From: Tony Finch <dot@dotat.at>
Date: Tue, 15 Oct 2019 14:12:29 +0000 (+0100)
Subject: Do not flush the cache for `rndc validation status`
X-Git-Tag: v9.15.6~37^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b612e38af165e136a84362b4d2e3dc4d6700a0c7;p=thirdparty%2Fbind9.git

Do not flush the cache for `rndc validation status`

And add a note to the man page that `rndc validation` flushes the
cache when the validation state is changed. (It is necessary to flush
the cache when turning on validation, to avoid continuing to use
cryptographically invalid data. It is probably wise to flush the cache
when turning off validation to recover from lameness problems.)
---

diff --git a/bin/named/server.c b/bin/named/server.c
index 452b38945d8..2cd6b10d88f 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -11081,9 +11081,9 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 		if ((ptr != NULL && strcasecmp(ptr, view->name) != 0)
 		    || strcasecmp("_bind", view->name) == 0)
 			continue;
-		CHECK(dns_view_flushcache(view, false));
 
 		if (set) {
+			CHECK(dns_view_flushcache(view, false));
 			view->enablevalidation = enable;
 			changed = true;
 		} else {
diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
index acc14ac2cda..c5c1c4e0a24 100644
--- a/bin/rndc/rndc.docbook
+++ b/bin/rndc/rndc.docbook
@@ -1078,6 +1078,8 @@
 	  <para>
 	    Enable, disable, or check the current status of
 	    DNSSEC validation.  By default, validation is enabled.
+	    The cache is flushed when validation is turned on or off
+	    to avoid using data that might differ between states.
 	  </para>
 	</listitem>
       </varlistentry>