Re: bind makes RRSIG disappear?

2011-02-07 Thread Cathy Almond
Hi Gilles, You've identified a corner-case bug - the logic is incorrect in the case where the ACL holds none instead of being empty. There's no compile-time option - but we are treating what you've reported to us as a bug (RT #23120). It is currently under investigation/discussion. Many thanks

Re: bind makes RRSIG disappear?

2011-02-07 Thread Evan Hunt
Thanks, this works indeed. This raises a few questions, as I'd really like to understand bind's behavior: - is there any description of exactly how/when Bind assumes signing authority over a zone? Or simply where some kind of zone-manipulating intelligence kicks in? - is it possible

Re: bind makes RRSIG disappear?

2011-02-07 Thread Gilles Massen
Evan, Thanks for outlining this - it's much clearer now. BIND will try to maintain the signatures in a zone if the zone is configured to be dynamic--i.e, if it has an update-policy or allow-update option. It won't create signatures where there were none, but it will try to keep existing

Re: bind makes RRSIG disappear?

2011-02-07 Thread Evan Hunt
BIND will try to maintain the signatures in a zone if the zone is configured to be dynamic--i.e, if it has an update-policy or allow-update option. It won't create signatures where there were none, but it will try to keep existing RRSIGs up to date for you. Not that I would need it, but

bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Hello, I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working fine. But now, completely out of the blue, Bind decides to claim some authority over the zone: the SOA RRSIG (only that one) is scrapped, and this is logged: 06-Feb-2011

Re: bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Chris, thanks for the hint, but: On 6/2/11 19:20 , Chris Thompson wrote: On Feb 6 2011, Gilles Massen wrote: I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working fine. But now, completely out of the blue, Bind decides to claim some

Re: bind makes RRSIG disappear?

2011-02-06 Thread Mark Andrews
In message 4d4ef872.6070...@restena.lu, Gilles Massen writes: Chris, thanks for the hint, but: On 6/2/11 19:20 , Chris Thompson wrote: On Feb 6 2011, Gilles Massen wrote: I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working

Re: bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Mark, On 02/06/2011 10:41 PM, Mark Andrews wrote: Mark Andrews writes: Does your configuration also have an allow-update setting (other than none) for it, maybe only for the instance that is giving you trouble? In that case BIND will take it that you want it to do resigning as the RRSIGs