[master] correctly validate 5011 trust anchors

3976.	[bug]		When refreshing managed-key trust anchors, clear
			any cached trust so that they will always be
			revalidated with the current set of secure
			roots. [RT #37506]

diff --git a/CHANGES b/CHANGES
index e2872ab293866eddf85a349190ea3889b868a548..3e8f70e21e969f3959d3462966251092ed61d4f7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3976.  [bug]           When refreshing managed-key trust anchors, clear
+                       any cached trust so that they will always be
+                       revalidated with the current set of secure
+                       roots. [RT #37506]
+
 3975.  [bug]           Don't populate or use the bad cache for queries that
                        don't request or use recursion. [RT #37466]
 

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index ac13de15a2b04b28461ded417a47fbeb1cd02e97..af3681ac60f5b3e74400dd0a8851244e29ce7e46 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8738,6 +8738,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
                goto done;
        }
 
+       /*
+        * Clear any cached trust level, as we need to run validation
+        * over again; trusted keys might have changed.
+        */
+       kfetch->dnskeyset.trust = kfetch->dnskeysigset.trust = dns_trust_none;
+
        /*
         * Validate the dnskeyset against the current trusted keys.
         */
@@ -8771,7 +8777,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
                                dns_zone_log(zone, ISC_LOG_DEBUG(3),
                                             "Verifying DNSKEY set for zone "
-                                            "'%s': %s", namebuf,
+                                            "'%s' using key %d/%d: %s",
+                                            namebuf, sig.keyid, sig.algorithm,
                                             dns_result_totext(result));
 
                                if (result == ISC_R_SUCCESS) {