Fix a kasp lock issue

The kasp lock would stay locked if 'dns_keymgr_run' failed.

(cherry picked from commit cf17698f877e460cf24a49ce5cbe150ace094fc3)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index a24c0fa9eca4172f08ffddfc3820cdf40b208de8..17d7ca239352fde39e86428288ffa92df5df59d2 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -19806,22 +19806,20 @@ zone_rekey(dns_zone_t *zone) {
                           isc_result_totext(result));
        }
 
-       if (kasp != NULL &&
-           (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND)) {
-               result = dns_keymgr_run(&zone->origin, zone->rdclass, dir, mctx,
-                                       &keys, kasp, now, &nexttime);
-               if (result != ISC_R_SUCCESS) {
-                       if (kasp != NULL) {
+       if (kasp != NULL) {
+               if (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND) {
+                       result = dns_keymgr_run(&zone->origin, zone->rdclass,
+                                               dir, mctx, &keys, kasp, now,
+                                               &nexttime);
+                       if (result != ISC_R_SUCCESS) {
+                               dnssec_log(zone, ISC_LOG_ERROR,
+                                          "zone_rekey:dns_dnssec_keymgr "
+                                          "failed: %s",
+                                          isc_result_totext(result));
                                UNLOCK(&kasp->lock);
+                               goto failure;
                        }
-                       dnssec_log(zone, ISC_LOG_ERROR,
-                                  "zone_rekey:dns_dnssec_keymgr failed: %s",
-                                  isc_result_totext(result));
-                       goto failure;
                }
-       }
-
-       if (kasp != NULL) {
                UNLOCK(&kasp->lock);
        }
 
@@ -20178,6 +20176,10 @@ failure:
                 * Something went wrong; try again in ten minutes or
                 * after a key refresh interval, whichever is shorter.
                 */
+               dnssec_log(zone, ISC_LOG_DEBUG(3),
+                          "zone_rekey failure: %s (retry in %u seconds)",
+                          isc_result_totext(result),
+                          ISC_MIN(zone->refreshkeyinterval, 600));
                isc_interval_set(&ival, ISC_MIN(zone->refreshkeyinterval, 600),
                                 0);
                isc_time_nowplusinterval(&zone->refreshkeytime, &ival);