When signing with a new algorithm preserve NSEC/NSEC3 chains

If the zone already has existing NSEC/NSEC3 chains then zone_sign
needs to continue to use them.  If there are no chains then use
kasp setting otherwise generate an NSEC chain.

(cherry picked from commit 4b5520145969222e6482e4552e49e96cc7d9bd97)

diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
index d3832cb707b5ba72c713418005a2819d6e9a8868..3ebf247182600c2fa5d4e1d5a3058a221d378f9d 100644 (file)
--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
@@ -398,12 +398,6 @@ then
        set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
        set_key_default_values "KEY2"
        echo_i "check zone ${ZONE} after reconfig"
-
-       ret=0
-       wait_for_log 10 "zone $ZONE/IN (signed): wait building NSEC3 chain until NSEC only DNSKEYs are removed" ns3/named.run || ret=1
-       test "$ret" -eq 0 || echo_i "failed"
-       status=$((status+ret))
-
        check_nsec
 
        # Zone: nsec3-to-rsasha1.kasp.

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index c9bb34515637b445c176137f897aa8e0a1b0b12b..5f0c099dff5c562f9838d4de0d56bcccee2da9bc 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -9582,23 +9582,23 @@ zone_sign(dns_zone_t *zone) {
                   use_kasp ? "yes" : "no");
 
        /* Determine which type of chain to build */
-       if (use_kasp) {
-               build_nsec3 = dns_kasp_nsec3(kasp);
-               if (!dns_zone_check_dnskey_nsec3(zone, db, version, NULL,
-                                                (dst_key_t **)&zone_keys,
-                                                nkeys))
-               {
-                       dnssec_log(zone, ISC_LOG_INFO,
-                                  "wait building NSEC3 chain until NSEC only "
-                                  "DNSKEYs are removed");
-                       build_nsec3 = false;
-               }
-               build_nsec = !build_nsec3;
-       } else {
-               CHECK(dns_private_chains(db, version, zone->privatetype,
-                                        &build_nsec, &build_nsec3));
-               /* If neither chain is found, default to NSEC */
-               if (!build_nsec && !build_nsec3) {
+       CHECK(dns_private_chains(db, version, zone->privatetype, &build_nsec,
+                                &build_nsec3));
+       if (!build_nsec && !build_nsec3) {
+               if (use_kasp) {
+                       build_nsec3 = dns_kasp_nsec3(kasp);
+                       if (!dns_zone_check_dnskey_nsec3(
+                                   zone, db, version, NULL,
+                                   (dst_key_t **)&zone_keys, nkeys))
+                       {
+                               dnssec_log(zone, ISC_LOG_INFO,
+                                          "wait building NSEC3 chain until "
+                                          "NSEC only DNSKEYs are removed");
+                               build_nsec3 = false;
+                       }
+                       build_nsec = !build_nsec3;
+               } else {
+                       /* If neither chain is found, default to NSEC */
                        build_nsec = true;
                }
        }