dnssec/DS-push: replan from timers if reconf'd during submission

diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index 7308ec4f9d2a97f462868f4fbe8229a5fa62b176..0166886d2fc05be04ccfd410e53011ee5ed2dbde 100644 (file)
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -884,11 +884,18 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
                CHECK_RET;
        }
 
-       if (dnssec_ctx->policy->ds_push && node_rrtype_exists(ch.add->apex, KNOT_RRTYPE_CDS)) {
+       if (node_rrtype_exists(ch.add->apex, KNOT_RRTYPE_CDS)) {
                // there is indeed a change to CDS
                update->zone->timers->next_ds_push = time(NULL) + dnssec_ctx->policy->propagation_delay;
                update->zone->timers->flags |= TIMERS_MODIFIED;
-               zone_events_schedule_at(update->zone, ZONE_EVENT_DS_PUSH, update->zone->timers->next_ds_push);
+               // the event is planned only if DS-push configured, but timers set always just for case of later reconfiguration
+               if (dnssec_ctx->policy->ds_push) {
+                       zone_events_schedule_at(update->zone, ZONE_EVENT_DS_PUSH, update->zone->timers->next_ds_push);
+               }
+       } else if (node_rrtype_exists(ch.remove->apex, KNOT_RRTYPE_CDS)) {
+               // CDS removal
+               update->zone->timers->next_ds_push = 0;
+               update->zone->timers->flags |= TIMERS_MODIFIED;
        }
 
        ret = zone_update_apply_changeset(update, &ch);

diff --git a/src/knot/events/replan.c b/src/knot/events/replan.c
index 5c3ddbcf77b65af69ef2a812a0c0f7a66c5df84a..304cec7f1840a02059645ee8a1edd106bdf745eb 100644 (file)
--- a/src/knot/events/replan.c
+++ b/src/knot/events/replan.c
@@ -147,7 +147,13 @@ void replan_from_timers(conf_t *conf, zone_t *zone)
                if (ds_check == 0) {
                        ds_check = TIME_IGNORE;
                }
-               ds_push = zone->timers->next_ds_push;
+               val = conf_zone_get(conf, C_DS_PUSH, zone->name);
+               if (val.code != KNOT_EOK) {
+                       val = conf_id_get(conf, C_POLICY, C_DS_PUSH, &policy);
+               }
+               if (conf_val_count(&val) > 0) {
+                        ds_push = zone->timers->next_ds_push;
+               }
                if (ds_push == 0) {
                        ds_push = TIME_IGNORE;
                }

diff --git a/tests-extra/tests/dnssec/ds_push/test.py b/tests-extra/tests/dnssec/ds_push/test.py
index a252e33db4dc2374b6ab06ceddf6d12c72af9d91..51326aadb90d4e7ec8bf13bbe4db8fd7bfb010e3 100644 (file)
--- a/tests-extra/tests/dnssec/ds_push/test.py
+++ b/tests-extra/tests/dnssec/ds_push/test.py
@@ -124,7 +124,6 @@ child.dnssec(child_zone).propagation_delay = 4
 child.dnssec(child_zone).ksk_shared = True
 child.dnssec(child_zone).cds_cdnskey_publish = "always"
 
-child.conf_zone(child_zone).ds_push = [ parent ]
 child.conf_ss("submission", child_zone).parent = [ parent ]
 child.conf_ss("submission", child_zone).check_interval = 2
 
@@ -135,7 +134,17 @@ t.sleep(2)
 child.start()
 child.zone_wait(child_zone)
 
-t.sleep(9)
+SLEEP_FIRST=random.randint(0, 5)
+t.sleep(SLEEP_FIRST)
+
+child.conf_zone(child_zone).ds_push = [ parent ]
+child.gen_confile()
+child.reload()
+
+t.sleep(7-SLEEP_FIRST)
+
+if not child.log_search("KSK submission, confirmed"):
+    set_err("initial KSK not confirmed")
 
 pregenerate_key(child, child_zone, "ECDSAP256SHA256")
 watch_ksk_rollover(t, child, child_zone[0], 2, 2, 3, "KSK rollover")