fix: count each RRSIG once when DNSKEY key tags collide #117

tobez commented 2026年05月12日 21:27:25 +02:00

The signatures verified value printed by -s was inflated whenever a
zone published two DNSKEYs sharing the same key tag. rrsig_validate
queues a verification attempt per candidate key, and every attempt
incremented the counter — so an RRSIG covered by a two-way key-tag
collision was counted twice.

The fix moves the increment out of the per-attempt path (both the
threaded worker and the inline single-threaded branch) and into
verify_all_keys, where it now ticks exactly once per RRSIG processed.
The user's xn--leagaviika-52b.no zone (8 RRSIGs, two DNSKEYs sharing
key tag 729) is added as a regression fixture.

Fixes #78

The `signatures verified` value printed by `-s` was inflated whenever a zone published two DNSKEYs sharing the same key tag. `rrsig_validate` queues a verification attempt per candidate key, and every attempt incremented the counter — so an RRSIG covered by a two-way key-tag collision was counted twice. The fix moves the increment out of the per-attempt path (both the threaded worker and the inline single-threaded branch) and into `verify_all_keys`, where it now ticks exactly once per RRSIG processed. The user's xn--leagaviika-52b.no zone (8 RRSIGs, two DNSKEYs sharing key tag 729) is added as a regression fixture. Fixes #78

jelu commented 2026年05月13日 10:03:43 +02:00

#build

#build