Allow rndc signing commands with dnssec-policy

Some 'rndc signing' commands can still be used in conjunction with
'dnssec-policy' because it shows the progress of signing and
private type records can be cleaned up. Allow these commands to be
executed.

However, setting NSEC3 parameters is incompatible with dnssec-policy.

diff --git a/bin/named/server.c b/bin/named/server.c
index 8a6b0657088048db264cf0a3b8451461ddd7d010..130175bcff9ea9c07ac1ceb414dff451a06cf64b 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -14455,6 +14455,7 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
        unsigned char salt[255];
        const char *ptr;
        size_t n;
+       bool kasp = false;
 
        REQUIRE(text != NULL);
 
@@ -14562,17 +14563,14 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
        }
 
        if (dns_zone_getkasp(zone) != NULL) {
-               (void)putstr(text, "zone uses dnssec-policy, use rndc dnssec "
-                                  "command instead");
-               (void)putnull(text);
-               goto cleanup;
+               kasp = true;
        }
 
        if (clear) {
                CHECK(dns_zone_keydone(zone, keystr));
                (void)putstr(text, "request queued");
                (void)putnull(text);
-       } else if (chain) {
+       } else if (chain && !kasp) {
                CHECK(dns_zone_setnsec3param(
                        zone, (uint8_t)hash, (uint8_t)flags, iter,
                        (uint8_t)saltlen, salt, true, resalt));
@@ -14629,6 +14627,10 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
                if (result == ISC_R_NOMORE) {
                        result = ISC_R_SUCCESS;
                }
+       } else if (kasp) {
+               (void)putstr(text, "zone uses dnssec-policy, use rndc dnssec "
+                                  "command instead");
+               (void)putnull(text);
        }
 
 cleanup: