mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

2780. [bug] dnssec-keygen -A none didn't properly unset the

Browse Source 
activation date in all cases. [RT #20648]

2779.	[bug]		Dynamic key revokation could fail. [RT #20644]

2778.	[bug]		dnssec-signzone could fail when a key was revoked
			without deleting the unrevoked version. [RT #20638]
This commit is contained in:
Evan Hunt
2009-11-23 02:55:41 +00:00
parent 289dbe005c
commit cef109efa7
8 changed files with 67 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
CHANGES
View File

@@ -1,3 +1,13 @@
--- 9.7.0b3 released ---
2780. [bug] dnssec-keygen -A none didn't properly unset the
activation date in all cases. [RT #20648]
2779. [bug] Dynamic key revokation could fail. [RT #20644]
2778. [bug] dnssec-signzone could fail when a key was revoked
without deleting the unrevoked version. [RT #20638]
2777. [contrib] DLZ MYSQL auto reconnect support discovery was wrong. 2777. [contrib] DLZ MYSQL auto reconnect support discovery was wrong.
2776. [bug] Change #2762 was not correct. [RT #20647] 2776. [bug] Change #2762 was not correct. [RT #20647]
@@ -11,8 +21,6 @@
2773. [bug] In autosigned zones, the SOA could be signed 2773. [bug] In autosigned zones, the SOA could be signed
with the KSK. [RT #20628] with the KSK. [RT #20628]
--- 9.7.0b3 released ---
2772. [security] When validating, track whether pending data was from 2772. [security] When validating, track whether pending data was from
the additional section or not and only return it if the additional section or not and only return it if
validates as secure. [RT #20438] validates as secure. [RT #20438]

8
bin/dnssec/dnssec-keyfromlabel.c
View File

@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE. * PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: dnssec-keyfromlabel.c,v 1.27 2009/11/21 17:51:49 fdupont Exp $ */ /* $Id: dnssec-keyfromlabel.c,v 1.28 2009/11/23 02:55:40 each Exp $ */
/*! \file */ /*! \file */
@@ -461,12 +461,14 @@ main(int argc, char **argv) {
if (setpub) if (setpub)
dst_key_settime(key, DST_TIME_PUBLISH, publish); dst_key_settime(key, DST_TIME_PUBLISH, publish);
else if (!genonly) else if (setact)
dst_key_settime(key, DST_TIME_PUBLISH, activate);
else if (!genonly && !unsetpub)
dst_key_settime(key, DST_TIME_PUBLISH, now); dst_key_settime(key, DST_TIME_PUBLISH, now);
if (setact) if (setact)
dst_key_settime(key, DST_TIME_ACTIVATE, activate); dst_key_settime(key, DST_TIME_ACTIVATE, activate);
else if (!genonly) else if (!genonly && !unsetact)
dst_key_settime(key, DST_TIME_ACTIVATE, now); dst_key_settime(key, DST_TIME_ACTIVATE, now);
if (setrev) { if (setrev) {

9
bin/dnssec/dnssec-keygen.c
View File

@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: dnssec-keygen.c,v 1.106 2009/10/28 00:27:10 marka Exp $ */ /* $Id: dnssec-keygen.c,v 1.107 2009/11/23 02:55:40 each Exp $ */
/*! \file */ /*! \file */
@@ -772,13 +772,16 @@ main(int argc, char **argv) {
if (setpub) if (setpub)
dst_key_settime(key, DST_TIME_PUBLISH, publish); dst_key_settime(key, DST_TIME_PUBLISH, publish);
else if (!genonly && !setact) else if (setact)
dst_key_settime(key, DST_TIME_PUBLISH,
activate);
else if (!genonly && !unsetpub)
dst_key_settime(key, DST_TIME_PUBLISH, now); dst_key_settime(key, DST_TIME_PUBLISH, now);
if (setact) if (setact)
dst_key_settime(key, DST_TIME_ACTIVATE, dst_key_settime(key, DST_TIME_ACTIVATE,
activate); activate);
else if (!genonly && !setpub) else if (!genonly && !unsetact)
dst_key_settime(key, DST_TIME_ACTIVATE, now); dst_key_settime(key, DST_TIME_ACTIVATE, now);
if (setrev) { if (setrev) {

21
bin/dnssec/dnssec-signzone.c
View File

@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: dnssec-signzone.c,v 1.253 2009/11/16 04:27:44 each Exp $ */ /* $Id: dnssec-signzone.c,v 1.254 2009/11/23 02:55:40 each Exp $ */
/*! \file */ /*! \file */
@@ -2760,7 +2760,7 @@ static void
build_final_keylist() { build_final_keylist() {
isc_result_t result; isc_result_t result;
dns_dbversion_t *ver = NULL; dns_dbversion_t *ver = NULL;
dns_diff_t del, add; dns_diff_t diff;
dns_dnsseckeylist_t matchkeys; dns_dnsseckeylist_t matchkeys;
char name[DNS_NAME_FORMATSIZE]; char name[DNS_NAME_FORMATSIZE];
@@ -2777,31 +2777,24 @@ build_final_keylist() {
result = dns_db_newversion(gdb, &ver); result = dns_db_newversion(gdb, &ver);
check_result(result, "dns_db_newversion"); check_result(result, "dns_db_newversion");
dns_diff_init(mctx, &del); dns_diff_init(mctx, &diff);
dns_diff_init(mctx, &add);
/* /*
* Update keylist with information from from the key repository. * Update keylist with information from from the key repository.
*/ */
dns_dnssec_updatekeys(&keylist, &matchkeys, NULL, gorigin, keyttl, dns_dnssec_updatekeys(&keylist, &matchkeys, NULL, gorigin, keyttl,
&add, &del, ignore_kskflag, mctx, report); &diff, ignore_kskflag, mctx, report);
dns_name_format(gorigin, name, sizeof(name)); dns_name_format(gorigin, name, sizeof(name));
result = dns_diff_applysilently(&del, gdb, ver); result = dns_diff_applysilently(&diff, gdb, ver);
if (result != ISC_R_SUCCESS) if (result != ISC_R_SUCCESS)
fatal("failed to delete DNSKEYs at node '%s': %s", fatal("failed to update DNSKEY RRset at node '%s': %s",
name, isc_result_totext(result));
result = dns_diff_applysilently(&add, gdb, ver);
if (result != ISC_R_SUCCESS)
fatal("failed to add DNSKEYs at node '%s': %s",
name, isc_result_totext(result)); name, isc_result_totext(result));
dns_db_closeversion(gdb, &ver, ISC_TRUE); dns_db_closeversion(gdb, &ver, ISC_TRUE);
dns_diff_clear(&del); dns_diff_clear(&diff);
dns_diff_clear(&add);
} }
static void static void

6
bin/named/update.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE. * PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: update.c,v 1.169 2009/11/18 21:22:31 each Exp $ */ /* $Id: update.c,v 1.170 2009/11/23 02:55:41 each Exp $ */
#include <config.h> #include <config.h>
@@ -1883,8 +1883,8 @@ add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
(isc_stdtime_t) 0, &rdataset, NULL)); (isc_stdtime_t) 0, &rdataset, NULL));
dns_db_detachnode(db, &node); dns_db_detachnode(db, &node);
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) == 1) #define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) == 1) #define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
#define ALG(x) dst_key_alg(x) #define ALG(x) dst_key_alg(x)
/* /*

