New setting compare-signatures-on-zone-freshness-check to disable DO flag for SOA...

Turning this off will disable the DO flag for SOA queries during zone freshness checks of secondary zones
to workaround truncated SOA responses. It will also disable signature comparison which are used to detect
signature changes even when the serial was not increased. Hence, disable this setting only if the Primary
name server always increases the serial on signature changes.
Default: yes (= old behavior)

(cherry picked from commit 343566c59bc06ef4f246e0a49e903b9dbd9d1722)

diff --git a/docs/modes-of-operation.rst b/docs/modes-of-operation.rst
index 0b2be10f326caebacbf1a11963ffc3b6b3aa6365..6ada9d2699316f9138aa1d3d12b07435a9d4ecb4 100644 (file)
--- a/docs/modes-of-operation.rst
+++ b/docs/modes-of-operation.rst
@@ -101,6 +101,20 @@ retrieved and inserted into the database. In any case, after the check,
 the domain is declared 'fresh', and will only be checked again after
 '**refresh**' seconds have passed.
 
+If the serial on the Primary is equal to the serial on the Secondary,
+but the zone is presigned, the Secondary will also compare the RRSIG
+of the SOA and queue a zone transfer if the signatures are different.
+This is useful if the Primary is also PowerDNS as the serial may not be
+increased although signatures are updated. To compare also the RRSIGs,
+PowerDNS sets the DO flag when querying the SOA on the Primary. Setting
+the DO flag may trigger truncated responses and the SOA check should
+fall-back to TCP. As this fall-back is currently not supported in
+PowerDNS, freshnes checks may fail. If it is known that the Primary
+always increases the serial on signature changes, signature comparison
+can be turned off by disabling
+:ref:`setting-compare-signatures-on-zone-freshness-check`. This will disable
+the DO flag and should work around the truncate issue.
+
 When the freshness of a domain cannot be checked, e.g. because the
 master is offline, PowerDNS will retry the domain after
 :ref:`setting-xfr-cycle-interval` seconds.

diff --git a/docs/settings.rst b/docs/settings.rst
index 96362b0788089169891be1e94fbbcd88d048b4ed..ed4d4904b39e34aa6954defbe4c13344fffb4a3c 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -273,6 +273,21 @@ Either don't ``chroot`` on these systems or set the 'Type' of the
 service to 'simple' instead of 'notify' (refer to the systemd
 documentation on how to modify unit-files).
 
+.. _setting-compare-signatures-on-zone-freshness-check:
+
+``compare-signatures-on-zone-freshness-check``
+----------------------------------------------
+
+.. versionadded:: 4.7.0
+
+-  Boolean
+-  Default: yes
+
+Turning this off will disable the DO flag for SOA queries during zone freshness checks of secondary zones
+to workaround truncated SOA responses. It will also disable signature comparison which are used to detect
+signature changes even when the serial was not increased. Hence, disable this setting only if the Primary
+name server always increases the serial on signature changes.
+
 .. _setting-config-dir:
 
 ``config-dir``

diff --git a/pdns/auth-main.cc b/pdns/auth-main.cc
index 427a997fbd9580b7ae1ca96086ccc8b52b9c0ed0..65bde150273cd4c6f6eabb2718f29fc987ad4ddb 100644 (file)
--- a/pdns/auth-main.cc
+++ b/pdns/auth-main.cc
@@ -214,6 +214,7 @@ void declareArguments()
   ::arg().set("allow-notify-from", "Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies.") = "0.0.0.0/0,::/0";
   ::arg().set("slave-cycle-interval", "Schedule slave freshness checks once every .. seconds") = "60";
   ::arg().set("xfr-cycle-interval", "Schedule primary/secondary SOA freshness checks once every .. seconds") = "60";
+  ::arg().set("compare-signatures-on-zone-freshness-check", "Set DO flag on SOA queries to receive signatures for signature comparison") = "yes";
 
   ::arg().set("tcp-control-address", "If set, PowerDNS can be controlled over TCP on this address") = "";
   ::arg().set("tcp-control-port", "If set, PowerDNS can be controlled over TCP on this address") = "53000";

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index d8ccff1388fc92bfaecacafb6814b25dc01c3266..eaf4d22abdab5b3db780bd3d5e8cbd3a459e05cf 100644 (file)
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -1182,7 +1182,11 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
 
       DomainNotificationInfo dni;
       dni.di=di;
-      dni.dnssecOk = dk.doesDNSSEC();
+      if (::arg().mustDo("compare-signatures-on-zone-freshness-check")) {
+        dni.dnssecOk = dk.doesDNSSEC();
+      } else {
+        dni.dnssecOk = false;
+      }
 
       if(dk.getTSIGForAccess(di.zone, sr.master, &dni.tsigkeyname)) {
         string secret64;
@@ -1327,7 +1331,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
     }
     else if(hasSOA && theirserial == ourserial) {
       uint32_t maxExpire=0, maxInception=0;
-      if(dk.isPresigned(di.zone)) {
+      if(dk.isPresigned(di.zone) && ::arg().mustDo("compare-signatures-on-zone-freshness-check")) {
         B->lookup(QType(QType::RRSIG), di.zone, di.id); // can't use DK before we are done with this lookup!
         DNSZoneRecord zr;
         while(B->get(zr)) {