dnssec/zone_update: zone sign bumps SOA serial only if not updated yet

this bug bahaves like this: if you configure:
    dnssec-signing: on
    zonefile-load: difference
it will, upon changing zonefile, make inconsistencies in journal
leading in broken IXFR

the reason is that by calling set_new_soa over existing SOA in
changeset (probably because of zone_update_from_differences)
it updates the changeset's soa_from to incorrect value

diff --git a/src/knot/dnssec/zone-events.c b/src/knot/dnssec/zone-events.c
index 91f74459c51fe6c7c1f998731f579d40e70c734b..4e157ca58d27e786c8e64f776c5170186a0c3084 100644 (file)
--- a/src/knot/dnssec/zone-events.c
+++ b/src/knot/dnssec/zone-events.c
@@ -201,7 +201,7 @@ int knot_dnssec_zone_sign(zone_update_t *update,
                goto done;
        }
 
-       if (!(flags & ZONE_SIGN_KEEP_SERIAL)) {
+       if (!(flags & ZONE_SIGN_KEEP_SERIAL) && zone_update_to(update) == NULL) {
                result = zone_update_increment_soa(update, conf());
                if (result == KNOT_EOK) {
                        result = knot_zone_sign_soa(update, &keyset, &ctx);