picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

resolved: support the RSASHA1_NSEC3_SHA1 pseudo-algorithm 

RSASHA1_NSEC3_SHA1 is an alias for RSASHA1, used to do NSEC3 feature
negotiation. While verifying RRsets there's no difference, hence support
it here.
This commit is contained in:
Lennart Poettering 2015-12-03 00:39:44 +01:00
parent 37da893166
commit 964ef14c25
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/resolve/resolved-dns-dnssec.c
View File

@ -48,11 +48,17 @@
*/
static bool dnssec_algorithm_supported(int algorithm) {
return IN_SET(algorithm, DNSSEC_ALGORITHM_RSASHA1, DNSSEC_ALGORITHM_RSASHA256, DNSSEC_ALGORITHM_RSASHA512);
return IN_SET(algorithm,
DNSSEC_ALGORITHM_RSASHA1,
DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1,
DNSSEC_ALGORITHM_RSASHA256,
DNSSEC_ALGORITHM_RSASHA512);
}
static bool dnssec_digest_supported(int digest) {
return IN_SET(digest, DNSSEC_DIGEST_SHA1, DNSSEC_DIGEST_SHA256);
return IN_SET(digest,
DNSSEC_DIGEST_SHA1,
DNSSEC_DIGEST_SHA256);
}
uint16_t dnssec_keytag(DnsResourceRecord *dnskey) {
@ -305,6 +311,7 @@ int dnssec_verify_rrset(
switch (rrsig->rrsig.algorithm) {
case DNSSEC_ALGORITHM_RSASHA1:
case DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1:
gcry_md_open(&md, GCRY_MD_SHA1, 0);
hash_size = 20;
break;