4821. [bug] When resigning ensure that the SOA's expire time is

                        always later that the resigning time of other records.
                        [RT #46473]

4820.   [bug]           dns_db_subtractrdataset should transfer the resigning
                        information to the new header. [RT #46473]

4819.   [bug]           Fully backout the transaction when adding a RRset
                        to the resigning / removal heaps fail. [RT #46473]

(cherry picked from commit 656eed7c9bd1ee735777f4d2a11294b68e6e9e17)

diff --git a/CHANGES b/CHANGES
index de82e1271af3bbd5d93244c59b53ff0fae4ea1f3..804ba4880846f40ff41e97d27b37d762df566592 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,13 @@
+4821.  [bug]           When resigning ensure that the SOA's expire time is
+                       always later that the resigning time of other records.
+                       [RT #46473]
+
+4820.  [bug]           dns_db_subtractrdataset should transfer the resigning
+                       information to the new header. [RT #46473]
+
+4819.  [bug]           Fully backout the transaction when adding a RRset
+                       to the resigning / removal heaps fail. [RT #46473]
+
 4818.  [test]          The logfileconfig system test could intermittently
                        report false negatives on some platforms. [RT #46615]
 

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 3159fc4a492e29c89f0599b008fc28b9b4d95a92..0b8b60d08d11d67d651addec51f911f00d2fa8fd 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6444,27 +6444,8 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                                        return (result);
                        }
                } else {
-                       newheader->down = topheader;
-                       topheader->next = newheader;
-                       rbtnode->dirty = 1;
-                       if (changed != NULL)
-                               changed->dirty = ISC_TRUE;
-                       if (rbtversion == NULL) {
-                               set_ttl(rbtdb, header, 0);
-                               mark_stale_header(rbtdb, header);
-                               if (sigheader != NULL) {
-                                       set_ttl(rbtdb, sigheader, 0);
-                                       mark_stale_header(rbtdb, sigheader);
-                               }
-                       }
                        idx = newheader->node->locknum;
                        if (IS_CACHE(rbtdb)) {
-                               if (ZEROTTL(newheader))
-                                       ISC_LIST_APPEND(rbtdb->rdatasets[idx],
-                                                       newheader, link);
-                               else
-                                       ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
-                                                        newheader, link);
                                /*
                                 * XXXMLG We don't check the return value
                                 * here.  If it fails, we will not do TTL
@@ -6473,13 +6454,42 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                                 * will not leak... for long.
                                 */
                                INSIST(rbtdb->heaps != NULL);
-                               (void)isc_heap_insert(rbtdb->heaps[idx],
+                               result = isc_heap_insert(rbtdb->heaps[idx],
+                                                        newheader);
+                               if (result != ISC_R_SUCCESS) {
+                                       free_rdataset(rbtdb,
+                                                     rbtdb->common.mctx,
                                                      newheader);
+                                       return (result);
+                               }
+                               if (ZEROTTL(newheader))
+                                       ISC_LIST_APPEND(rbtdb->rdatasets[idx],
+                                                       newheader, link);
+                               else
+                                       ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
+                                                        newheader, link);
                        } else if (RESIGN(newheader)) {
-                               resign_delete(rbtdb, rbtversion, header);
                                result = resign_insert(rbtdb, idx, newheader);
-                               if (result != ISC_R_SUCCESS)
+                               if (result != ISC_R_SUCCESS) {
+                                       free_rdataset(rbtdb,
+                                                     rbtdb->common.mctx,
+                                                     newheader);
                                        return (result);
+                               }
+                               resign_delete(rbtdb, rbtversion, header);
+                       }
+                       newheader->down = topheader;
+                       topheader->next = newheader;
+                       rbtnode->dirty = 1;
+                       if (changed != NULL)
+                               changed->dirty = ISC_TRUE;
+                       if (rbtversion == NULL) {
+                               set_ttl(rbtdb, header, 0);
+                               mark_stale_header(rbtdb, header);
+                               if (sigheader != NULL) {
+                                       set_ttl(rbtdb, sigheader, 0);
+                                       mark_stale_header(rbtdb, sigheader);
+                               }
                        }
                }
        } else {
@@ -6496,6 +6506,30 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                        return (DNS_R_UNCHANGED);
                }
 
