upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 05:49:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Inherit dnssec-policy in check for inline-signing

Browse source 
When dnssec-policy is used, and the zone is not dynamic, BIND will
assume that the zone is inline-signed. But the function responsible
for this did not inherit the dnssec-policy option from the view or
options level, and thus never enabled inline-signing, while the zone
should have been.

This is fixed by this commit.
This commit is contained in:
Matthijs Mekking 2022-07-11 10:30:44 +02:00
parent efa8a4e88d
commit 576b21b168
1 changed files with 18 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
bin/named/zoneconf.c
View file

@ -2132,6 +2132,7 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
const cfg_obj_t *updatepolicy = NULL;
bool zone_is_dynamic = false;
bool inline_signing = false;
bool dnssec_policy = false;
(void)cfg_map_get(config, "options", &options);
@ -2183,16 +2184,23 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
* inline-signing.
*/
signing = NULL;
if (!inline_signing && !zone_is_dynamic &&
cfg_map_get(zoptions, "dnssec-policy", &signing) == ISC_R_SUCCESS &&
signing != NULL)
{
if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
inline_signing = true;
dns_zone_log(zone, ISC_LOG_DEBUG(1),
"inline-signing: "
"implicitly through dnssec-policy");
}
res = cfg_map_get(zoptions, "dnssec-policy", &signing);
if (res != ISC_R_SUCCESS && voptions != NULL) {
res = cfg_map_get(voptions, "dnssec-policy", &signing);
}
if (res != ISC_R_SUCCESS && options != NULL) {
res = cfg_map_get(options, "dnssec-policy", &signing);
}
if (res == ISC_R_SUCCESS) {
dnssec_policy = (strcmp(cfg_obj_asstring(signing), "none") !=
0);
}
if (!inline_signing && !zone_is_dynamic && dnssec_policy) {
inline_signing = true;
dns_zone_log(zone, ISC_LOG_DEBUG(1),
"inline-signing: "
"implicitly through dnssec-policy");
}
return (inline_signing);