+1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY.
+
1515. [func] Allow transfer source to be set in a server statement.
[RT #6496]
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-makekeyset.c,v 1.59 2002/12/03 05:01:34 marka Exp $ */
+/* $Id: dnssec-makekeyset.c,v 1.60 2003/09/30 05:55:59 marka Exp $ */
#include <config.h>
fatal("failed to convert key %s to a DNS KEY: %s",
argv[i], isc_result_totext(result));
isc_buffer_usedregion(&b, &r);
- dns_rdata_fromregion(&rdata, rdclass, dns_rdatatype_key, &r);
+ dns_rdata_fromregion(&rdata, rdclass, dns_rdatatype_dnskey, &r);
tuple = NULL;
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
domain, ttl, &rdata, &tuple);
dns_fixedname_init(&tname);
dns_rdataset_init(&rdataset);
- result = dns_db_find(db, domain, version, dns_rdatatype_key, 0, 0,
+ result = dns_db_find(db, domain, version, dns_rdatatype_dnskey, 0, 0,
NULL, dns_fixedname_name(&tname), &rdataset,
NULL);
check_result(result, "dns_db_find");
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-signkey.c,v 1.59 2003/07/25 00:01:04 marka Exp $ */
+/* $Id: dnssec-signkey.c,v 1.60 2003/09/30 05:55:59 marka Exp $ */
#include <config.h>
}
static dst_key_t *
-findkey(dns_rdata_sig_t *sig) {
+findkey(dns_rdata_rrsig_t *sig) {
keynode_t *keynode;
for (keynode = ISC_LIST_HEAD(keylist);
keynode != NULL;
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdata_t sigrdata = DNS_RDATA_INIT;
dns_rdataset_t rdataset, sigrdataset;
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
isc_result_t result;
isc_buffer_t b;
isc_log_t *log = NULL;
dns_rdataset_init(&rdataset);
dns_rdataset_init(&sigrdataset);
- result = dns_db_findrdataset(db, node, version, dns_rdatatype_key, 0,
+ result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey, 0,
0, &rdataset, &sigrdataset);
if (result != ISC_R_SUCCESS) {
char domainstr[DNS_NAME_FORMATSIZE];
dst_key_free(&key);
}
- result = dns_db_deleterdataset(db, node, version, dns_rdatatype_sig,
- dns_rdatatype_key);
+ result = dns_db_deleterdataset(db, node, version, dns_rdatatype_rrsig,
+ dns_rdatatype_dnskey);
check_result(result, "dns_db_deleterdataset");
result = dns_diff_apply(&diff, db, version);
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-signzone.c,v 1.168 2003/04/17 03:45:49 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.169 2003/09/30 05:56:00 marka Exp $ */
#include <config.h>
#include <dns/log.h>
#include <dns/master.h>
#include <dns/masterdump.h>
-#include <dns/nxt.h>
+#include <dns/nsec.h>
#include <dns/rdata.h>
#include <dns/rdataset.h>
#include <dns/rdataclass.h>
* that we've loaded already, and then see if there's a key on disk.
*/
static signer_key_t *
-keythatsigned(dns_rdata_sig_t *sig) {
+keythatsigned(dns_rdata_rrsig_t *sig) {
isc_result_t result;
dst_key_t *pubkey = NULL, *privkey = NULL;
signer_key_t *key;
char namestr[DNS_NAME_FORMATSIZE];
dns_fixedname_init(&fname);
- result = dns_db_find(gdb, name, gversion, dns_rdatatype_key, options,
+ result = dns_db_find(gdb, name, gversion, dns_rdatatype_dnskey, options,
0, NULL, dns_fixedname_name(&fname), NULL, NULL);
switch (result) {
case ISC_R_SUCCESS:
{
dns_rdataset_t sigset;
dns_rdata_t sigrdata = DNS_RDATA_INIT;
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
signer_key_t *key;
isc_result_t result;
isc_boolean_t nosigs = ISC_FALSE;
ttl = ISC_MIN(set->ttl, endtime - starttime);
dns_rdataset_init(&sigset);
- result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_sig,
+ result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_rrsig,
set->type, 0, &sigset, NULL);
if (result == ISC_R_NOTFOUND) {
result = ISC_R_SUCCESS;
continue;
if (!(ignoreksk || key->isdsk ||
(key->isksk &&
- set->type == dns_rdatatype_key &&
+ set->type == dns_rdatatype_dnskey &&
dns_name_equal(name, gorigin))))
continue;
return (DNS_R_BADDB);
}
dns_rdataset_init(&keyset);
- result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_key, 0, 0,
+ result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 0, 0,
&keyset, NULL);
if (result != ISC_R_SUCCESS) {
dns_db_detachnode(db, &node);
}
static isc_boolean_t
-nxt_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type,
+nsec_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type,
unsigned int val)
{
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
- dns_rdata_nxt_t nxt;
+ dns_rdata_nsec_t nsec;
unsigned int newlen;
unsigned char bitmap[16];
- unsigned char nxtdata[16 + DNS_NAME_MAXWIRE];
+ unsigned char nsecdata[16 + DNS_NAME_MAXWIRE];
isc_boolean_t answer = ISC_FALSE;
INSIST(type < 128);
result = dns_rdataset_first(rdataset);
check_result(result, "dns_rdataset_first()");
dns_rdataset_current(rdataset, &rdata);
- result = dns_rdata_tostruct(&rdata, &nxt, NULL);
+ result = dns_rdata_tostruct(&rdata, &nsec, NULL);
check_result(result, "dns_rdata_tostruct");
newlen = type / 8 + 1;
- INSIST(nxt.len < sizeof(bitmap));
+ INSIST(nsec.len < sizeof(bitmap));
INSIST(newlen < sizeof(bitmap));
memset(bitmap, 0, sizeof(bitmap));
- memcpy(bitmap, nxt.typebits, nxt.len);
+ memcpy(bitmap, nsec.typebits, nsec.len);
set_bit(bitmap, type, val);
while (newlen > 0 && bitmap[newlen - 1] == 0)
newlen--;
- if (newlen != nxt.len ||
- memcmp(nxt.typebits, bitmap, newlen) != 0) {
+ if (newlen != nsec.len ||
+ memcmp(nsec.typebits, bitmap, newlen) != 0) {
dns_rdata_t newrdata = DNS_RDATA_INIT;
isc_buffer_t b;
dns_diff_t diff;
check_result(result, "dns_difftuple_create");
dns_diff_append(&diff, &tuple);
- nxt.typebits = bitmap;
- nxt.len = newlen;
- isc_buffer_init(&b, nxtdata, sizeof(nxtdata));
+ nsec.typebits = bitmap;
+ nsec.len = newlen;
+ isc_buffer_init(&b, nsecdata, sizeof(nsecdata));
result = dns_rdata_fromstruct(&newrdata, rdata.rdclass,
- dns_rdatatype_nxt, &nxt,
+ dns_rdatatype_nsec, &nsec,
&b);
check_result(result, "dns_rdata_fromstruct");
dns_diff_clear(&diff);
answer = ISC_TRUE;
}
- dns_rdata_freestruct(&nxt);
+ dns_rdata_freestruct(&nsec);
return (answer);
}
/*
* Signs all records at a name. This mostly just signs each set individually,
- * but also adds the SIG bit to any NXTs generated earlier, deals with
+ * but also adds the SIG bit to any NSECs generated earlier, deals with
* parent/child KEY signatures, and handles other exceptional cases.
*/
static void
} else if (dns_rdataset_isassociated(&sigdsset)) {
result = dns_db_deleterdataset(gdb, node,
gversion,
- dns_rdatatype_sig,
+ dns_rdatatype_rrsig,
dns_rdatatype_ds);
check_result(result, "dns_db_deleterdataset");
dns_rdataset_disassociate(&sigdsset);
}
/*
- * Make sure that NXT bits are appropriately set.
+ * Make sure that NSEC bits are appropriately set.
*/
dns_rdataset_init(&rdataset);
RUNTIME_CHECK(dns_db_findrdataset(gdb, node, gversion,
- dns_rdatatype_nxt, 0, 0, &rdataset,
+ dns_rdatatype_nsec, 0, 0, &rdataset,
NULL) == ISC_R_SUCCESS);
if (!nokeys)
- changed = nxt_setbit(name, &rdataset, dns_rdatatype_sig, 1);
+ changed = nsec_setbit(name, &rdataset, dns_rdatatype_rrsig, 1);
if (changed) {
dns_rdataset_disassociate(&rdataset);
RUNTIME_CHECK(dns_db_findrdataset(gdb, node, gversion,
- dns_rdatatype_nxt, 0, 0,
+ dns_rdatatype_nsec, 0, 0,
&rdataset,
NULL) == ISC_R_SUCCESS);
}
if (hasds)
- (void)nxt_setbit(name, &rdataset, dns_rdatatype_ds, 1);
+ (void)nsec_setbit(name, &rdataset, dns_rdatatype_ds, 1);
else
- (void)nxt_setbit(name, &rdataset, dns_rdatatype_ds, 0);
+ (void)nsec_setbit(name, &rdataset, dns_rdatatype_ds, 0);
dns_rdataset_disassociate(&rdataset);
/*
dns_rdatasetiter_current(rdsiter, &rdataset);
/* If this is a SIG set, skip it. */
- if (rdataset.type == dns_rdatatype_sig)
+ if (rdataset.type == dns_rdatatype_rrsig)
goto skip;
/*
* If this name is a delegation point, skip all records
- * except NXT and DS sets. Otherwise check that there
+ * except NSEC and DS sets. Otherwise check that there
* isn't a DS record.
*/
if (isdelegation) {
- if (rdataset.type != dns_rdatatype_nxt &&
+ if (rdataset.type != dns_rdatatype_nsec &&
rdataset.type != dns_rdatatype_ds)
goto skip;
} else if (rdataset.type == dns_rdatatype_ds) {
result = dns_rdatasetiter_first(rdsiter);
while (result == ISC_R_SUCCESS) {
dns_rdatasetiter_current(rdsiter, &rdataset);
- if (rdataset.type != dns_rdatatype_nxt)
+ if (rdataset.type != dns_rdatatype_nsec)
active = ISC_TRUE;
dns_rdataset_disassociate(&rdataset);
if (!active)
if (!active) {
/*
- * Make sure there is no NXT record for this node.
+ * Make sure there is no NSEC record for this node.
*/
result = dns_db_deleterdataset(gdb, node, gversion,
- dns_rdatatype_nxt, 0);
+ dns_rdatatype_nsec, 0);
if (result == DNS_R_UNCHANGED)
result = ISC_R_SUCCESS;
check_result(result, "dns_db_deleterdataset");
isc_boolean_t destroy = ISC_FALSE;
dns_rdatatype_t covers = 0;
dns_rdatasetiter_current(rdsiter, &set);
- if (set.type == dns_rdatatype_sig) {
+ if (set.type == dns_rdatatype_rrsig) {
covers = set.covers;
destroy = ISC_TRUE;
}
result = dns_rdatasetiter_next(rdsiter);
if (destroy) {
dresult = dns_db_deleterdataset(db, node, version,
- dns_rdatatype_sig,
+ dns_rdatatype_rrsig,
covers);
check_result(dresult, "dns_db_deleterdataset");
}
dns_name_t *name;
dns_dbnode_t *node;
sevent_t *sevent;
- dns_rdataset_t nxt;
+ dns_rdataset_t nsec;
isc_boolean_t found;
isc_result_t result;
if (result != ISC_R_SUCCESS)
fatal("failure iterating database: %s",
isc_result_totext(result));
- dns_rdataset_init(&nxt);
+ dns_rdataset_init(&nsec);
result = dns_db_findrdataset(gdb, node, gversion,
- dns_rdatatype_nxt, 0, 0,
- &nxt, NULL);
+ dns_rdatatype_nsec, 0, 0,
+ &nsec, NULL);
if (result == ISC_R_SUCCESS)
found = ISC_TRUE;
else
dumpnode(name, node);
- if (dns_rdataset_isassociated(&nxt))
- dns_rdataset_disassociate(&nxt);
+ if (dns_rdataset_isassociated(&nsec))
+ dns_rdataset_disassociate(&nsec);
if (!found)
dns_db_detachnode(gdb, &node);
}
/*
- * Generate NXT records for the zone.
+ * Generate NSEC records for the zone.
*/
static void
-nxtify(void) {
+nsecify(void) {
dns_dbiterator_t *dbiter = NULL;
dns_dbnode_t *node = NULL, *nextnode = NULL;
dns_fixedname_t fname, fnextname, fzonecut;
} else if (result != ISC_R_SUCCESS)
fatal("iterating through the database failed: %s",
isc_result_totext(result));
- result = dns_nxt_build(gdb, gversion, node, nextname, zonettl);
- check_result(result, "dns_nxt_build()");
+ result = dns_nsec_build(gdb, gversion, node, nextname,
+ zonettl);
+ check_result(result, "dns_nsec_build()");
dns_db_detachnode(gdb, &node);
}
dns_rdataset_init(&rdataset);
result = dns_db_findrdataset(db, node, currentversion,
- dns_rdatatype_key, 0, 0, &rdataset, NULL);
+ dns_rdatatype_dnskey, 0, 0, &rdataset, NULL);
if (result != ISC_R_SUCCESS)
fatal("failed to find keys at the zone apex: %s",
isc_result_totext(result));
dns_rdataset_init(&rdataset);
result = dns_db_findrdataset(db, node, currentversion,
- dns_rdatatype_key, 0, 0, &rdataset, NULL);
+ dns_rdatatype_dnskey, 0, 0, &rdataset, NULL);
if (result != ISC_R_SUCCESS)
fatal("failed to find keys at the zone apex: %s",
isc_result_totext(result));
isc_region_t r;
isc_result_t result;
isc_boolean_t have_non_ksk = ISC_FALSE;
+ isc_boolean_t have_ksk = ISC_FALSE;
isc_buffer_init(&namebuf, namestr, sizeof(namestr));
result = dns_name_tofilenametext(gorigin, ISC_FALSE, &namebuf);
break;
}
+ for (key = ISC_LIST_HEAD(keylist);
+ key != NULL;
+ key = ISC_LIST_NEXT(key, link))
+ if (key->isksk) {
+ have_ksk = ISC_TRUE;
+ break;
+ }
+
for (key = ISC_LIST_HEAD(keylist);
key != NULL;
key = ISC_LIST_NEXT(key, link))
{
- if (have_non_ksk && !key->isksk)
+ if (have_ksk && have_non_ksk && !key->isksk)
continue;
dns_rdata_init(&rdata);
isc_buffer_init(&b, keybuf, sizeof(keybuf));
result = dst_key_todns(key->key, &b);
check_result(result, "dst_key_todns");
isc_buffer_usedregion(&b, &r);
- dns_rdata_fromregion(&rdata, gclass, dns_rdatatype_key, &r);
+ dns_rdata_fromregion(&rdata, gclass, dns_rdatatype_dnskey, &r);
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, gorigin,
zonettl, &rdata, &tuple);
check_result(result, "dns_difftuple_create");
dst_key_name(newkey)))
{
/* Override key flags. */
+ key->issigningkey = ISC_TRUE;
key->isksk = ISC_TRUE;
key->isdsk = ISC_FALSE;
dst_key_free(&dkey);
result = dns_db_newversion(gdb, &gversion);
check_result(result, "dns_db_newversion()");
- nxtify();
+ nsecify();
if (!nokeys)
writekeyset();
- WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: dnssec-signzone.docbook,v 1.6 2003/02/07 01:13:10 marka Exp $ -->
+<!-- $Id: dnssec-signzone.docbook,v 1.7 2003/09/30 05:56:00 marka Exp $ -->
<refentry>
<refentryinfo>
<refsect1>
<title>DESCRIPTION</title>
<para>
- <command>dnssec-signzone</command> signs a zone. It generates NXT
- and SIG records and produces a signed version of the zone. If there
+ <command>dnssec-signzone</command> signs a zone. It generates NSEC
+ and RRSIG records and produces a signed version of the zone. If there
is a <filename>signedkey</filename> file from the zone's parent,
the parent's signatures will be incorporated into the generated
signed zone file. The security status of delegations from the the
<term>-s <replaceable class="parameter">start-time</replaceable></term>
<listitem>
<para>
- Specify the date and time when the generated SIG records
+ Specify the date and time when the generated RRSIG records
become valid. This can be either an absolute or relative
time. An absolute start time is indicated by a number
in YYYYMMDDHHMMSS notation; 20000530144500 denotes
<term>-e <replaceable class="parameter">end-time</replaceable></term>
<listitem>
<para>
- Specify the date and time when the generated SIG records
+ Specify the date and time when the generated RRSIG records
expire. As with <option>start-time</option>, an absolute
time is indicated in YYYYMMDDHHMMSS notation. A time relative
to the start time is indicated with +N, which is N seconds from
When a previously signed zone is passed as input, records
may be resigned. The <option>interval</option> option
specifies the cycle interval as an offset from the current
- time (in seconds). If a SIG record expires after the
+ time (in seconds). If a RRSIG record expires after the
cycle interval, it is retained. Otherwise, it is considered
to be expiring soon, and it will be replaced.