+               idx = newheader->node->locknum;
+               if (IS_CACHE(rbtdb)) {
+                       result = isc_heap_insert(rbtdb->heaps[idx], newheader);
+                       if (result != ISC_R_SUCCESS) {
+                               free_rdataset(rbtdb, rbtdb->common.mctx,
+                                             newheader);
+                               return (result);
+                       }
+                       if (ZEROTTL(newheader))
+                               ISC_LIST_APPEND(rbtdb->rdatasets[idx],
+                                               newheader, link);
+                       else
+                               ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
+                                                newheader, link);
+               } else if (RESIGN(newheader)) {
+                       result = resign_insert(rbtdb, idx, newheader);
+                       if (result != ISC_R_SUCCESS) {
+                               free_rdataset(rbtdb, rbtdb->common.mctx,
+                                             newheader);
+                               return (result);
+                       }
+                       resign_delete(rbtdb, rbtversion, header);
+               }
+
                if (topheader != NULL) {
                        /*
                         * We have an list of rdatasets of the given type,
@@ -6536,21 +6570,6 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                                                   sizeof(*newheader));
                        RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
                }
-               idx = newheader->node->locknum;
-               if (IS_CACHE(rbtdb)) {
-                       if (ZEROTTL(newheader))
-                               ISC_LIST_APPEND(rbtdb->rdatasets[idx],
-                                               newheader, link);
-                       else
-                               ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
-                                                newheader, link);
-                       isc_heap_insert(rbtdb->heaps[idx], newheader);
-               } else if (RESIGN(newheader)) {
-                       resign_delete(rbtdb, rbtversion, header);
-                       result = resign_insert(rbtdb, idx, newheader);
-                       if (result != ISC_R_SUCCESS)
-                               return (result);
-               }
        }
 
        /*
@@ -6999,6 +7018,19 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
                        newheader = (rdatasetheader_t *)subresult;
                        init_rdataset(rbtdb, newheader);
                        update_newheader(newheader, header);
+                       if (RESIGN(header)) {
+                               newheader->attributes |= RDATASET_ATTR_RESIGN;
+                               newheader->resign = header->resign;
+                               newheader->resign_lsb = header->resign_lsb;
+                               result = resign_insert(rbtdb, rbtnode->locknum,
+                                                      newheader);
+                               if (result != ISC_R_SUCCESS) {
+                                       free_rdataset(rbtdb,
+                                                     rbtdb->common.mctx,
+                                                     newheader);
+                                       goto unlock;
+                               }
+                       }
                        /*
                         * We have to set the serial since the rdataslab
                         * subtraction routine copies the reserved portion of
@@ -8080,9 +8112,8 @@ getsize(dns_db_t *db, dns_dbversion_t *version, isc_uint64_t *records,
 static isc_result_t
 setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
        dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-       isc_stdtime_t oldresign;
        isc_result_t result = ISC_R_SUCCESS;
-       rdatasetheader_t *header;
+       rdatasetheader_t *header, oldheader;
 
        REQUIRE(VALID_RBTDB(rbtdb));
        REQUIRE(!IS_CACHE(rbtdb));
@@ -8094,7 +8125,7 @@ setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
        NODE_LOCK(&rbtdb->node_locks[header->node->locknum].lock,
                  isc_rwlocktype_write);
 
-       oldresign = (header->resign << 1) | header->resign_lsb;
+       oldheader = *header;
        header->resign = (isc_stdtime_t)(dns_time64_from32(resign) >> 1);
        header->resign_lsb = resign & 0x1;
        if (header->heap_index != 0) {
@@ -8103,13 +8134,13 @@ setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
                        isc_heap_delete(rbtdb->heaps[header->node->locknum],
                                        header->heap_index);
                        header->heap_index = 0;
-               } else if (resign < oldresign)
+               } else if (resign_sooner(header, &oldheader))
                        isc_heap_increased(rbtdb->heaps[header->node->locknum],
                                           header->heap_index);
-               else if (resign > oldresign)
+               else if (resign_sooner(&oldheader, header))
                        isc_heap_decreased(rbtdb->heaps[header->node->locknum],
                                           header->heap_index);
-       } else if (resign && header->heap_index == 0) {
+       } else if (resign != 0 && header->heap_index == 0) {
                header->attributes |= RDATASET_ATTR_RESIGN;
                result = resign_insert(rbtdb, header->node->locknum, header);
        }

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fe548eae9f282456beb0c8054c3fc428994cc67f..dc948a28ee3712b8fccec5a9c9315b14857bfa6f 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6494,7 +6494,7 @@ zone_resigninc(dns_zone_t *zone) {
         * we still want some clustering to occur.
         */
        isc_random_get(&jitter);
-       expire = soaexpire - jitter % 3600;
+       expire = soaexpire - jitter % 3600 - 1;
        stop = now + 5;
 
        check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);