ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Fix reloading inline-signed zones

Browse Source 
While "rndc reload" causes dns_zone_asyncload() to be called for the
signed version of an inline-signed zone, the subsequent zone_load() call
causes the raw version to be reloaded from storage.  This means that
DNS_ZONEFLG_LOADPENDING gets set for the signed version of the zone by
dns_zone_asyncload() before the reload is attempted, but zone_postload()
is only called for the raw version and thus DNS_ZONEFLG_LOADPENDING is
cleared for the raw version, but not for the signed version.  This in
turn prevents zone maintenance from happening for the signed version of
the zone.

Until commit 29b7efdd9f, this problem
remained dormant because DNS_ZONEFLG_LOADPENDING was previously
immediately, unconditionally cleared after zone loading was started
(whereas it should only be cleared when zone loading is finished or an
error occurs).  This behavior caused other issues [1] and thus had to be
changed.

Fix reloading inline-signed zones by clearing DNS_ZONEFLG_LOADPENDING
for the signed version of the zone once the raw version reload
completes.  Take care not to clear it prematurely during initial zone
load.  Also make sure that DNS_ZONEFLG_LOADPENDING gets cleared when
zone_postload() encounters an error or returns early, to prevent other
scenarios from resulting in the same problem.  Add comments aiming to
help explain code flow.

[1] see RT #47076
This commit is contained in:
Michał Kępień
2018-08-22 11:28:54 +02:00
parent d2785afebe
commit 5431583971
5 changed files with 98 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
bin/tests/system/inline/ns3/master5.db.in Normal file
View File

@@ -0,0 +1,22 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300 ; 5 minutes
@ IN SOA ns3 . (
2000042411 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns3
ns3 A 10.53.0.3
c A 10.0.0.3
e A 10.0.0.5

4
bin/tests/system/inline/ns3/named.conf.in
View File

@@ -58,6 +58,10 @@ zone "master" {
inline-signing yes;
auto-dnssec maintain;
file "master.db";
notify explicit;
also-notify {
10.53.0.3;
};
};
zone "dynamic" {

25
bin/tests/system/inline/tests.sh
View File

@@ -897,6 +897,31 @@ done
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)"
ret=1
# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so
# that the master file modification time has no possibility of being equal to
# the one stored during server startup.
sleep 1
nextpart ns3/named.run > /dev/null
cp ns3/master5.db.in ns3/master.db
$RNDCCMD 10.53.0.3 reload 2>&1 | sed 's/^/ns3 /' | cat_i
for i in 1 2 3 4 5 6 7 8 9 10
do
if nextpart ns3/named.run | grep "zone master.*sending notifies" > /dev/null; then
ret=0
break
fi
sleep 1
done
# Sanity check: master file updates should be reflected in the signed zone,
# i.e. SOA RNAME should no longer be set to "hostmaster".
$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1
grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "test add/del zone combinations ($n)"
ret=0