</para>
<option>end-time</option> or <option>start-time</option>
are specified, <command>dnssec-signzone</command> generates
signatures that are valid for 30 days, with a cycle
- interval of 7.5 days. Therefore, if any existing SIG records
+ interval of 7.5 days. Therefore, if any existing RRSIG records
are due to expire in less than 7.5 days, they would be
replaced.
</para>
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssectool.c,v 1.37 2003/07/25 00:01:04 marka Exp $ */
+/* $Id: dnssectool.c,v 1.38 2003/09/30 05:56:00 marka Exp $ */
#include <config.h>
}
void
-sig_format(dns_rdata_sig_t *sig, char *cp, unsigned int size) {
+sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
char namestr[DNS_NAME_FORMATSIZE];
char algstr[DNS_NAME_FORMATSIZE];
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssectool.h,v 1.16 2001/09/21 00:17:01 bwelling Exp $ */
+/* $Id: dnssectool.h,v 1.17 2003/09/30 05:56:00 marka Exp $ */
#ifndef DNSSECTOOL_H
#define DNSSECTOOL_H 1
#define ALG_FORMATSIZE 10
void
-sig_format(dns_rdata_sig_t *sig, char *cp, unsigned int size);
+sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
#define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + ALG_FORMATSIZE + sizeof("65535"))
void
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: lwdgrbn.c,v 1.11 2001/01/24 01:42:41 bwelling Exp $ */
+/* $Id: lwdgrbn.c,v 1.12 2003/09/30 05:56:01 marka Exp $ */
#include <config.h>
dns_rdataset_init(&set);
dns_rdatasetiter_current(iter, &set);
- if (set.type != dns_rdatatype_sig) {
+ if (set.type != dns_rdatatype_rrsig) {
dns_rdataset_disassociate(&set);
continue;
}
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.c,v 1.246 2003/07/29 22:05:01 jinmei Exp $ */
+/* $Id: query.c,v 1.247 2003/09/30 05:56:01 marka Exp $ */
#include <config.h>
* XXXRTH We should lower the priority here. Alternatively,
* we could raise the priority of glue records.
*/
- eresult = query_addadditional(client, name, dns_rdatatype_key);
+ eresult = query_addadditional(client, name, dns_rdatatype_dnskey);
} else if (type == dns_rdatatype_srv && trdataset != NULL) {
/*
* If we're adding SRV records to the additional data
* XXXRTH We should lower the priority here. Alternatively,
* we could raise the priority of glue records.
*/
- (void)query_addadditional(client, fname, dns_rdatatype_key);
+ (void)query_addadditional(client, fname, dns_rdatatype_dnskey);
}
CTRACE("query_addrdataset: done");
}
result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0,
client->now, rdataset, sigrdataset);
/*
- * If we didn't find it, look for an NXT. */
+ * If we didn't find it, look for an NSEC. */
if (result == ISC_R_NOTFOUND)
result = dns_db_findrdataset(db, node, NULL,
- dns_rdatatype_nxt, 0, client->now,
+ dns_rdatatype_nsec, 0, client->now,
rdataset, sigrdataset);
if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
goto cleanup;
goto cleanup;
result = dns_db_find(db, name, NULL,
- dns_rdatatype_nxt, options, 0, &node,
+ dns_rdatatype_nsec, options, 0, &node,
fname, rdataset, sigrdataset);
if (node != NULL)
dns_db_detachnode(db, &node);
if (result != ISC_R_SUCCESS)
continue;
- result = dns_db_find(db, tname, NULL, dns_rdatatype_nxt,
+ result = dns_db_find(db, tname, NULL, dns_rdatatype_nsec,
client->query.dboptions, 0, &node,
fname, rdataset, sigrdataset);
if (node != NULL)
}
static void
-query_addnxrrsetnxt(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
+query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
{
dns_name_t *name;
dns_rdataset_t *sigrdataset;
dns_rdata_t sigrdata;
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
unsigned int labels;
isc_buffer_t *dbuf, b;
dns_name_t *fname;
is_zone = ISC_FALSE;
qtype = event->qtype;
- if (qtype == dns_rdatatype_sig)
+ if (qtype == dns_rdatatype_rrsig)
type = dns_rdatatype_any;
else
type = qtype;
/*
* If it's a SIG query, we'll iterate the node.
*/
- if (qtype == dns_rdatatype_sig)
+ if (qtype == dns_rdatatype_rrsig)
type = dns_rdatatype_any;
else
type = qtype;
INSIST(is_zone);
if (dns_rdataset_isassociated(rdataset)) {
/*
- * If we've got a NXT record, we need to save the
+ * If we've got a NSEC record, we need to save the
* name now because we're going call query_addsoa()
* below, and it needs to use the name buffer.
*/
goto cleanup;
}
/*
- * Add NXT record if we found one.
+ * Add NSEC record if we found one.
*/
if (WANTDNSSEC(client)) {
if (dns_rdataset_isassociated(rdataset))
- query_addnxrrsetnxt(client, db, &fname,
+ query_addnxrrsetnsec(client, db, &fname,
&rdataset, &sigrdataset);
}
goto cleanup;
INSIST(is_zone);
if (dns_rdataset_isassociated(rdataset)) {
/*
- * If we've got a NXT record, we need to save the
+ * If we've got a NSEC record, we need to save the
* name now because we're going call query_addsoa()
* below, and it needs to use the name buffer.
*/
goto cleanup;
}
/*
- * Add NXT record if we found one.
+ * Add NSEC record if we found one.
*/
if (dns_rdataset_isassociated(rdataset)) {
if (WANTDNSSEC(client)) {
/*
* We didn't match any rdatasets.
*/
- if (qtype == dns_rdatatype_sig &&
+ if (qtype == dns_rdatatype_rrsig &&
result == ISC_R_NOMORE) {
/*
* XXXRTH If this is a secure zone and we
}
/*
- * Add NXT records to the authority section if they're needed for
+ * Add NSEC records to the authority section if they're needed for
* DNSSEC wildcard proofs.
*/
if (need_wildcardproof && dns_db_issecure(db))
* to return data before validation has completed.
*/
if (message->flags & DNS_MESSAGEFLAG_CD ||
- qtype == dns_rdatatype_sig)
+ qtype == dns_rdatatype_rrsig)
{
client->query.dboptions |= DNS_DBFIND_PENDINGOK;
client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.404 2003/09/25 18:16:43 jinmei Exp $ */
+/* $Id: server.c,v 1.405 2003/09/30 05:56:01 marka Exp $ */
#include <config.h>
dns_keytable_t *keytable, isc_mem_t *mctx)
{
dns_rdataclass_t viewclass;
- dns_rdata_key_t keystruct;
+ dns_rdata_dnskey_t keystruct;
isc_uint32_t flags, proto, alg;
char *keystr, *keynamestr;
unsigned char keydata[4096];
&viewclass));
}
keystruct.common.rdclass = viewclass;
- keystruct.common.rdtype = dns_rdatatype_key;
+ keystruct.common.rdtype = dns_rdatatype_dnskey;
/*
* The key data in keystruct is not dynamically allocated.
*/
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: update.c,v 1.105 2003/01/21 05:18:11 marka Exp $ */
+/* $Id: update.c,v 1.106 2003/09/30 05:56:02 marka Exp $ */
#include <config.h>
#include <dns/fixedname.h>
#include <dns/journal.h>
#include <dns/message.h>
-#include <dns/nxt.h>
+#include <dns/nsec.h>
#include <dns/rdataclass.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
isc_boolean_t result;
/*
- * If we're deleting all records, it's ok to delete SIG and NXT even
+ * If we're deleting all records, it's ok to delete RRSIG and NSEC even
* if we're normally not allowed to.
*/
- if (rrset->type == dns_rdatatype_sig ||
- rrset->type == dns_rdatatype_nxt)
+ if (rrset->type == dns_rdatatype_rrsig ||
+ rrset->type == dns_rdatatype_nsec)
return (ISC_TRUE);
result = dns_ssutable_checkrules(ssuinfo->table, ssuinfo->signer,
ssuinfo->name, rrset->type);
this name and type */
*typep = type = t->rdata.type;
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
covers = dns_rdata_covers(&t->rdata);
else
covers = 0;
* Return true iff 'update_rr' should replace 'db_rr' according
* to the special RFC2136 rules for CNAME, SOA, and WKS records.
*
- * RFC2136 does not mention NXT or DNAME, but multiple NXTs or DNAMEs
+ * RFC2136 does not mention NSEC or DNAME, but multiple NSECs or DNAMEs
* make little sense, so we replace those, too.
*/
static isc_boolean_t
return (ISC_TRUE);
if (db_rr->type == dns_rdatatype_soa)
return (ISC_TRUE);
- if (db_rr->type == dns_rdatatype_nxt)
+ if (db_rr->type == dns_rdatatype_nsec)
return (ISC_TRUE);
if (db_rr->type == dns_rdatatype_wks) {
/*
/**************************************************************************/
/*
- * Incremental updating of NXTs and SIGs.
+ * Incremental updating of NSECs and RRSIGs.
*/
#define MAXZONEKEYS 32 /* Maximum number of zone keys supported. */
/*
- * Helper function for non_nxt_rrset_exists().
+ * Helper function for non_nsec_rrset_exists().
*/
static isc_result_t
-is_non_nxt_action(void *data, dns_rdataset_t *rrset) {
+is_non_nsec_action(void *data, dns_rdataset_t *rrset) {
UNUSED(data);
- if (!(rrset->type == dns_rdatatype_nxt ||
- (rrset->type == dns_rdatatype_sig &&
- rrset->covers == dns_rdatatype_nxt)))
+ if (!(rrset->type == dns_rdatatype_nsec ||
+ (rrset->type == dns_rdatatype_rrsig &&
+ rrset->covers == dns_rdatatype_nsec)))
return (ISC_R_EXISTS);
return (ISC_R_SUCCESS);
}
/*
- * Check whether there is an rrset other than a NXT or SIG NXT,
+ * Check whether there is an rrset other than a NSEC or RRSIG NSEC,
* i.e., anything that justifies the continued existence of a name
* after a secure update.
*
* Otherwise, set it to ISC_FALSE.
*/
static isc_result_t
-non_nxt_rrset_exists(dns_db_t *db, dns_dbversion_t *ver,
+non_nsec_rrset_exists(dns_db_t *db, dns_dbversion_t *ver,
dns_name_t *name, isc_boolean_t *exists)
{
isc_result_t result;
result = foreach_rrset(db, ver, name,
- is_non_nxt_action, NULL);
+ is_non_nsec_action, NULL);
RETURN_EXISTENCE_FLAG;
}
return (ISC_R_SUCCESS);
} else if (result == DNS_R_ZONECUT) {
/*
- * We are at the zonecut. The name will have an NXT, but
+ * We are at the zonecut. The name will have an NSEC, but
* non-delegation will be omitted from the type bit map.
*/
*flag = ISC_FALSE;
}
/*
- * Find the next/previous name that has a NXT record.
+ * Find the next/previous name that has a NSEC record.
* In other words, skip empty database nodes and names that
- * have had their NXTs removed because they are obscured by
+ * have had their NSECs removed because they are obscured by
* a zone cut.
*/
static isc_result_t
{
isc_result_t result;
dns_dbiterator_t *dbit = NULL;
- isc_boolean_t has_nxt;
+ isc_boolean_t has_nsec;
unsigned int wraps = 0;
CHECK(dns_db_createiterator(db, ISC_FALSE, &dbit));
wraps++;
if (wraps == 2) {
update_log(client, zone, ISC_LOG_ERROR,
- "secure zone with no NXTs");
+ "secure zone with no NSECs");
result = DNS_R_BADZONE;
goto failure;
}
*/
CHECK(dns_dbiterator_pause(dbit));
CHECK(rrset_exists(db, ver, newname,
- dns_rdatatype_nxt, 0, &has_nxt));
+ dns_rdatatype_nsec, 0, &has_nsec));
- } while (! has_nxt);
+ } while (! has_nsec);
failure:
if (dbit != NULL)
dns_dbiterator_destroy(&dbit);
}
/*
- * Add a NXT record for "name", recording the change in "diff".
- * The existing NXT is removed.
+ * Add a NSEC record for "name", recording the change in "diff".
+ * The existing NSEC is removed.
*/
static isc_result_t
-add_nxt(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
+add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff)
{
isc_result_t result;
dns_dbnode_t *node = NULL;
- unsigned char buffer[DNS_NXT_BUFFERSIZE];
+ unsigned char buffer[DNS_NSEC_BUFFERSIZE];
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_difftuple_t *tuple = NULL;
dns_fixedname_t fixedname;
target = dns_fixedname_name(&fixedname);
/*
- * Find the successor name, aka NXT target.
+ * Find the successor name, aka NSEC target.
*/
CHECK(next_active(client, zone, db, ver, name, target, ISC_TRUE));
/*
- * Create the NXT RDATA.
+ * Create the NSEC RDATA.
*/
CHECK(dns_db_findnode(db, name, ISC_FALSE, &node));
dns_rdata_init(&rdata);
- CHECK(dns_nxt_buildrdata(db, ver, node, target, buffer, &rdata));
+ CHECK(dns_nsec_buildrdata(db, ver, node, target, buffer, &rdata));
dns_db_detachnode(db, &node);
/*
- * Delete the old NXT and record the change.
+ * Delete the old NSEC and record the change.
*/
- CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nxt, 0,
+ CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nsec, 0,
NULL, diff));
/*
- * Add the new NXT and record the change.
+ * Add the new NSEC and record the change.
*/
CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name,
3600, /* XXXRTH */
}
/*
- * Add a placeholder NXT record for "name", recording the change in "diff".
+ * Add a placeholder NSEC record for "name", recording the change in "diff".
