From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 5 Mar 2021 10:22:01 +0000 (+0100)
Subject: Fix "unable to thaw dynamic kasp zone"
X-Git-Tag: v9.17.12~40^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b518ed9f4687d8eef4802acef33090193b6a31b8;p=thirdparty%2Fbind9.git

Fix "unable to thaw dynamic kasp zone"

Dynamic zones with dnssec-policy could not be thawed because KASP
zones were considered always dynamic. But a dynamic KASP zone should
also check whether updates are disabled.
---

diff --git a/CHANGES b/CHANGES
index 780969125d0..fa1fc30a70b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5601.	[bug]		Dynamic zones with dnssec-policy could not be thawed
+			because KASP zones were always considered dynamic;
+			previously, dynamic KASP zones did not check whether
+			updates were disabled. This has been fixed. [GL #2523]
+
 5600.	[bug]		Load a certificate chain file so that the full chain is
 			sent to DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH)
 			clients that require full chain verification. [GL #2514]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 8c388ae75d4..f98bc55bd5c 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -83,5 +83,8 @@ Bug Fixes
   (upgrade). Note that this *must not* be done while ``named`` is
   running.  [GL #2505]
 
+- Dynamic zones with ``dnssec-policy`` that were frozen could not be thawed.
+  This has been fixed. [GL #2523]
+
 - Fix a crash when transferring a zone over TLS, after "named" previously
   skipped a master. [GL #2562]
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index baa3271c25b..e9766b8e664 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1841,11 +1841,6 @@ dns_zone_isdynamic(dns_zone_t *zone, bool ignore_freeze) {
 		return (true);
 	}
 
-	/* Kasp zones are always dynamic. */
-	if (dns_zone_use_kasp(zone)) {
-		return (true);
-	}
-
 	/* If !ignore_freeze, we need check whether updates are disabled.  */
 	if (zone->type == dns_zone_master &&
 	    (!zone->update_disabled || ignore_freeze) &&
@@ -2094,8 +2089,8 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 	is_dynamic = dns_zone_isdynamic(zone, false);
 	if (zone->db != NULL && is_dynamic) {
 		/*
-		 * This is a slave, stub, dynamically updated, or kasp enabled
-		 * zone being reloaded.  Do nothing - the database we already
+		 * This is a slave, stub, or dynamically updated zone being
+		 * reloaded.  Do nothing - the database we already
 		 * have is guaranteed to be up-to-date.
 		 */
 		if (zone->type == dns_zone_master && !hasraw) {