From: Michał Kępień <michal@isc.org>
Date: Fri, 15 Jun 2018 07:59:20 +0000 (+0200)
Subject: Do not call exit() upon dns_zoneverify_dnssec() errors
X-Git-Tag: v9.13.2~31^2~7
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ac14cb75342e20a265e717530a1781855aa9c69;p=thirdparty%2Fbind9.git

Do not call exit() upon dns_zoneverify_dnssec() errors

Replace the remaining fatal() calls inside dns_zoneverify_dnssec() with
zoneverify_log_error() and zoneverify_print() calls, ensuring proper
cleanup.
---

diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index b83157a6f34..b6eb433f9e2 100644
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -1837,12 +1837,18 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		goto done;
 	}
 
-	if (ignore_kskflag ) {
-		if (!vctx.goodksk && !vctx.goodzsk)
-			fatal("No self-signed DNSKEY found.");
-	} else if (!vctx.goodksk)
-		fatal("No self-signed KSK DNSKEY found.  Supply an active\n"
-		      "key with the KSK flag set, or use '-P'.");
+	if (ignore_kskflag) {
+		if (!vctx.goodksk && !vctx.goodzsk) {
+			zoneverify_log_error(&vctx,
+					     "No self-signed DNSKEY found");
+			result = ISC_R_FAILURE;
+			goto done;
+		}
+	} else if (!vctx.goodksk) {
+		zoneverify_log_error(&vctx, "No self-signed KSK DNSKEY found");
+		result = ISC_R_FAILURE;
+		goto done;
+	}
 
 	determine_active_algorithms(&vctx, ignore_kskflag, keyset_kskonly);
 
@@ -1863,9 +1869,13 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		goto done;
 	}
 
-	if (vresult != ISC_R_SUCCESS)
-		fatal("DNSSEC completeness test failed (%s).",
-		      dns_result_totext(vresult));
+	result = vresult;
+	if (result != ISC_R_SUCCESS) {
+		zoneverify_print(&vctx,
+				 "DNSSEC completeness test failed (%s).\n",
+				 dns_result_totext(result));
+		goto done;
+	}
 
 	if (vctx.goodksk || ignore_kskflag) {
 		print_summary(&vctx, keyset_kskonly);