Move update_sigs() to lib/dns/zone_p.h

Rename update_sigs() to dns__zone_updatesigs() and move it to
lib/dns/zone_p.h, so that it can be unit tested.  Add a comment
describing the purpose of this function.

(cherry picked from commit b1947cee8210844b917320453cb308fbe168d320)
(cherry picked from commit 4d06f50ba84edca141c28f9decd6640465c5f9ed)
(cherry picked from commit 5c71a025c6ec1cbaab04ada54101200a48a98bd1)

diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index e2dc74d58b22be77f85f5cf6205cb7a254bc2fc9..c6b8ff4eb3833c0a9761f893a0e0c7bcd643eada 100644 (file)
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -7,6 +7,7 @@ dns__rbt_getheight
 dns__rbt_checkproperties
 dns__rbtnode_getdistance
 dns__zone_loadpending
+dns__zone_updatesigs
 dns_acache_attach
 dns_acache_attachentry
 dns_acache_cancelentry

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 3a9bb797b129c9cd53ecf1db763525dadc6427e6..e9e473dcbea09150edf072da13cab167f309688c 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -7205,12 +7205,18 @@ need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver,
        return (result);
 }
 
-static isc_result_t
-update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
-           dst_key_t *zone_keys[], unsigned int nkeys, dns_zone_t *zone,
-           isc_stdtime_t inception, isc_stdtime_t expire, isc_stdtime_t now,
-           isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
-           dns__zonediff_t *zonediff)
+/*%
+ * Add/remove DNSSEC signatures for the list of "raw" zone changes supplied in
+ * 'diff'.  Gradually remove tuples from 'diff' and append them to 'zonediff'
+ * along with tuples representing relevant signature changes.
+ */
+isc_result_t
+dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
+                    dst_key_t *zone_keys[], unsigned int nkeys,
+                    dns_zone_t *zone, isc_stdtime_t inception,
+                    isc_stdtime_t expire, isc_stdtime_t now,
+                    isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
+                    dns__zonediff_t *zonediff)
 {
        dns_difftuple_t *tuple;
        isc_result_t result;
@@ -7223,7 +7229,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                                  zone_keys, nkeys, now, ISC_FALSE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
-                                    "update_sigs:del_sigs -> %s",
+                                    "dns__zone_updatesigs:del_sigs -> %s",
                                     dns_result_totext(result));
                        return (result);
                }
@@ -7233,7 +7239,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                                  expire, check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
-                                    "update_sigs:add_sigs -> %s",
+                                    "dns__zone_updatesigs:add_sigs -> %s",
                                     dns_result_totext(result));
                        return (result);
                }
@@ -7399,7 +7405,7 @@ zone_nsec3chain(dns_zone_t *zone) {
         *
         * Note that the "signatures" variable is only used here to limit the
         * amount of work performed.  Actual DNSSEC signatures are only
-        * generated by update_sigs() calls later in this function.
+        * generated by dns__zone_updatesigs() calls later in this function.
         */
        while (nsec3chain != NULL && nodes-- > 0 && signatures > 0) {
                LOCK_ZONE(zone);
@@ -7885,12 +7891,13 @@ zone_nsec3chain(dns_zone_t *zone) {
         */
        if (nsec3chain != NULL)
                dns_dbiterator_pause(nsec3chain->dbiterator);
-       result = update_sigs(&nsec3_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&nsec3_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -7898,12 +7905,13 @@ zone_nsec3chain(dns_zone_t *zone) {
         * We have changed the NSEC3PARAM or private RRsets
         * above so we need to update the signatures.
         */
-       result = update_sigs(&param_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&param_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -7918,12 +7926,13 @@ zone_nsec3chain(dns_zone_t *zone) {
                }
        }
 
-       result = update_sigs(&nsec_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&nsec_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -8503,12 +8512,14 @@ zone_sign(dns_zone_t *zone) {
        }
 
        if (ISC_LIST_HEAD(post_diff.tuples) != NULL) {
-               result = update_sigs(&post_diff, db, version, zone_keys,
-                                    nkeys, zone, inception, expire, now,
-                                    check_ksk, keyset_kskonly, &zonediff);
+               result = dns__zone_updatesigs(&post_diff, db, version,
+                                             zone_keys, nkeys, zone,
+                                             inception, expire, now,
+                                             check_ksk, keyset_kskonly,
+                                             &zonediff);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:"
-                                    "update_sigs -> %s",
+                                    "dns__zone_updatesigs -> %s",
                                     dns_result_totext(result));
                        goto failure;
                }
@@ -17314,9 +17325,8 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
        keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
 
        /*
-        * See if update_sigs will update DNSKEY signature and if not
-        * cause them to sign so that so that newly activated keys
-        * are used.
+        * See if dns__zone_updatesigs() will update DNSKEY signature and if
+        * not cause them to sign so that newly activated keys are used.
         */
        for (tuple = ISC_LIST_HEAD(diff->tuples);
             tuple != NULL;
@@ -17348,13 +17358,12 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
                }
        }
 
-       result = update_sigs(diff, db, ver, zone_keys, nkeys, zone,
-                            inception, soaexpire, now, check_ksk,
-                            keyset_kskonly, zonediff);
-
+       result = dns__zone_updatesigs(diff, db, ver, zone_keys, nkeys, zone,
+                                     inception, soaexpire, now, check_ksk,
+                                     keyset_kskonly, zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
-                            "sign_apex:update_sigs -> %s",
+                            "sign_apex:dns__zone_updatesigs -> %s",
                             dns_result_totext(result));
                goto failure;
        }

diff --git a/lib/dns/zone_p.h b/lib/dns/zone_p.h
index 3ef05e023ce2fd82078203a3f6a2077361b1c2f1..b9b0c79c6aa557d46e714d1b197b576f79ad3a5e 100644 (file)
--- a/lib/dns/zone_p.h
+++ b/lib/dns/zone_p.h
@@ -26,6 +26,14 @@ typedef struct {
        isc_boolean_t   offline;
 } dns__zonediff_t;
 
+isc_result_t
+dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
+                    dst_key_t *zone_keys[], unsigned int nkeys,
+                    dns_zone_t *zone, isc_stdtime_t inception,
+                    isc_stdtime_t expire, isc_stdtime_t now,
+                    isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
+                    dns__zonediff_t *zonediff);
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_ZONE_P_H */