3421. [bug] Named loops when re-signing if all keys are offline.

                        [RT #31916]

Squashed commit of the following:

commit f47af0ca6793687b9c8d08fd44b0c091ba5a4f9a
Author: Mark Andrews <marka@isc.org>
Date:   Wed Nov 21 17:45:21 2012 +1100

    dns_dns_zonediff_t -> dns_zonediff_t, clarify comment

commit 344edefc3ee90856a7ff990abe7971925ba843b2
Author: Mark Andrews <marka@isc.org>
Date:   Tue Nov 20 13:12:26 2012 +1100

    commit the zone changes if a keep was marked as being offline

commit cad2c2446ebfc20b6d8c4f6dd0d6596d7106cc0f
Author: Mark Andrews <marka@isc.org>
Date:   Tue Nov 20 13:08:29 2012 +1100

    check for looping when re-signing expiring.example

diff --git a/CHANGES b/CHANGES
index 9a952c9886f3cfd9b4d45ac95c3b8b5951452b42..93024ccb9a128b299d775e11e16ed15810d4ff0d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3421.  [bug]           Named loops when re-signing if all keys are offline.
+                       [RT #31916]
+
 3420.  [bug]           Address VPATH compilation issues. [RT #31879]
 
 3419.  [bug]           Memory leak on validation cancel. [RT #31869]

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 0de949c3ceb28d1f66fcc8b8cef6ecc8a0da77c6..6683360f3618fb2550370397991ea24e53e6952c 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -1944,5 +1944,13 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:check that named doesn't loop when all private keys are not available ($n)"
+ret=0
+lines=`grep "reading private key file expiring.example" ns3/named.run | wc -l`
+test ${lines:-1000} -lt 10 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index da7e868f170530c92c30782e0ffc1a5634fbd5ce..c59501346c0b8454cd655ef8e1a44d36797de9d0 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -373,6 +373,18 @@ struct dns_zone {
        isc_uint32_t            sourceserial;
 };
 
+typedef struct {
+       dns_diff_t      *diff;
+       isc_boolean_t   offline;
+} zonediff_t;
+
+#define zonediff_init(z, d) \
+       do { \
+               zonediff_t *_z = (z); \
+               (_z)->diff = (d); \
+               (_z)->offline = ISC_FALSE; \
+       } while (0)
+
 #define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
 #define DNS_ZONE_SETFLAG(z,f) do { \
                INSIST(LOCKED_ZONE(z)); \
@@ -5068,20 +5080,21 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 }
 
 static isc_result_t
-offline(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff, dns_name_t *name,
-       dns_ttl_t ttl, dns_rdata_t *rdata)
+offline(dns_db_t *db, dns_dbversion_t *ver, zonediff_t *zonediff,
+       dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata)
 {
        isc_result_t result;
 
        if ((rdata->flags & DNS_RDATA_OFFLINE) != 0)
                return (ISC_R_SUCCESS);
-       result = update_one_rr(db, ver, diff, DNS_DIFFOP_DELRESIGN,
+       result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_DELRESIGN,
                               name, ttl, rdata);
        if (result != ISC_R_SUCCESS)
                return (result);
        rdata->flags |= DNS_RDATA_OFFLINE;
-       result = update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN,
+       result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_ADDRESIGN,
                               name, ttl, rdata);
+       zonediff->offline = ISC_TRUE;
        return (result);
 }
 
