With update-check-ksk also consider offline keys

The option `update-check-ksk` will look if both KSK and ZSK are
available before signing records.  It will make sure the keys are
active and available.  However, for operational practices keys may
be offline.  This commit relaxes the update-check-ksk check and will
mark a key that is offline to be available when adding signature
tasks.

diff --git a/CHANGES b/CHANGES
index 635db93930328b2f8718c85ad9e48c10e76a1b4e..2d6853200bb364b9d46382e4ea05b98d1b395fac 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5209.  [bug]           When update-check-ksk is true, add_sigs was not
+                       considering offline keys, leaving record sets signed
+                       with the incorrect type key. [GL #763]
+
 5208.  [test]          Run valid rdata wire encodings through totext+fromtext
                        and tofmttext+fromtext methods to check these methods.
                        [GL #899]

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2c5156ff07d0c2115bc3e454d12d2d4d7048f4b2..3181efeb79464eb00c721c710e42a23df463a4f3 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8867,9 +8867,6 @@ zone_sign(dns_zone_t *zone) {
                        if (!dst_key_isprivate(zone_keys[i])) {
                                continue;
                        }
-                       /*
-                        * Should be redundant.
-                        */
                        if (dst_key_inactive(zone_keys[i])) {
                                continue;
                        }
@@ -8913,11 +8910,10 @@ zone_sign(dns_zone_t *zone) {
                                        {
                                                continue;
                                        }
-                                       if (!dst_key_isprivate(zone_keys[j])) {
-                                               continue;
-                                       }
-                                       /*
-                                        * Should be redundant.
+                                       /* Don't consider inactive keys, however
+                                        * the key may be temporary offline, so do
+                                        * consider keys which private key files are
+                                        * unavailable.
                                         */
                                        if (dst_key_inactive(zone_keys[j])) {
                                                continue;