ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Don't resign raw version of the zone

Browse Source 
Update the function 'set_resigntime()' so that raw versions of
inline-signing zones are not scheduled to be resigned.

Also update the check in the same function for zone is dynamic, there
exists a function 'dns_zone_isdynamic()' that does a similar thing
and is more complete.

Also in 'zone_postload()' check whether the zone is not the raw
version of an inline-signing zone, preventing calculating the next
resign time.
This commit is contained in:
Matthijs Mekking
2023-10-16 09:26:56 +02:00
parent c90b622648
commit 741ce2d07a
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/zone.c
+3 -7
View File
@@ -3825,15 +3825,11 @@ set_resigntime(dns_zone_t *zone) {
INSIST(LOCKED_ZONE(zone));
/* We only re-sign zones that can be dynamically updated */
if (zone->update_disabled) {
if (!dns_zone_isdynamic(zone, false)) {
return;
}
if (!inline_secure(zone) &&
(zone->type != dns_zone_primary ||
(zone->ssutable == NULL &&
(zone->update_acl == NULL || dns_acl_isnone(zone->update_acl)))))
{
if (inline_raw(zone)) {
return;
}
@@ -5174,7 +5170,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
is_dynamic = dns_zone_isdynamic(zone, false);
if (zone->type == dns_zone_primary && is_dynamic &&
dns_db_issecure(db))
dns_db_issecure(db) && !inline_raw(zone))
{
dns_name_t *name;
dns_fixedname_t fixed;