Before using a key for validation, also verify that algorithm matches.

e6c2a670 · Giovanni Bajo · Simon Kelley · 47f99dd2 · e6c2a670
Commit e6c2a670 authored Apr 25, 2012 by Giovanni Bajo Committed by Simon Kelley Aug 20, 2013
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

src/dnssec.c src/dnssec.c +2 -0

No files found.
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -252,6 +252,8 @@ static void dnssec_parserrsig(struct dns_header *header, size_t pktlen,

      if (crecp->addr.key.keytag != val.keytag)
        continue;
+      if (crecp->addr.key.algo != verifyalg_algonum(val.alg))
+        continue;

      printf("RRSIG: found DNSKEY %d in cache, attempting validation\n", val.keytag);