diff options
| author | Martin Basti <mbasti@redhat.com> | 2015-08-24 12:53:30 +0200 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2015-08-25 17:37:44 +0200 |
| commit | 32fedf03ebb0c8798cad0145e7adde58e4e9d09c (patch) | |
| tree | 37c3aa32e30bac7e5f7e3ef0a14cf01fe5e18359 | |
| parent | b648d124b570cbacc7d8f7d5df2976352cdba1ba (diff) | |
| download | freeipa-32fedf03ebb0c8798cad0145e7adde58e4e9d09c.tar.gz freeipa-32fedf03ebb0c8798cad0145e7adde58e4e9d09c.tar.xz freeipa-32fedf03ebb0c8798cad0145e7adde58e4e9d09c.zip | |
DNSSEC: fix forward zone forwarders checks
https://fedorahosted.org/freeipa/ticket/5179
Reviewed-By: Petr Spacek <pspacek@redhat.com>
| -rw-r--r-- | ipalib/util.py | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/ipalib/util.py b/ipalib/util.py index 649a4875f..a3500ae29 100644 --- a/ipalib/util.py +++ b/ipalib/util.py @@ -694,20 +694,21 @@ def validate_dnssec_zone_forwarder_step2(ipa_ip_addr, fwzone, log=None, ans_cd = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr, edns0=True, dnssec=True, flag_cd=True, timeout=timeout) + except NXDOMAIN as e: + # sometimes CD flag is ignored and NXDomain is returned + _log_response(log, e) + raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) except DNSException as e: _log_response(log, e) + raise UnresolvableRecordError(owner=fwzone, rtype=rtype, + ip=ipa_ip_addr, error=e) try: ans_do = _resolve_record(fwzone, rtype, nameserver_ip=ipa_ip_addr, edns0=True, dnssec=True, timeout=timeout) - except NXDOMAIN as e: - # sometimes CD flag is ignored and NXDomain is returned - _log_response(log, e) - raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) except DNSException as e: _log_response(log, e) - raise UnresolvableRecordError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr, - error=e) + raise DNSSECValidationError(owner=fwzone, rtype=rtype, ip=ipa_ip_addr) else: if (ans_do.canonical_name == ans_cd.canonical_name and ans_do.rrset == ans_cd.rrset): |