@@ -5156,7 +5169,7 @@ delsig_ok(dns_rdata_rrsig_t *rrsig_ptr, dst_key_t **keys, unsigned int nkeys) {
  */
 static isc_result_t
 del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-        dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
+        dns_rdatatype_t type, zonediff_t *zonediff, dst_key_t **keys,
         unsigned int nkeys, isc_stdtime_t now, isc_boolean_t incremental)
 {
        isc_result_t result;
@@ -5202,7 +5215,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 
                if (type != dns_rdatatype_dnskey) {
                        if (delsig_ok(&rrsig, keys, nkeys)) {
-                               result = update_one_rr(db, ver, diff,
+                               result = update_one_rr(db, ver, zonediff->diff,
                                               DNS_DIFFOP_DELRESIGN, name,
                                               rdataset.ttl, &rdata);
                                if (incremental)
@@ -5220,8 +5233,9 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
                                 * for the private part.
                                 */
                                if (incremental) {
-                                       result = offline(db, ver, diff, name,
-                                                        rdataset.ttl, &rdata);
+                                       result = offline(db, ver, zonediff,
+                                                        name, rdataset.ttl,
+                                                        &rdata);
                                        changed = ISC_TRUE;
                                        if (result != ISC_R_SUCCESS)
                                                break;
@@ -5281,11 +5295,12 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
                                                warn = maybe;
                                        if (warn == 0 || warn > timeexpire)
                                                warn = timeexpire;
-                                       result = offline(db, ver, diff, name,
-                                                        rdataset.ttl, &rdata);
+                                       result = offline(db, ver, zonediff,
+                                                        name, rdataset.ttl,
+                                                        &rdata);
                                        break;
                                }
-                               result = update_one_rr(db, ver, diff,
+                               result = update_one_rr(db, ver, zonediff->diff,
                                                       DNS_DIFFOP_DELRESIGN,
                                                       name, rdataset.ttl,
                                                       &rdata);
@@ -5298,7 +5313,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
                 * delete the RRSIG.
                 */
                if (!found)
-                       result = update_one_rr(db, ver, diff,
+                       result = update_one_rr(db, ver, zonediff->diff,
                                               DNS_DIFFOP_DELRESIGN, name,
                                               rdataset.ttl, &rdata);
                if (result != ISC_R_SUCCESS)
@@ -5428,9 +5443,11 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 
 static void
 zone_resigninc(dns_zone_t *zone) {
+       const char *me = "zone_resigninc";
        dns_db_t *db = NULL;
        dns_dbversion_t *version = NULL;
-       dns_diff_t sig_diff;
+       dns_diff_t _sig_diff;
+       zonediff_t zonediff;
        dns_fixedname_t fixed;
        dns_name_t *name;
        dns_rdataset_t rdataset;
@@ -5444,11 +5461,13 @@ zone_resigninc(dns_zone_t *zone) {
        unsigned int nkeys = 0;
        unsigned int resign;
 
+       ENTER;
+
        dns_rdataset_init(&rdataset);
        dns_fixedname_init(&fixed);
-       dns_diff_init(zone->mctx, &sig_diff);
-       sig_diff.resign = zone->sigresigninginterval;
-
+       dns_diff_init(zone->mctx, &_sig_diff);
+       _sig_diff.resign = zone->sigresigninginterval;
+       zonediff_init(&zonediff, &_sig_diff);
 
        /*
         * Zone is frozen or automatic resigning is disabled.
@@ -5521,7 +5540,7 @@ zone_resigninc(dns_zone_t *zone) {
                    resign > stop)
                        break;
 
-               result = del_sigs(zone, db, version, name, covers, &sig_diff,
+               result = del_sigs(zone, db, version, name, covers, &zonediff,
                                  zone_keys, nkeys, now, ISC_TRUE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
@@ -5530,7 +5549,7 @@ zone_resigninc(dns_zone_t *zone) {
                        break;
                }
 
-               result = add_sigs(db, version, name, covers, &sig_diff,
+               result = add_sigs(db, version, name, covers, zonediff.diff,
                                  zone_keys, nkeys, zone->mctx, inception,
                                  expire, check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
@@ -5555,7 +5574,7 @@ zone_resigninc(dns_zone_t *zone) {
                goto failure;
 
        result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, now, ISC_TRUE);
+                         &zonediff, zone_keys, nkeys, now, ISC_TRUE);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:del_sigs -> %s",
@@ -5566,11 +5585,16 @@ zone_resigninc(dns_zone_t *zone) {
        /*
         * Did we change anything in the zone?
         */
-       if (ISC_LIST_EMPTY(sig_diff.tuples))
+       if (ISC_LIST_EMPTY(zonediff.diff->tuples)) {
+               /*
+                * Commit the changes if any key has been marked as offline.                     */
+               if (zonediff.offline)
+                       dns_db_closeversion(db, &version, ISC_TRUE);
                goto failure;
+       }
 
