From: Michał Kępień Date: Tue, 13 Mar 2018 13:06:09 +0000 (+0100) Subject: Move update_sigs() to lib/dns/zone_p.h X-Git-Tag: v9.9.13rc1~28^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b767528e1373b78cb4bbfd9dcd82a6b13b909f42;p=thirdparty%2Fbind9.git Move update_sigs() to lib/dns/zone_p.h Rename update_sigs() to dns__zone_updatesigs() and move it to lib/dns/zone_p.h, so that it can be unit tested. Add a comment describing the purpose of this function. (cherry picked from commit b1947cee8210844b917320453cb308fbe168d320) (cherry picked from commit 4d06f50ba84edca141c28f9decd6640465c5f9ed) (cherry picked from commit 5c71a025c6ec1cbaab04ada54101200a48a98bd1) (cherry picked from commit ae03a5c1fa5d7d6cce93273cd41171595882c7d4) --- diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in index 7cd05d61f9f..eed2594ae31 100644 --- a/lib/dns/win32/libdns.def.in +++ b/lib/dns/win32/libdns.def.in @@ -4,6 +4,7 @@ LIBRARY libdns EXPORTS dns__zone_loadpending +dns__zone_updatesigs dns_acache_attach dns_acache_attachentry dns_acache_cancelentry diff --git a/lib/dns/zone.c b/lib/dns/zone.c index b170b3f518a..b069944608d 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -6765,12 +6765,18 @@ need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver, return (result); } -static isc_result_t -update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, - dst_key_t *zone_keys[], unsigned int nkeys, dns_zone_t *zone, - isc_stdtime_t inception, isc_stdtime_t expire, isc_stdtime_t now, - isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, - dns__zonediff_t *zonediff) +/*% + * Add/remove DNSSEC signatures for the list of "raw" zone changes supplied in + * 'diff'. Gradually remove tuples from 'diff' and append them to 'zonediff' + * along with tuples representing relevant signature changes. + */ +isc_result_t +dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, + dst_key_t *zone_keys[], unsigned int nkeys, + dns_zone_t *zone, isc_stdtime_t inception, + isc_stdtime_t expire, isc_stdtime_t now, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, + dns__zonediff_t *zonediff) { dns_difftuple_t *tuple; isc_result_t result; @@ -6783,7 +6789,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, zone_keys, nkeys, now, ISC_FALSE); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "update_sigs:del_sigs -> %s", + "dns__zone_updatesigs:del_sigs -> %s", dns_result_totext(result)); return (result); } @@ -6793,7 +6799,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, expire, check_ksk, keyset_kskonly); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "update_sigs:add_sigs -> %s", + "dns__zone_updatesigs:add_sigs -> %s", dns_result_totext(result)); return (result); } @@ -6959,7 +6965,7 @@ zone_nsec3chain(dns_zone_t *zone) { * * Note that the "signatures" variable is only used here to limit the * amount of work performed. Actual DNSSEC signatures are only - * generated by update_sigs() calls later in this function. + * generated by dns__zone_updatesigs() calls later in this function. */ while (nsec3chain != NULL && nodes-- > 0 && signatures > 0) { LOCK_ZONE(zone); @@ -7445,12 +7451,13 @@ zone_nsec3chain(dns_zone_t *zone) { */ if (nsec3chain != NULL) dns_dbiterator_pause(nsec3chain->dbiterator); - result = update_sigs(&nsec3_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&nsec3_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -7458,12 +7465,13 @@ zone_nsec3chain(dns_zone_t *zone) { * We have changed the NSEC3PARAM or private RRsets * above so we need to update the signatures. */ - result = update_sigs(¶m_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(¶m_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -7478,12 +7486,13 @@ zone_nsec3chain(dns_zone_t *zone) { } } - result = update_sigs(&nsec_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&nsec_diff, db, version, zone_keys, + nkeys, zone, inception, expire, now, + check_ksk, keyset_kskonly, &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:" - "update_sigs -> %s", dns_result_totext(result)); + "dns__zone_updatesigs -> %s", + dns_result_totext(result)); goto failure; } @@ -8063,12 +8072,14 @@ zone_sign(dns_zone_t *zone) { } if (ISC_LIST_HEAD(post_diff.tuples) != NULL) { - result = update_sigs(&post_diff, db, version, zone_keys, - nkeys, zone, inception, expire, now, - check_ksk, keyset_kskonly, &zonediff); + result = dns__zone_updatesigs(&post_diff, db, version, + zone_keys, nkeys, zone, + inception, expire, now, + check_ksk, keyset_kskonly, + &zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:" - "update_sigs -> %s", + "dns__zone_updatesigs -> %s", dns_result_totext(result)); goto failure; } @@ -16796,9 +16807,8 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY); /* - * See if update_sigs will update DNSKEY signature and if not - * cause them to sign so that so that newly activated keys - * are used. + * See if dns__zone_updatesigs() will update DNSKEY signature and if + * not cause them to sign so that newly activated keys are used. */ for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; @@ -16830,13 +16840,12 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, } } - result = update_sigs(diff, db, ver, zone_keys, nkeys, zone, - inception, soaexpire, now, check_ksk, - keyset_kskonly, zonediff); - + result = dns__zone_updatesigs(diff, db, ver, zone_keys, nkeys, zone, + inception, soaexpire, now, check_ksk, + keyset_kskonly, zonediff); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, - "sign_apex:update_sigs -> %s", + "sign_apex:dns__zone_updatesigs -> %s", dns_result_totext(result)); goto failure; } diff --git a/lib/dns/zone_p.h b/lib/dns/zone_p.h index 3ef05e023ce..b9b0c79c6aa 100644 --- a/lib/dns/zone_p.h +++ b/lib/dns/zone_p.h @@ -26,6 +26,14 @@ typedef struct { isc_boolean_t offline; } dns__zonediff_t; +isc_result_t +dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, + dst_key_t *zone_keys[], unsigned int nkeys, + dns_zone_t *zone, isc_stdtime_t inception, + isc_stdtime_t expire, isc_stdtime_t now, + isc_boolean_t check_ksk, isc_boolean_t keyset_kskonly, + dns__zonediff_t *zonediff); + ISC_LANG_ENDDECLS #endif /* DNS_ZONE_P_H */