Move update_sigs() to lib/dns/zone_p.h

Rename update_sigs() to dns__zone_updatesigs() and move it to
lib/dns/zone_p.h, so that it can be unit tested.  Add a comment
describing the purpose of this function.

(cherry picked from commit b1947cee8210844b917320453cb308fbe168d320)
(cherry picked from commit 4d06f50ba84edca141c28f9decd6640465c5f9ed)
(cherry picked from commit 5c71a025c6ec1cbaab04ada54101200a48a98bd1)
(cherry picked from commit ae03a5c1fa5d7d6cce93273cd41171595882c7d4)

diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index 7cd05d61f9f587c69a00c62a7fe85a05d85693c0..eed2594ae312f7d94697535de6d0a59f315daf29 100644 (file)
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -4,6 +4,7 @@ LIBRARY libdns
 EXPORTS
 
 dns__zone_loadpending
+dns__zone_updatesigs
 dns_acache_attach
 dns_acache_attachentry
 dns_acache_cancelentry

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b170b3f518ab000e395cfe944349ee2150c6a0b0..b069944608da1eb9486366edcb97f3e8bf725fd2 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6765,12 +6765,18 @@ need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver,
        return (result);
 }
 
-static isc_result_t
-update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
-           dst_key_t *zone_keys[], unsigned int nkeys, dns_zone_t *zone,
-           isc_stdtime_t inception, isc_stdtime_t expire, isc_stdtime_t now,
-           isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
-           dns__zonediff_t *zonediff)
+/*%
+ * Add/remove DNSSEC signatures for the list of "raw" zone changes supplied in
+ * 'diff'.  Gradually remove tuples from 'diff' and append them to 'zonediff'
+ * along with tuples representing relevant signature changes.
+ */
+isc_result_t
+dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
+                    dst_key_t *zone_keys[], unsigned int nkeys,
+                    dns_zone_t *zone, isc_stdtime_t inception,
+                    isc_stdtime_t expire, isc_stdtime_t now,
+                    isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
+                    dns__zonediff_t *zonediff)
 {
        dns_difftuple_t *tuple;
        isc_result_t result;
@@ -6783,7 +6789,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                                  zone_keys, nkeys, now, ISC_FALSE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
-                                    "update_sigs:del_sigs -> %s",
+                                    "dns__zone_updatesigs:del_sigs -> %s",
                                     dns_result_totext(result));
                        return (result);
                }
@@ -6793,7 +6799,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                                  expire, check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
-                                    "update_sigs:add_sigs -> %s",
+                                    "dns__zone_updatesigs:add_sigs -> %s",
                                     dns_result_totext(result));
                        return (result);
                }
@@ -6959,7 +6965,7 @@ zone_nsec3chain(dns_zone_t *zone) {
         *
         * Note that the "signatures" variable is only used here to limit the
         * amount of work performed.  Actual DNSSEC signatures are only
-        * generated by update_sigs() calls later in this function.
+        * generated by dns__zone_updatesigs() calls later in this function.
         */
        while (nsec3chain != NULL && nodes-- > 0 && signatures > 0) {
                LOCK_ZONE(zone);
@@ -7445,12 +7451,13 @@ zone_nsec3chain(dns_zone_t *zone) {
         */
        if (nsec3chain != NULL)
                dns_dbiterator_pause(nsec3chain->dbiterator);
-       result = update_sigs(&nsec3_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&nsec3_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -7458,12 +7465,13 @@ zone_nsec3chain(dns_zone_t *zone) {
         * We have changed the NSEC3PARAM or private RRsets
         * above so we need to update the signatures.
         */
-       result = update_sigs(&param_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&param_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -7478,12 +7486,13 @@ zone_nsec3chain(dns_zone_t *zone) {
                }
        }
 
-       result = update_sigs(&nsec_diff, db, version, zone_keys,
-                            nkeys, zone, inception, expire, now,
-                            check_ksk, keyset_kskonly, &zonediff);
+       result = dns__zone_updatesigs(&nsec_diff, db, version, zone_keys,
+                                     nkeys, zone, inception, expire, now,
+                                     check_ksk, keyset_kskonly, &zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-                            "update_sigs -> %s", dns_result_totext(result));
+                            "dns__zone_updatesigs -> %s",
+                            dns_result_totext(result));
                goto failure;
        }
 
@@ -8063,12 +8072,14 @@ zone_sign(dns_zone_t *zone) {
        }
 
        if (ISC_LIST_HEAD(post_diff.tuples) != NULL) {
-               result = update_sigs(&post_diff, db, version, zone_keys,
-                                    nkeys, zone, inception, expire, now,
-                                    check_ksk, keyset_kskonly, &zonediff);
+               result = dns__zone_updatesigs(&post_diff, db, version,
+                                             zone_keys, nkeys, zone,
+                                             inception, expire, now,
+                                             check_ksk, keyset_kskonly,
+                                             &zonediff);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:"
-                                    "update_sigs -> %s",
+                                    "dns__zone_updatesigs -> %s",
                                     dns_result_totext(result));
                        goto failure;
                }
@@ -16796,9 +16807,8 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
        keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
 
        /*
-        * See if update_sigs will update DNSKEY signature and if not
-        * cause them to sign so that so that newly activated keys
-        * are used.
+        * See if dns__zone_updatesigs() will update DNSKEY signature and if
+        * not cause them to sign so that newly activated keys are used.
         */
        for (tuple = ISC_LIST_HEAD(diff->tuples);
             tuple != NULL;
@@ -16830,13 +16840,12 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
                }
        }
 
-       result = update_sigs(diff, db, ver, zone_keys, nkeys, zone,
-                            inception, soaexpire, now, check_ksk,
-                            keyset_kskonly, zonediff);
-
+       result = dns__zone_updatesigs(diff, db, ver, zone_keys, nkeys, zone,
+                                     inception, soaexpire, now, check_ksk,
+                                     keyset_kskonly, zonediff);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
-                            "sign_apex:update_sigs -> %s",
+                            "sign_apex:dns__zone_updatesigs -> %s",
                             dns_result_totext(result));
                goto failure;
        }

diff --git a/lib/dns/zone_p.h b/lib/dns/zone_p.h
index 3ef05e023ce2fd82078203a3f6a2077361b1c2f1..b9b0c79c6aa557d46e714d1b197b576f79ad3a5e 100644 (file)
--- a/lib/dns/zone_p.h
+++ b/lib/dns/zone_p.h
@@ -26,6 +26,14 @@ typedef struct {
        isc_boolean_t   offline;
 } dns__zonediff_t;
 
+isc_result_t
+dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
+                    dst_key_t *zone_keys[], unsigned int nkeys,
+                    dns_zone_t *zone, isc_stdtime_t inception,
+                    isc_stdtime_t expire, isc_stdtime_t now,
+                    isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly,
+                    dns__zonediff_t *zonediff);
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_ZONE_P_H */