From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 5 Mar 2021 10:27:59 +0000 (+0100)
Subject: Fully sign a thawed zone
X-Git-Tag: v9.17.12~40^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b90846f2226d54556c2c16dbbec431266b69689e;p=thirdparty%2Fbind9.git

Fully sign a thawed zone

When thawing a zone, we don't know what changes have been made. If we
do DNSSEC maintenance on this zone, schedule a full sign.
---

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index e9766b8e664..782959b62a5 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2404,6 +2404,16 @@ dns_zone_loadandthaw(dns_zone_t *zone) {
 	if (inline_raw(zone)) {
 		result = zone_load(zone->secure, DNS_ZONELOADFLAG_THAW, false);
 	} else {
+		/*
+		 * When thawing a zone, we don't know what changes
+		 * have been made. If we do DNSSEC maintenance on this
+		 * zone, schedule a full sign for this zone.
+		 */
+		if (zone->type == dns_zone_master &&
+		    DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
+		{
+			DNS_ZONEKEY_SETOPTION(zone, DNS_ZONEKEY_FULLSIGN);
+		}
 		result = zone_load(zone, DNS_ZONELOADFLAG_THAW, false);
 	}