        /* Increment SOA serial if we have made changes */
-       result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+       result = update_soa_serial(db, version, zonediff.diff, zone->mctx,
                                   zone->updatemethod);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
@@ -5584,8 +5608,8 @@ zone_resigninc(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, zone->mctx, inception,
-                         soaexpire, check_ksk, keyset_kskonly);
+                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:add_sigs -> %s",
@@ -5594,13 +5618,13 @@ zone_resigninc(dns_zone_t *zone) {
        }
 
        /* Write changes to journal file. */
-       CHECK(zone_journal(zone, &sig_diff, NULL, "zone_resigninc"));
+       CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_resigninc"));
 
        /* Everything has succeeded. Commit the changes. */
        dns_db_closeversion(db, &version, ISC_TRUE);
 
  failure:
-       dns_diff_clear(&sig_diff);
+       dns_diff_clear(&_sig_diff);
        for (i = 0; i < nkeys; i++)
                dst_key_free(&zone_keys[i]);
        if (version != NULL) {
@@ -6277,7 +6301,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
            dst_key_t *zone_keys[], unsigned int nkeys, dns_zone_t *zone,
            isc_stdtime_t inception, isc_stdtime_t expire, isc_stdtime_t now,
            isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
-           dns_diff_t *sig_diff)
+           zonediff_t *zonediff)
 {
        dns_difftuple_t *tuple;
        isc_result_t result;
@@ -6286,7 +6310,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
             tuple != NULL;
             tuple = ISC_LIST_HEAD(diff->tuples)) {
                result = del_sigs(zone, db, version, &tuple->name,
-                                 tuple->rdata.type, sig_diff,
+                                 tuple->rdata.type, zonediff,
                                  zone_keys, nkeys, now, ISC_FALSE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
@@ -6295,7 +6319,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                        return (result);
                }
                result = add_sigs(db, version, &tuple->name,
-                                 tuple->rdata.type, sig_diff,
+                                 tuple->rdata.type, zonediff->diff,
                                  zone_keys, nkeys, zone->mctx, inception,
                                  expire, check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
@@ -6312,7 +6336,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                                !dns_name_equal(&tuple->name, &next->name)))
                                next = ISC_LIST_NEXT(next, link);
                        ISC_LIST_UNLINK(diff->tuples, tuple, link);
-                       dns_diff_appendminimal(sig_diff, &tuple);
+                       dns_diff_appendminimal(zonediff->diff, &tuple);
                        INSIST(tuple == NULL);
                        tuple = next;
                } while (tuple != NULL);
@@ -6326,13 +6350,15 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
  */
 static void
 zone_nsec3chain(dns_zone_t *zone) {
+       const char *me = "zone_nsec3chain";
        dns_db_t *db = NULL;
        dns_dbnode_t *node = NULL;
        dns_dbversion_t *version = NULL;
-       dns_diff_t sig_diff;
+       dns_diff_t _sig_diff;
        dns_diff_t nsec_diff;
        dns_diff_t nsec3_diff;
        dns_diff_t param_diff;
+       zonediff_t zonediff;
        dns_fixedname_t fixed;
        dns_fixedname_t nextfixed;
        dns_name_t *name, *nextname;
@@ -6358,6 +6384,8 @@ zone_nsec3chain(dns_zone_t *zone) {
        isc_boolean_t updatensec = ISC_FALSE;
        dns_rdatatype_t privatetype = zone->privatetype;
 
+       ENTER;
+
        dns_rdataset_init(&rdataset);
        dns_fixedname_init(&fixed);
        name = dns_fixedname_name(&fixed);
@@ -6366,8 +6394,9 @@ zone_nsec3chain(dns_zone_t *zone) {
        dns_diff_init(zone->mctx, &param_diff);
        dns_diff_init(zone->mctx, &nsec3_diff);
        dns_diff_init(zone->mctx, &nsec_diff);
-       dns_diff_init(zone->mctx, &sig_diff);
-       sig_diff.resign = zone->sigresigninginterval;
+       dns_diff_init(zone->mctx, &_sig_diff);
+       _sig_diff.resign = zone->sigresigninginterval;
+       zonediff_init(&zonediff, &_sig_diff);
        ISC_LIST_INIT(cleanup);
 