*/
static isc_result_t
-add_placeholder_nxt(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
+add_placeholder_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dns_diff_t *diff) {
isc_result_t result;
dns_difftuple_t *tuple = NULL;
r.base = data;
r.length = sizeof(data);
- dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nxt, &r);
+ dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nsec, &r);
CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 0,
&rdata, &tuple));
CHECK(do_one_tuple(&tuple, db, ver, diff));
}
/*
- * Add SIG records for an RRset, recording the change in "diff".
+ * Add RRSIG records for an RRset, recording the change in "diff".
*/
static isc_result_t
add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dns_db_detachnode(db, &node);
for (i = 0; i < nkeys; i++) {
- /* Calculate the signature, creating a SIG RDATA. */
+ /* Calculate the signature, creating a RRSIG RDATA. */
CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
&inception, &expire,
mctx, &buffer, &sig_rdata));
- /* Update the database and journal with the SIG. */
+ /* Update the database and journal with the RRSIG. */
/* XXX inefficient - will cause dataset merging */
CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,
rdataset.ttl, &sig_rdata));
}
/*
- * Update SIG and NXT records affected by an update. The original
- * update, including the SOA serial update but exluding the SIG & NXT
+ * Update RRSIG and NSEC records affected by an update. The original
+ * update, including the SOA serial update but exluding the RRSIG & NSEC
* changes, is in "diff" and has already been applied to "newver" of "db".
* The database version prior to the update is "oldver".
*
- * The necessary SIG and NXT changes will be applied to "newver"
+ * The necessary RRSIG and NSEC changes will be applied to "newver"
* and added (as a minimal diff) to "diff".
*
- * The SIGs generated will be valid for 'sigvalidityinterval' seconds.
+ * The RRSIGs generated will be valid for 'sigvalidityinterval' seconds.
*/
static isc_result_t
update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
dns_diff_t diffnames;
dns_diff_t affected;
dns_diff_t sig_diff;
- dns_diff_t nxt_diff;
- dns_diff_t nxt_mindiff;
+ dns_diff_t nsec_diff;
+ dns_diff_t nsec_mindiff;
isc_boolean_t flag;
dst_key_t *zone_keys[MAXZONEKEYS];
unsigned int nkeys = 0;
dns_diff_init(client->mctx, &affected);
dns_diff_init(client->mctx, &sig_diff);
- dns_diff_init(client->mctx, &nxt_diff);
- dns_diff_init(client->mctx, &nxt_mindiff);
+ dns_diff_init(client->mctx, &nsec_diff);
+ dns_diff_init(client->mctx, &nsec_mindiff);
result = find_zone_keys(zone, db, newver, client->mctx,
MAXZONEKEYS, zone_keys, &nkeys);
/*
* Find all RRsets directly affected by the update, and
- * update their SIGs. Also build a list of names affected
+ * update their RRSIGs. Also build a list of names affected
* by the update in "diffnames".
*/
CHECK(dns_diff_sort(diff, temp_order));
* affected by the update.
*/
- /* Don't sign SIGs. */
- if (type == dns_rdatatype_sig)
+ /* Don't sign RRSIGs. */
+ if (type == dns_rdatatype_rrsig)
goto skip;
/*
- * Delete all old SIGs covering this type, since they
+ * Delete all old RRSIGs covering this type, since they
* are all invalid when the signed RRset has changed.
* We may not be able to recreate all of them - tough.
*/
CHECK(delete_if(true_p, db, newver, name,
- dns_rdatatype_sig, type,
+ dns_rdatatype_rrsig, type,
NULL, &sig_diff));
/*
}
}
- /* Remove orphaned NXTs and SIG NXTs. */
+ /* Remove orphaned NSECs and RRSIG NSECs. */
for (t = ISC_LIST_HEAD(diffnames.tuples);
t != NULL;
t = ISC_LIST_NEXT(t, link))
{
- CHECK(non_nxt_rrset_exists(db, newver, &t->name, &flag));
+ CHECK(non_nsec_rrset_exists(db, newver, &t->name, &flag));
if (! flag) {
CHECK(delete_if(true_p, db, newver, &t->name,
dns_rdatatype_any, 0,
/*
* When a name is created or deleted, its predecessor needs to
- * have its NXT updated.
+ * have its NSEC updated.
*/
for (t = ISC_LIST_HEAD(diffnames.tuples);
t != NULL;
* Find the predecessor.
* When names become obscured or unobscured in this update
* transaction, we may find the wrong predecessor because
- * the NXTs have not yet been updated to reflect the delegation
+ * the NSECs have not yet been updated to reflect the delegation
* change. This should not matter because in this case,
* the correct predecessor is either the delegation node or
* a newly unobscured node, and those nodes are on the
continue;
/*
* There was a delegation change. Mark all subdomains
- * of t->name as potentially needing a NXT update.
+ * of t->name as potentially needing a NSEC update.
*/
CHECK(namelist_append_subdomain(db, &t->name, &affected));
}
CHECK(uniqify_name_list(&affected));
/*
- * Determine which names should have NXTs, and delete/create
- * NXTs to make it so. We don't know the final NXT targets yet,
- * so we just create placeholder NXTs with arbitrary contents
+ * Determine which names should have NSECs, and delete/create
+ * NSECs to make it so. We don't know the final NSEC targets yet,
+ * so we just create placeholder NSECs with arbitrary contents
* to indicate that their respective owner names should be part of
- * the NXT chain.
+ * the NSEC chain.
*/
for (t = ISC_LIST_HEAD(affected.tuples);
t != NULL;
if (flag) {
/*
* This name is obscured. Delete any
- * existing NXT record.
+ * existing NSEC record.
*/
CHECK(delete_if(true_p, db, newver, &t->name,
- dns_rdatatype_nxt, 0,
- NULL, &nxt_diff));
+ dns_rdatatype_nsec, 0,
+ NULL, &nsec_diff));
} else {
/*
- * This name is not obscured. It should have a NXT.
+ * This name is not obscured. It should have a NSEC.
*/
CHECK(rrset_exists(db, newver, &t->name,
- dns_rdatatype_nxt, 0, &flag));
+ dns_rdatatype_nsec, 0, &flag));
if (! flag)
- CHECK(add_placeholder_nxt(db, newver, &t->name,
+ CHECK(add_placeholder_nsec(db, newver, &t->name,
diff));
}
}
/*
- * Now we know which names are part of the NXT chain.
+ * Now we know which names are part of the NSEC chain.
* Make them all point at their correct targets.
*/
for (t = ISC_LIST_HEAD(affected.tuples);
t = ISC_LIST_NEXT(t, link))
{
CHECK(rrset_exists(db, newver, &t->name,
- dns_rdatatype_nxt, 0, &flag));
+ dns_rdatatype_nsec, 0, &flag));
if (flag) {
/*
- * There is a NXT, but we don't know if it is correct.
+ * There is a NSEC, but we don't know if it is correct.
* Delete it and create a correct one to be sure.
* If the update was unnecessary, the diff minimization
* will take care of eliminating it from the journal,
* IXFRs, etc.
*
- * The SIG bit should always be set in the NXTs
- * we generate, because they will all get SIG NXTs.
+ * The RRSIG bit should always be set in the NSECs
+ * we generate, because they will all get RRSIG NSECs.
* (XXX what if the zone keys are missing?).
- * Because the SIG NXTs have not necessarily been
+ * Because the RRSIG NSECs have not necessarily been
* created yet, the correctness of the bit mask relies
- * on the assumption that NXTs are only created if
+ * on the assumption that NSECs are only created if
* there is other data, and if there is other data,
- * there are other SIGs.
+ * there are other RRSIGs.
*/
- CHECK(add_nxt(client, zone, db, newver,
- &t->name, &nxt_diff));
+ CHECK(add_nsec(client, zone, db, newver,
+ &t->name, &nsec_diff));
}
}
/*
- * Minimize the set of NXT updates so that we don't
- * have to regenerate the SIG NXTs for NXTs that were
+ * Minimize the set of NSEC updates so that we don't
+ * have to regenerate the RRSIG NSECs for NSECs that were
* replaced with identical ones.
*/
- while ((t = ISC_LIST_HEAD(nxt_diff.tuples)) != NULL) {
- ISC_LIST_UNLINK(nxt_diff.tuples, t, link);
- dns_diff_appendminimal(&nxt_mindiff, &t);
+ while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) {
+ ISC_LIST_UNLINK(nsec_diff.tuples, t, link);
+ dns_diff_appendminimal(&nsec_mindiff, &t);
}
- /* Update SIG NXTs. */
- for (t = ISC_LIST_HEAD(nxt_mindiff.tuples);
+ /* Update RRSIG NSECs. */
+ for (t = ISC_LIST_HEAD(nsec_mindiff.tuples);
t != NULL;
t = ISC_LIST_NEXT(t, link))
{
if (t->op == DNS_DIFFOP_DEL) {
CHECK(delete_if(true_p, db, newver, &t->name,
- dns_rdatatype_sig, dns_rdatatype_nxt,
+ dns_rdatatype_rrsig, dns_rdatatype_nsec,
NULL, &sig_diff));
} else if (t->op == DNS_DIFFOP_ADD) {
- CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nxt,
+ CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,
&sig_diff, zone_keys, nkeys,
client->mctx, inception, expire));
} else {
ISC_LIST_UNLINK(sig_diff.tuples, t, link);
dns_diff_appendminimal(diff, &t);
}
- while ((t = ISC_LIST_HEAD(nxt_mindiff.tuples)) != NULL) {
- ISC_LIST_UNLINK(nxt_mindiff.tuples, t, link);
+ while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) {
+ ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link);
dns_diff_appendminimal(diff, &t);
}
INSIST(ISC_LIST_EMPTY(sig_diff.tuples));
- INSIST(ISC_LIST_EMPTY(nxt_diff.tuples));
- INSIST(ISC_LIST_EMPTY(nxt_mindiff.tuples));
+ INSIST(ISC_LIST_EMPTY(nsec_diff.tuples));
+ INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples));
failure:
dns_diff_clear(&sig_diff);
- dns_diff_clear(&nxt_diff);
- dns_diff_clear(&nxt_mindiff);
+ dns_diff_clear(&nsec_diff);
+ dns_diff_clear(&nsec_mindiff);
dns_diff_clear(&affected);
dns_diff_clear(&diffnames);
/*
* draft-ietf-dnsind-simple-secure-update-01 says
* "Unlike traditional dynamic update, the client
- * is forbidden from updating NXT records."
+ * is forbidden from updating NSEC records."
*/
if (dns_db_issecure(db)) {
- if (rdata.type == dns_rdatatype_nxt) {
+ if (rdata.type == dns_rdatatype_nsec) {
FAILC(DNS_R_REFUSED,
- "explicit NXT updates are not allowed "
+ "explicit NSEC updates are not allowed "
"in secure zones");
}
- else if (rdata.type == dns_rdatatype_sig) {
+ else if (rdata.type == dns_rdatatype_rrsig) {
FAILC(DNS_R_REFUSED,
- "explicit SIG updates are currently not "
+ "explicit RRSIG updates are currently not "
"supported in secure zones");
}
}
/*
* If any changes were made, increment the SOA serial number,
- * update SIGs and NXTs (if zone is secure), and write the update
+ * update RRSIGs and NSECs (if zone is secure), and write the update
* to the journal.
*/
if (! ISC_LIST_EMPTY(diff.tuples)) {
if (result != ISC_R_SUCCESS) {
update_log(client, zone,
ISC_LOG_ERROR,
- "SIG/NXT update failed: %s",
+ "RRSIG/NSEC update failed: %s",
isc_result_totext(result));
goto failure;
}
- WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: nsupdate.docbook,v 1.13 2003/03/19 17:43:41 marka Exp $ -->
+<!-- $Id: nsupdate.docbook,v 1.14 2003/09/30 05:56:02 marka Exp $ -->
<refentry>
<refentryinfo>
long-standing rule in RFC1034 that a name must not exist as any other
record type if it exists as a CNAME.
(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
-SIG, KEY and NXT records.)
+RRSIG, DNSKEY and NSEC records.)
</para>
</refsect1>
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.117 2002/12/27 03:29:32 marka Exp $
+# $Id: Makefile.in,v 1.118 2003/09/30 05:56:02 marka Exp $
srcdir = @srcdir@
VPATH = @srcdir@
master_test@EXEEXT@ \
mempool_test@EXEEXT@ \
name_test@EXEEXT@ \
- nxtify@EXEEXT@ \
+ nsecify@EXEEXT@ \
ratelimiter_test@EXEEXT@ \
rbt_test@EXEEXT@ \
rdata_test@EXEEXT@ \
master_test.c \
mempool_test.c \
name_test.c \
- nxtify.c \
+ nsecify.c \
printmsg.c \
ratelimiter_test.c \
rbt_test.c \
${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ adb_test.@O@ \
${DNSLIBS} ${ISCLIBS} ${LIBS}
-nxtify@EXEEXT@: nxtify.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
- ${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ nxtify.@O@ \
+nsecify@EXEEXT@: nsecify.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+ ${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ nsecify.@O@ \
${DNSLIBS} ${ISCLIBS} ${LIBS}
byaddr_test@EXEEXT@: byaddr_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
604800 ;expiration
3600 ) ;minimum
-secure1 3600 IN KEY (
+secure1 3600 IN DNSKEY (
FLAG2|FLAG4|FLAG5|NTYP3|FLAG8|FLAG9|FLAG10|FLAG11|SIG15
3 3
ArT0a8FtOZWEONG2YQVl9+RA34op30JPz4NPEroCxm2yImT2
/7YMt8VUkA8/8UCszBBT7XAJ3OFjiMO8mvxrZZFzvwJlPBQ1
oFq/TNZlSe+N )
-secure2 3600 in key (
+secure2 3600 in DNSKEY (
flag2|flag4|flag5|ntyp3|flag8|flag9|flag10|flag11|sig15
3 3
ArT0a8FtOZWEONG2YQVl9+RA34op30JPz4NPEroCxm2yImT2
604800 ;expiration
3600 ) ;minimum
-secure1 3600 IN KEY (
+secure1 3600 IN DNSKEY (
NOKEY|FLAG2|FLAG4|FLAG5|NTYP3|FLAG8|FLAG9|FLAG10|FLAG11|SIG15
3 3 )
-secure2 3600 in key (
+secure2 3600 in DNSKEY (
nokey|flag2|flag4|flag5|ntyp3|flag8|flag9|flag10|flag11|sig15
3 3 )
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: t_master.c,v 1.30 2001/05/22 01:44:36 gson Exp $ */
+/* $Id: t_master.c,v 1.31 2003/09/30 05:56:03 marka Exp $ */
#include <config.h>
}
static const char *a6 =
- "dns_master_loadfile understands KEY RR specifications "
+ "dns_master_loadfile understands DNSKEY RR specifications "
"containing key material";
static void
}
static const char *a7 =
- "dns_master_loadfile understands KEY RR specifications "
+ "dns_master_loadfile understands DNSKEY RR specifications "
"containing no key material";
static void
{ t3, "DNS_NOOWNER" },
{ t4, "DNS_NOTTL" },
{ t5, "DNS_BADCLASS" },
- { t6, "KEY RR 1" },
- { t7, "KEY RR 2" },
+ { t6, "DNSKEY RR 1" },
+ { t7, "DNSKEY RR 2" },
{ t8, "$INCLUDE" },
{ t9, "$INCLUDE w/ DNS_BADCLASS" },
{ t10, "non empty blank lines" },
+++ /dev/null
-#
-# format of file is <testname> <tab> <bitlabel_pos> <tab> <expected_bits>
-#
-\[x42/7] 0 7
-a.b.c.\[x42/7] 3 7
-\[o033/9] 0 9
-\[b01001/5] 0 5
+++ /dev/null
-#
-# format is:
-# <testname> <tab> <labelpos> <tab> <bitpos> <tab> <expected value>
-#
-\[x42/7] 0 6 1
-a.b.c.\[x42/7] 3 5 0
-\[o033/9] 0 2 0
-\[o033/9] 0 3 0
-\[o033/9] 0 4 1
-\[b0101/4] 0 1 1
a.b.c.d 4
a.b.c 3
. 1
-\[b1100110].b.\[xab].a 4
-\[b1100110].b.\[xab].a. 5
-\[b1100110].\[xa2].\[o031].a. 3
#
# and where: exp_nlabels and exp_nbits are not tested if < 0
#
-#c.d.\[x31].abc.\[b110011]
a.b.c.d.
a.b.c.d.[A].[aaa.
