From: Otto Moerbeek Date: Mon, 2 Dec 2024 11:42:40 +0000 (+0100) Subject: Also handle sigs as a shared point to a vector X-Git-Tag: dnsdist-2.0.0-alpha1~195^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=45e3241f667da3ede7139afbeccdbdb82df52c86;p=thirdparty%2Fpdns.git Also handle sigs as a shared point to a vector --- diff --git a/pdns/recursordist/aggressive_nsec.cc b/pdns/recursordist/aggressive_nsec.cc index e894666d50..a48af4f375 100644 --- a/pdns/recursordist/aggressive_nsec.cc +++ b/pdns/recursordist/aggressive_nsec.cc @@ -441,7 +441,7 @@ bool AggressiveNSECCache::getNSEC3(time_t now, std::shared_ptr& recordSet, std::vector> signatures, const DNSName& owner, bool doDNSSEC, std::vector& ret, DNSResourceRecord::Place place = DNSResourceRecord::AUTHORITY) +static void addToRRSet(const time_t now, std::vector& recordSet, const MemRecursorCache::SigRecs& signatures, const DNSName& owner, bool doDNSSEC, std::vector& ret, DNSResourceRecord::Place place = DNSResourceRecord::AUTHORITY) { uint32_t ttl = 0; @@ -458,12 +458,12 @@ static void addToRRSet(const time_t now, std::vector& recordSet, std: } if (doDNSSEC) { - for (auto& signature : signatures) { + for (const auto& signature : *signatures) { DNSRecord dr; dr.d_type = QType::RRSIG; dr.d_name = owner; dr.d_ttl = ttl; - dr.setContent(std::move(signature)); + dr.setContent(signature); dr.d_place = place; dr.d_class = QClass::IN; ret.push_back(std::move(dr)); @@ -501,7 +501,7 @@ bool AggressiveNSECCache::synthesizeFromNSEC3Wildcard(time_t now, const DNSName& vState cachedState; std::vector wcSet; - std::vector> wcSignatures; + MemRecursorCache::SigRecs wcSignatures; if (g_recCache->get(now, wildcardName, type, MemRecursorCache::RequireAuth, &wcSet, ComboAddress("127.0.0.1"), boost::none, doDNSSEC ? &wcSignatures : nullptr, nullptr, nullptr, &cachedState) <= 0 || cachedState != vState::Secure) { VLOG(log, name << ": Unfortunately we don't have a valid entry for " << wildcardName << ", so we cannot synthesize from that wildcard" << endl); @@ -525,14 +525,14 @@ bool AggressiveNSECCache::synthesizeFromNSECWildcard(time_t now, const DNSName& vState cachedState; std::vector wcSet; - std::vector> wcSignatures; + MemRecursorCache::SigRecs wcSignatures; if (g_recCache->get(now, wildcardName, type, MemRecursorCache::RequireAuth, &wcSet, ComboAddress("127.0.0.1"), boost::none, doDNSSEC ? &wcSignatures : nullptr, nullptr, nullptr, &cachedState) <= 0 || cachedState != vState::Secure) { VLOG(log, name << ": Unfortunately we don't have a valid entry for " << wildcardName << ", so we cannot synthesize from that wildcard" << endl); return false; } - addToRRSet(now, wcSet, std::move(wcSignatures), name, doDNSSEC, ret, DNSResourceRecord::ANSWER); + addToRRSet(now, wcSet, wcSignatures, name, doDNSSEC, ret, DNSResourceRecord::ANSWER); // coverity[store_truncates_time_t] addRecordToRRSet(nsec.d_owner, QType::NSEC, nsec.d_ttd - now, nsec.d_record, nsec.d_signatures, doDNSSEC, ret); @@ -542,7 +542,7 @@ bool AggressiveNSECCache::synthesizeFromNSECWildcard(time_t now, const DNSName& return true; } -bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr>& zoneEntry, std::vector& soaSet, std::vector>& soaSignatures, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, const OptLog& log, pdns::validation::ValidationContext& validationContext) +bool AggressiveNSECCache::getNSEC3Denial(time_t now, std::shared_ptr>& zoneEntry, std::vector& soaSet, const MemRecursorCache::SigRecs& soaSignatures, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, const OptLog& log, pdns::validation::ValidationContext& validationContext) { DNSName zone; std::string salt; @@ -812,7 +812,7 @@ bool