From 95650c0836beac729b159259c83c03750d3e6a62 Mon Sep 17 00:00:00 2001 From: Reto Guadagnini Date: Thu, 5 Jul 2012 12:17:49 +0200 Subject: [PATCH] ipseckey: Report IPSECKEYs with invalid DNSSEC security state --- src/libcharon/plugins/ipseckey/ipseckey_cred.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/libcharon/plugins/ipseckey/ipseckey_cred.c b/src/libcharon/plugins/ipseckey/ipseckey_cred.c index 9c4bc5950..53f30fedf 100644 --- a/src/libcharon/plugins/ipseckey/ipseckey_cred.c +++ b/src/libcharon/plugins/ipseckey/ipseckey_cred.c @@ -172,8 +172,7 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*, } if (!response->has_data(response) || - !response->query_name_exist(response) || - !(response->get_security_state(response) == SECURE) ) + !response->query_name_exist(response)) { DBG1(DBG_CFG, "ipseckey_cred: Unable to retrieve IPSECKEY RRs " "for the domain %s from the DNS", fqdn); @@ -181,6 +180,17 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*, free(fqdn); return enumerator_create_empty(); } + + if (!(response->get_security_state(response) == SECURE)) + { + DBG1(DBG_CFG, "ipseckey_cred: DNSSEC security state of the " + "IPSECKEY RRs of the domain %s is not SECURE " + "as required", fqdn); + response->destroy(response); + free(fqdn); + return enumerator_create_empty(); + } + free(fqdn); /** Determine the validity period of the retrieved IPSECKEYs