Ba\x\aa.b.c\[\[o\\.Z
# case insensitive hash of testname2, otherwise cishm != 0
#
a.b.c.d a.b.c.d. 0 0
-\[x42/7].A. \[x42/7].a. 0 1
# format is:
# <testname> <tab> <expected value>
#
-\[x42/7]. 1
-a.b.c.\[x42/7] 0
-\[o033/9].z. 1
+x. 1
+a.b.c.d 0
+x.z. 1
# format:
# <test_name>
#
-c.d.\[x31].abc.\[b110011]
a.b.c.d.
a.b.c.d.[A].[aaa.
Ba\x\aa.b.c\[\[o\\.Z
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nxtify.c,v 1.20 2001/11/27 01:55:20 gson Exp $ */
+/* $Id: nsecify.c,v 1.2 2003/09/30 06:00:38 marka Exp $ */
#include <config.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
#include <dns/fixedname.h>
-#include <dns/nxt.h>
+#include <dns/nsec.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
#include <dns/result.h>
result = dns_rdatasetiter_first(rdsiter);
while (result == ISC_R_SUCCESS) {
dns_rdatasetiter_current(rdsiter, &rdataset);
- if (rdataset.type != dns_rdatatype_nxt)
+ if (rdataset.type != dns_rdatatype_nsec)
active = ISC_TRUE;
dns_rdataset_disassociate(&rdataset);
if (!active)
if (!active) {
/*
- * Make sure there is no NXT record for this node.
+ * Make sure there is no NSEC record for this node.
*/
result = dns_db_deleterdataset(db, node, version,
- dns_rdatatype_nxt, 0);
+ dns_rdatatype_nsec, 0);
if (result == DNS_R_UNCHANGED)
result = ISC_R_SUCCESS;
check_result(result, "dns_db_deleterdataset");
}
static void
-nxtify(char *filename) {
+nsecify(char *filename) {
isc_result_t result;
dns_db_t *db;
dns_dbversion_t *wversion;
target = NULL; /* Make compiler happy. */
fatal("db iteration failed");
}
- dns_nxt_build(db, wversion, node, target, 3600); /* XXX BEW */
+ dns_nsec_build(db, wversion, node, target, 3600); /* XXX BEW */
dns_db_detachnode(db, &node);
node = nextnode;
}
argv++;
for (i = 0; i < argc; i++)
- nxtify(argv[i]);
+ nsecify(argv[i]);
/* isc_mem_stats(mctx, stdout); */
isc_mem_destroy(&mctx);
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data add new.name ISC_R_SUCCESS
-dns_rbt.data add \[x42/7].name ISC_R_SUCCESS
-dns_rbt.data add \[b11011].name ISC_R_SUCCESS
-dns_rbt.data add \[o033/9].name ISC_R_SUCCESS
a.vix.com
b.vix.com
c.vix.com
-\[x42/7].vix.com
-a.\[x42/7].com
-a.vix.\[x42/7]
-\[b011011].vix.com
-a.\[b011011].com
-a.vix.\[b011011].com
a.a.vix.com
a.a.a.vix.com
a.a.a.a.vix.com
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data delete a.vix.com ISC_R_SUCCESS
-dns_rbt_bitstring.data delete \[x42/7].vix.com ISC_R_SUCCESS
-dns_rbt_bitstring.data delete a.\[x42/7].com ISC_R_SUCCESS
-dns_rbt_bitstring.data delete a.vix.\[x42/7] ISC_R_SUCCESS
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data delete new.name ISC_R_NOTFOUND
-dns_rbt.data delete \[x42/7].vix.com ISC_R_NOTFOUND
-dns_rbt.data delete a.\[x42/7].com ISC_R_NOTFOUND
-dns_rbt.data delete a.vix.\[x42/7] ISC_R_NOTFOUND
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data search a.vix.com ISC_R_SUCCESS
-dns_rbt_bitstring.data search \[x42/7].vix.com ISC_R_SUCCESS
-dns_rbt_bitstring.data search a.\[x42/7].com ISC_R_SUCCESS
-dns_rbt_bitstring.data search a.vix.\[x42/7] ISC_R_SUCCESS
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data search not.used.here ISC_R_NOTFOUND
-dns_rbt.data search \[x42/7].vix.com ISC_R_NOTFOUND
-dns_rbt.data search a.\[x42/7].com ISC_R_NOTFOUND
-dns_rbt.data search a.vix.\[x42/7] ISC_R_NOTFOUND
# format is: <dbfile> <command> <testname> <exp_result>
#
dns_rbt.data search a.b.vix.com DNS_R_PARTIALMATCH
-dns_rbt_bitstring.data search b.a.\[x42/7].com DNS_R_PARTIALMATCH
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rdata_test.c,v 1.38 2002/03/06 07:41:25 marka Exp $ */
+/* $Id: rdata_test.c,v 1.39 2003/09/30 05:56:02 marka Exp $ */
#include <config.h>
result = dns_rdata_tostruct(rdata, sp = &x25, NULL);
break;
}
+ case dns_rdatatype_nsec: {
+ dns_rdata_nsec_t nsec;
+ result = dns_rdata_tostruct(rdata, sp = &nsec, NULL);
+ break;
+ }
+ case dns_rdatatype_rrsig: {
+ dns_rdata_rrsig_t rrsig;
+ result = dns_rdata_tostruct(rdata, sp = &rrsig, NULL);
+ break;
+ }
+ case dns_rdatatype_dnskey: {
+ dns_rdata_dnskey_t dnskey;
+ result = dns_rdata_tostruct(rdata, sp = &dnskey, NULL);
+ break;
+ }
default:
result = ISC_R_NOTIMPLEMENTED;
break;
result = dns_rdata_tostruct(rdata, sp = &x25, mctx);
break;
}
+ case dns_rdatatype_nsec: {
+ dns_rdata_nsec_t nsec;
+ result = dns_rdata_tostruct(rdata, sp = &nsec, mctx);
+ break;
+ }
+ case dns_rdatatype_rrsig: {
+ dns_rdata_rrsig_t rrsig;
+ result = dns_rdata_tostruct(rdata, sp = &rrsig, mctx);
+ break;
+ }
+ case dns_rdatatype_dnskey: {
+ dns_rdata_dnskey_t dnskey;
+ result = dns_rdata_tostruct(rdata, sp = &dnskey, mctx);
+ break;
+ }
default:
result = ISC_R_NOTIMPLEMENTED;
break;
result = dns_rdata_fromstruct(rdata2, rdc, rdt, &x25, b);
break;
}
+ case dns_rdatatype_nsec: {
+ dns_rdata_nsec_t nsec;
+ result = dns_rdata_fromstruct(rdata2, rdc, rdt, &nsec, b);
+ break;
+ }
+ case dns_rdatatype_rrsig: {
+ dns_rdata_rrsig_t rrsig;
+ result = dns_rdata_fromstruct(rdata2, rdc, rdt, &rrsig, b);
+ break;
+ }
+ case dns_rdatatype_dnskey: {
+ dns_rdata_dnskey_t dnskey;
+ result = dns_rdata_fromstruct(rdata2, rdc, rdt, &dnskey, b);
+ break;
+ }
default:
result = ISC_R_NOTIMPLEMENTED;
break;
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: conf.sh.in,v 1.24 2002/06/17 04:01:10 marka Exp $
+# $Id: conf.sh.in,v 1.25 2003/09/30 05:56:06 marka Exp $
#
# Common configuration data for system tests, to be sourced into
# The "stress" test is not run by default since it creates enough
# load on the machine to make it unusable to other users.
+# v6synth
SUBDIRS="cacheclean dnssec forward glue ixfr limits lwresd \
masterfile notify nsupdate resolver sortlist stub tkey \
- unknown upforwd v6synth views xfer xferquota"
+ unknown upforwd views xfer xferquota"
# PERL will be an empty string if no perl interpreter was found.
PERL=@PERL@
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: sign.sh,v 1.14 2002/06/17 04:01:12 marka Exp $
+# $Id: sign.sh,v 1.15 2003/09/30 05:56:06 marka Exp $
SYSTEMTESTTOP=../..
. $SYSTEMTESTTOP/conf.sh
cat $infile $keyname.key > $zonefile
-$SIGNER -r $RANDFILE -o $zone $zonefile > /dev/null
+$SIGNER -g -r $RANDFILE -o $zone $zonefile > /dev/null
# Configure the resolving server with a trusted key.
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: sign.sh,v 1.21 2002/07/19 06:20:24 marka Exp $
+# $Id: sign.sh,v 1.22 2003/09/30 05:56:07 marka Exp $
SYSTEMTESTTOP=../..
. $SYSTEMTESTTOP/conf.sh
cat $infile $keyname1.key $keyname2.key >$zonefile
-$SIGNER -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+$SIGNER -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
# Sign the privately secure file
cat $privinfile $privkeyname.key >$privzonefile
-$SIGNER -r $RANDFILE -o $privzone $privzonefile > /dev/null
+$SIGNER -g -r $RANDFILE -o $privzone $privzonefile > /dev/null
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: genzone.sh,v 1.3 2002/02/20 03:33:46 marka Exp $
+# $Id: genzone.sh,v 1.4 2003/09/30 05:56:06 marka Exp $
#
# Set up a test zone
nsap-ptr01 NSAP-PTR .
; type 24
-sig01 SIG NXT 1 3 ( 3600 20000102030405
- 19961211100908 2143 foo.nil.
- MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
- kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
- VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
+;sig01 SIG NXT 1 3 ( 3600 20000102030405
+; 19961211100908 2143 foo.nil.
+; MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
+; kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
+; VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
; type 25
-key01 KEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
- 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
- sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
- a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
+;key01 KEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
+; 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
+; sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
+; a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
; type 26
px01 PX 65535 foo. bar.
2000.00m 20.00m )
; type 30
-nxt01 NXT a.secure.nil. ( NS SOA MX SIG KEY LOC NXT )
-nxt02 NXT . NXT NSAP-PTR
-nxt03 NXT . 1
-nxt04 NXT . 127
+;nxt01 NXT a.secure.nil. ( NS SOA MX RRSIG KEY LOC NXT )
+;nxt02 NXT . NXT NSAP-PTR
+;nxt03 NXT . 1
+;nxt04 NXT . 127
; type 33
srv01 SRV 0 0 0 .
; type 41
; OPT is a meta-type and should never occur in master files.
+; type 46
+rrsig01 RRSIG NSEC 1 3 ( 3600 20000102030405
+ 19961211100908 2143 foo.nil.
+ MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
+ kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
+ VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
+
+; type 47
+nsec01 NSEC a.secure.nil. ( NS SOA MX RRSIG DNSKEY LOC NSEC )
+nsec02 NSEC . NSEC NSAP-PTR
+nsec03 NSEC . 1
+nsec04 NSEC . 127
+
+; type 48
+dnskey01 DNSKEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY
+ 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV
+ sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg
+ a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
+
; type 249
; TKEY is a meta-type and should never occur in master files.
; The text representation is not specified in the draft.
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: tests.sh,v 1.5 2001/01/09 21:43:18 bwelling Exp $
+# $Id: tests.sh,v 1.6 2003/09/30 05:56:07 marka Exp $
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
$DIG +norec @10.53.0.1 -p 5300 foo.bar.xx. a >dig.out || status=1
$PERL ../digcomp.pl xx.good dig.out || status=1
-echo "I:testing that we find glue A/AAAA/A6 RRs in the cache"
+echo "I:testing that we find glue A/AAAA RRs in the cache"
$DIG +norec @10.53.0.1 -p 5300 foo.bar.yy. a >dig.out || status=1
$PERL ../digcomp.pl yy.good dig.out || status=1
;; ADDITIONAL SECTION:
ns.zz. 3463 IN A 10.0.0.1
-ns.zz. 86263 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
ns.zz. 86263 IN AAAA 10::1
; NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
; WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-; $Id: example1.db,v 1.13 2003/07/08 05:17:20 marka Exp $
+; $Id: example1.db,v 1.14 2003/09/30 05:56:08 marka Exp $
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
8.8.7.7 DNAME net
0.0.f.f.e.e.d.d.c.c.b.b.a.a.9.9.net PTR dname
e A 10.0.1.1
- SIG A 1 1 300 20001202003412 (
+ RRSIG A 1 1 300 20001202003412 (
20001102003412 1 example. abcd )
a.example.nil. 300 IN PTR foo.net.
a01.example.nil. 3600 IN A 0.0.0.0
a02.example.nil. 3600 IN A 255.255.255.255
-a601.example.nil. 3600 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-a601.example.nil. 3600 IN A6 64 ::ffff:ffff:ffff:ffff foo.
-a601.example.nil. 3600 IN A6 127 ::1 foo.
-a601.example.nil. 3600 IN A6 128 .
+a601.example.nil. 3600 IN AAAA ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
afsdb01.example.nil. 3600 IN AFSDB 0 hostname.example.nil.
afsdb02.example.nil. 3600 IN AFSDB 65535 .
b.example.nil. 300 IN CNAME foo.net.
a.example.nil. 300 IN PTR foo.net.
a01.example.nil. 3600 IN A 0.0.0.0
a02.example.nil. 3600 IN A 255.255.255.255
-a601.example.nil. 3600 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-a601.example.nil. 3600 IN A6 64 ::ffff:ffff:ffff:ffff foo.
-a601.example.nil. 3600 IN A6 127 ::1 foo.
-a601.example.nil. 3600 IN A6 128 .
+a601.example.nil. 3600 IN AAAA ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
afsdb01.example.nil. 3600 IN AFSDB 0 hostname.example.nil.
afsdb02.example.nil. 3600 IN AFSDB 65535 .
b.example.nil. 300 IN CNAME foo.net.
isdn02.example. 3600 IN ISDN "isdn-address" "subaddress"
isdn03.example. 3600 IN ISDN "isdn-address"
isdn04.example. 3600 IN ISDN "isdn-address" "subaddress"
-key01.example. 3600 IN KEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+dnskey01.example. 3600 IN DNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
kx01.example. 3600 IN KX 10 kdc.example.
kx02.example. 3600 IN KX 10 .
loc01.example. 3600 IN LOC 60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
nsap-ptr01.example. 3600 IN NSAP-PTR foo.
nsap01.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100
nsap02.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100
-nxt01.example. 3600 IN NXT a.secure.nil. NS SOA MX SIG KEY LOC NXT
-nxt02.example. 3600 IN NXT . NSAP-PTR NXT
-nxt03.example. 3600 IN NXT . A
-nxt04.example. 3600 IN NXT . 127
+nsec01.example. 3600 IN NSEC a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY
+nsec02.example. 3600 IN NSEC . NSAP-PTR NSEC
+nsec03.example. 3600 IN NSEC . A
+nsec04.example. 3600 IN NSEC . 127
ptr01.example. 3600 IN PTR example.
px01.example. 3600 IN PX 65535 foo. bar.
px02.example. 3600 IN PX 65535 . .
rp02.example. 3600 IN RP . .
rt01.example. 3600 IN RT 0 intermediate-host.example.
rt02.example. 3600 IN RT 65535 .