AggressiveNSECCache::getDenial(time_t now, const DNSName& name, const QType vState cachedState; std::vector soaSet; - std::vector> soaSignatures; + MemRecursorCache::SigRecs soaSignatures; /* we might not actually need the SOA if we find a matching wildcard, but let's not bother for now */ if (g_recCache->get(now, zone, QType::SOA, MemRecursorCache::RequireAuth, &soaSet, who, routingTag, doDNSSEC ? &soaSignatures : nullptr, nullptr, nullptr, &cachedState) <= 0 || cachedState != vState::Secure) { VLOG(log, name << ": No valid SOA found for " << zone << ", which is the best match for " << name << endl); @@ -898,9 +898,9 @@ bool AggressiveNSECCache::getDenial(time_t now, const DNSName& name, const QType return false; } - ret.reserve(ret.size() + soaSet.size() + soaSignatures.size() + /* NSEC */ 1 + entry.d_signatures.size() + (needWildcard ? (/* NSEC */ 1 + wcEntry.d_signatures.size()) : 0)); + ret.reserve(ret.size() + soaSet.size() + soaSignatures->size() + /* NSEC */ 1 + entry.d_signatures.size() + (needWildcard ? (/* NSEC */ 1 + wcEntry.d_signatures.size()) : 0)); - addToRRSet(now, soaSet, std::move(soaSignatures), zone, doDNSSEC, ret); + addToRRSet(now, soaSet, soaSignatures, zone, doDNSSEC, ret); // coverity[store_truncates_time_t] addRecordToRRSet(entry.d_owner, QType::NSEC, entry.d_ttd - now, entry.d_record, entry.d_signatures, doDNSSEC, ret); diff --git a/pdns/recursordist/aggressive_nsec.hh b/pdns/recursordist/aggressive_nsec.hh index 22983c590a..faee812726 100644 --- a/pdns/recursordist/aggressive_nsec.hh +++ b/pdns/recursordist/aggressive_nsec.hh @@ -38,6 +38,7 @@ using namespace ::boost::multi_index; #include "stat_t.hh" #include "logger.hh" #include "validate.hh" +#include "recursor_cache.hh" class AggressiveNSECCache { @@ -154,7 +155,7 @@ private: std::shared_ptr> getBestZone(const DNSName& zone); bool getNSECBefore(time_t now, std::shared_ptr>& zoneEntry, const DNSName& name, ZoneEntry::CacheEntry& entry); bool getNSEC3(time_t now, std::shared_ptr>& zoneEntry, const DNSName& name, ZoneEntry::CacheEntry& entry); - bool getNSEC3Denial(time_t now, std::shared_ptr>& zoneEntry, std::vector& soaSet, std::vector>& soaSignatures, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, const OptLog&, pdns::validation::ValidationContext& validationContext); + bool getNSEC3Denial(time_t now, std::shared_ptr>& zoneEntry, std::vector& soaSet, const MemRecursorCache::SigRecs& soaSignatures, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, const OptLog&, pdns::validation::ValidationContext& validationContext); bool synthesizeFromNSEC3Wildcard(time_t now, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, ZoneEntry::CacheEntry& nextCloser, const DNSName& wildcardName, const OptLog&); bool synthesizeFromNSECWildcard(time_t now, const DNSName& name, const QType& type, std::vector& ret, int& res, bool doDNSSEC, ZoneEntry::CacheEntry& nsec, const DNSName& wildcardName, const OptLog&); diff --git a/pdns/recursordist/recursor_cache.cc b/pdns/recursordist/recursor_cache.cc index 380275a535..5c00a77a17 100644 --- a/pdns/recursordist/recursor_cache.cc +++ b/pdns/recursordist/recursor_cache.cc @@ -77,6 +77,7 @@ uint16_t MemRecursorCache::s_maxRRSetSize = 256; bool MemRecursorCache::s_limitQTypeAny = true; const MemRecursorCache::AuthRecs MemRecursorCache::s_emptyAuthRecs = std::make_shared(); +const MemRecursorCache::SigRecs MemRecursorCache::s_emptySigRecs = std::make_shared(); void MemRecursorCache::resetStaticsForTests() { @@ -174,7 +175,7 @@ static void ptrAssign(T* ptr, const T& value) } } -time_t MemRecursorCache::handleHit(time_t now, MapCombo::LockedContent& content, MemRecursorCache::OrderedTagIterator_t& entry, const DNSName& qname, uint32_t& origTTL, vector* res, vector>* signatures, AuthRecs* authorityRecs, bool* variable, boost::optional& state, bool* wasAuth, DNSName* fromAuthZone, ComboAddress* fromAuthIP) +time_t MemRecursorCache::handleHit(time_t now, MapCombo::LockedContent& content, OrderedTagIterator_t& entry, const DNSName& qname, uint32_t& origTTL, vector* res, SigRecs* signatures, AuthRecs* authorityRecs, bool* variable, boost::optional& state, bool* wasAuth, DNSName* fromAuthZone, ComboAddress* fromAuthIP) { // MUTEX SHOULD BE ACQUIRED (as indicated by the reference to the content which is protected by a lock) if (entry->d_tooBig) { @@ -213,10 +214,21 @@ time_t MemRecursorCache::handleHit(time_t now, MapCombo::LockedContent& content, } if (signatures != nullptr) { - signatures->insert(signatures->end(), entry->d_signatures.begin(), entry->d_signatures.end()); + if (*signatures && !(*signatures)->empty() && entry->d_signatures && !entry->d_signatures->empty()) { + // Return a new vec if we need to append to a non-empty vector + SigRecsVec vec(**signatures); + vec.insert(vec.end(), entry->d_signatures->cbegin(), entry->d_signatures->cend()); + *signatures = std::make_shared(vec); + } + else { + assert(*signatures == nullptr || (*signatures)->empty()); + *signatures = entry->d_signatures ? entry->d_signatures : s_emptySigRecs; + } } if (authorityRecs != nullptr) { + // XXX Might need to be adapted like sigs to handle a non-empty incoming authorityRecs + assert(*authorityRecs == nullptr || (*authorityRecs)->empty()); *authorityRecs = entry->d_authorityRecs ? entry->d_authorityRecs : s_emptyAuthRecs; } @@ -384,7 +396,7 @@ time_t MemRecursorCache::fakeTTD(MemRecursorCache::OrderedTagIterator_t& entry, } // returns -1 for no hits -time_t MemRecursorCache::get(time_t now, const DNSName& qname, const QType qtype, Flags flags, vector* res, const ComboAddress& who, const OptTag& routingTag, vector>* signatures, AuthRecs* authorityRecs, bool* variable, vState* state, bool* wasAuth, DNSName* fromAuthZone, ComboAddress* fromAuthIP) // NOLINT(readability-function-cognitive-complexity) +time_t MemRecursorCache::get(time_t now, const DNSName& qname, const QType qtype, Flags flags, vector* res, const ComboAddress& who, const OptTag& routingTag, SigRecs* signatures, AuthRecs* authorityRecs, bool* variable, vState* state, bool* wasAuth, DNSName* fromAuthZone, ComboAddress* fromAuthIP) // NOLINT(readability-function-cognitive-complexity) { bool requireAuth = (flags & RequireAuth) != 0; bool refresh = (flags & Refresh) != 0; @@ -587,7 +599,7 @@ bool MemRecursorCache::replace(CacheEntry&& entry) return false; } -void MemRecursorCache::replace(time_t now, const DNSName& qname, const QType qtype, const vector& content, const vector>& signatures, const AuthRecsVec& authorityRecs, bool auth, const DNSName& authZone, boost::optional ednsmask, const OptTag& routingTag, vState state, boost::optional from, bool refresh, time_t ttl_time) +void MemRecursorCache::replace(time_t now, const DNSName& qname, const QType qtype, const vector& content, const SigRecsVec& signatures, const AuthRecsVec& authorityRecs, bool auth, const DNSName& authZone, boost::optional ednsmask, const OptTag& routingTag, vState state, boost::optional from, bool refresh, time_t ttl_time) { auto& shard = getMap(qname); auto lockedShard = shard.lock(); @@ -647,7 +659,12 @@ void MemRecursorCache::replace(time_t now, const DNSName& qname, const QType qty cacheEntry.d_auth = true; } - cacheEntry.d_signatures = signatures; + if (!signatures.empty()) { + cacheEntry.d_signatures = std::make_shared(signatures); + } + else { + cacheEntry.d_signatures = nullptr; + } if (!authorityRecs.empty()) { cacheEntry.d_authorityRecs = std::make_shared(authorityRecs); } @@ -881,13 +898,15 @@ uint64_t MemRecursorCache::doDump(int fileDesc, size_t maxCacheEntries) fprintf(filePtr.get(), "; error printing '%s'\n", recordSet.d_qname.empty() ? "EMPTY" : recordSet.d_qname.toString().c_str()); } } - for (const auto& sig : recordSet.d_signatures) { - count++; - try { - fprintf(filePtr.get(), "%s %" PRIu32 " %" PRId64 " IN RRSIG %s ; %s\n", recordSet.d_qname.toString().c_str(), recordSet.d_orig_ttl, static_cast(recordSet.d_ttd - now), sig->getZoneRepresentation().c_str(), recordSet.d_netmask.empty() ? "" : recordSet.d_netmask.toString().c_str()); - } - catch (...) { - fprintf(filePtr.get(), "; error printing '%s'\n", recordSet.d_qname.empty() ? "EMPTY" : recordSet.d_qname.toString().c_str()); + if (recordSet.d_signatures) { + for (const auto& sig : *recordSet.d_signatures) { + count++; + try { + fprintf(filePtr.get(), "%s %" PRIu32 " %" PRId64 " IN RRSIG %s ; %s\n", recordSet.d_qname.toString().c_str(), recordSet.d_orig_ttl, static_cast(recordSet.d_ttd - now), sig->getZoneRepresentation().c_str(), recordSet.d_netmask.empty() ? "" : recordSet.d_netmask.toString().c_str()); + } + catch (...) { + fprintf(filePtr.get(), "; error printing '%s'\n", recordSet.d_qname.empty() ? "EMPTY" : recordSet.d_qname.toString().c_str()); + } } } } @@ -1023,7 +1042,7 @@ void MemRecursorCache::getRecordSet(T& message, U recordSet) for (const auto& record : recordSet->d_records) { message.add_bytes(PBCacheEntry::repeated_bytes_record, record->serialize(recordSet->d_qname, true)); } - for (const auto& record : recordSet->d_signatures) { + for (const auto& record : *recordSet->d_signatures) { message.add_bytes(PBCacheEntry::repeated_bytes_sig, record->serialize(recordSet->d_qname, true)); } for (const auto& authRec : *recordSet->d_authorityRecs) { @@ -1138,7 +1157,8 @@ static void putAuthRecord(protozero::pbf_message& message, const D template bool MemRecursorCache::putRecordSet(T& message) { - std::vector authRecs; + AuthRecsVec authRecs; + SigRecsVec sigRecs; CacheEntry cacheEntry{{g_rootdnsname, QType::A, boost::none, Netmask()}, false}; while (message.next()) { switch (message.tag()) { @@ -1148,13 +1168,16 @@ bool MemRecursorCache::putRecordSet(T& message) break; } case PBCacheEntry::repeated_bytes_sig: { + if (!cacheEntry.d_signatures) { + cacheEntry.d_signatures = std::make_shared(); + } auto ptr = DNSRecordContent::deserialize(cacheEntry.d_qname, QType::RRSIG, message.get_bytes()); - cacheEntry.d_signatures.emplace_back(std::dynamic_pointer_cast(ptr)); + sigRecs.emplace_back(std::dynamic_pointer_cast(ptr)); break; } case PBCacheEntry::repeated_message_authRecord: if (!cacheEntry.d_authorityRecs) { - cacheEntry.d_authorityRecs = std::make_shared>(); + cacheEntry.d_authorityRecs = std::make_shared(); } putAuthRecord(message, cacheEntry.d_qname, authRecs); break; @@ -1203,7 +1226,10 @@ bool MemRecursorCache::putRecordSet(T& message) } } if (!authRecs.empty()) { - cacheEntry.d_authorityRecs = std::make_shared>(authRecs); + cacheEntry.d_authorityRecs = std::make_shared(authRecs); + } + if (!sigRecs.empty()) { + cacheEntry.d_signatures = std::make_shared(sigRecs); } return replace(std::move(cacheEntry)); } diff --git a/pdns/recursordist/recursor_cache.hh b/pdns/recursordist/recursor_cache.hh index 43822af5cd..3ce9186e64 100644 --- a/pdns/recursordist/recursor_cache.hh +++ b/pdns/recursordist/recursor_cache.hh @@ -82,9 +82,13 @@ public: using AuthRecs = std::shared_ptr; // const to avoid modifying the vector, which would be bad for shared data const static AuthRecs s_emptyAuthRecs; - [[nodiscard]] time_t