From: Michał Kępień Date: Tue, 13 Mar 2018 13:06:09 +0000 (+0100) Subject: Move update_sigs() to lib/dns/zone_p.h X-Git-Tag: v9.10.8rc1~27^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae03a5c1fa5d7d6cce93273cd41171595882c7d4;p=thirdparty%2Fbind9.git Move update_sigs() to lib/dns/zone_p.h Rename update_sigs() to dns__zone_updatesigs() and move it to lib/dns/zone_p.h, so that it can be unit tested. Add a comment describing the purpose of this function. (cherry picked from commit b1947cee8210844b917320453cb308fbe168d320) (cherry picked from commit 4d06f50ba84edca141c28f9decd6640465c5f9ed) (cherry picked from commit 5c71a025c6ec1cbaab04ada54101200a48a98bd1) --- diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in index e2dc74d58b2..c6b8ff4eb38 100644 --- a/lib/dns/win32/libdns.def.in +++ b/lib/dns/win32/libdns.def.in @@ -7,6 +7,7 @@ dns__rbt_getheight dns__rbt_checkproperties dns__rbtnode_getdistance dns__zone_loadpending +dns__zone_updatesigs dns_acache_attach dns_acache_attachentry dns_acache_cancelentry diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 3a9bb797b12..e9e473dcbea 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -7205,12 +7205,18 @@ need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver, return (result); } -static isc_result_t -update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, - dst_key_t *zone_keys[], unsigned int nkeys, dns_zone_t *zone, - isc_stdtime_t inception, isc_stdtime_t expire, isc_stdtime_t now, - isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, - dns__zonediff_t *zonediff) +/*% + * Add/remove DNSSEC signatures for the list of "raw" zone changes supplied in + * 'diff'. Gradually remove tuples from 'diff' and append them to 'zonediff' + * along with tuples representing relevant signature changes. + */ +isc_result_t +dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, + dst_key_t *zone_keys[], unsigned int nkeys, + dns_zone_t *zone, isc_stdtime_t inception, + isc_stdtime_t expire, isc_stdtime_t now, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, + dns__zonediff_t *zonediff) { dns_difftuple_t *tuple; isc_result_t result; @@ -7223,7 +7229,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, zone_keys, nkeys, now, ISC_FALSE); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "update_sigs:del_sigs -> %s", + "dns__zone_updatesigs:del_sigs -> %s", dns_result_totext(result)); return (result); } @@ -7233,7 +7239,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, expire, check_ksk, keyset_kskonly); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "update_sigs:add_sigs -> %s", + "dns__zone_updatesigs:add_sigs -> %s", dns_result_totext(result)); return (result); } @@ -7399,7 +7405,7 @@ zone_nsec3chain(dns_zone_t *zone) { * * Note that the "signatures" variable is only used here to limit the * amount of work performed. Actual DNSSEC signatures are only - * generated by update_sigs() calls later in this function. + * generated by dns__zone_updatesigs() calls later in this function. */ while (nsec3chain != NULL && nodes-- > 0 && signatures > 0) { LOCK_ZONE(zone); @@ -7885,12 +7891,13 @@ zone_nsec3chain(dns_zone_t *zone) { */ if (nsec3chain != NULL) dns_dbiterator_pause(nsec3chain->dbiterator); - result = update_sigs(&nsec3_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&nsec3_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -7898,12 +7905,13 @@ zone_nsec3chain(dns_zone_t *zone) { * We have changed the NSEC3PARAM or private RRsets * above so we need to update the signatures. */ - result = update_sigs(¶m_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(¶m_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -7918,12 +7926,13 @@ zone_nsec3chain(dns_zone_t *zone) { } } - result = update_sigs(&nsec_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&nsec_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -8503,12 +8512,14 @@ zone_sign(dns_zone_t *zone) { } if (ISC_LIST_HEAD(post_diff.tuples) != NULL) { - result = update_sigs(&post_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&post_diff, db, version, + zone_keys, nkeys, zone, + inception, expire, now, + check_ksk, keyset_kskonly, + &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:" - "update_sigs -> %s", + "dns__zone_updatesigs -> %s", dns_result_totext(result)); goto failure; } @@ -17314,9 +17325,8 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY); /* - * See if update_sigs will update DNSKEY signature and if not - * cause them to sign so that so that newly activated keys - * are used. + * See if dns__zone_updatesigs() will update DNSKEY signature and if + * not cause them to sign so that newly activated keys are used. */ for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; @@ -17348,13 +17358,12 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, } } - result = update_sigs(diff, db, ver, zone_keys, nkeys, zone, - inception, soaexpire, now, check_ksk, - keyset_kskonly, zonediff); - + result = dns__zone_updatesigs(diff, db, ver, zone_keys, nkeys, zone, + inception, soaexpire, now, check_ksk, + keyset_kskonly, zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "sign_apex:update_sigs -> %s", + "sign_apex:dns__zone_updatesigs -> %s", dns_result_totext(result)); goto failure; } diff --git a/lib/dns/zone_p.h b/lib/dns/zone_p.h index 3ef05e023ce..b9b0c79c6aa 100644 --- a/lib/dns/zone_p.h +++ b/lib/dns/zone_p.h @@ -26,6 +26,14 @@ typedef struct { isc_boolean_t offline; } dns__zonediff_t; +isc_result_t +dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, + dst_key_t *zone_keys[], unsigned int nkeys, + dns_zone_t *zone, isc_stdtime_t inception, + isc_stdtime_t expire, isc_stdtime_t now, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, + dns__zonediff_t *zonediff); + ISC_LANG_ENDDECLS #endif /* DNS_ZONE_P_H */