-sig01.example. 3600 IN SIG NXT 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+rrsig01.example. 3600 IN RRSIG NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
srv01.example. 3600 IN SRV 0 0 0 .
srv02.example. 3600 IN SRV 65535 65535 65535 old-slow-box.example.
txt01.example. 3600 IN TXT "foo"
isdn02.example. 3600 IN ISDN "isdn-address" "subaddress"
isdn03.example. 3600 IN ISDN "isdn-address"
isdn04.example. 3600 IN ISDN "isdn-address" "subaddress"
-key01.example. 3600 IN KEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+dnskey01.example. 3600 IN DNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
kx01.example. 3600 IN KX 10 kdc.example.
kx02.example. 3600 IN KX 10 .
loc01.example. 3600 IN LOC 60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
nsap-ptr01.example. 3600 IN NSAP-PTR foo.
nsap01.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100
nsap02.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100
-nxt01.example. 3600 IN NXT a.secure.nil. NS SOA MX SIG KEY LOC NXT
-nxt02.example. 3600 IN NXT . NSAP-PTR NXT
-nxt03.example. 3600 IN NXT . A
-nxt04.example. 3600 IN NXT . 127
+nsec01.example. 3600 IN NSEC a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY
+nsec02.example. 3600 IN NSEC . NSAP-PTR NSEC
+nsec03.example. 3600 IN NSEC . A
+nsec04.example. 3600 IN NSEC . 127
ptr01.example. 3600 IN PTR example.
px01.example. 3600 IN PX 65535 foo. bar.
px02.example. 3600 IN PX 65535 . .
rp02.example. 3600 IN RP . .
rt01.example. 3600 IN RT 0 intermediate-host.example.
rt02.example. 3600 IN RT 65535 .
-sig01.example. 3600 IN SIG NXT 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+rrsig01.example. 3600 IN RRSIG NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
srv01.example. 3600 IN SRV 0 0 0 .
srv02.example. 3600 IN SRV 65535 65535 65535 old-slow-box.example.
txt01.example. 3600 IN TXT "foo"
; NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
; WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-; $Id: example.db,v 1.8 2002/11/27 09:52:50 marka Exp $
+; $Id: example.db,v 1.9 2003/09/30 05:56:10 marka Exp $
$ORIGIN .
$TTL 300 ; 5 minutes
isdn02 ISDN "isdn-address" "subaddress"
isdn03 ISDN "isdn-address"
isdn04 ISDN "isdn-address" "subaddress"
-key01 KEY 512 255 1 (
+dnskey01 DNSKEY 512 255 1 (
AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aR
yzWZriO6i2odGWWQVucZqKVsENW91IOW4vqudngPZsY3
GvQ/xVA8/7pyFj6b7Esga60zyGW6LFe9r8n6paHrlG5o
NSAP-PTR .
nsap01 NSAP 0x47000580005a0000000001e133ffffff00016100
nsap02 NSAP 0x47000580005a0000000001e133ffffff00016100
-nxt01 NXT a.secure ( NS SOA MX SIG KEY LOC NXT )
-nxt02 NXT . ( NSAP-PTR NXT )
-nxt03 NXT . ( A )
-nxt04 NXT . ( 127 )
+nsec01 NSEC a.secure ( NS SOA MX RRSIG DNSKEY LOC NSEC )
+nsec02 NSEC . ( NSAP-PTR NSEC )
+nsec03 NSEC . ( A )
+nsec04 NSEC . ( 127 )
ptr01 PTR example.
px01 PX 65535 foo. bar.
px02 PX 65535 . .
ns A 73.80.65.49
$ORIGIN example.
$TTL 3600 ; 1 hour
-sig01 SIG NXT 1 3 3600 20000102030405 (
+rrsig01 RRSIG NSEC 1 3 3600 20000102030405 (
19961211100908 2143 foo
MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgi
WCn/GxHhai6VAuHAoNUz4YoU1tVfSCSqQYn6//11U6Nl
txt11 TXT "\"foo\""
txt12 TXT "\"foo\""
$TTL 300 ; 5 minutes
-u TXT "txt-not-in-nxt"
+u TXT "txt-not-in-nsec"
$ORIGIN u.example.
a A 73.80.65.49
b A 73.80.65.49
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.137 2003/02/26 05:05:15 marka Exp $
+# $Id: Makefile.in,v 1.138 2003/09/30 05:56:10 marka Exp $
srcdir = @srcdir@
VPATH = @srcdir@
dnssec.@O@ ds.@O@ forward.@O@ journal.@O@ keytable.@O@ \
lib.@O@ log.@O@ lookup.@O@ \
master.@O@ masterdump.@O@ message.@O@ \
- name.@O@ ncache.@O@ nxt.@O@ order.@O@ peer.@O@ portlist.@O@ \
+ name.@O@ ncache.@O@ nsec.@O@ order.@O@ peer.@O@ portlist.@O@ \
rbt.@O@ rbtdb.@O@ rbtdb64.@O@ rdata.@O@ rdatalist.@O@ \
rdataset.@O@ rdatasetiter.@O@ rdataslab.@O@ request.@O@ \
resolver.@O@ result.@O@ rootns.@O@ sdb.@O@ soa.@O@ ssu.@O@ \
dnssec.c ds.c forward.c journal.c keytable.c \
lib.c log.c lookup.c \
master.c masterdump.c message.c \
- name.c ncache.c nxt.c order.c peer.c portlist.c \
+ name.c ncache.c nsec.c order.c peer.c portlist.c \
rbt.c rbtdb.c rbtdb64.c rdata.c rdatalist.c \
rdataset.c rdatasetiter.c rdataslab.c request.c \
resolver.c result.c rootns.c sdb.c soa.c ssu.c \
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: cache.c,v 1.53 2002/05/23 04:32:28 marka Exp $ */
+/* $Id: cache.c,v 1.54 2003/09/30 05:56:10 marka Exp $ */
#include <config.h>
dns_rdatatype_t covers;
dns_rdataset_current(&rdataset, &rdata);
- if (rdata.type == dns_rdatatype_sig)
+ if (rdata.type == dns_rdatatype_rrsig)
covers = dns_rdata_covers(&rdata);
else
covers = 0;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: db.c,v 1.70 2001/09/04 12:17:13 marka Exp $ */
+/* $Id: db.c,v 1.71 2003/09/30 05:56:10 marka Exp $ */
/***
*** Imports
*/
REQUIRE(DNS_DB_VALID(db));
- REQUIRE(type != dns_rdatatype_sig);
+ REQUIRE(type != dns_rdatatype_rrsig);
REQUIRE(nodep == NULL || (nodep != NULL && *nodep == NULL));
REQUIRE(dns_name_hasbuffer(foundname));
REQUIRE(rdataset == NULL ||
REQUIRE(node != NULL);
REQUIRE(DNS_RDATASET_VALID(rdataset));
REQUIRE(! dns_rdataset_isassociated(rdataset));
- REQUIRE(covers == 0 || type == dns_rdatatype_sig);
+ REQUIRE(covers == 0 || type == dns_rdatatype_rrsig);
REQUIRE(type != dns_rdatatype_any);
REQUIRE(sigrdataset == NULL ||
(DNS_RDATASET_VALID(sigrdataset) &&
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: diff.c,v 1.6 2002/08/06 14:33:08 marka Exp $ */
+/* $Id: diff.c,v 1.7 2003/09/30 05:56:10 marka Exp $ */
#include <config.h>
static dns_rdatatype_t
rdata_covers(dns_rdata_t *rdata) {
- return (rdata->type == dns_rdatatype_sig ?
+ return (rdata->type == dns_rdatatype_rrsig ?
dns_rdata_covers(rdata) : 0);
}
*/
/*
- * $Id: dnssec.c,v 1.76 2002/11/15 21:25:21 marka Exp $
+ * $Id: dnssec.c,v 1.77 2003/09/30 05:56:10 marka Exp $
*/
}
static isc_result_t
-digest_sig(dst_context_t *ctx, dns_rdata_t *sigrdata, dns_rdata_sig_t *sig) {
+digest_sig(dst_context_t *ctx, dns_rdata_t *sigrdata, dns_rdata_rrsig_t *sig) {
isc_region_t r;
isc_result_t ret;
dns_fixedname_t fname;
isc_stdtime_t *inception, isc_stdtime_t *expire,
isc_mem_t *mctx, isc_buffer_t *buffer, dns_rdata_t *sigrdata)
{
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
dns_rdata_t tmpsigrdata;
dns_rdata_t *rdatas;
int nrdatas, i;
sig.mctx = mctx;
sig.common.rdclass = set->rdclass;
- sig.common.rdtype = dns_rdatatype_sig;
+ sig.common.rdtype = dns_rdatatype_rrsig;
ISC_LINK_INIT(&sig.common, link);
dns_name_init(&sig.signer, NULL);
isc_boolean_t ignoretime, isc_mem_t *mctx,
dns_rdata_t *sigrdata)
{
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
dns_fixedname_t fnewname;
isc_region_t r;
isc_buffer_t envbuf;
REQUIRE(set != NULL);
REQUIRE(key != NULL);
REQUIRE(mctx != NULL);
- REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_sig);
+ REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_rrsig);
ret = dns_rdata_tostruct(sigrdata, &sig, NULL);
if (ret != ISC_R_SUCCESS)
*nkeys = 0;
dns_rdataset_init(&rdataset);
- RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_key, 0, 0,
+ RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0,
&rdataset, NULL));
RETERR(dns_rdataset_first(&rdataset));
while (result == ISC_R_SUCCESS && count < maxkeys) {
isc_result_t
dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
- dns_rdata_sig_t sig;
+ dns_rdata_sig_t sig; /* SIG(0) */
unsigned char data[512];
unsigned char header[DNS_MESSAGE_HEADERLEN];
isc_buffer_t headerbuf, databuf, sigbuf;
mctx = msg->mctx;
- memset(&sig, 0, sizeof(dns_rdata_sig_t));
+ memset(&sig, 0, sizeof(sig));
sig.mctx = mctx;
sig.common.rdclass = dns_rdataclass_any;
- sig.common.rdtype = dns_rdatatype_sig;
+ sig.common.rdtype = dns_rdatatype_sig; /* SIG(0) */
ISC_LINK_INIT(&sig.common, link);
sig.covered = 0;
* is identical to dns format.
*/
RETERR(dns_rdata_fromstruct(NULL, dns_rdataclass_any,
- dns_rdatatype_sig, &sig, &databuf));
+ dns_rdatatype_sig /* SIG(0) */,
+ &sig, &databuf));
isc_buffer_usedregion(&databuf, &r);
RETERR(dst_context_adddata(ctx, &r));
RETERR(dns_message_gettemprdata(msg, &rdata));
RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
- dns_rdatatype_sig, &sig, dynbuf));
+ dns_rdatatype_rrsig, &sig, dynbuf));
isc_mem_put(mctx, sig.signature, sig.siglen);
signeedsfree = ISC_FALSE;
datalist = NULL;
RETERR(dns_message_gettemprdatalist(msg, &datalist));
datalist->rdclass = dns_rdataclass_any;
- datalist->type = dns_rdatatype_sig;
+ datalist->type = dns_rdatatype_rrsig;
datalist->covers = 0;
datalist->ttl = 0;
ISC_LIST_INIT(datalist->rdata);
dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
dst_key_t *key)
{
- dns_rdata_sig_t sig;
+ dns_rdata_rrsig_t sig;
unsigned char header[DNS_MESSAGE_HEADERLEN];
dns_rdata_t rdata = DNS_RDATA_INIT;
isc_region_t r, source_r, sig_r, header_r;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: ds.c,v 1.2 2002/06/17 04:01:18 marka Exp $ */
+/* $Id: ds.c,v 1.3 2003/09/30 05:56:10 marka Exp $ */
#include <config.h>
isc_buffer_t b;
dns_rdata_ds_t ds;
+ REQUIRE(key != NULL);
+ REQUIRE(key->type == dns_rdatatype_dnskey);
+
if (digest_type != DNS_DSDIGEST_SHA1)
return (ISC_R_NOTIMPLEMENTED);
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.48 2003/02/26 05:05:15 marka Exp $
+# $Id: Makefile.in,v 1.49 2003/09/30 05:56:16 marka Exp $
srcdir = @srcdir@
VPATH = @srcdir@
dnssec.h ds.h events.h fixedname.h journal.h keyflags.h \
keytable.h keyvalues.h lib.h log.h master.h masterdump.h \
message.h name.h ncache.h \
- nxt.h peer.h portlist.h rbt.h rcode.h \
+ nsec.h peer.h portlist.h rbt.h rcode.h \
rdata.h rdataclass.h rdatalist.h rdataset.h rdatasetiter.h \
rdataslab.h rdatatype.h request.h resolver.h result.h \
rootns.h sdb.h secalg.h secproto.h soa.h ssu.h \
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: db.h,v 1.72 2003/02/26 01:21:09 marka Exp $ */
+/* $Id: db.h,v 1.73 2003/09/30 05:56:16 marka Exp $ */
#ifndef DNS_DB_H
#define DNS_DB_H 1
#define DNS_DBFIND_NOWILD 0x04
#define DNS_DBFIND_PENDINGOK 0x08
#define DNS_DBFIND_NOEXACT 0x10
-#define DNS_DBFIND_FORCENXT 0x20
+#define DNS_DBFIND_FORCENSEC 0x20
/*
* Options that can be specified for dns_db_addrdataset().
* If the DNS_DBFIND_NOWILD option is set, then wildcard matching will
* be disabled. This option is only meaningful for zone databases.
*
- * If the DNS_DBFIND_FORCENXT option is set, the database is assumed to
- * have NXT records, and these will be returned when appropriate. This
+ * If the DNS_DBFIND_FORCENSEC option is set, the database is assumed to
+ * have NSEC records, and these will be returned when appropriate. This
* is only necessary when querying a database that was not secure
* when created.
*
* ISC_R_NOMEMORY
*
* DNS_R_BADDB Data that is required to be
- * present in the DB, e.g. an NXT
+ * present in the DB, e.g. an NSEC
* record in a secure zone, is not
* present.
*
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: message.h,v 1.111 2003/01/10 02:43:56 marka Exp $ */
+/* $Id: message.h,v 1.112 2003/09/30 05:56:16 marka Exp $ */
#ifndef DNS_MESSAGE_H
#define DNS_MESSAGE_H 1
*
* 'type' be a valid type.
*
- * If 'type' is dns_rdatatype_sig, 'covers' must be a valid type.
+ * If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
* Otherwise it should be 0.
*
* Returns:
*
* 'type' be a valid type, and NOT dns_rdatatype_any.
*
- * If 'type' is dns_rdatatype_sig, 'covers' must be a valid type.
+ * If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
* Otherwise it should be 0.
