From 0f44ee49596f565f78144f676f431cb7f29bf15b Mon Sep 17 00:00:00 2001 From: Martin Basti Date: Mon, 24 Aug 2015 12:53:30 +0200 Subject: [PATCH] DNSSEC: fix forward zone forwarders checks https://fedorahosted.org/freeipa/ticket/5179 Reviewed-By: Petr Spacek --- ipalib/util.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/ipalib/util.py b/ipalib/util.py index 649a4875fde0b44844749946cce53d81f7f6eea4..a3500ae29b56ac6a289fbec97d15cf026baf7068 100644 --- a/ipalib/util.py +++ b/ipalib/util.py @@ -694,20 +694,21 @@ def validate_dnssec_zone_forwarder_step2(ipa_ip_addr, fwzone, log=None, ans_cd = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr, edns0=True, dnssec=True, flag_cd=True, timeout=timeout) + except NXDOMAIN as e: + # sometimes CD flag is ignored and NXDomain is returned + _log_response(log, e) + raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) except DNSException as e: _log_response(log, e) + raise UnresolvableRecordError(owner=fwzone, rtype=rtype, + ip=ipa_ip_addr, error=e) try: ans_do = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr, edns0=True, dnssec=True, timeout=timeout) - except NXDOMAIN as e: - # sometimes CD flag is ignored and NXDomain is returned - _log_response(log, e) - raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) except DNSException as e: _log_response(log, e) - raise UnresolvableRecordError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr, - error=e) + raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) else: if (ans_do.canonical_name == ans_cd.canonical_name and ans_do.rrset == ans_cd.rrset): -- 2.4.3