upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 09:09:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Don't also skip keymgr run if checkds is skipped

Browse source 
Checking the DS at the parent only happens if dns_zone_getdnsseckeys()
returns success. However, if this function somehow fails, it can also
prevent the keymgr from running.

Before adding the check DS functionality, the keymgr should only run
if 'dns_dnssec_findmatchingkeys()' did not return an error (either
ISC_R_SUCCESS or ISC_R_NOTFOUND). After this change the correct
result code is used again.

(cherry picked from commit 07c2acf15d)
This commit is contained in:
Matthijs Mekking 2024-01-31 11:44:07 +01:00
parent 76d1ea8936
commit b730a65975
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
lib/dns/zone.c
View file

@ -22108,20 +22108,20 @@ zone_rekey(dns_zone_t *zone) {
ISC_LIST_INIT(zone->checkds_ok);
UNLOCK_ZONE(zone);
result = dns_zone_getdnsseckeys(zone, db, ver, now,
&zone->checkds_ok);
if (result == ISC_R_SUCCESS) {
isc_result_t ret = dns_zone_getdnsseckeys(zone, db, ver, now,
&zone->checkds_ok);
if (ret == ISC_R_SUCCESS) {
zone_checkds(zone);
} else {
dnssec_log(zone,
(result == ISC_R_NOTFOUND) ? ISC_LOG_DEBUG(1)
: ISC_LOG_ERROR,
(ret == ISC_R_NOTFOUND) ? ISC_LOG_DEBUG(1)
: ISC_LOG_ERROR,
"zone_rekey:dns_zone_getdnsseckeys failed: "
"%s",
isc_result_totext(result));
isc_result_totext(ret));
}
/* Run keymgr */
if (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND) {
dns_zone_lock_keyfiles(zone);
result = dns_keymgr_run(&zone->origin, zone->rdclass,
@ -22142,6 +22142,12 @@ zone_rekey(dns_zone_t *zone) {
KASP_UNLOCK(kasp);
/*
* Update CDS, CDNSKEY and DNSKEY record sets if the keymgr ran
* successfully (dns_keymgr_run returned ISC_R_SUCCESS), or in
* case of DNSSEC management without dnssec-policy if we have keys
* (dns_dnssec_findmatchingkeys returned ISC_R_SUCCESS).
*/
if (result == ISC_R_SUCCESS) {
bool cdsdel = false;
bool cdnskeydel = false;