handle nonexistent managed-keys-directory

3378.	[bug]		Handle missing 'managed-keys-directory' better.
			[RT #30625]

diff --git a/CHANGES b/CHANGES
index 05156a6df726d16034f15c98a33dcbf371a844d6..bc9e223f0ce3e147d3a16c69266c4d89fb25d3bd 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3378.  [bug]           Handle missing 'managed-keys-directory' better.
+                       [RT #30625]
+
 3377.  [bug]           Removed spurious newline from NSEC3 multiline
                        output. [RT #31044]
 

diff --git a/bin/named/server.c b/bin/named/server.c
index 652245274862f6f4486d88fdf4334809983b6aac..27e676489e0f5dca876d7300f22b88e0b3bf8374 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -808,7 +808,17 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
         */
        obj = NULL;
        (void)ns_config_get(maps, "managed-keys-directory", &obj);
-       directory = obj != NULL ? cfg_obj_asstring(obj) : NULL;
+       directory = (obj != NULL ? cfg_obj_asstring(obj) : NULL);
+       if (directory != NULL)
+               result = isc_file_isdirectory(directory);
+       if (result != ISC_R_SUCCESS) {
+               isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+                             NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+                             "invalid managed-keys-directory %s: %s",
+                             directory, isc_result_totext(result));
+               goto cleanup;
+
+       }
        CHECK(add_keydata_zone(view, directory, ns_g_mctx));
 
   cleanup:

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 58110a6dac8131a8f400c9069b1823b693c48eda..ca622cf5474e6af108eeb64289dfbf120d3a6a4e 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3599,6 +3599,13 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
        }
 
  failure:
+       if (result != ISC_R_SUCCESS &&
+           !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
+               dns_zone_log(zone, ISC_LOG_ERROR,
+                            "unable to synchronize managed keys: %s",
+                            dns_result_totext(result));
+               isc_time_settoepoch(&zone->refreshkeytime);
+       }
        if (keynode != NULL)
                dns_keytable_detachkeynode(sr, &keynode);
        if (sr != NULL)
@@ -8597,10 +8604,12 @@ zone_maintenance(dns_zone_t *zone) {
         */
        switch (zone->type) {
        case dns_zone_key:
-               if (isc_time_compare(&now, &zone->refreshkeytime) >= 0 &&
-                   DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
-                   !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING))
-                       zone_refreshkeys(zone);
+               if (isc_time_compare(&now, &zone->refreshkeytime) >= 0) {
+                       if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
+                           !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING)) {
+                               zone_refreshkeys(zone);
+                       }
+               }
                break;
        case dns_zone_master:
                if (!isc_time_isepoch(&zone->refreshkeytime) &&

diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 03bdb23cad3bef97b886e207ec1ebedbb598b295..923ae87f2423759814e9bfad77bd29021de6a2e3 100644 (file)
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -220,6 +220,22 @@ isc_file_isplainfilefd(int fd);
  *             These occur when stat returns -1 and an errno.
  */
 
+isc_result_t
+isc_file_isdirectory(const char *name);
+/*!<
+ * \brief Check that 'name' exists and is a directory.
+ *
+ * Returns:
+ *\li  #ISC_R_SUCCESS
+ *             Success, file is a directory.
+ *\li  #ISC_R_INVALIDFILE
+ *             File is not a directory.
+ *\li  #ISC_R_FILENOTFOUND
+ *             File does not exist.
+ *\li  #other ISC_R_* errors translated from errno
+ *             These occur when stat returns -1 and an errno.
+ */
+
 isc_boolean_t
 isc_file_iscurrentdir(const char *filename);
 /*!<

diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index 8c2b86972b7b9b1176640b0e8cfa8328f8251a4e..9688dc28e48be083ce6d1b8cb086c9385b6849af 100644 (file)
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -460,6 +460,25 @@ isc_file_isplainfilefd(int fd) {
        return(ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_file_isdirectory(const char *filename) {
+       /*
+        * This function returns success if filename exists and is a
+        * directory.
+        */
+       struct stat filestat;
+       memset(&filestat,0,sizeof(struct stat));
+
+       if ((stat(filename, &filestat)) == -1)
+               return(isc__errno2result(errno));
+
+       if(! S_ISDIR(filestat.st_mode))
+               return(ISC_R_INVALIDFILE);
+
+       return(ISC_R_SUCCESS);
+}
+
+
 isc_boolean_t
 isc_file_isabsolute(const char *filename) {
        REQUIRE(filename != NULL);

diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index 65a900d0699a77283564fc0403910170ad308d7f..bcbb2bb9fa2ffe573599b2c3237f2ba5c68823cd 100644 (file)
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -496,6 +496,24 @@ isc_file_isplainfilefd(int fd) {
        return(ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_file_isdirectory(const char *filename) {
+       /*
+        * This function returns success if filename is a directory.
+        */
+       struct stat filestat;
+       memset(&filestat,0,sizeof(struct stat));
+
+       if ((stat(filename, &filestat)) == -1)
+               return(isc__errno2result(errno));
+
+       if(! S_ISDIR(filestat.st_mode))
+               return(ISC_R_INVALIDFILE);
+
+       return(ISC_R_SUCCESS);
+}
+
+
 isc_boolean_t
 isc_file_isabsolute(const char *filename) {
        REQUIRE(filename != NULL);

diff --git a/lib/isc/win32/libisc.def b/lib/isc/win32/libisc.def
index a6ac6186d1a32f29add64015f25532d9e0691c7c..d1dedfa261caf5bd73913f4385b72b121eb714ab 100644 (file)
--- a/lib/isc/win32/libisc.def
+++ b/lib/isc/win32/libisc.def
@@ -230,6 +230,7 @@ isc_file_getsizefd
 isc_file_isabsolute
 isc_file_ischdiridempotent
 isc_file_iscurrentdir
+isc_file_isdirectory
 isc_file_isplainfile
 isc_file_isplainfilefd
 isc_file_mktemplate