Fix "unable to thaw dynamic kasp zone"

Dynamic zones with dnssec-policy could not be thawed because KASP
zones were considered always dynamic. But a dynamic KASP zone should
also check whether updates are disabled.

diff --git a/CHANGES b/CHANGES
index 780969125d034ae639ac2c6a353d8c7f8bd7a3d8..fa1fc30a70bfb2c22e750c47dd1922e24902c568 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5601.  [bug]           Dynamic zones with dnssec-policy could not be thawed
+                       because KASP zones were always considered dynamic;
+                       previously, dynamic KASP zones did not check whether
+                       updates were disabled. This has been fixed. [GL #2523]
+
 5600.  [bug]           Load a certificate chain file so that the full chain is
                        sent to DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH)
                        clients that require full chain verification. [GL #2514]

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 8c388ae75d42089af6329ccf10a99c9f6b32b482..f98bc55bd5c7ed5cfc4aa92624de1be86c4c09d1 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -83,5 +83,8 @@ Bug Fixes
   (upgrade). Note that this *must not* be done while ``named`` is
   running.  [GL #2505]
 
+- Dynamic zones with ``dnssec-policy`` that were frozen could not be thawed.
+  This has been fixed. [GL #2523]
+
 - Fix a crash when transferring a zone over TLS, after "named" previously
   skipped a master. [GL #2562]

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index baa3271c25b4847b4c126775b24f2e3beb84e2bd..e9766b8e66409251d6c51f0b2b00385a4070ab74 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1841,11 +1841,6 @@ dns_zone_isdynamic(dns_zone_t *zone, bool ignore_freeze) {
                return (true);
        }
 
-       /* Kasp zones are always dynamic. */
-       if (dns_zone_use_kasp(zone)) {
-               return (true);
-       }
-
        /* If !ignore_freeze, we need check whether updates are disabled.  */
        if (zone->type == dns_zone_master &&
            (!zone->update_disabled || ignore_freeze) &&
@@ -2094,8 +2089,8 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
        is_dynamic = dns_zone_isdynamic(zone, false);
        if (zone->db != NULL && is_dynamic) {
                /*
-                * This is a slave, stub, dynamically updated, or kasp enabled
-                * zone being reloaded.  Do nothing - the database we already
+                * This is a slave, stub, or dynamically updated zone being
+                * reloaded.  Do nothing - the database we already
                 * have is guaranteed to be up-to-date.
                 */
                if (zone->type == dns_zone_master && !hasraw) {