mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Allow CDS/CDNSKEY DELETE records in unsigned zone

Browse Source 
While not useful, having a CDS/CDNSKEY DELETE record in an unsigned
zone is not an error and "named-checkzone" should not complain.
This commit is contained in:
Matthijs Mekking
2021-03-17 10:02:22 +01:00
parent 052ec16a44
commit f211c7c2a1
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
bin/tests/system/checkzone/zones/good-cds-unsigned.db Normal file
View File

@@ -0,0 +1,5 @@
example. 0 SOA . . 0 0 0 0 0
example. 0 NS .
example. 0 CDS 0 0 0 00
example. 0 CDNSKEY 0 3 0 AA==

23
lib/dns/zone.c
View File

@@ -20524,6 +20524,7 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
unsigned char buffer[DNS_DS_BUFFERSIZE]; unsigned char buffer[DNS_DS_BUFFERSIZE];
unsigned char algorithms[256]; unsigned char algorithms[256];
unsigned int i; unsigned int i;
bool empty = false;
enum { notexpected = 0, expected = 1, found = 2 }; enum { notexpected = 0, expected = 1, found = 2 };
@@ -20559,14 +20560,8 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey, result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
dns_rdatatype_none, 0, &dnskey, NULL); dns_rdatatype_none, 0, &dnskey, NULL);
if (result == ISC_R_NOTFOUND) { if (result == ISC_R_NOTFOUND) {
if (dns_rdataset_isassociated(&cds)) { empty = true;
result = DNS_R_BADCDS; } else if (result != ISC_R_SUCCESS) {
} else {
result = DNS_R_BADCDNSKEY;
}
goto failure;
}
if (result != ISC_R_SUCCESS) {
goto failure; goto failure;
} }
@@ -20596,6 +20591,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
delete = true; delete = true;
continue; continue;
} }
if (empty) {
result = DNS_R_BADCDS;
goto failure;
}
CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL)); CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL));
if (algorithms[structcds.algorithm] == 0) { if (algorithms[structcds.algorithm] == 0) {
algorithms[structcds.algorithm] = expected; algorithms[structcds.algorithm] = expected;
@@ -20663,6 +20664,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
delete = true; delete = true;
continue; continue;
} }
if (empty) {
result = DNS_R_BADCDNSKEY;
goto failure;
}
CHECK(dns_rdata_tostruct(&crdata, &structcdnskey, CHECK(dns_rdata_tostruct(&crdata, &structcdnskey,
NULL)); NULL));
if (algorithms[structcdnskey.algorithm] == 0) { if (algorithms[structcdnskey.algorithm] == 0) {