        /*
@@ -6905,7 +6934,7 @@ zone_nsec3chain(dns_zone_t *zone) {
                dns_dbiterator_pause(nsec3chain->dbiterator);
        result = update_sigs(&nsec3_diff, db, version, zone_keys,
                             nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &sig_diff);
+                            check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
                             "update_sigs -> %s", dns_result_totext(result));
@@ -6918,7 +6947,7 @@ zone_nsec3chain(dns_zone_t *zone) {
         */
        result = update_sigs(&param_diff, db, version, zone_keys,
                             nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &sig_diff);
+                            check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
                             "update_sigs -> %s", dns_result_totext(result));
@@ -6938,7 +6967,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 
        result = update_sigs(&nsec_diff, db, version, zone_keys,
                             nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &sig_diff);
+                            check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
                             "update_sigs -> %s", dns_result_totext(result));
@@ -6949,18 +6978,23 @@ zone_nsec3chain(dns_zone_t *zone) {
         * If we made no effective changes to the zone then we can just
         * cleanup otherwise we need to increment the serial.
         */
-       if (ISC_LIST_HEAD(sig_diff.tuples) == NULL)
+       if (ISC_LIST_EMPTY(zonediff.diff->tuples)) {
+               /*
+                * No need to call dns_db_closeversion() here as it is
+                * called with commit = ISC_TRUE below.
+                */
                goto done;
+       }
 
        result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
+                         &zonediff, zone_keys, nkeys, now, ISC_FALSE);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
                             "del_sigs -> %s", dns_result_totext(result));
                goto failure;
        }
 
-       result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+       result = update_soa_serial(db, version, zonediff.diff, zone->mctx,
                                   zone->updatemethod);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
@@ -6970,8 +7004,8 @@ zone_nsec3chain(dns_zone_t *zone) {
        }
 
        result = add_sigs(db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, zone->mctx, inception,
-                         soaexpire, check_ksk, keyset_kskonly);
+                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
                             "add_sigs -> %s", dns_result_totext(result));
@@ -6979,7 +7013,7 @@ zone_nsec3chain(dns_zone_t *zone) {
        }
 
        /* Write changes to journal file. */
-       CHECK(zone_journal(zone, &sig_diff, NULL, "zone_nsec3chain"));
+       CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_nsec3chain"));
 
        LOCK_ZONE(zone);
        zone_needdump(zone, DNS_DUMP_DELAY);
@@ -6999,6 +7033,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 
        /*
         * Everything has succeeded. Commit the changes.
+        * Unconditionally commit as zonediff.offline not checked above.
         */
        dns_db_closeversion(db, &version, ISC_TRUE);
 
@@ -7068,7 +7103,7 @@ zone_nsec3chain(dns_zone_t *zone) {
        dns_diff_clear(&param_diff);
        dns_diff_clear(&nsec3_diff);
        dns_diff_clear(&nsec_diff);
-       dns_diff_clear(&sig_diff);
+       dns_diff_clear(&_sig_diff);
 
        if (iterator != NULL)
                dns_rdatasetiter_destroy(&iterator);
@@ -7170,11 +7205,13 @@ del_sig(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
  */
 static void
 zone_sign(dns_zone_t *zone) {
+       const char *me = "zone_sign";
        dns_db_t *db = NULL;
        dns_dbnode_t *node = NULL;
        dns_dbversion_t *version = NULL;
-       dns_diff_t sig_diff;
+       dns_diff_t _sig_diff;
        dns_diff_t post_diff;
+       zonediff_t zonediff;
        dns_fixedname_t fixed;
        dns_fixedname_t nextfixed;
        dns_name_t *name, *nextname;
@@ -7196,14 +7233,17 @@ zone_sign(dns_zone_t *zone) {
        unsigned int nkeys = 0;
        isc_uint32_t nodes;
 
