From: Evan Hunt <each@isc.org>
Date: Fri, 17 Oct 2014 22:40:07 +0000 (-0700)
Subject: [master] correctly validate 5011 trust anchors
X-Git-Tag: v9.11.0a1~1354
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=eb6d61d5e02946e1a7a959bac37eae9dbbc2051b;p=thirdparty%2Fbind9.git

[master] correctly validate 5011 trust anchors

3976.	[bug]		When refreshing managed-key trust anchors, clear
			any cached trust so that they will always be
			revalidated with the current set of secure
			roots. [RT #37506]
---

diff --git a/CHANGES b/CHANGES
index e2872ab2938..3e8f70e21e9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3976.	[bug]		When refreshing managed-key trust anchors, clear
+			any cached trust so that they will always be
+			revalidated with the current set of secure
+			roots. [RT #37506]
+
 3975.	[bug]		Don't populate or use the bad cache for queries that
 			don't request or use recursion. [RT #37466]
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index ac13de15a2b..af3681ac60f 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8738,6 +8738,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 		goto done;
 	}
 
+	/*
+	 * Clear any cached trust level, as we need to run validation
+	 * over again; trusted keys might have changed.
+	 */
+	kfetch->dnskeyset.trust = kfetch->dnskeysigset.trust = dns_trust_none;
+
 	/*
 	 * Validate the dnskeyset against the current trusted keys.
 	 */
@@ -8771,7 +8777,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 				dns_zone_log(zone, ISC_LOG_DEBUG(3),
 					     "Verifying DNSKEY set for zone "
-					     "'%s': %s", namebuf,
+					     "'%s' using key %d/%d: %s",
+					     namebuf, sig.keyid, sig.algorithm,
 					     dns_result_totext(result));
 
 				if (result == ISC_R_SUCCESS) {