mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-04 17:24:47 -04:00
0ae3ffdc1c
When named restarts, it will examine signed zones and checks if the current denial of existence strategy matches the dnssec-policy. If not, it will schedule to create a new NSEC(3) chain. However, on startup the zone database may not be read yet, fooling BIND that the denial of existence chain needs to be created. This results in a replacement of the previous NSEC(3) chain. Change the code such that if the NSEC3PARAM lookup failed (the result did not return in ISC_R_SUCCESS or ISC_R_NOTFOUND), we will try again later. The nsec3param structure has additional variables to signal if the lookup is postponed. We also need to save the signal if an explicit resalt was requested. In addition to the two added boolean variables, we add a variable to store the NSEC3PARAM rdata. This may have a yet to be determined salt value. We can't create the private data yet because there may be a mismatch in salt length and the NULL salt value. |
||
|---|---|---|
| .. | ||
| bind9 | ||
| dns | ||
| irs | ||
| isc | ||
| isccc | ||
| isccfg | ||
| ns | ||
| win32/bindevt | ||
| .gitignore | ||
| Makefile.am | ||
| unit-test-driver.sh.in | ||