+       ENTER;
+
        dns_rdataset_init(&rdataset);
        dns_fixedname_init(&fixed);
        name = dns_fixedname_name(&fixed);
        dns_fixedname_init(&nextfixed);
        nextname = dns_fixedname_name(&nextfixed);
-       dns_diff_init(zone->mctx, &sig_diff);
-       sig_diff.resign = zone->sigresigninginterval;
+       dns_diff_init(zone->mctx, &_sig_diff);
+       _sig_diff.resign = zone->sigresigninginterval;
        dns_diff_init(zone->mctx, &post_diff);
+       zonediff_init(&zonediff, &_sig_diff);
        ISC_LIST_INIT(cleanup);
 
        /*
@@ -7317,7 +7357,7 @@ zone_sign(dns_zone_t *zone) {
                        dns_dbiterator_pause(signing->dbiterator);
                        CHECK(del_sig(db, version, name, node, nkeys,
                                      signing->algorithm, signing->keyid,
-                                     &sig_diff));
+                                     zonediff.diff));
                }
 
                /*
@@ -7412,7 +7452,7 @@ zone_sign(dns_zone_t *zone) {
                                          build_nsec, zone_keys[i], inception,
                                          expire, zone->minimum, is_ksk,
                                          ISC_TF(both && keyset_kskonly),
-                                         &delegation, &sig_diff,
+                                         &delegation, zonediff.diff,
                                          &signatures, zone->mctx));
                        /*
                         * If we are adding we are done.  Look for other keys
@@ -7494,7 +7534,7 @@ zone_sign(dns_zone_t *zone) {
        if (ISC_LIST_HEAD(post_diff.tuples) != NULL) {
                result = update_sigs(&post_diff, db, version, zone_keys,
                                     nkeys, zone, inception, expire, now,
-                                    check_ksk, keyset_kskonly, &sig_diff);
+                                    check_ksk, keyset_kskonly, &zonediff);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:"
                                     "update_sigs -> %s",
@@ -7506,7 +7546,9 @@ zone_sign(dns_zone_t *zone) {
        /*
         * Have we changed anything?
         */
-       if (ISC_LIST_HEAD(sig_diff.tuples) == NULL) {
+       if (ISC_LIST_EMPTY(zonediff.diff->tuples)) {
+               if (zonediff.offline)
+                       commit = ISC_TRUE;
                result = ISC_R_SUCCESS;
                goto pauseall;
        }
@@ -7514,7 +7556,7 @@ zone_sign(dns_zone_t *zone) {
        commit = ISC_TRUE;
 
        result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
+                         &zonediff, zone_keys, nkeys, now, ISC_FALSE);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_sign:del_sigs -> %s",
@@ -7522,7 +7564,7 @@ zone_sign(dns_zone_t *zone) {
                goto failure;
        }
 
-       result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+       result = update_soa_serial(db, version, zonediff.diff, zone->mctx,
                                   zone->updatemethod);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
@@ -7536,8 +7578,8 @@ zone_sign(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, dns_rdatatype_soa,
-                         &sig_diff, zone_keys, nkeys, zone->mctx, inception,
-                         soaexpire, check_ksk, keyset_kskonly);
+                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_sign:add_sigs -> %s",
@@ -7548,7 +7590,7 @@ zone_sign(dns_zone_t *zone) {
        /*
         * Write changes to journal file.
         */
-       CHECK(zone_journal(zone, &sig_diff, NULL, "zone_sign"));
+       CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_sign"));
 
  pauseall:
        /*
@@ -7608,7 +7650,7 @@ zone_sign(dns_zone_t *zone) {
             signing = ISC_LIST_NEXT(signing, link))
                dns_dbiterator_pause(signing->dbiterator);
 