27
lib/dns/dnssec.c
View File

@@ -16,7 +16,7 @@
*/ */
/* /*
* $Id: dnssec.c,v 1.110 2009/11/17 05:46:53 each Exp $ * $Id: dnssec.c,v 1.111 2009/11/23 02:55:41 each Exp $
*/ */
/*! \file */ /*! \file */
@@ -1078,7 +1078,7 @@ get_hints(dns_dnsseckey_t *key) {
* *
* If it hasn't already been done, we should also revoke it now. * If it hasn't already been done, we should also revoke it now.
*/ */
if (key->hint_publish && (revset && revoke < now)) { if (key->hint_publish && (revset && revoke <= now)) {
isc_uint32_t flags; isc_uint32_t flags;
key->hint_sign = ISC_TRUE; key->hint_sign = ISC_TRUE;
flags = dst_key_flags(key->key); flags = dst_key_flags(key->key);
@@ -1384,7 +1384,7 @@ make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
} }
static isc_result_t static isc_result_t
publish_key(dns_diff_t *add, dns_dnsseckey_t *key, dns_name_t *origin, publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
dns_ttl_t ttl, isc_mem_t *mctx, isc_boolean_t allzsk, dns_ttl_t ttl, isc_mem_t *mctx, isc_boolean_t allzsk,
void (*report)(const char *, ...)) void (*report)(const char *, ...))
{ {
@@ -1418,7 +1418,7 @@ publish_key(dns_diff_t *add, dns_dnsseckey_t *key, dns_name_t *origin,
/* publish key */ /* publish key */
RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_ADD, origin, ttl, RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_ADD, origin, ttl,
&dnskey, &tuple)); &dnskey, &tuple));
dns_diff_append(add, &tuple); dns_diff_appendminimal(diff, &tuple);
result = ISC_R_SUCCESS; result = ISC_R_SUCCESS;
failure: failure:
@@ -1426,7 +1426,7 @@ publish_key(dns_diff_t *add, dns_dnsseckey_t *key, dns_name_t *origin,
} }
static isc_result_t static isc_result_t
remove_key(dns_diff_t *del, dns_dnsseckey_t *key, dns_name_t *origin, remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
dns_ttl_t ttl, isc_mem_t *mctx, const char *reason, dns_ttl_t ttl, isc_mem_t *mctx, const char *reason,
void (*report)(const char *, ...)) void (*report)(const char *, ...))
{ {
@@ -1443,7 +1443,7 @@ remove_key(dns_diff_t *del, dns_dnsseckey_t *key, dns_name_t *origin,
RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey)); RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_DEL, origin, ttl, &dnskey, RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_DEL, origin, ttl, &dnskey,
&tuple)); &tuple));
dns_diff_append(del, &tuple); dns_diff_appendminimal(diff, &tuple);
result = ISC_R_SUCCESS; result = ISC_R_SUCCESS;
failure: failure:
@@ -1459,9 +1459,8 @@ remove_key(dns_diff_t *del, dns_dnsseckey_t *key, dns_name_t *origin,
isc_result_t isc_result_t
dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
dns_dnsseckeylist_t *removed, dns_name_t *origin, dns_dnsseckeylist_t *removed, dns_name_t *origin,
dns_ttl_t ttl, dns_diff_t *add, dns_diff_t *del, dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
isc_boolean_t allzsk, isc_mem_t *mctx, isc_mem_t *mctx, void (*report)(const char *, ...))
void (*report)(const char *, ...))
{ {
isc_result_t result; isc_result_t result;
dns_dnsseckey_t *key, *key1, *key2, *next; dns_dnsseckey_t *key, *key1, *key2, *next;
@@ -1476,7 +1475,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
key = ISC_LIST_NEXT(key, link)) { key = ISC_LIST_NEXT(key, link)) {
if (key->source == dns_keysource_user && if (key->source == dns_keysource_user &&
(key->hint_publish || key->force_publish)) { (key->hint_publish || key->force_publish)) {
RETERR(publish_key(add, key, origin, ttl, RETERR(publish_key(diff, key, origin, ttl,
mctx, allzsk, report)); mctx, allzsk, report));
} }
} }
@@ -1515,7 +1514,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
if (key1->source != dns_keysource_zoneapex && if (key1->source != dns_keysource_zoneapex &&
(key1->hint_publish || key1->force_publish)) { (key1->hint_publish || key1->force_publish)) {
RETERR(publish_key(add, key1, origin, ttl, RETERR(publish_key(diff, key1, origin, ttl,
mctx, allzsk, report)); mctx, allzsk, report));
if (key1->hint_sign || key1->force_sign) if (key1->hint_sign || key1->force_sign)
key1->first_sign = ISC_TRUE; key1->first_sign = ISC_TRUE;
@@ -1526,7 +1525,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
/* Match found: remove or update it as needed */ /* Match found: remove or update it as needed */
if (key1->hint_remove) { if (key1->hint_remove) {
RETERR(remove_key(del, key2, origin, ttl, mctx, RETERR(remove_key(diff, key2, origin, ttl, mctx,
"expired", report)); "expired", report));
ISC_LIST_UNLINK(*keys, key2, link); ISC_LIST_UNLINK(*keys, key2, link);
if (removed != NULL) if (removed != NULL)
@@ -1541,7 +1540,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
* We need to remove the old version and pull * We need to remove the old version and pull
* in the new one. * in the new one.
*/ */
RETERR(remove_key(del, key2, origin, ttl, mctx, RETERR(remove_key(diff, key2, origin, ttl, mctx,
"revoked", report)); "revoked", report));
ISC_LIST_UNLINK(*keys, key2, link); ISC_LIST_UNLINK(*keys, key2, link);
if (removed != NULL) if (removed != NULL)
@@ -1549,7 +1548,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
else else
dns_dnsseckey_destroy(mctx, &key2); dns_dnsseckey_destroy(mctx, &key2);
RETERR(publish_key(add, key1, origin, ttl, RETERR(publish_key(diff, key1, origin, ttl,
mctx, allzsk, report)); mctx, allzsk, report));
ISC_LIST_UNLINK(*newkeys, key1, link); ISC_LIST_UNLINK(*newkeys, key1, link);
ISC_LIST_APPEND(*keys, key1, link); ISC_LIST_APPEND(*keys, key1, link);

