ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

When signing with a new algorithm preserve NSEC/NSEC3 chains

Browse Source 
If the zone already has existing NSEC/NSEC3 chains then zone_sign
needs to continue to use them.  If there are no chains then use
kasp setting otherwise generate an NSEC chain.

(cherry picked from commit 4b55201459)
This commit is contained in:
Mark Andrews
2023-03-15 00:30:22 +11:00
parent 589a203f23
commit 772cdf453d
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/zone.c
+8 -8
View File
@@ -9599,14 +9599,14 @@ zone_sign(dns_zone_t *zone) {
use_kasp ? "yes" : "no");
/* Determine which type of chain to build */
if (use_kasp) {
build_nsec3 = dns_kasp_nsec3(kasp);
build_nsec = !build_nsec3;
} else {
CHECK(dns_private_chains(db, version, zone->privatetype,
&build_nsec, &build_nsec3));
/* If neither chain is found, default to NSEC */
if (!build_nsec && !build_nsec3) {
CHECK(dns_private_chains(db, version, zone->privatetype, &build_nsec,
&build_nsec3));
if (!build_nsec && !build_nsec3) {
if (use_kasp) {
build_nsec3 = dns_kasp_nsec3(kasp);
build_nsec = !build_nsec3;
} else {
/* If neither chain is found, default to NSEC */
build_nsec = true;
}
}