From 76fb29d8001f9f00f116ef1d597409479ef0fa0e Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Wed, 12 Oct 2022 17:01:57 +1100
Subject: [PATCH] Don't sign the raw zone

The raw zone is not supposed to be signed.  DNSKEY records in a raw zone
should not trigger zone signing.  The update code needs to be able to
identify when it is working on a raw zone.  Add dns_zone_israw() to
enable it to do this.

(cherry picked from commit 4b287ac02170351ce16f0d60a89b95a7f84ab0f2)
---
 lib/dns/include/dns/zone.h |  3 +++
 lib/dns/zone.c             | 10 ++++++++++
 lib/ns/update.c            |  8 ++++++--
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index ae84a5ff67..289cad6c89 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -2523,6 +2523,9 @@ dns_zone_link(dns_zone_t *zone, dns_zone_t *raw);
 void
 dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw);
 
+bool
+dns_zone_israw(dns_zone_t *zone);
+
 isc_result_t
 dns_zone_keydone(dns_zone_t *zone, const char *data);
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fd8431408e..ade8c779f8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -22563,6 +22563,16 @@ dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw) {
 	UNLOCK(&zone->lock);
 }
 
+bool
+dns_zone_israw(dns_zone_t *zone) {
+	bool result;
+	REQUIRE(DNS_ZONE_VALID(zone));
+	LOCK(&zone->lock);
+	result = zone->secure != NULL;
+	UNLOCK(&zone->lock);
+	return (result);
+}
+
 struct keydone {
 	isc_event_t event;
 	bool all;
diff --git a/lib/ns/update.c b/lib/ns/update.c
index cf4a469e10..cf6d94ac33 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -3413,7 +3413,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 
 		CHECK(rollback_private(db, privatetype, ver, &diff));
 
-		CHECK(add_signing_records(db, privatetype, ver, &diff));
+		if (!dns_zone_israw(zone)) {
+			CHECK(add_signing_records(db, privatetype, ver, &diff));
+		}
 
 		CHECK(add_nsec3param_records(client, zone, db, ver, &diff));
 
@@ -3426,7 +3428,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			 */
 			CHECK(dns_nsec3param_deletechains(db, ver, zone, true,
 							  &diff));
-		} else if (has_dnskey && isdnssec(db, ver, privatetype)) {
+		} else if (!dns_zone_israw(zone) && has_dnskey &&
+			   isdnssec(db, ver, privatetype))
+		{
 			dns_update_log_t log;
 			uint32_t interval =
 				dns_zone_getsigvalidityinterval(zone);