From 1dc7288708a2c1027405d5c2b376809a335cf252 Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Wed, 1 Jun 2022 08:51:55 +0000
Subject: [PATCH 1/2] Don't process DNSSEC-related and ZONEMD records in catz

When processing a catalog zone update, skip processing records with
DNSSEC-related and ZONEMD types, because we are not interested in them
in the context of a catalog zone, and processing them will fail and
produce an unnecessary warning message.

(cherry picked from commit 73d664313703d2874c3b1a4380afdcd8ba26dc62)
---
 lib/dns/catz.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 53fbb1c2a7..a749ffa9d4 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -1799,6 +1799,12 @@ cleanup:
 	return (result);
 }
 
+static bool
+catz_rdatatype_is_processable(const dns_rdatatype_t type) {
+	return (!dns_rdatatype_isdnssec(type) && type != dns_rdatatype_cds &&
+		type != dns_rdatatype_cdnskey && type != dns_rdatatype_zonemd);
+}
+
 void
 dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 	dns_catz_zone_t *oldzone = NULL, *newzone = NULL;
@@ -1908,6 +1914,17 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 		result = dns_rdatasetiter_first(rdsiter);
 		while (result == ISC_R_SUCCESS) {
 			dns_rdatasetiter_current(rdsiter, &rdataset);
+
+			/*
+			 * Skip processing DNSSEC-related and ZONEMD types,
+			 * because we are not interested in them in the context
+			 * of a catalog zone, and processing them will fail
+			 * and produce an unnecessary warning message.
+			 */
+			if (!catz_rdatatype_is_processable(rdataset.type)) {
+				goto next;
+			}
+
 			result = dns_catz_update_process(catzs, newzone, name,
 							 &rdataset);
 			if (result != ISC_R_SUCCESS) {
@@ -1930,6 +1947,7 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 					      cname, classbuf, typebuf,
 					      isc_result_totext(result));
 			}
+		next:
 			dns_rdataset_disassociate(&rdataset);
 			if (result != ISC_R_SUCCESS) {
 				break;

From a0121f4908eadc97be21423c536af61465e3a833 Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Thu, 2 Jun 2022 08:42:05 +0000
Subject: [PATCH 2/2] Add CHANGES and release note for [GL #3380]

(cherry picked from commit b8073cbe72563b931c6840eb4a1591ab4fc7aac9)
---
 CHANGES                     | 3 +++
 doc/notes/notes-current.rst | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/CHANGES b/CHANGES
index fe408d0698..c2af95bd44 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5899.	[func]		Don't try to process DNSSEC-related and ZONEMD records
+			in catz. [GL #3380]
+
 5890.	[bug]		When the fetches-per-server quota was adjusted
 			because of an authoritative server timing out more
 			or less frequently, it was incorrectly set to 1
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 37d9d630c4..046b9151bc 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -43,3 +43,6 @@ Bug Fixes
 - Key files were updated every time the ``dnssec-policy`` key manager ran,
   whether the metadata has changed or not. BIND now checks if changes were
   applied before writing out the key files. :gl:`#3302`.
+
+- DNSSEC-signed catalog zones were not being processed correctly. This
+  has been fixed. :gl:`#3380`.