11
lib/dns/include/dns/dnssec.h
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE. * PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: dnssec.h,v 1.39 2009/10/27 03:59:45 each Exp $ */ /* $Id: dnssec.h,v 1.40 2009/11/23 02:55:41 each Exp $ */
#ifndef DNS_DNSSEC_H #ifndef DNS_DNSSEC_H
#define DNS_DNSSEC_H 1 #define DNS_DNSSEC_H 1
@@ -290,19 +290,18 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
isc_result_t isc_result_t
dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys, dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
dns_dnsseckeylist_t *removed, dns_name_t *origin, dns_dnsseckeylist_t *removed, dns_name_t *origin,
dns_ttl_t ttl, dns_diff_t *add, dns_diff_t *del, dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
isc_boolean_t allzsk, isc_mem_t *mctx, isc_mem_t *mctx, void (*report)(const char *, ...));
void (*report)(const char *, ...));
/*%< /*%<
* Update the list of keys in 'keys' with new key information in 'newkeys'. * Update the list of keys in 'keys' with new key information in 'newkeys'.
* *
* For each key in 'newkeys', see if it has a match in 'keys'. * For each key in 'newkeys', see if it has a match in 'keys'.
* - If not, and if the metadata says the key should be published: * - If not, and if the metadata says the key should be published:
* add it to 'keys', and place a dns_difftuple into 'add' so * add it to 'keys', and place a dns_difftuple into 'diff' so
* the key can be added to the DNSKEY set. If the metadata says it * the key can be added to the DNSKEY set. If the metadata says it
* should be active, set the first_sign flag. * should be active, set the first_sign flag.
* - If so, and if the metadata says it should be removed: * - If so, and if the metadata says it should be removed:
* remove it from 'keys', and place a dns_difftuple into 'del' so * remove it from 'keys', and place a dns_difftuple into 'diff' so
* the key can be removed from the DNSKEY set. if 'removed' is non-NULL, * the key can be removed from the DNSKEY set. if 'removed' is non-NULL,
* copy the key into that list; otherwise destroy it. * copy the key into that list; otherwise destroy it.
* - Otherwise, make sure keys has current metadata. * - Otherwise, make sure keys has current metadata.

