Commit 82f72ae2 authored by Matthijs Mekking's avatar Matthijs Mekking 🏡
Browse files

Rekey immediately after rndc checkds/rollover

Call 'dns_zone_rekey' after a 'rndc dnssec -checkds' or 'rndc dnssec
-rollover' command is received, because such a command may influence
the next key event. Updating the keys immediately avoids unnecessary
rollover delays.

The kasp system test no longer needs to call 'rndc loadkeys' after
a 'rndc dnssec -checkds' or 'rndc dnssec -rollover' command.
parent 28923bc6
5607. [bug] Rekey after 'rndc dnssec -checkds' or 'rndc dnssec
-rollover' command is received, because such a command
may influence the next key event. [GL #2488]
5606. [bug] CDS/CDNSKEY DELETE records were not removed when a zone
transitioned from secure to insecure. "named-checkzone"
should not complain if such records exist in an
......
......@@ -15122,6 +15122,12 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
switch (result) {
case ISC_R_SUCCESS:
/*
* Rekey after checkds command because the next key
* event may have changed.
*/
dns_zone_rekey(zone, false);
if (use_keyid) {
char tagbuf[6];
snprintf(tagbuf, sizeof(tagbuf), "%u", keyid);
......@@ -15166,6 +15172,12 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
switch (result) {
case ISC_R_SUCCESS:
/*
* Rekey after rollover command because the next key
* event may have changed.
*/
dns_zone_rekey(zone, false);
if (use_keyid) {
char tagbuf[6];
snprintf(tagbuf, sizeof(tagbuf), "%u", keyid);
......
......@@ -1037,25 +1037,6 @@ check_cdslog() {
status=$((status+ret))
}
#
# Utility to call after 'rndc dnssec -checkds|-rollover'.
#
_loadkeys_on() {
_server=$1
_dir=$2
_zone=$3
nextpart $_dir/named.run > /dev/null
_rndccmd $_server loadkeys $_zone in $_view > rndc.dnssec.loadkeys.out.$_zone.$n
if [ "${DYNAMIC}" = "yes" ]; then
wait_for_log 20 "zone ${_zone}/IN: next key event" $_dir/named.run || return 1
else
# inline-signing zone adds "(signed)"
wait_for_log 20 "zone ${_zone}/IN (signed): next key event" $_dir/named.run || return 1
fi
}
# Tell named that the DS for the key in given zone has been seen in the
# parent (this does not actually has to be true, we just issue the command
# to make named believe it can continue with the rollover).
......@@ -1085,10 +1066,6 @@ rndc_checkds() {
_rndccmd $_server dnssec -checkds $_keycmd $_whencmd $_what $_zone in $_view > rndc.dnssec.checkds.out.$_zone.$n || _log_error "rndc dnssec -checkds${_keycmd}${_whencmd} ${_what} zone ${_zone} failed"
if [ "$ret" -eq 0 ]; then
_loadkeys_on $_server $_dir $_zone || _log_error "loadkeys zone ${_zone} failed ($n)"
fi
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
}
......@@ -1113,8 +1090,6 @@ rndc_rollover() {
_rndccmd $_server dnssec -rollover -key $_keyid $_whencmd $_zone in $_view > rndc.dnssec.rollover.out.$_zone.$n || _log_error "rndc dnssec -rollover (key ${_keyid} when ${_when}) zone ${_zone} failed"
_loadkeys_on $_server $_dir $_zone || _log_error "loadkeys zone ${_zone} failed ($n)"
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
}
......@@ -39,6 +39,10 @@ Feature Changes
Bug Fixes
~~~~~~~~~
- When calling ``rndc dnssec -rollover`` or ``rndc checkds -checkds``,
``named`` now updates the keys immediately, avoiding unnecessary rollover
delays. [#2488]
- Dynamic zones with ``dnssec-policy`` that were frozen could not be thawed.
This has been fixed. [GL #2523]
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment