]> git.ipfire.org Git - thirdparty/bind9.git/commit
Use signer name when disabling DNSSEC algorithms
authorMark Andrews <marka@isc.org>
Thu, 7 Aug 2025 04:37:33 +0000 (14:37 +1000)
committerMark Andrews <marka@isc.org>
Mon, 29 Sep 2025 01:16:24 +0000 (11:16 +1000)
commit2554a724d4e3435491bf797fd25dbdfe83a82665
tree59c664d0abf882e565d9d6e5379a14eae14096c5
parentd2f551140cd008129f3a95e0f27d7e34f6aaa913
Use signer name when disabling DNSSEC algorithms

When disabling algorithms, use the signer name to determine if the
algorithm is disabled or not.  This allows for algorithms to be
cleanly disabled on a zone level basis.  Previously, just using the
records owner name, "disable-algorithms" could impact resolution of
names that where not disabled.  This does now mean that
"disable-algorithms" can not be used to disable part of a zone anymore.

(cherry picked from commit a0945f6337fb4a27fb7104838ee51d3722e1e9a0)
bin/tests/system/dnssec/ns3/badalg.secure.example.db.in [new file with mode: 0644]
bin/tests/system/dnssec/ns3/named.conf.in
bin/tests/system/dnssec/ns3/secure.example.db.in
bin/tests/system/dnssec/ns3/sign.sh
bin/tests/system/dnssec/tests.sh
bin/tests/system/dnssec/tests_sh_dnssec.py
lib/dns/validator.c
lib/ns/query.c