get(time_t, const DNSName& qname, QType qtype, Flags flags, vector* res, const ComboAddress& who, const OptTag& routingTag = boost::none, vector>* signatures = nullptr, AuthRecs* authorityRecs = nullptr, bool* variable = nullptr, vState* state = nullptr, bool* wasAuth = nullptr, DNSName* fromAuthZone = nullptr, ComboAddress* fromAuthIP = nullptr); + using SigRecsVec = std::vector>; + using SigRecs = std::shared_ptr; + const static SigRecs s_emptySigRecs; - void replace(time_t, const DNSName& qname, QType qtype, const vector& content, const vector>& signatures, const AuthRecsVec& authorityRecs, bool auth, const DNSName& authZone, boost::optional ednsmask = boost::none, const OptTag& routingTag = boost::none, vState state = vState::Indeterminate, boost::optional from = boost::none, bool refresh = false, time_t ttl_time = time(nullptr)); + [[nodiscard]] time_t get(time_t, const DNSName& qname, QType qtype, Flags flags, vector* res, const ComboAddress& who, const OptTag& routingTag = boost::none, SigRecs* signatures = nullptr, AuthRecs* authorityRecs = nullptr, bool* variable = nullptr, vState* state = nullptr, bool* wasAuth = nullptr, DNSName* fromAuthZone = nullptr, ComboAddress* fromAuthIP = nullptr); + + void replace(time_t, const DNSName& qname, QType qtype, const vector& content, const SigRecsVec& signatures, const AuthRecsVec& authorityRecs, bool auth, const DNSName& authZone, boost::optional ednsmask = boost::none, const OptTag& routingTag = boost::none, vState state = vState::Indeterminate, boost::optional from = boost::none, bool refresh = false, time_t ttl_time = time(nullptr)); void doPrune(time_t now, size_t keep); uint64_t doDump(int fileDesc, size_t maxCacheEntries); @@ -143,7 +147,7 @@ private: bool shouldReplace(time_t now, bool auth, vState state, bool refresh); records_t d_records; - std::vector> d_signatures; + SigRecs d_signatures; AuthRecs d_authorityRecs; DNSName d_qname; DNSName d_authZone; @@ -356,7 +360,7 @@ private: static Entries getEntries(MapCombo::LockedContent& map, const DNSName& qname, QType qtype, const OptTag& rtag); static cache_t::const_iterator getEntryUsingECSIndex(MapCombo::LockedContent& map, time_t now, const DNSName& qname, QType qtype, bool requireAuth, const ComboAddress& who, bool serveStale); - static time_t handleHit(time_t now, MapCombo::LockedContent& content, OrderedTagIterator_t& entry, const DNSName& qname, uint32_t& origTTL, vector* res, vector>* signatures, AuthRecs* authorityRecs, bool* variable, boost::optional& state, bool* wasAuth, DNSName* authZone, ComboAddress* fromAuthIP); + static time_t handleHit(time_t now, MapCombo::LockedContent& content, OrderedTagIterator_t& entry, const DNSName& qname, uint32_t& origTTL, vector* res, SigRecs* signatures, AuthRecs* authorityRecs, bool* variable, boost::optional& state, bool* wasAuth, DNSName* authZone, ComboAddress* fromAuthIP); static void updateStaleEntry(time_t now, OrderedTagIterator_t& entry); static void handleServeStaleBookkeeping(time_t, bool, OrderedTagIterator_t&); }; diff --git a/pdns/recursordist/syncres.cc b/pdns/recursordist/syncres.cc index b62add31b9..465f93313d 100644 --- a/pdns/recursordist/syncres.cc +++ b/pdns/recursordist/syncres.cc @@ -2555,7 +2555,7 @@ static pair scanForCNAMELoop(const DNSName& name, const vect bool SyncRes::doCNAMECacheCheck(const DNSName& qname, const QType qtype, vector& ret, unsigned int depth, const string& prefix, int& res, Context& context, bool wasAuthZone, bool wasForwardRecurse, bool checkForDups) // NOLINT(readability-function-cognitive-complexity) { vector cset; - vector> signatures; + MemRecursorCache::SigRecs signatures = MemRecursorCache::s_emptySigRecs; MemRecursorCache::AuthRecs