-       dns_diff_clear(&sig_diff);
+       dns_diff_clear(&_sig_diff);
 
        for (i = 0; i < nkeys; i++)
                dst_key_free(&zone_keys[i]);
@@ -15335,7 +15377,7 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
 
 static isc_result_t
 sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-         dns_diff_t *diff, dns_diff_t *sig_diff)
+         dns_diff_t *diff, zonediff_t *zonediff)
 {
        isc_result_t result;
        isc_stdtime_t now, inception, soaexpire;
@@ -15375,7 +15417,7 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 
        if (tuple == NULL) {
                result = del_sigs(zone, db, ver, &zone->origin,
-                                 dns_rdatatype_dnskey, sig_diff,
+                                 dns_rdatatype_dnskey, zonediff,
                                  zone_keys, nkeys, now, ISC_FALSE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
@@ -15384,7 +15426,7 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
                        goto failure;
                }
                result = add_sigs(db, ver, &zone->origin, dns_rdatatype_dnskey,
-                                 sig_diff, zone_keys, nkeys, zone->mctx,
+                                 zonediff->diff, zone_keys, nkeys, zone->mctx,
                                  inception, soaexpire, check_ksk,
                                  keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
@@ -15397,7 +15439,7 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 
        result = update_sigs(diff, db, ver, zone_keys, nkeys, zone,
                             inception, soaexpire, now, check_ksk,
-                            keyset_kskonly, sig_diff);
+                            keyset_kskonly, zonediff);
 
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
@@ -15554,7 +15596,8 @@ zone_rekey(dns_zone_t *zone) {
        dns_rdataset_t soaset, soasigs, keyset, keysigs;
        dns_dnsseckeylist_t dnskeys, keys, rmkeys;
        dns_dnsseckey_t *key;
-       dns_diff_t diff, sig_diff;
+       dns_diff_t diff, _sig_diff;
+       zonediff_t zonediff;
        isc_boolean_t commit = ISC_FALSE, newactive = ISC_FALSE;
        isc_boolean_t newalg = ISC_FALSE;
        isc_boolean_t fullsign;
@@ -15578,8 +15621,9 @@ zone_rekey(dns_zone_t *zone) {
        dir = dns_zone_getkeydirectory(zone);
        mctx = zone->mctx;
        dns_diff_init(mctx, &diff);
-       dns_diff_init(mctx, &sig_diff);
-       sig_diff.resign = zone->sigresigninginterval;
+       dns_diff_init(mctx, &_sig_diff);
+       _sig_diff.resign = zone->sigresigninginterval;
+       zonediff_init(&zonediff, &_sig_diff);
 
        CHECK(dns_zone_getdb(zone, &db));
        CHECK(dns_db_newversion(db, &ver));
@@ -15677,14 +15721,14 @@ zone_rekey(dns_zone_t *zone) {
                        CHECK(update_soa_serial(db, ver, &diff, mctx,
                                                zone->updatemethod));
                        CHECK(add_chains(zone, db, ver, &diff));
-                       CHECK(sign_apex(zone, db, ver, &diff, &sig_diff));
-                       CHECK(zone_journal(zone, &sig_diff, NULL,
+                       CHECK(sign_apex(zone, db, ver, &diff, &zonediff));
+                       CHECK(zone_journal(zone, zonediff.diff, NULL,
                                           "zone_rekey"));
                        commit = ISC_TRUE;
                }
        }
 
-       dns_db_closeversion(db, &ver, commit);
+       dns_db_closeversion(db, &ver, ISC_TRUE);
 
        if (commit) {
                dns_difftuple_t *tuple;
@@ -15769,7 +15813,7 @@ zone_rekey(dns_zone_t *zone) {
                 * Cause the zone to add/delete NSEC3 chains for the
                 * deferred NSEC3PARAM changes.
                 */
-               for (tuple = ISC_LIST_HEAD(sig_diff.tuples);
+               for (tuple = ISC_LIST_HEAD(zonediff.diff->tuples);
                     tuple != NULL;
                     tuple = ISC_LIST_NEXT(tuple, link)) {
                        unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];
@@ -15852,7 +15896,7 @@ zone_rekey(dns_zone_t *zone) {
 
  done:
        dns_diff_clear(&diff);
-       dns_diff_clear(&sig_diff);
+       dns_diff_clear(&_sig_diff);
 
        clear_keylist(&dnskeys, mctx);
        clear_keylist(&keys, mctx);