --- a/src/resolve/resolved-dns-trust-anchor.c +++ b/src/resolve/resolved-dns-trust-anchor.c @@ -188,6 +188,14 @@ static int dns_trust_anchor_load_positive(DnsTrustAnchor *d, const char *path, u r = safe_atou16(flags, &f); if (r < 0) return log_warning_errno(r, "Failed to parse DNSKEY flags field %s on line %s:%u", flags, path, line); + if ((f & DNSKEY_FLAG_ZONE_KEY) == 0) { + log_warning("DNSKEY lacks zone key bit set on line %s:%u", path, line); + return -EINVAL; + } + if ((f & DNSKEY_FLAG_REVOKE)) { + log_warning("DNSKEY is already revoked on line %s:%u", path, line); + return -EINVAL; + } a = dnssec_algorithm_from_string(algorithm); if (a < 0) { -- cgit v1.2.3-54-g00ecf