2576. [bug] NSEC record were not being correctly signed when

                        a zone transitions from insecure to secure.
                        Handle such incorrectly signed zones. [RT #19114]

diff --git a/CHANGES b/CHANGES
index 56129c7aaa033f33a9aeb9d64eb64e899b324554..281ab1fc94ac5a3c91418a394797b7f995aaf5c3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2576.  [bug]           NSEC record were not being correctly signed when
+                       a zone transitions from insecure to secure.
+                       Handle such incorrectly signed zones. [RT #19114]
+
 2574.  [doc]           Document nsupdate -g and -o. [RT #19351]
 
 2573.  [bug]           Replacing a non-CNAME record with a CNAME record in a

diff --git a/bin/named/query.c b/bin/named/query.c
index 69a522c587bde62635ca9aa1d664036285bb093f..ffd9b3554a76c7c86d1f6025e57e4a4e6f4ea6d1 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.313.20.6 2009/02/15 23:07:33 marka Exp $ */
+/* $Id: query.c,v 1.313.20.7 2009/03/13 01:38:51 marka Exp $ */
 
 /*! \file */
 
@@ -2741,6 +2741,10 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node,
                goto cleanup;
        fname = query_newname(client, dbuf, &b);
        dns_fixedname_init(&fixed);
+       if (dns_rdataset_isassociated(rdataset))
+               dns_rdataset_disassociate(rdataset);
+       if (dns_rdataset_isassociated(sigrdataset))
+               dns_rdataset_disassociate(sigrdataset);
        query_findclosestnsec3(name, db, version, client, rdataset,
                               sigrdataset, fname, ISC_TRUE,
                               dns_fixedname_name(&fixed));

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index bdc038c96d2ae27e2b0cb3dca496ae481ed88021..732566fc39647a5a38aad945a19fbb94b1a39d6c 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.483.36.4 2009/02/16 02:04:05 marka Exp $ */
+/* $Id: zone.c,v 1.483.36.5 2009/03/13 01:38:51 marka Exp $ */
 
 /*! \file */
 
@@ -4250,7 +4250,9 @@ sign_a_node(dns_db_t *db, dns_name_t *name, dns_dbnode_t *node,
                        goto next_rdataset;
                if (is_ksk && rdataset.type != dns_rdatatype_dnskey)
                        goto next_rdataset;
-               if (*delegation && !dns_rdatatype_atparent(rdataset.type))
+               if (*delegation &&
+                   rdataset.type != dns_rdatatype_ds &&
+                   rdataset.type != dns_rdatatype_nsec)
                        goto next_rdataset;
                if (signed_with_key(db, node, version, rdataset.type, key))
                        goto next_rdataset;