[master] improve debugging output from dnssec-cds

4883.	[cleanup]	Improved debugging output from dnssec-cds. [RT #47026]

Patch submitted by Tony Finch (dot@dotat.at)

diff --git a/CHANGES b/CHANGES
index 7132d34c5810d47c18de2bf4005248c6ef271911..a00f7e4f1ee5009f525efaa9a887b62c7b7f2eb2 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4883.  [cleanup]       Improved debugging output from dnssec-cds. [RT #47026]
+
 4882.  [bug]           Address potential memory leak in
                        dns_update_signaturesinc. [RT #47084]
 

diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index 56237823c17819c0eb8b9c0d283c5c389fd303ad..fdb20d09f84e5cd7b0ea00afb3ff142916b14d6c 100644 (file)
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -85,7 +85,7 @@ static dns_rdataclass_t rdclass = dns_rdataclass_in;
  */
 static isc_uint8_t dtype[8];
 
-static const char *startstr  = NULL;   /* from which we derive notbefore */
+static const char *startstr  = NULL;   /* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;    /* restrict sig inception times */
 static dns_rdata_rrsig_t oldestsig;    /* for recording inception time */
 
@@ -521,6 +521,13 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
                }
        }
 
+       vbprintf(1, "no matching %s for %s %d %d\n",
+                dsset->type == dns_rdatatype_cds
+                ? "CDS" : "DS",
+                ki->rdata.type == dns_rdatatype_cdnskey
+                ? "CDNSKEY" : "DNSKEY",
+                ki->tag, ki->algo);
+
        return (ISC_FALSE);
 }
 
@@ -647,17 +654,25 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 
                for (i = 0; i < nkey; i++) {
                        keyinfo_t *ki = &keytbl[i];
-                       if (ki->dst == NULL ||
-                           sig.keyid != ki->tag ||
+                       if (sig.keyid != ki->tag ||
                            sig.algorithm != ki->algo ||
                            !dns_name_equal(&sig.signer, name))
                        {
                                continue;
                        }
+                       if (ki->dst == NULL) {
+                               vbprintf(1, "skip RRSIG by key %d:"
+                                        " no matching (C)DS\n",
+                                        sig.keyid);
+                               continue;
+                       }
 
                        result = dns_dnssec_verify(name, rdataset, ki->dst,
                                                   ISC_FALSE, mctx, &sigrdata);
                        if (result != ISC_R_SUCCESS) {
+                               vbprintf(1, "skip RRSIG by key %d:"
+                                        " verification failed: %s\n",
+                                        sig.keyid, isc_result_totext(result));
                                continue;
                        }