4916. [bug] Not creating signing keys for an inline signed zone
prevented changes applied to the raw zone from being
reflected in the secure zone until signing keys were
made available. [GL #159]
4915. [bug] Bumped signed serial of an inline signed zone was
logged even when an error occurred while updating
signatures. [GL #159]
(cherry picked from commit 7d2c09c905)
(cherry picked from commit e4995efe24)
(cherry picked from commit 821c27bb7c)
When inline signing is enabled for a zone without creating signing keys
for it, changes subsequently applied to the raw zone will not be
reflected in the secure zone due to the dns_update_signaturesinc() call
inside receive_secure_serial() failing. Given that an inline zone will
be served (without any signatures) even with no associated signing keys
being present, keep applying raw zone deltas to the secure zone until
keys become available in an attempt to follow the principle of least
astonishment.
(cherry picked from commit 6acf326969)
(cherry picked from commit 8a58a60772)
(cherry picked from commit fcbdeed802)
If a raw zone is modified, but the dns_update_signaturesinc() call in
receive_secure_serial() fails, the corresponding secure zone's database
will not be modified, even though by that time a message containing the
bumped signed serial will already have been logged. This creates
confusion, because a different secure zone version will be served than
the one announced in the logs. Move the relevant dns_zone_log() call so
that it is only performed if the secure zone's database is modified.
(cherry picked from commit cfbc8e264d)
(cherry picked from commit cdc7ab42b1)
(cherry picked from commit c042ec70d2)
- these are cases where result has been explicitly set, so
if (result != ISC_R_SUCCESS) is unnecessary
(cherry picked from commit e00eb55cd2)
(cherry picked from commit 0dcff8f93c)
- IMHO we should consider removing dnsconf.c and deprecating the
/etc/dns.conf file, though, as I don't think it's likely anyone
is using it
(cherry picked from commit a08ba418ef)
(cherry picked from commit b9db91aa64)
Commit f87e0c03ee removed the "system" directory from the TESTDIRS
variable in bin/tests/Makefile.in in an attempt to fix "make distclean"
which was broken since commit 0d784de16a. However, this change
prevented any system tests from being run when "make test" is invoked.
We now put it back into both SUBDIRS and TESTDIRS, but with a modified
rule to check for the existence of a Makefile in each subdirectory before
trying to run make there. This prevents "make distclean" from trying to
run again in a directory where it's already been run.
(cherry picked from commit 93ee6b8a22)
Apart from ensuring "make test" returns 0, also check whether any system
test output was generated as a result of running it. This prevents the
CI job running system tests from succeeding unless it actually tests
something.
(cherry picked from commit 80ab2c0f22)
Paul HoffmanandEvan Hunt
Michał KępieńandEvan Hunt
Mark Andrews
Ondřej SurýandMark Andrews
Petr MensikandMark Andrews
Mukund SivaramanandMark Andrews
Ondřej Surý