make sure we wait for all signatures to come in from workers at the end of a zonetransfer

speed up NSEC generation

git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@1964 d19b8d6e-7fed-0310-83ef-9ca221ded41b

diff --git a/pdns/dnssecsigner.cc b/pdns/dnssecsigner.cc
index a2b6eb65ea33a6e069604d594274084a1d30ff62..f7e925cb92bf3286b90fa23a5df6017768672f39 100644 (file)
--- a/pdns/dnssecsigner.cc
+++ b/pdns/dnssecsigner.cc
@@ -120,6 +120,8 @@ void fillOutRRSIG(DNSSECPrivateKey& dpk, const std::string& signQName, RRSIGReco
   string msg=getMessageForRRSET(signQName, rrc, toSign); // this is what we will hash & sign
   pair<string, string> lookup(rc->getPubKeyHash(), pdns_md5sum(msg)); 
   
+  bool doCache=1;
+  if(doCache)
   {
     Lock l(&g_signatures_lock);
     if(g_signatures.count(lookup)) {
@@ -136,8 +138,10 @@ void fillOutRRSIG(DNSSECPrivateKey& dpk, const std::string& signQName, RRSIGReco
   rrc.d_signature = rc->sign(msg);
   //cerr<<dt.udiff()<<endl;
 
-  Lock l(&g_signatures_lock);
-  g_signatures[lookup] = rrc.d_signature;
+  if(doCache) {
+    Lock l(&g_signatures_lock);
+    g_signatures[lookup] = rrc.d_signature;
+  }
 }
 
 static bool rrsigncomp(const DNSResourceRecord& a, const DNSResourceRecord& b)

diff --git a/pdns/signingpipe.cc b/pdns/signingpipe.cc
index 4393d1bc3d56f6961eaf768bd960b696e6b83dbb..25bf5ef1b25a911c72bf9299538c23f54192c03e 100644 (file)
--- a/pdns/signingpipe.cc
+++ b/pdns/signingpipe.cc
@@ -3,11 +3,15 @@
 AtomicCounter ChunkedSigningPipe::s_workerid;
 
 void* ChunkedSigningPipe::helperWorker(void* p)
+try
 {
   ChunkedSigningPipe* us = (ChunkedSigningPipe*)p;
   us->worker();
   return 0;
 }
+catch(std::exception& e) {
+  cerr<<"Signing thread died with error "<<e.what()<<endl;
+}
 
 ChunkedSigningPipe::ChunkedSigningPipe(DNSSECKeeper& dk, UeberBackend& db, const std::string& signerName, bool mustSign, unsigned int workers) 
   : d_dk(dk), d_db(db), d_signer(signerName), d_chunkrecords(100), d_outstanding(0), d_numworkers(workers), d_tids(d_numworkers),

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 3d5d6c3976b724120dbc54a0f10e1ad687de87ec..da21dec290d9fd12ed0285b94854ad2b0b097bcc 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -500,7 +500,7 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
   
   ChunkedSigningPipe csp(dk, signatureDB, target, securedZone, ::arg().asNum("signing-threads"));
   
-  typedef map<string, NSECXEntry, CanonicalCompare> nsecxrepo_t;
+  typedef map<string, NSECXEntry> nsecxrepo_t;
   nsecxrepo_t nsecxrepo;
   
   // this is where the DNSKEYs go  in
@@ -512,7 +512,7 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
     rr.ttl = sd.default_ttl;
     rr.auth = 1; // please sign! 
     rr.content = value.first.getDNSKEY().getZoneRepresentation();
-    string keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : rr.qname;
+    string keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : labelReverse(rr.qname);
     NSECXEntry& ne = nsecxrepo[keyname];
     
     ne.d_set.insert(rr.qtype.getCode());
@@ -524,9 +524,11 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
   
   string keyname;
   
+  int records=0;
   while(sd.db->get(rr)) {
-    if(securedZone && (rr.auth || rr.qtype.getCode() == QType::NS || rr.qtype.getCode() == QType::DS)) {
-      keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : rr.qname;
+    records++;
+    if(securedZone && (rr.auth || rr.qtype.getCode() == QType::NS || rr.qtype.getCode() == QType::DS)) { // this is probably NSEC specific, NSEC3 is different
+      keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : labelReverse(rr.qname);
       NSECXEntry& ne = nsecxrepo[keyname];
       ne.d_set.insert(rr.qtype.getCode());
       ne.d_ttl = rr.ttl;
@@ -540,7 +542,6 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
       outpacket=getFreshAXFRPacket(q); 
     }
   }
-  
   if(securedZone) {   
     if(NSEC3Zone) {
       for(nsecxrepo_t::const_iterator iter = nsecxrepo.begin(); iter != nsecxrepo.end(); ++iter) {
@@ -577,12 +578,12 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
       nrc.d_set.insert(QType::RRSIG);
       nrc.d_set.insert(QType::NSEC);
       if(boost::next(iter) != nsecxrepo.end()) {
-        nrc.d_next = boost::next(iter)->first;
+        nrc.d_next = labelReverse(boost::next(iter)->first);
       }
       else
-        nrc.d_next=nsecxrepo.begin()->first;
+        nrc.d_next=labelReverse(nsecxrepo.begin()->first);
   
-      rr.qname = iter->first;
+      rr.qname = labelReverse(iter->first);
   
       rr.ttl = iter->second.d_ttl;
       rr.content = nrc.getZoneRepresentation();
@@ -596,11 +597,15 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
       }
     }
   }
-  
-  outpacket->getRRS() = csp.getChunk(true); // final
-  if(!outpacket->getRRS().empty()) {
-    sendPacket(outpacket, outsock);
-    outpacket=getFreshAXFRPacket(q);
+ 
+  for(;;) { 
+    outpacket->getRRS() = csp.getChunk(true); // flush the pipe
+    if(!outpacket->getRRS().empty()) {
+      sendPacket(outpacket, outsock);
+      outpacket=getFreshAXFRPacket(q);
+    }
+    else 
+      break;
   }
   
   DLOG(L<<"Done writing out records"<<endl);