*
* Returns:
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nxt.h,v 1.12 2001/01/09 21:53:08 bwelling Exp $ */
+/* $Id: nsec.h,v 1.2 2003/09/30 06:00:39 marka Exp $ */
-#ifndef DNS_NXT_H
-#define DNS_NXT_H 1
+#ifndef DNS_NSEC_H
+#define DNS_NSEC_H 1
#include <isc/lang.h>
#include <dns/types.h>
-#define DNS_NXT_BUFFERSIZE (256 + 16)
+#define DNS_NSEC_BUFFERSIZE (256 + 16)
ISC_LANG_BEGINDECLS
isc_result_t
-dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version,
- dns_dbnode_t *node, dns_name_t *target,
- unsigned char *buffer, dns_rdata_t *rdata);
+dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
+ dns_dbnode_t *node, dns_name_t *target,
+ unsigned char *buffer, dns_rdata_t *rdata);
/*
- * Build the rdata of a NXT record.
+ * Build the rdata of a NSEC record.
*
* Requires:
* buffer Points to a temporary buffer of at least
- * DNS_NXT_BUFFERSIZE bytes.
+ * DNS_NSEC_BUFFERSIZE bytes.
* rdata Points to an initialized dns_rdata_t.
*
* Ensures:
- * *rdata Contains a valid NXT rdata. The 'data' member refers
+ * *rdata Contains a valid NSEC rdata. The 'data' member refers
* to 'buffer'.
*/
isc_result_t
-dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
- dns_name_t *target, dns_ttl_t ttl);
+dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
+ dns_name_t *target, dns_ttl_t ttl);
/*
- * Build a NXT record and add it to a database.
+ * Build a NSEC record and add it to a database.
*/
isc_boolean_t
-dns_nxt_typepresent(dns_rdata_t *nxt, dns_rdatatype_t type);
+dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type);
/*
- * Determine if a type is marked as present in an NXT record.
+ * Determine if a type is marked as present in an NSEC record.
*
* Requires:
- * 'nxt' points to a valid rdataset of type NXT
+ * 'nsec' points to a valid rdataset of type NSEC
* 'type' < 128
*
*/
ISC_LANG_ENDDECLS
-#endif /* DNS_NXT_H */
+#endif /* DNS_NSEC_H */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rdata.h,v 1.56 2003/07/30 00:54:27 marka Exp $ */
+/* $Id: rdata.h,v 1.57 2003/09/30 05:56:17 marka Exp $ */
#ifndef DNS_RDATA_H
#define DNS_RDATA_H 1
dns_rdatatype_iszonecutauth(dns_rdatatype_t type);
/*
* Return true iff rdata of type 'type' is considered authoritative
- * data (not glue) in the NXT chain when it occurs in the parent zone
+ * data (not glue) in the NSEC chain when it occurs in the parent zone
* at a zone cut.
*
* Requires:
#define DNS_RDATATYPEATTR_EXCLUSIVE 0x00000002U
/* Is a meta type */
#define DNS_RDATATYPEATTR_META 0x00000004U
-/* Is a DNSSEC type, like SIG or NXT */
+/* Is a DNSSEC type, like RRSIG or NSEC */
#define DNS_RDATATYPEATTR_DNSSEC 0x00000008U
/* Is a zone cut authority type */
#define DNS_RDATATYPEATTR_ZONECUTAUTH 0x00000010U
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: result.h,v 1.98 2003/04/17 03:43:35 marka Exp $ */
+/* $Id: result.h,v 1.99 2003/09/30 05:56:17 marka Exp $ */
#ifndef DNS_RESULT_H
#define DNS_RESULT_H 1
#define DNS_R_ALIAS (ISC_RESULTCLASS_DNS + 57)
#define DNS_R_USETCP (ISC_RESULTCLASS_DNS + 58)
#define DNS_R_NOVALIDSIG (ISC_RESULTCLASS_DNS + 59)
-#define DNS_R_NOVALIDNXT (ISC_RESULTCLASS_DNS + 60)
+#define DNS_R_NOVALIDNSEC (ISC_RESULTCLASS_DNS + 60)
#define DNS_R_NOTINSECURE (ISC_RESULTCLASS_DNS + 61)
#define DNS_R_UNKNOWNSERVICE (ISC_RESULTCLASS_DNS + 62)
#define DNS_R_RECOVERABLE (ISC_RESULTCLASS_DNS + 63)
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: ssu.h,v 1.11 2001/01/09 21:53:29 bwelling Exp $ */
+/* $Id: ssu.h,v 1.12 2003/09/30 05:56:17 marka Exp $ */
#ifndef DNS_SSU_H
#define DNS_SSU_H 1
* to be updated matches the signing identity.
*
* If 'ntypes' is 0, this rule applies to all types except
- * NS, SOA, SIG, and NXT.
+ * NS, SOA, RRSIG, and NSEC.
*
* If 'types' includes ANY, this rule applies to all types
- * except NXT.
+ * except NSEC.
*
* Requires:
* 'table' is a valid SSU table
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: validator.h,v 1.23 2003/04/10 02:06:51 marka Exp $ */
+/* $Id: validator.h,v 1.24 2003/09/30 05:56:17 marka Exp $ */
#ifndef DNS_VALIDATOR_H
#define DNS_VALIDATOR_H 1
#include <dns/fixedname.h>
#include <dns/types.h>
#include <dns/rdataset.h>
-#include <dns/rdatastruct.h> /* for dns_rdata_sig_t */
+#include <dns/rdatastruct.h> /* for dns_rdata_rrsig_t */
#include <dst/dst.h>
dns_keytable_t * keytable;
dns_keynode_t * keynode;
dst_key_t * key;
- dns_rdata_sig_t * siginfo;
+ dns_rdata_rrsig_t * siginfo;
isc_task_t * task;
isc_taskaction_t action;
void * arg;
dns_rdataset_t * keyset;
dns_rdataset_t * dsset;
dns_rdataset_t * soaset;
- dns_rdataset_t * nxtset;
+ dns_rdataset_t * nsecset;
dns_name_t * soaname;
dns_rdataset_t frdataset;
dns_rdataset_t fsigrdataset;
* null key.
*
* The complete response message may be given in 'message',
- * to make available any authority section NXTs that may be
+ * to make available any authority section NSECs that may be
* needed for validation of a response resulting from a
* wildcard expansion (though no such wildcard validation
* is implemented yet). If the complete response message
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: view.h,v 1.86 2003/09/19 14:35:03 marka Exp $ */
+/* $Id: view.h,v 1.87 2003/09/30 05:56:17 marka Exp $ */
#ifndef DNS_VIEW_H
#define DNS_VIEW_H 1
* 'name' is valid name.
*
* 'type' is a valid dns_rdatatype_t, and is not a meta query type
- * (e.g. dns_rdatatype_any), or dns_rdatatype_sig.
+ * (e.g. dns_rdatatype_any), or dns_rdatatype_rrsig.
*
* 'rdataset' is a valid, disassociated rdataset.
*
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: lookup.c,v 1.10 2001/11/12 19:05:17 gson Exp $ */
+/* $Id: lookup.c,v 1.11 2003/09/30 05:56:10 marka Exp $ */
#include <config.h>
dns_name_t *name = dns_fixedname_name(&lookup->name);
dns_rdatatype_t type;
- if (lookup->type == dns_rdatatype_sig)
+ if (lookup->type == dns_rdatatype_rrsig)
type = dns_rdatatype_any;
else
type = lookup->type;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: master.c,v 1.145 2003/04/17 11:31:02 marka Exp $ */
+/* $Id: master.c,v 1.146 2003/09/30 05:56:11 marka Exp $ */
#include <config.h>
isc_boolean_t ttl_known;
isc_boolean_t default_ttl_known;
isc_boolean_t warn_1035;
+ isc_boolean_t warn_tcr;
isc_boolean_t warn_sigexpired;
isc_boolean_t seen_include;
isc_uint32_t ttl;
lctx->default_ttl_known = ISC_FALSE;
lctx->default_ttl = 0;
lctx->warn_1035 = ISC_TRUE; /* XXX Argument? */
+ lctx->warn_tcr = ISC_TRUE; /* XXX Argument? */
lctx->warn_sigexpired = ISC_TRUE; /* XXX Argument? */
lctx->options = options;
lctx->seen_include = ISC_FALSE;
}
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
covers = dns_rdata_covers(&rdata[rdcount]);
else
covers = 0;
lctx->warn_1035 = ISC_FALSE;
}
- if (type == dns_rdatatype_sig && lctx->warn_sigexpired) {
- dns_rdata_sig_t sig;
+ if (type == dns_rdatatype_rrsig && lctx->warn_sigexpired) {
+ dns_rdata_rrsig_t sig;
(void)dns_rdata_tostruct(&rdata[rdcount], &sig, NULL);
if (isc_serial_lt(sig.timeexpire, now)) {
(*callbacks->warn)(callbacks,
}
}
+ if ((type == dns_rdatatype_sig || type == dns_rdatatype_nxt) &&
+ lctx->warn_tcr && (lctx->options & DNS_MASTER_ZONE) != 0 &&
+ (lctx->options & DNS_MASTER_SLAVE) == 0) {
+ (*callbacks->warn)(callbacks, "%s:%lu: old style DNSSEC "
+ " zone detected", source, line);
+ lctx->warn_tcr = ISC_FALSE;
+ }
+
if ((lctx->options & DNS_MASTER_AGETTL) != 0) {
/*
* Adjust the TTL for $DATE. If the RR has already
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: masterdump.c,v 1.68 2003/06/18 05:42:45 marka Exp $ */
+/* $Id: masterdump.c,v 1.69 2003/09/30 05:56:12 marka Exp $ */
#include <config.h>
dump_order(const dns_rdataset_t *rds) {
int t;
int sig;
- if (rds->type == dns_rdatatype_sig) {
+ if (rds->type == dns_rdatatype_rrsig) {
t = rds->covers;
sig = 1;
} else {
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: message.c,v 1.218 2003/09/11 01:49:16 marka Exp $ */
+/* $Id: message.c,v 1.219 2003/09/30 05:56:12 marka Exp $ */
/***
*** Imports
if (msg->opcode != dns_opcode_update
&& rdtype != dns_rdatatype_tsig
&& rdtype != dns_rdatatype_opt
- && rdtype != dns_rdatatype_key /* in a TKEY query */
+ && rdtype != dns_rdatatype_dnskey /* in a TKEY query */
&& rdtype != dns_rdatatype_sig /* SIG(0) */
&& rdtype != dns_rdatatype_tkey /* Win2000 TKEY */
&& msg->rdclass != rdclass)
if (result != ISC_R_SUCCESS)
goto cleanup;
rdata->rdclass = rdclass;
- issigzero = ISC_FALSE;
- if (rdtype == dns_rdatatype_sig && rdata->flags == 0) {
+ if (rdtype == dns_rdatatype_rrsig &&
+ rdata->flags == 0) {
covers = dns_rdata_covers(rdata);
- if (covers == 0) {
+ if (covers == 0)
+ DO_FORMERR;
+ } else
+ covers = 0;
+
+ issigzero = ISC_FALSE;
+ if (rdtype == dns_rdatatype_sig /* SIG(0) */ &&
+ rdata->flags == 0) {
+ if (dns_rdata_covers(rdata) == 0) {
if (sectionid != DNS_SECTION_ADDITIONAL ||
count != msg->counts[sectionid] - 1)
DO_FORMERR;
skip_type_search = ISC_TRUE;
issigzero = ISC_TRUE;
}
- } else
- covers = 0;
+ }
/*
* If we are doing a dynamic update or this is a meta-type,
else
pass_needed = 3;
break;
- case dns_rdatatype_sig:
- case dns_rdatatype_key:
+ case dns_rdatatype_rrsig:
+ case dns_rdatatype_dnskey:
pass_needed = 2;
break;
default:
if (view == NULL)
return (DNS_R_KEYUNAUTHORIZED);
result = dns_view_simplefind(view, &sig.signer,
- dns_rdatatype_key, 0, 0,
- ISC_FALSE, &keyset, NULL);
+ dns_rdatatype_key /* SIG(0) */,
+ 0, 0, ISC_FALSE, &keyset, NULL);
if (result != ISC_R_SUCCESS) {
/* XXXBEW Should possibly create a fetch here */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: ncache.c,v 1.33 2003/09/17 05:24:42 marka Exp $ */
+/* $Id: ncache.c,v 1.34 2003/09/30 05:56:12 marka Exp $ */
#include <config.h>
DNS_RDATASETATTR_NCACHE) == 0)
continue;
type = rdataset->type;
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
type = rdataset->covers;
if (type == dns_rdatatype_soa ||
- type == dns_rdatatype_nxt) {
+ type == dns_rdatatype_nsec) {
if (ttl > rdataset->ttl)
ttl = rdataset->ttl;
if (trust > rdataset->trust)
REQUIRE(ncacherdataset->type == 0);
REQUIRE(name != NULL);
REQUIRE(!dns_rdataset_isassociated(rdataset));
- REQUIRE(type != dns_rdatatype_sig);
+ REQUIRE(type != dns_rdatatype_rrsig);
result = dns_rdataset_first(ncacherdataset);
if (result != ISC_R_SUCCESS)
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nxt.c,v 1.26 2001/01/09 21:51:09 bwelling Exp $ */
+/* $Id: nsec.c,v 1.2 2003/09/30 06:00:39 marka Exp $ */
#include <config.h>
#include <isc/util.h>
#include <dns/db.h>
-#include <dns/nxt.h>
+#include <dns/nsec.h>
#include <dns/rdata.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
}
isc_result_t
-dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version,
- dns_dbnode_t *node, dns_name_t *target,
- unsigned char *buffer, dns_rdata_t *rdata)
+dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
+ dns_dbnode_t *node, dns_name_t *target,
+ unsigned char *buffer, dns_rdata_t *rdata)
{
isc_result_t result;
dns_rdataset_t rdataset;
isc_region_t r;
int i;
- unsigned char *nxt_bits;
+ unsigned char *nsec_bits;
unsigned int max_type;
dns_rdatasetiter_t *rdsiter;
- memset(buffer, 0, DNS_NXT_BUFFERSIZE);
+ memset(buffer, 0, DNS_NSEC_BUFFERSIZE);
dns_name_toregion(target, &r);
memcpy(buffer, r.base, r.length);
r.base = buffer;
- nxt_bits = r.base + r.length;
- set_bit(nxt_bits, dns_rdatatype_nxt, 1);
- max_type = dns_rdatatype_nxt;
+ nsec_bits = r.base + r.length;
+ set_bit(nsec_bits, dns_rdatatype_nsec, 1);
+ max_type = dns_rdatatype_nsec;
dns_rdataset_init(&rdataset);
rdsiter = NULL;
result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
if (rdataset.type > 127)
/* XXX "rdataset type too large" */
return (ISC_R_RANGE);
- if (rdataset.type != dns_rdatatype_nxt) {
+ if (rdataset.type != dns_rdatatype_nsec) {
if (rdataset.type > max_type)
max_type = rdataset.type;
- set_bit(nxt_bits, rdataset.type, 1);
+ set_bit(nsec_bits, rdataset.type, 1);
}
dns_rdataset_disassociate(&rdataset);
}
/*
* At zone cuts, deny the existence of glue in the parent zone.
