From: Matthijs Mekking <matthijs@isc.org>
Date: Wed, 24 Feb 2021 08:35:06 +0000 (+0100)
Subject: Fix dnssec-policy NSEC3 on dynamic zones
X-Git-Tag: v9.17.11~25^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4b176c850b943fb2f57a430480f155952360ec95;p=thirdparty%2Fbind9.git

Fix dnssec-policy NSEC3 on dynamic zones

When applying dnssec-policy on a dynamic zone (e.g. that allows Dynamic
Updates), the NSEC3 parameters were put on the queue, but they were
not being processed (until a reload of the zone or reconfiguration).

Process the NSEC3PARAM queue on zone postload when handling a
dynamic zone.
---

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2fe91debe44..5b8b1f1ddca 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -4881,12 +4881,32 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			      "could not find NS and/or SOA records");
 	}
 
+	/*
+	 * Process any queued NSEC3PARAM change requests. Only for dynamic
+	 * zones, an inline-signing zone will perform this action when
+	 * receiving the secure db (receive_secure_db).
+	 */
+	is_dynamic = dns_zone_isdynamic(zone, true);
+	if (is_dynamic) {
+		isc_event_t *setnsec3param_event;
+		dns_zone_t *dummy;
+
+		while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
+			setnsec3param_event =
+				ISC_LIST_HEAD(zone->setnsec3param_queue);
+			ISC_LIST_UNLINK(zone->setnsec3param_queue,
+					setnsec3param_event, ev_link);
+			dummy = NULL;
+			zone_iattach(zone, &dummy);
+			isc_task_send(zone->task, &setnsec3param_event);
+		}
+	}
+
 	/*
 	 * Check to make sure the journal is up to date, and remove the
 	 * journal file if it isn't, as we wouldn't be able to apply
 	 * updates otherwise.
 	 */
-	is_dynamic = dns_zone_isdynamic(zone, true);
 	if (zone->journal != NULL && is_dynamic &&
 	    !DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS))
 	{