IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

DNSSEC: fix forward zone forwarders checks

Browse Source 
https://fedorahosted.org/freeipa/ticket/5179

Reviewed-By: Petr Spacek <pspacek@redhat.com>
This commit is contained in:
Martin Basti
2015-08-24 12:53:30 +02:00
parent a14c4b5001
commit b4daa45baa
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
ipalib/util.py
View File

@@ -691,20 +691,21 @@ def validate_dnssec_zone_forwarder_step2(ipa_ip_addr, fwzone, log=None,
ans_cd = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr,
edns0=True, dnssec=True, flag_cd=True,
timeout=timeout)
except DNSException as e:
_log_response(log, e)
try:
ans_do = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr,
edns0=True, dnssec=True, timeout=timeout)
except NXDOMAIN as e:
# sometimes CD flag is ignored and NXDomain is returned
_log_response(log, e)
raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr)
except DNSException as e:
_log_response(log, e)
raise UnresolvableRecordError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr,
error=e)
raise UnresolvableRecordError(owner=fwzone, rtype=rtype,
ip=ipa_ip_addr, error=e)
try:
ans_do = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr,
edns0=True, dnssec=True, timeout=timeout)
except DNSException as e:
_log_response(log, e)
raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr)
else:
if (ans_do.canonical_name == ans_cd.canonical_name
and ans_do.rrset == ans_cd.rrset):