mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Apply raw zone deltas to yet unsigned secure zones

Browse Source 
When inline signing is enabled for a zone without creating signing keys
for it, changes subsequently applied to the raw zone will not be
reflected in the secure zone due to the dns_update_signaturesinc() call
inside receive_secure_serial() failing.  Given that an inline zone will
be served (without any signatures) even with no associated signing keys
being present, keep applying raw zone deltas to the secure zone until
keys become available in an attempt to follow the principle of least
astonishment.
This commit is contained in:
Michał Kępień
2018-03-17 00:12:23 +01:00
committed by Evan Hunt
parent cfbc8e264d
commit 6acf326969
7 changed files with 242 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
lib/dns/zone.c
View File

@@ -14230,8 +14230,17 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
fprintf(stderr, "looping on dns_update_signaturesinc\n");
return;
}
if (result != ISC_R_SUCCESS)
/*
* If something went wrong while trying to update the secure zone and
* the latter was already signed before, do not apply raw zone deltas
* to it as that would break existing DNSSEC signatures. However, if
* the secure zone was not yet signed (e.g. because no signing keys
* were created for it), commence applying raw zone deltas to it so
* that contents of the raw zone and the secure zone are kept in sync.
*/
if (result != ISC_R_SUCCESS && dns_db_issecure(zone->rss_db)) {
goto failure;
}
if (rjournal == NULL)
CHECK(dns_journal_open(zone->rss_raw->mctx,