*/
- if (bit_isset(nxt_bits, dns_rdatatype_ns) &&
- ! bit_isset(nxt_bits, dns_rdatatype_soa)) {
+ if (bit_isset(nsec_bits, dns_rdatatype_ns) &&
+ ! bit_isset(nsec_bits, dns_rdatatype_soa)) {
for (i = 0; i < 128; i++) {
- if (bit_isset(nxt_bits, i) &&
+ if (bit_isset(nsec_bits, i) &&
! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i))
- set_bit(nxt_bits, i, 0);
+ set_bit(nsec_bits, i, 0);
}
}
return (result);
r.length += ((max_type + 7) / 8);
- INSIST(r.length <= DNS_NXT_BUFFERSIZE);
+ INSIST(r.length <= DNS_NSEC_BUFFERSIZE);
dns_rdata_fromregion(rdata,
dns_db_class(db),
- dns_rdatatype_nxt,
+ dns_rdatatype_nsec,
&r);
return (ISC_R_SUCCESS);
isc_result_t
-dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
- dns_name_t *target, dns_ttl_t ttl)
+dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
+ dns_name_t *target, dns_ttl_t ttl)
{
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
- unsigned char data[DNS_NXT_BUFFERSIZE];
+ unsigned char data[DNS_NSEC_BUFFERSIZE];
dns_rdatalist_t rdatalist;
dns_rdataset_t rdataset;
dns_rdataset_init(&rdataset);
dns_rdata_init(&rdata);
- RETERR(dns_nxt_buildrdata(db, version, node, target, data, &rdata));
+ RETERR(dns_nsec_buildrdata(db, version, node, target, data, &rdata));
rdatalist.rdclass = dns_db_class(db);
- rdatalist.type = dns_rdatatype_nxt;
+ rdatalist.type = dns_rdatatype_nsec;
rdatalist.covers = 0;
rdatalist.ttl = ttl;
ISC_LIST_INIT(rdatalist.rdata);
}
isc_boolean_t
-dns_nxt_typepresent(dns_rdata_t *nxt, dns_rdatatype_t type) {
- dns_rdata_nxt_t nxtstruct;
+dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) {
+ dns_rdata_nsec_t nsecstruct;
isc_result_t result;
isc_boolean_t present;
- REQUIRE(nxt != NULL);
- REQUIRE(nxt->type == dns_rdatatype_nxt);
+ REQUIRE(nsec != NULL);
+ REQUIRE(nsec->type == dns_rdatatype_nsec);
REQUIRE(type < 128);
/* This should never fail */
- result = dns_rdata_tostruct(nxt, &nxtstruct, NULL);
+ result = dns_rdata_tostruct(nsec, &nsecstruct, NULL);
INSIST(result == ISC_R_SUCCESS);
- if (type >= nxtstruct.len * 8)
+ if (type >= nsecstruct.len * 8)
present = ISC_FALSE;
else
- present = ISC_TF(bit_isset(nxtstruct.typebits, type));
- dns_rdata_freestruct(&nxt);
+ present = ISC_TF(bit_isset(nsecstruct.typebits, type));
+ dns_rdata_freestruct(&nsec);
return (present);
}
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rbtdb.c,v 1.187 2003/04/17 01:56:34 marka Exp $ */
+/* $Id: rbtdb.c,v 1.188 2003/09/30 05:56:12 marka Exp $ */
/*
* Principal Author: Bob Halley
#define RBTDB_RDATATYPE_EXT(type) ((dns_rdatatype_t)((type) >> 16))
#define RBTDB_RDATATYPE_VALUE(b, e) (((e) << 16) | (b))
-#define RBTDB_RDATATYPE_SIGNXT \
- RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_nxt)
+#define RBTDB_RDATATYPE_SIGNSEC \
+ RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec)
#define RBTDB_RDATATYPE_SIGNS \
- RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_ns)
+ RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns)
#define RBTDB_RDATATYPE_SIGCNAME \
- RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_cname)
+ RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname)
#define RBTDB_RDATATYPE_SIGDNAME \
- RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_dname)
+ RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname)
#define RBTDB_RDATATYPE_NCACHEANY \
RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_any)
}
static inline isc_result_t
-find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep,
- dns_name_t *foundname, dns_rdataset_t *rdataset,
- dns_rdataset_t *sigrdataset, isc_boolean_t need_sig)
+find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
+ dns_name_t *foundname, dns_rdataset_t *rdataset,
+ dns_rdataset_t *sigrdataset, isc_boolean_t need_sig)
{
dns_rbtnode_t *node;
rdatasetheader_t *header, *header_next, *found, *foundsig;
header = header_next) {
header_next = header->next;
/*
- * Look for an active, extant NXT or SIG NXT.
+ * Look for an active, extant NSEC or RRSIG NSEC.
*/
do {
if (header->serial <= search->serial &&
* active rdataset at this node.
*/
empty_node = ISC_FALSE;
- if (header->type == dns_rdatatype_nxt) {
+ if (header->type == dns_rdatatype_nsec) {
found = header;
if (foundsig != NULL)
break;
} else if (header->type ==
- RBTDB_RDATATYPE_SIGNXT) {
+ RBTDB_RDATATYPE_SIGNSEC) {
foundsig = header;
if (found != NULL)
break;
(foundsig != NULL || !need_sig))
{
/*
- * We've found the right NXT record.
+ * We've found the right NSEC record.
*
* Note: for this to really be the right
- * NXT record, it's essential that the NXT
+ * NSEC record, it's essential that the NSEC
* records of any nodes obscured by a zone
* cut have been removed; we assume this is
* the case.
}
} else if (found == NULL && foundsig == NULL) {
/*
- * This node is active, but has no NXT or
- * SIG NXT. That means it's glue or
+ * This node is active, but has no NSEC or
+ * RRSIG NSEC. That means it's glue or
* other obscured zone data that isn't
* relevant for our search. Treat the
* node as if it were empty and keep looking.
} else {
/*
* We found an active node, but either the
- * NXT or the SIG NXT is missing. This
+ * NSEC or the RRSIG NSEC is missing. This
* shouldn't happen.
*/
result = DNS_R_BADDB;
/*
* If the result is ISC_R_NOMORE, then we got to the beginning of
- * the database and didn't find a NXT record. This shouldn't
+ * the database and didn't find a NSEC record. This shouldn't
* happen.
*/
if (result == ISC_R_NOMORE)
isc_boolean_t wild;
isc_boolean_t empty_node;
isc_mutex_t *lock;
- rdatasetheader_t *header, *header_next, *found, *nxtheader;
- rdatasetheader_t *foundsig, *cnamesig, *nxtsig;
+ rdatasetheader_t *header, *header_next, *found, *nsecheader;
+ rdatasetheader_t *foundsig, *cnamesig, *nsecsig;
rbtdb_rdatatype_t sigtype;
isc_boolean_t active;
dns_rbtnodechain_t chain;
* beneath a zonecut, and there's no matching wildcard.
*/
if (search.rbtdb->secure ||
- (search.options & DNS_DBFIND_FORCENXT) != 0)
+ (search.options & DNS_DBFIND_FORCENSEC) != 0)
{
- result = find_closest_nxt(&search, nodep, foundname,
+ result = find_closest_nsec(&search, nodep, foundname,
rdataset, sigrdataset,
search.rbtdb->secure);
if (result == ISC_R_SUCCESS)
* Certain DNSSEC types are not subject to CNAME matching
* (RFC 2535, section 2.3.5).
*
- * We don't check for SIG, because we don't store SIG records
+ * We don't check for RRSIG, because we don't store RRSIG records
* directly.
*/
- if (type == dns_rdatatype_key || type == dns_rdatatype_nxt)
+ if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec)
cname_ok = ISC_FALSE;
/*
found = NULL;
foundsig = NULL;
- sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type);
- nxtheader = NULL;
- nxtsig = NULL;
+ sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
+ nsecheader = NULL;
+ nsecsig = NULL;
cnamesig = NULL;
empty_node = ISC_TRUE;
for (header = node->data; header != NULL; header = header_next) {
maybe_zonecut = ISC_FALSE;
at_zonecut = ISC_TRUE;
if ((search.options & DNS_DBFIND_GLUEOK) == 0
- && type != dns_rdatatype_nxt
- && type != dns_rdatatype_key) {
+ && type != dns_rdatatype_nsec
+ && type != dns_rdatatype_dnskey) {
/*
* Glue is not OK, but any answer we
* could return would be glue. Return
* We may be finding a CNAME instead
* of the desired type.
*
- * If we've already got the CNAME SIG,
+ * If we've already got the CNAME RRSIG,
* use it, otherwise change sigtype
* so that we find it.
*/
break;
} else if (header->type == sigtype) {
/*
- * We've found the SIG rdataset for our
+ * We've found the RRSIG rdataset for our
* target type. Remember it.
*/
foundsig = header;
*/
if (!maybe_zonecut && found != NULL)
break;
- } else if (header->type == dns_rdatatype_nxt) {
+ } else if (header->type == dns_rdatatype_nsec) {
/*
- * Remember a NXT rdataset even if we're
+ * Remember a NSEC rdataset even if we're
* not specifically looking for it, because
* we might need it later.
*/
- nxtheader = header;
- } else if (header->type == RBTDB_RDATATYPE_SIGNXT) {
+ nsecheader = header;
+ } else if (header->type == RBTDB_RDATATYPE_SIGNSEC) {
/*
- * If we need the NXT rdataset, we'll also
+ * If we need the NSEC rdataset, we'll also
* need its signature.
*/
- nxtsig = header;
+ nsecsig = header;
} else if (cname_ok &&
header->type == RBTDB_RDATATYPE_SIGCNAME) {
/*
*/
result = DNS_R_NXRRSET;
if (search.rbtdb->secure &&
- (nxtheader == NULL || nxtsig == NULL)) {
+ (nsecheader == NULL || nsecsig == NULL)) {
/*
- * The zone is secure but there's no NXT,
- * or the NXT has no signature!
+ * The zone is secure but there's no NSEC,
+ * or the NSEC has no signature!
*/
if (!wild) {
result = DNS_R_BADDB;
}
UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
- result = find_closest_nxt(&search, nodep, foundname,
+ result = find_closest_nsec(&search, nodep, foundname,
rdataset, sigrdataset,
search.rbtdb->secure);
if (result == ISC_R_SUCCESS)
result = DNS_R_EMPTYWILD;
goto tree_exit;
}
- if ((search.options & DNS_DBFIND_FORCENXT) != 0 &&
- nxtheader == NULL)
+ if ((search.options & DNS_DBFIND_FORCENSEC) != 0 &&
+ nsecheader == NULL)
{
/*
- * There's no NXT record, and we were told
+ * There's no NSEC record, and we were told
* to find one.
*/
result = DNS_R_BADDB;
*nodep = node;
}
if (search.rbtdb->secure ||
- (search.options & DNS_DBFIND_FORCENXT) != 0)
+ (search.options & DNS_DBFIND_FORCENSEC) != 0)
{
- bind_rdataset(search.rbtdb, node, nxtheader,
+ bind_rdataset(search.rbtdb, node, nsecheader,
0, rdataset);
- if (nxtsig != NULL)
+ if (nsecsig != NULL)
bind_rdataset(search.rbtdb, node,
- nxtsig, 0, sigrdataset);
+ nsecsig, 0, sigrdataset);
}
if (wild)
foundname->attributes |= DNS_NAMEATTR_WILDCARD;
/*
* If we're beneath a zone cut, we must indicate that the
* result is glue, unless we're actually at the zone cut
- * and the type is NXT or KEY.
+ * and the type is NSEC or KEY.
*/
if (search.zonecut == node) {
- if (type == dns_rdatatype_nxt ||
- type == dns_rdatatype_key)
+ if (type == dns_rdatatype_nsec ||
+ type == dns_rdatatype_dnskey)
result = ISC_R_SUCCESS;
else if (type == dns_rdatatype_any)
result = DNS_R_ZONECUT;
LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
/*
- * Look for a DNAME or SIG DNAME rdataset.
+ * Look for a DNAME or RRSIG DNAME rdataset.
*/
dname_header = NULL;
sigdname_header = NULL;
LOCK(&(rbtdb->node_locks[node->locknum].lock));
/*
- * Look for NS and SIG NS rdatasets.
+ * Look for NS and RRSIG NS rdatasets.
*/
found = NULL;
foundsig = NULL;
rdatasetheader_t *header, *header_prev, *header_next;
rdatasetheader_t *found, *nsheader;
rdatasetheader_t *foundsig, *nssig, *cnamesig;
- rbtdb_rdatatype_t sigtype, nxtype;
+ rbtdb_rdatatype_t sigtype, nsecype;
UNUSED(version);
* Certain DNSSEC types are not subject to CNAME matching
* (RFC 2535, section 2.3.5).
*
- * We don't check for SIG, because we don't store SIG records
+ * We don't check for RRSIG, because we don't store RRSIG records
* directly.
*/
- if (type == dns_rdatatype_key || type == dns_rdatatype_nxt)
+ if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec)
cname_ok = ISC_FALSE;
/*
found = NULL;
foundsig = NULL;
- sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type);
- nxtype = RBTDB_RDATATYPE_VALUE(0, type);
+ sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
+ nsecype = RBTDB_RDATATYPE_VALUE(0, type);
nsheader = NULL;
nssig = NULL;
cnamesig = NULL;
cname_ok &&
cnamesig != NULL) {
/*
- * If we've already got the CNAME SIG,
+ * If we've already got the CNAME RRSIG,
* use it, otherwise change sigtype
* so that we find it.
*/
}
} else if (header->type == sigtype) {
/*
- * We've found the SIG rdataset for our
+ * We've found the RRSIG rdataset for our
* target type. Remember it.
*/
foundsig = header;
} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
- header->type == nxtype) {
+ header->type == nsecype) {
/*
* We've found a negative cache entry.
*/
foundsig = NULL;
matchtype = RBTDB_RDATATYPE_VALUE(type, covers);
if (covers == 0)
- sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type);
+ sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
else
sigmatchtype = 0;
dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
rdatasetheader_t *header, *header_next, *found, *foundsig;
- rbtdb_rdatatype_t matchtype, sigmatchtype, nxtype;
+ rbtdb_rdatatype_t matchtype, sigmatchtype, nsecype;
isc_result_t result;
REQUIRE(VALID_RBTDB(rbtdb));
found = NULL;
foundsig = NULL;
matchtype = RBTDB_RDATATYPE_VALUE(type, covers);
- nxtype = RBTDB_RDATATYPE_VALUE(0, type);
+ nsecype = RBTDB_RDATATYPE_VALUE(0, type);
if (covers == 0)
- sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type);
+ sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
else
sigmatchtype = 0;
if (header->type == matchtype)
found = header;
else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
- header->type == nxtype)
+ header->type == nsecype)
found = header;
else if (header->type == sigmatchtype)
foundsig = header;
* Look for active extant "other data".
*
* "Other data" is any rdataset whose type is not
- * KEY, SIG KEY, NXT, SIG NXT, or SIG CNAME.
+ * DNSKEY, RRSIG DNSKEY, NSEC, RRSIG NSEC,
+ * or RRSIG CNAME.
*/
rdtype = RBTDB_RDATATYPE_BASE(header->type);
- if (rdtype == dns_rdatatype_sig)
+ if (rdtype == dns_rdatatype_rrsig)
rdtype = RBTDB_RDATATYPE_EXT(header->type);
- if (rdtype != dns_rdatatype_nxt &&
- rdtype != dns_rdatatype_key &&
+ if (rdtype != dns_rdatatype_nsec &&
+ rdtype != dns_rdatatype_dnskey &&
rdtype != dns_rdatatype_cname) {
/*
* We've found a type that isn't
- * NXT, KEY, CNAME, or one of their
+ * NSEC, KEY, CNAME, or one of their
* signatures. Is it active and extant?