authorityRecs = MemRecursorCache::s_emptyAuthRecs; bool wasAuth = false; uint32_t capTTL = std::numeric_limits::max(); @@ -2619,10 +2619,10 @@ bool SyncRes::doCNAMECacheCheck(const DNSName& qname, const QType qtype, vector< if (!wasAuthZone && shouldValidate() && (wasAuth || wasForwardRecurse) && context.state == vState::Indeterminate && d_requireAuthData) { /* This means we couldn't figure out the state when this entry was cached */ - vState recordState = getValidationStatus(foundName, !signatures.empty(), qtype == QType::DS, depth, prefix); + vState recordState = getValidationStatus(foundName, !signatures->empty(), qtype == QType::DS, depth, prefix); if (recordState == vState::Secure) { LOG(prefix << qname << ": Got vState::Indeterminate state from the " << foundQT.toString() << " cache, validating.." << endl); - context.state = SyncRes::validateRecordsWithSigs(depth, prefix, qname, qtype, foundName, foundQT, cset, signatures); + context.state = SyncRes::validateRecordsWithSigs(depth, prefix, qname, qtype, foundName, foundQT, cset, *signatures); if (context.state != vState::Indeterminate) { LOG(prefix << qname << ": Got vState::Indeterminate state from the " << foundQT.toString() << " cache, new validation result is " << context.state << endl); if (vStateIsBogus(context.state)) { @@ -2652,10 +2652,10 @@ bool SyncRes::doCNAMECacheCheck(const DNSName& qname, const QType qtype, vector< dnsRecord.d_ttl = std::min(dnsRecord.d_ttl, capTTL); const uint32_t ttl = dnsRecord.d_ttl; if (!alreadyPresent) { - ret.reserve(ret.size() + 2 + signatures.size() + authorityRecs->size()); + ret.reserve(ret.size() + 2 + signatures->size() + authorityRecs->size()); ret.push_back(dnsRecord); - for (const auto& signature : signatures) { + for (const auto& signature : *signatures) { DNSRecord sigdr; sigdr.d_type = QType::RRSIG; sigdr.d_name = foundName; @@ -2772,7 +2772,7 @@ namespace struct CacheEntry { vector records; - vector> signatures; + MemRecursorCache::SigRecsVec signatures; time_t d_ttl_time{0}; uint32_t signaturesTTL{std::numeric_limits::max()}; }; @@ -2816,9 +2816,9 @@ static void reapRecordsForValidation(std::map& entries, const } } -static void reapSignaturesForValidation(std::map& entries, const vector>& signatures) +static void reapSignaturesForValidation(std::map& entries, const MemRecursorCache::SigRecs& signatures) { - for (const auto& sig : signatures) { + for (const auto& sig : *signatures) { entries[sig->d_type].signatures.push_back(sig); } } @@ -2998,7 +2998,7 @@ bool SyncRes::doCacheCheck(const DNSName& qname, const DNSName& authname, bool w vector cset; bool found = false; bool expired = false; - vector> signatures; + MemRecursorCache::SigRecs signatures = MemRecursorCache::s_emptySigRecs; MemRecursorCache::AuthRecs authorityRecs = MemRecursorCache::s_emptyAuthRecs; uint32_t ttl = 0; uint32_t capTTL = std::numeric_limits::max(); @@ -3020,12 +3020,12 @@ bool SyncRes::doCacheCheck(const DNSName& qname, const DNSName& authname, bool w if (!wasAuthZone && shouldValidate() && (wasCachedAuth || wasForwardRecurse) && cachedState == vState::Indeterminate && d_requireAuthData) { /* This means we couldn't figure out the state when this entry was cached */ - vState recordState = getValidationStatus(qname, !signatures.empty(), qtype == QType::DS, depth, prefix); + vState recordState = getValidationStatus(qname, !signatures->empty(), qtype == QType::DS, depth, prefix); if (recordState == vState::Secure) { LOG(prefix << sqname << ": Got vState::Indeterminate state from the cache, validating.." << endl); - if (sqt == QType::DNSKEY && sqname == getSigner(signatures)) { - cachedState = validateDNSKeys(sqname, cset, signatures, depth, prefix); + if (sqt == QType::DNSKEY && sqname == getSigner(*signatures)) { + cachedState = validateDNSKeys(sqname, cset, *signatures, depth, prefix); } else { if (sqt == QType::ANY) { @@ -3045,7 +3045,7 @@ bool SyncRes::doCacheCheck(const DNSName& qname, const DNSName& authname, bool w } } else { - cachedState = SyncRes::validateRecordsWithSigs(depth, prefix, qname, qtype, sqname, sqt, cset, signatures); + cachedState = SyncRes::validateRecordsWithSigs(depth, prefix, qname, qtype, sqname, sqt, cset, *signatures); } } } @@ -3087,9 +3087,9 @@ bool SyncRes::doCacheCheck(const DNSName& qname, const DNSName& authname, bool w } } - ret.reserve(ret.size() + signatures.size() + authorityRecs->size()); + ret.reserve(ret.size() + signatures->size() + authorityRecs->size()); - for (const auto& signature : signatures) { + for (const auto& signature : *signatures) { DNSRecord dnsRecord; dnsRecord.d_type = QType::RRSIG; dnsRecord.d_name = sqname; @@ -3606,7 +3606,7 @@ bool SyncRes::validationEnabled() return g_dnssecmode != DNSSECMode::Off && g_dnssecmode != DNSSECMode::ProcessNoValidate; } -uint32_t SyncRes::computeLowestTTD(const std::vector& records, const std::vector>& signatures, uint32_t signaturesTTL, const MemRecursorCache::AuthRecsVec& authorityRecs) const +uint32_t SyncRes::computeLowestTTD(const std::vector& records, const MemRecursorCache::SigRecsVec& signatures, uint32_t signaturesTTL, const MemRecursorCache::AuthRecsVec& authorityRecs) const { uint32_t lowestTTD = std::numeric_limits::max(); for (const auto& record : records) { @@ -3929,7 +3929,7 @@ vState SyncRes::getValidationStatus(const DNSName& name, bool wouldBeValid, bool return result; } -vState SyncRes::validateDNSKeys(const DNSName& zone, const std::vector& dnskeys, const std::vector>& signatures, unsigned int depth, const string& prefix) +vState SyncRes::validateDNSKeys(const DNSName& zone, const std::vector& dnskeys, const MemRecursorCache::SigRecsVec& signatures, unsigned int depth, const string& prefix) { dsset_t dsSet; if (signatures.empty()) { @@ -4040,7 +4040,7 @@ vState SyncRes::getDNSKeys(const DNSName& signer, skeyset_t& keys, bool& servFai return vState::BogusUnableToGetDNSKEYs; } -vState SyncRes::validateRecordsWithSigs(unsigned int depth, const string& prefix, const DNSName& qname, const QType qtype, const DNSName& name, const QType type, const std::vector& records, const std::vector>& signatures) +vState SyncRes::validateRecordsWithSigs(unsigned int depth, const string& prefix, const DNSName& qname, const QType qtype, const DNSName& name, const QType type, const std::vector& records, const MemRecursorCache::SigRecsVec& signatures) { skeyset_t keys; if (signatures.empty()) { diff --git a/pdns/recursordist/syncres.hh b/pdns/recursordist/syncres.hh index 5385332110..6b3366e13d 100644 --- a/pdns/recursordist/syncres.hh +++ b/pdns/recursordist/syncres.hh @@ -678,10 +678,10 @@ private: boost::optional getEDNSSubnetMask(const DNSName& name, const ComboAddress& rem); static bool validationEnabled(); - uint32_t computeLowestTTD(const std::vector& records, const std::vector>& signatures, uint32_t signaturesTTL, const MemRecursorCache::AuthRecsVec& authorityRecs) const; + uint32_t computeLowestTTD(const std::vector& records, const MemRecursorCache::SigRecsVec& signatures, uint32_t signaturesTTL, const MemRecursorCache::AuthRecsVec& authorityRecs) const; void updateValidationState(const DNSName& qname, vState& state, vState stateUpdate, const string& prefix); - vState validateRecordsWithSigs(unsigned int depth, const string& prefix, const DNSName& qname, QType qtype, const DNSName& name, QType type, const