Matthijs Mekking 39c0c5022d Wait with NSEC3 during a DNSSEC policy change ... When doing a dnssec-policy reconfiguration from a zone with NSEC only keys to a zone that uses NSEC3, figure out to wait with building the NSEC3 chain. Previously, BIND 9 would attempt to sign such a zone, but failed to do so because the NSEC3 chain conflicted with existing DNSKEY records in the zone that were not compatible with NSEC3. There exists logic for detecting such a case in the functions dnskey_sane() (in lib/dns/zone.c) and check_dnssec() (in lib/ns/update.c). Both functions look very similar so refactor them to use the same code and call the new function (called dns_zone_check_dnskey_nsec3()). Also update the dns_nsec_nseconly() function to take an additional parameter 'diff' that, if provided, will be checked whether an offending NSEC only DNSKEY will be deleted from the zone. If so, this key will not be considered when checking the zone for NSEC only DNSKEYs. This is needed to allow a transition from an NSEC zone with NSEC only DNSKEYs to an NSEC3 zone. (cherry picked from commit 09a81dc84ce0fee37442f03cdbd63c2398215376)		2022-08-22 19:21:39 +02:00
..
dns	Wait with NSEC3 during a DNSSEC policy change	2022-08-22 19:21:39 +02:00
dst	Fix CID 352776: Concurrent data access violations	2022-05-23 12:00:45 +02:00
.clang-format	Add separate .clang-format files for headers	2020-02-14 09:31:05 +01:00