mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

Don't also skip keymgr run if checkds is skipped

Browse Source 
Checking the DS at the parent only happens if dns_zone_getdnsseckeys()
returns success. However, if this function somehow fails, it can also
prevent the keymgr from running.

Before adding the check DS functionality, the keymgr should only run
if 'dns_dnssec_findmatchingkeys()' did not return an error (either
ISC_R_SUCCESS or ISC_R_NOTFOUND). After this change the correct
result code is used again.
This commit is contained in:
Matthijs Mekking
2024-01-31 11:44:07 +01:00
parent 6391ad4660
commit 07c2acf15d
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/dns/zone.c
View File

@@ -21959,20 +21959,20 @@ zone_rekey(dns_zone_t *zone) {
ISC_LIST_INIT(zone->checkds_ok); ISC_LIST_INIT(zone->checkds_ok);
UNLOCK_ZONE(zone); UNLOCK_ZONE(zone);
result = dns_zone_getdnsseckeys(zone, db, ver, now, isc_result_t ret = dns_zone_getdnsseckeys(zone, db, ver, now,
&zone->checkds_ok); &zone->checkds_ok);
if (ret == ISC_R_SUCCESS) {
if (result == ISC_R_SUCCESS) {
zone_checkds(zone); zone_checkds(zone);
} else { } else {
dnssec_log(zone, dnssec_log(zone,
(result == ISC_R_NOTFOUND) ? ISC_LOG_DEBUG(1) (ret == ISC_R_NOTFOUND) ? ISC_LOG_DEBUG(1)
: ISC_LOG_ERROR, : ISC_LOG_ERROR,
"zone_rekey:dns_zone_getdnsseckeys failed: " "zone_rekey:dns_zone_getdnsseckeys failed: "
"%s", "%s",
isc_result_totext(result)); isc_result_totext(ret));
} }
/* Run keymgr */
if (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND) { if (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND) {
dns_zone_lock_keyfiles(zone); dns_zone_lock_keyfiles(zone);
result = dns_keymgr_run(&zone->origin, zone->rdclass, result = dns_keymgr_run(&zone->origin, zone->rdclass,
@@ -21993,6 +21993,12 @@ zone_rekey(dns_zone_t *zone) {
KASP_UNLOCK(kasp); KASP_UNLOCK(kasp);
/*
* Update CDS, CDNSKEY and DNSKEY record sets if the keymgr ran
* successfully (dns_keymgr_run returned ISC_R_SUCCESS), or in
* case of DNSSEC management without dnssec-policy if we have keys
* (dns_dnssec_findmatchingkeys returned ISC_R_SUCCESS).
*/
if (result == ISC_R_SUCCESS) { if (result == ISC_R_SUCCESS) {
dns_kasp_digestlist_t digests; dns_kasp_digestlist_t digests;
bool cdsdel = false; bool cdsdel = false;