upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-03 14:00:47 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Allow CDS/CDNSKEY DELETE records in unsigned zone

Browse source 
While not useful, having a CDS/CDNSKEY DELETE record in an unsigned
zone is not an error and "named-checkzone" should not complain.
This commit is contained in:
Matthijs Mekking 2021-03-17 10:02:22 +01:00
parent 052ec16a44
commit f211c7c2a1
2 changed files with 20 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
bin/tests/system/checkzone/zones/good-cds-unsigned.db Normal file
View file

@ -0,0 +1,5 @@
example. 0 SOA . . 0 0 0 0 0
example. 0 NS .
example. 0 CDS 0 0 0 00
example. 0 CDNSKEY 0 3 0 AA==

23
lib/dns/zone.c
View file

@ -20524,6 +20524,7 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
unsigned char buffer[DNS_DS_BUFFERSIZE];
unsigned char algorithms[256];
unsigned int i;
bool empty = false;
enum { notexpected = 0, expected = 1, found = 2 };
@ -20559,14 +20560,8 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
dns_rdatatype_none, 0, &dnskey, NULL);
if (result == ISC_R_NOTFOUND) {
if (dns_rdataset_isassociated(&cds)) {
result = DNS_R_BADCDS;
} else {
result = DNS_R_BADCDNSKEY;
}
goto failure;
}
if (result != ISC_R_SUCCESS) {
empty = true;
} else if (result != ISC_R_SUCCESS) {
goto failure;
}
@ -20596,6 +20591,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
delete = true;
continue;
}
if (empty) {
result = DNS_R_BADCDS;
goto failure;
}
CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL));
if (algorithms[structcds.algorithm] == 0) {
algorithms[structcds.algorithm] = expected;
@ -20663,6 +20664,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
delete = true;
continue;
}
if (empty) {
result = DNS_R_BADCDNSKEY;
goto failure;
}
CHECK(dns_rdata_tostruct(&crdata, &structcdnskey,
NULL));
if (algorithms[structcdnskey.algorithm] == 0) {