std::vector& records, const std::vector>& signatures); - vState validateDNSKeys(const DNSName& zone, const std::vector& dnskeys, const std::vector>& signatures, unsigned int depth, const string& prefix); + vState validateRecordsWithSigs(unsigned int depth, const string& prefix, const DNSName& qname, QType qtype, const DNSName& name, QType type, const std::vector& records, const MemRecursorCache::SigRecsVec& signatures); + vState validateDNSKeys(const DNSName& zone, const std::vector& dnskeys, const MemRecursorCache::SigRecsVec& signatures, unsigned int depth, const string& prefix); vState getDNSKeys(const DNSName& signer, skeyset_t& keys, bool& servFailOccurred, unsigned int depth, const string& prefix); dState getDenialValidationState(const NegCache::NegCacheEntry& negEntry, dState expectedState, bool referralToUnsigned, const string& prefix); void updateDenialValidationState(const DNSName& qname, vState& neValidationState, const DNSName& neName, vState& state, dState denialState, dState expectedState, bool isDS, unsigned int depth, const string& prefix); diff --git a/pdns/recursordist/test-recursorcache_cc.cc b/pdns/recursordist/test-recursorcache_cc.cc index a46880522d..b0c98e1432 100644 --- a/pdns/recursordist/test-recursorcache_cc.cc +++ b/pdns/recursordist/test-recursorcache_cc.cc @@ -1342,7 +1342,7 @@ BOOST_AUTO_TEST_CASE(test_RecursorCacheDumpAndRestore) for (size_t counter = 0; counter < expected + 10; counter++) { std::vector retrieved; MemRecursorCache::AuthRecs authRecs; - std::vector> sigs; + MemRecursorCache::SigRecs sigs; bool variable = false; vState state = vState::Indeterminate; bool wasAuth = false; @@ -1352,8 +1352,8 @@ BOOST_AUTO_TEST_CASE(test_RecursorCacheDumpAndRestore) matches++; BOOST_CHECK_EQUAL(retrieved.size(), rset0.size()); BOOST_CHECK_EQUAL(getRR(retrieved.at(0))->getCA().toString(), dr0Content.toString()); - BOOST_CHECK_EQUAL(sigs.size(), 1U); - BOOST_CHECK_EQUAL(sigs.at(0)->getZoneRepresentation(), signatures.at(0)->getZoneRepresentation()); + BOOST_CHECK_EQUAL(sigs->size(), 1U); + BOOST_CHECK_EQUAL(sigs->at(0)->getZoneRepresentation(), signatures.at(0)->getZoneRepresentation()); BOOST_CHECK_EQUAL(authRecs->size(), 1U); BOOST_CHECK_EQUAL(authRecs->at(0).toString(), authRecords.at(0).toString()); diff --git a/pdns/recursordist/test-syncres_cc3.cc b/pdns/recursordist/test-syncres_cc3.cc index c78997e360..2599b0fd25 100644 --- a/pdns/recursordist/test-syncres_cc3.cc +++ b/pdns/recursordist/test-syncres_cc3.cc @@ -426,7 +426,7 @@ BOOST_AUTO_TEST_CASE(test_answer_no_aa) /* check that the record in the answer section has not been cached */ const ComboAddress who; vector cached; - vector> signatures; + MemRecursorCache::SigRecs signatures; BOOST_REQUIRE_GT(g_recCache->get(now, target, QType(QType::A), MemRecursorCache::None, &cached, who, boost::none, &signatures), 0); } diff --git a/pdns/recursordist/test-syncres_cc8.cc b/pdns/recursordist/test-syncres_cc8.cc index d167fa4342..ff08b91951 100644 --- a/pdns/recursordist/test-syncres_cc8.cc +++ b/pdns/recursordist/test-syncres_cc8.cc @@ -1367,10 +1367,10 @@ BOOST_AUTO_TEST_CASE(test_dnssec_rrsig_cache_validity) /* check that the entry has not been cached for longer than the RRSIG validity */ const ComboAddress who; vector cached; - vector> signatures; + MemRecursorCache::SigRecs signatures; BOOST_REQUIRE_EQUAL(g_recCache->get(tnow, target, QType(QType::A), MemRecursorCache::RequireAuth, &cached, who, boost::none, &signatures), 1); BOOST_REQUIRE_EQUAL(cached.size(), 1U); - BOOST_REQUIRE_EQUAL(signatures.size(), 1U); + BOOST_REQUIRE_EQUAL(signatures->size(), 1U); BOOST_CHECK_EQUAL((cached[0].d_ttl - tnow), 1); /* again, to test the cache */