From 0f44ee49596f565f78144f676f431cb7f29bf15b Mon Sep 17 00:00:00 2001
From: Martin Basti <mbasti@redhat.com>
Date: Mon, 24 Aug 2015 12:53:30 +0200
Subject: [PATCH] DNSSEC: fix forward zone forwarders checks

https://fedorahosted.org/freeipa/ticket/5179

Reviewed-By: Petr Spacek <pspacek@redhat.com>
---
 ipalib/util.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/ipalib/util.py b/ipalib/util.py
index 649a4875fde0b44844749946cce53d81f7f6eea4..a3500ae29b56ac6a289fbec97d15cf026baf7068 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -694,20 +694,21 @@ def validate_dnssec_zone_forwarder_step2(ipa_ip_addr, fwzone, log=None,
         ans_cd = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr,
                                  edns0=True, dnssec=True, flag_cd=True,
                                  timeout=timeout)
+    except NXDOMAIN as e:
+        # sometimes CD flag is ignored and NXDomain is returned
+        _log_response(log, e)
+        raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr)
     except DNSException as e:
         _log_response(log, e)
+        raise UnresolvableRecordError(owner=fwzone, rtype=rtype,
+                                      ip=ipa_ip_addr, error=e)
 
     try:
         ans_do = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr,
                                  edns0=True, dnssec=True, timeout=timeout)
-    except NXDOMAIN as e:
-        # sometimes CD flag is ignored and NXDomain is returned
-        _log_response(log, e)
-        raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr)
     except DNSException as e:
         _log_response(log, e)
-        raise UnresolvableRecordError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr,
-                                      error=e)
+        raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr)
     else:
         if (ans_do.canonical_name == ans_cd.canonical_name
             and ans_do.rrset == ans_cd.rrset):
-- 
2.4.3