upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

When signing with a new algorithm preserve NSEC/NSEC3 chains

Browse source 
If the zone already has existing NSEC/NSEC3 chains then zone_sign
needs to continue to use them.  If there are no chains then use
kasp setting otherwise generate an NSEC chain.

(cherry picked from commit 4b55201459)
This commit is contained in:
Mark Andrews 2023-03-14 13:13:14 +11:00
parent f012549203
commit 7f13c9d3fa
2 changed files with 17 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bin/tests/system/nsec3/tests.sh
View file

@ -398,12 +398,6 @@ then
set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
set_key_default_values "KEY2"
echo_i "check zone ${ZONE} after reconfig"
ret=0
wait_for_log 10 "zone $ZONE/IN (signed): wait building NSEC3 chain until NSEC only DNSKEYs are removed" ns3/named.run || ret=1
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
check_nsec
# Zone: nsec3-to-rsasha1.kasp.

34
lib/dns/zone.c
View file

@ -9582,23 +9582,23 @@ zone_sign(dns_zone_t *zone) {
use_kasp ? "yes" : "no");
/* Determine which type of chain to build */
if (use_kasp) {
build_nsec3 = dns_kasp_nsec3(kasp);
if (!dns_zone_check_dnskey_nsec3(zone, db, version, NULL,
(dst_key_t **)&zone_keys,
nkeys))
{
dnssec_log(zone, ISC_LOG_INFO,
"wait building NSEC3 chain until NSEC only "
"DNSKEYs are removed");
build_nsec3 = false;
}
build_nsec = !build_nsec3;
} else {
CHECK(dns_private_chains(db, version, zone->privatetype,
&build_nsec, &build_nsec3));
/* If neither chain is found, default to NSEC */
if (!build_nsec && !build_nsec3) {
CHECK(dns_private_chains(db, version, zone->privatetype, &build_nsec,
&build_nsec3));
if (!build_nsec && !build_nsec3) {
if (use_kasp) {
build_nsec3 = dns_kasp_nsec3(kasp);
if (!dns_zone_check_dnskey_nsec3(
zone, db, version, NULL,
(dst_key_t **)&zone_keys, nkeys))
{
dnssec_log(zone, ISC_LOG_INFO,
"wait building NSEC3 chain until "
"NSEC only DNSKEYs are removed");
build_nsec3 = false;
}
build_nsec = !build_nsec3;
} else {
/* If neither chain is found, default to NSEC */
build_nsec = true;
}
}