40
lib/dns/zone.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE. * PERFORMANCE OF THIS SOFTWARE.
*/ */
/* $Id: zone.c,v 1.530 2009/11/18 21:22:31 each Exp $ */ /* $Id: zone.c,v 1.531 2009/11/23 02:55:41 each Exp $ */
/*! \file */ /*! \file */
@@ -4549,8 +4549,8 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
goto failure; goto failure;
} }
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) == 1) #define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) == 1) #define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
#define ALG(x) dst_key_alg(x) #define ALG(x) dst_key_alg(x)
for (i = 0; i < nkeys; i++) { for (i = 0; i < nkeys; i++) {
@@ -13441,7 +13441,7 @@ zone_rekey(dns_zone_t *zone) {
dns_rdataset_t soaset, soasigs, keyset, keysigs; dns_rdataset_t soaset, soasigs, keyset, keysigs;
dns_dnsseckeylist_t dnskeys, keys, oldkeys; dns_dnsseckeylist_t dnskeys, keys, oldkeys;
dns_dnsseckey_t *key; dns_dnsseckey_t *key;
dns_diff_t add, del; dns_diff_t diff;
isc_boolean_t commit = ISC_FALSE; isc_boolean_t commit = ISC_FALSE;
dns_ttl_t ttl = 3600; dns_ttl_t ttl = 3600;
const char *dir; const char *dir;
@@ -13459,8 +13459,7 @@ zone_rekey(dns_zone_t *zone) {
dns_rdataset_init(&keysigs); dns_rdataset_init(&keysigs);
dir = dns_zone_getkeydirectory(zone); dir = dns_zone_getkeydirectory(zone);
mctx = zone->mctx; mctx = zone->mctx;
dns_diff_init(mctx, &add); dns_diff_init(mctx, &diff);
dns_diff_init(mctx, &del);
isc_stdtime_get(&now); isc_stdtime_get(&now);
CHECK(dns_zone_getdb(zone, &db)); CHECK(dns_zone_getdb(zone, &db));
@@ -13492,23 +13491,15 @@ zone_rekey(dns_zone_t *zone) {
check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK); check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
CHECK(dns_dnssec_updatekeys(&dnskeys, &keys, &oldkeys, CHECK(dns_dnssec_updatekeys(&dnskeys, &keys, &oldkeys,
&zone->origin, ttl, &add, &del, &zone->origin, ttl, &diff,
ISC_TF(!check_ksk), mctx, logmsg)); ISC_TF(!check_ksk), mctx, logmsg));
if (!ISC_LIST_EMPTY(del.tuples)) { if (!ISC_LIST_EMPTY(diff.tuples)) {
commit = ISC_TRUE; commit = ISC_TRUE;
add_signing_records(db, zone->privatetype, ver, &del); add_signing_records(db, zone->privatetype, ver, &diff);
dns_diff_apply(&del, db, ver); dns_diff_apply(&diff, db, ver);
result = increment_soa_serial(db, ver, &del, mctx); result = increment_soa_serial(db, ver, &diff, mctx);
if (result == ISC_R_SUCCESS) if (result == ISC_R_SUCCESS)
zone_journal(zone, &del, "zone_rekey"); zone_journal(zone, &diff, "zone_rekey");
}
if (!ISC_LIST_EMPTY(add.tuples)) {
commit = ISC_TRUE;
add_signing_records(db, zone->privatetype, ver, &add);
dns_diff_apply(&add, db, ver);
result = increment_soa_serial(db, ver, &add, mctx);
if (result == ISC_R_SUCCESS)
zone_journal(zone, &add, "zone_rekey");
} }
} }
@@ -13548,16 +13539,22 @@ zone_rekey(dns_zone_t *zone) {
* key metadata indicates there is a key change event * key metadata indicates there is a key change event
* scheduled in the future, set the key refresh timer. * scheduled in the future, set the key refresh timer.
*/ */
//HERE
dns_zone_log(zone, ISC_LOG_NOTICE, "1");
if (!DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN)) if (!DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
break; break;
dns_zone_log(zone, ISC_LOG_NOTICE, "2");
result = next_keyevent(key->key, &then); result = next_keyevent(key->key, &then);
if (result != ISC_R_SUCCESS) if (result != ISC_R_SUCCESS)
continue; continue;
dns_zone_log(zone, ISC_LOG_NOTICE, "3");
isc_time_set(&timethen, then, 0); isc_time_set(&timethen, then, 0);
if (isc_time_isepoch(&zone->refreshkeytime) || if (isc_time_isepoch(&zone->refreshkeytime) ||
isc_time_compare(&timethen, &zone->refreshkeytime) < 0) { isc_time_compare(&timethen, &zone->refreshkeytime) < 0) {
//HERE
dns_zone_log(zone, ISC_LOG_NOTICE, "setting refreshkeytime to %d\n", then);
zone->refreshkeytime = timethen; zone->refreshkeytime = timethen;
zone_settimer(zone, &timenow); zone_settimer(zone, &timenow);
} }
@@ -13566,8 +13563,7 @@ zone_rekey(dns_zone_t *zone) {
result = ISC_R_SUCCESS; result = ISC_R_SUCCESS;
failure: failure:
dns_diff_clear(&add); dns_diff_clear(&diff);
dns_diff_clear(&del);
clear_keylist(&dnskeys, mctx); clear_keylist(&dnskeys, mctx);
clear_keylist(&keys, mctx); clear_keylist(&keys, mctx);