*/
do {
isc_boolean_t header_nx;
isc_boolean_t newheader_nx;
isc_boolean_t merge;
- dns_rdatatype_t nxtype, rdtype, covers;
+ dns_rdatatype_t nsecype, rdtype, covers;
dns_trust_t trust;
/*
newheader_nx = NONEXISTENT(newheader) ? ISC_TRUE : ISC_FALSE;
topheader_prev = NULL;
- nxtype = 0;
+ nsecype = 0;
if (rbtversion == NULL && !newheader_nx) {
rdtype = RBTDB_RDATATYPE_BASE(newheader->type);
if (rdtype == 0) {
rbtnode->dirty = 1;
goto find_header;
}
- nxtype = RBTDB_RDATATYPE_VALUE(covers, 0);
+ nsecype = RBTDB_RDATATYPE_VALUE(covers, 0);
} else {
/*
* We're adding something that isn't a
topheader = NULL;
goto find_header;
}
- nxtype = RBTDB_RDATATYPE_VALUE(0, rdtype);
+ nsecype = RBTDB_RDATATYPE_VALUE(0, rdtype);
}
}
topheader != NULL;
topheader = topheader->next) {
if (topheader->type == newheader->type ||
- topheader->type == nxtype)
+ topheader->type == nsecype)
break;
topheader_prev = topheader;
}
if (type == dns_rdatatype_any)
return (ISC_R_NOTIMPLEMENTED);
- if (type == dns_rdatatype_sig && covers == 0)
+ if (type == dns_rdatatype_rrsig && covers == 0)
return (ISC_R_NOTIMPLEMENTED);
newheader = isc_mem_get(rbtdb->common.mctx, sizeof(*newheader));
static isc_boolean_t
iszonesecure(dns_db_t *db, dns_dbnode_t *origin) {
dns_rdataset_t keyset;
- dns_rdataset_t nxtset, signxtset;
+ dns_rdataset_t nsecset, signsecset;
isc_boolean_t haszonekey = ISC_FALSE;
- isc_boolean_t hasnxt = ISC_FALSE;
+ isc_boolean_t hasnsec = ISC_FALSE;
isc_result_t result;
dns_rdataset_init(&keyset);
- result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_key, 0,
+ result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_dnskey, 0,
0, &keyset, NULL);
if (result == ISC_R_SUCCESS) {
dns_rdata_t keyrdata = DNS_RDATA_INIT;
if (!haszonekey)
return (ISC_FALSE);
- dns_rdataset_init(&nxtset);
- dns_rdataset_init(&signxtset);
- result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_nxt, 0,
- 0, &nxtset, &signxtset);
+ dns_rdataset_init(&nsecset);
+ dns_rdataset_init(&signsecset);
+ result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_nsec, 0,
+ 0, &nsecset, &signsecset);
if (result == ISC_R_SUCCESS) {
- if (dns_rdataset_isassociated(&signxtset)) {
- hasnxt = ISC_TRUE;
- dns_rdataset_disassociate(&signxtset);
+ if (dns_rdataset_isassociated(&signsecset)) {
+ hasnsec = ISC_TRUE;
+ dns_rdataset_disassociate(&signsecset);
}
- dns_rdataset_disassociate(&nxtset);
+ dns_rdataset_disassociate(&nsecset);
}
- return (hasnxt);
+ return (hasnsec);
}
* Note: unlike everywhere else, we
* check for now > header->ttl instead
* of now >= header->ttl. This allows
- * ANY and SIG queries for 0 TTL
+ * ANY and RRSIG queries for 0 TTL
* rdatasets to work.
*/
if (NONEXISTENT(header) ||
* Note: unlike everywhere else, we
* check for now > header->ttl instead
* of now >= header->ttl. This allows
- * ANY and SIG queries for 0 TTL
+ * ANY and RRSIG queries for 0 TTL
* rdatasets to work.
*/
if ((header->attributes &
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rdata.c,v 1.179 2003/09/11 01:49:16 marka Exp $ */
+/* $Id: rdata.c,v 1.180 2003/09/30 05:56:12 marka Exp $ */
#include <config.h>
#include <ctype.h>
dns_rdatatype_t
dns_rdata_covers(dns_rdata_t *rdata) {
+ if (rdata->type == 46)
+ return (covers_rrsig(rdata));
return (covers_sig(rdata));
}
--- /dev/null
+/*
+ * Copyright (C) 1999-2002 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dnskey_48.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/*
+ * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
+ */
+
+/* RFC 2535 */
+
+#ifndef RDATA_GENERIC_DNSKEY_48_C
+#define RDATA_GENERIC_DNSKEY_48_C
+
+#include <dst/dst.h>
+
+#define RRTYPE_DNSKEY_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+
+static inline isc_result_t
+fromtext_dnskey(ARGS_FROMTEXT) {
+ isc_token_t token;
+ dns_secalg_t alg;
+ dns_secproto_t proto;
+ dns_keyflags_t flags;
+
+ REQUIRE(type == 48);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+ UNUSED(origin);
+ UNUSED(downcase);
+ UNUSED(callbacks);
+
+ /* flags */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_keyflags_fromtext(&flags, &token.value.as_textregion));
+ RETERR(uint16_tobuffer(flags, target));
+
+ /* protocol */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_secproto_fromtext(&proto, &token.value.as_textregion));
+ RETERR(mem_tobuffer(target, &proto, 1));
+
+ /* algorithm */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
+ RETERR(mem_tobuffer(target, &alg, 1));
+
+ /* No Key? */
+ if ((flags & 0xc000) == 0xc000)
+ return (ISC_R_SUCCESS);
+
+ return (isc_base64_tobuffer(lexer, target, -1));
+}
+
+static inline isc_result_t
+totext_dnskey(ARGS_TOTEXT) {
+ isc_region_t sr;
+ char buf[sizeof("64000")];
+ unsigned int flags;
+ unsigned char algorithm;
+
+ REQUIRE(rdata->type == 48);
+ REQUIRE(rdata->length != 0);
+
+ dns_rdata_toregion(rdata, &sr);
+
+ /* flags */
+ flags = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+ sprintf(buf, "%u", flags);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /* protocol */
+ sprintf(buf, "%u", sr.base[0]);
+ isc_region_consume(&sr, 1);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /* algorithm */
+ algorithm = sr.base[0];
+ sprintf(buf, "%u", algorithm);
+ isc_region_consume(&sr, 1);
+ RETERR(str_totext(buf, target));
+
+ /* No Key? */
+ if ((flags & 0xc000) == 0xc000)
+ return (ISC_R_SUCCESS);
+
+ /* key */
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" (", target));
+ RETERR(str_totext(tctx->linebreak, target));
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+ RETERR(str_totext(tctx->linebreak, target));
+ else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" ", target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(")", target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+ isc_region_t tmpr;
+
+ RETERR(str_totext(" ; key id = ", target));
+ dns_rdata_toregion(rdata, &tmpr);
+ sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
+ RETERR(str_totext(buf, target));
+ }
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_dnskey(ARGS_FROMWIRE) {
+ isc_region_t sr;
+
+ REQUIRE(type == 48);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+ UNUSED(dctx);
+ UNUSED(downcase);
+
+ isc_buffer_activeregion(source, &sr);
+ if (sr.length < 4)
+ return (ISC_R_UNEXPECTEDEND);
+
+ isc_buffer_forward(source, sr.length);
+ return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static inline isc_result_t
+towire_dnskey(ARGS_TOWIRE) {
+ isc_region_t sr;
+
+ REQUIRE(rdata->type == 48);
+ REQUIRE(rdata->length != 0);
+
+ UNUSED(cctx);
+
+ dns_rdata_toregion(rdata, &sr);
+ return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static inline int
+compare_dnskey(ARGS_COMPARE) {
+ isc_region_t r1;
+ isc_region_t r2;
+
+ REQUIRE(rdata1->type == rdata2->type);
+ REQUIRE(rdata1->rdclass == rdata2->rdclass);
+ REQUIRE(rdata1->type == 48);
+ REQUIRE(rdata1->length != 0);
+ REQUIRE(rdata2->length != 0);
+
+ dns_rdata_toregion(rdata1, &r1);
+ dns_rdata_toregion(rdata2, &r2);
+ return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_dnskey(ARGS_FROMSTRUCT) {
+ dns_rdata_dnskey_t *dnskey = source;
+
+ REQUIRE(type == 48);
+ REQUIRE(source != NULL);
+ REQUIRE(dnskey->common.rdtype == type);
+ REQUIRE(dnskey->common.rdclass == rdclass);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+
+ /* Flags */
+ RETERR(uint16_tobuffer(dnskey->flags, target));
+
+ /* Protocol */
+ RETERR(uint8_tobuffer(dnskey->protocol, target));
+
+ /* Algorithm */
+ RETERR(uint8_tobuffer(dnskey->algorithm, target));
+
+ /* Data */
+ return (mem_tobuffer(target, dnskey->data, dnskey->datalen));
+}
+
+static inline isc_result_t
+tostruct_dnskey(ARGS_TOSTRUCT) {
+ dns_rdata_dnskey_t *dnskey = target;
+ isc_region_t sr;
+
+ REQUIRE(rdata->type == 48);
+ REQUIRE(target != NULL);
+ REQUIRE(rdata->length != 0);
+
+ dnskey->common.rdclass = rdata->rdclass;
+ dnskey->common.rdtype = rdata->type;
+ ISC_LINK_INIT(&dnskey->common, link);
+
+ dns_rdata_toregion(rdata, &sr);
+
+ /* Flags */
+ if (sr.length < 2)
+ return (ISC_R_UNEXPECTEDEND);
+ dnskey->flags = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+
+ /* Protocol */
+ if (sr.length < 1)
+ return (ISC_R_UNEXPECTEDEND);
+ dnskey->protocol = uint8_fromregion(&sr);
+ isc_region_consume(&sr, 1);
+
+ /* Algorithm */
+ if (sr.length < 1)
+ return (ISC_R_UNEXPECTEDEND);
+ dnskey->algorithm = uint8_fromregion(&sr);
+ isc_region_consume(&sr, 1);
+
+ /* Data */
+ dnskey->datalen = sr.length;
+ dnskey->data = mem_maybedup(mctx, sr.base, dnskey->datalen);
+ if (dnskey->data == NULL)
+ return (ISC_R_NOMEMORY);
+
+ dnskey->mctx = mctx;
+ return (ISC_R_SUCCESS);
+}
+
+static inline void
+freestruct_dnskey(ARGS_FREESTRUCT) {
+ dns_rdata_dnskey_t *dnskey = (dns_rdata_dnskey_t *) source;
+
+ REQUIRE(source != NULL);
+ REQUIRE(dnskey->common.rdtype == 48);
+
+ if (dnskey->mctx == NULL)
+ return;
+
+ if (dnskey->data != NULL)
+ isc_mem_free(dnskey->mctx, dnskey->data);
+ dnskey->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_dnskey(ARGS_ADDLDATA) {
+ REQUIRE(rdata->type == 48);
+
+ UNUSED(rdata);
+ UNUSED(add);
+ UNUSED(arg);
+
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_dnskey(ARGS_DIGEST) {
+ isc_region_t r;
+
+ REQUIRE(rdata->type == 48);
+
+ dns_rdata_toregion(rdata, &r);
+
+ return ((digest)(arg, &r));
+}
+
+#endif /* RDATA_GENERIC_DNSKEY_48_C */
--- /dev/null
+/*
+ * Copyright (C) 1999-2001 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_DNSKEY_48_H
+#define GENERIC_DNSKEY_48_H 1
+
+/* $Id: dnskey_48.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/* RFC 2535 */
+
+typedef struct dns_rdata_dnskey {
+ dns_rdatacommon_t common;
+ isc_mem_t * mctx;
+ isc_uint16_t flags;
+ isc_uint8_t protocol;
+ isc_uint8_t algorithm;
+ isc_uint16_t datalen;
+ unsigned char * data;
+} dns_rdata_dnskey_t;
+
+
+#endif /* GENERIC_DNSKEY_48_H */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: key_25.c,v 1.44 2002/02/20 03:34:51 marka Exp $ */
+/* $Id: key_25.c,v 1.45 2003/09/30 05:56:17 marka Exp $ */
/*
* Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
#include <dst/dst.h>
-#define RRTYPE_KEY_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+#define RRTYPE_KEY_ATTRIBUTES (0)
static inline isc_result_t
fromtext_key(ARGS_FROMTEXT) {
--- /dev/null
+/*
+ * Copyright (C) 1999-2002 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: nsec_47.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
+
+/* RFC 2535 */
+
+#ifndef RDATA_GENERIC_NSEC_47_C
+#define RDATA_GENERIC_NSEC_47_C
+
+/*
+ * The attributes do not include DNS_RDATATYPEATTR_SINGLETON
+ * because we must be able to handle a parent/child NSEC pair.
+ */
+#define RRTYPE_NSEC_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+
+static inline isc_result_t
+fromtext_nsec(ARGS_FROMTEXT) {
+ isc_token_t token;
+ dns_name_t name;
+ isc_buffer_t buffer;
+ char *e;
+ unsigned char bm[8*1024]; /* 64k bits */
+ dns_rdatatype_t covered;
+ dns_rdatatype_t maxcovered = 0;
+ isc_boolean_t first = ISC_TRUE;
+ long n;
+
+ REQUIRE(type == 47);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+ UNUSED(callbacks);
+
+ /*
+ * Next domain.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ dns_name_init(&name, NULL);
+ buffer_fromregion(&buffer, &token.value.as_region);
+ origin = (origin != NULL) ? origin : dns_rootname;
+ RETTOK(dns_name_fromtext(&name, &buffer, origin, downcase, target));
+
+ memset(bm, 0, sizeof(bm));
+ do {
+ RETERR(isc_lex_getmastertoken(lexer, &token,
+ isc_tokentype_string, ISC_TRUE));
+ if (token.type != isc_tokentype_string)
+ break;
+ n = strtol(DNS_AS_STR(token), &e, 10);
+ if (e != DNS_AS_STR(token) && *e == '\0') {
+ covered = (dns_rdatatype_t)n;
+ } else if (dns_rdatatype_fromtext(&covered,
+ &token.value.as_textregion) == DNS_R_UNKNOWN)
+ RETTOK(DNS_R_UNKNOWN);
+ /*
+ * NSEC is only specified for types 1..127.
+ */
+ if (covered < 1 || covered > 127)
+ return (ISC_R_RANGE);
+ if (first || covered > maxcovered)
+ maxcovered = covered;
+ first = ISC_FALSE;
+ bm[covered/8] |= (0x80>>(covered%8));
+ } while (1);
+ isc_lex_ungettoken(lexer, &token);
+ if (first)
+ return (ISC_R_SUCCESS);
+ n = (maxcovered + 8) / 8;
+ return (mem_tobuffer(target, bm, n));
+}
+
+static inline isc_result_t
+totext_nsec(ARGS_TOTEXT) {
+ isc_region_t sr;
+ unsigned int i, j;
+ dns_name_t name;
+ dns_name_t prefix;
+ isc_boolean_t sub;
+
+ REQUIRE(rdata->type == 47);
+ REQUIRE(rdata->length != 0);
+
+ dns_name_init(&name, NULL);
+ dns_name_init(&prefix, NULL);
+ dns_rdata_toregion(rdata, &sr);
+ dns_name_fromregion(&name, &sr);
+ isc_region_consume(&sr, name_length(&name));
+ sub = name_prefix(&name, tctx->origin, &prefix);
+ RETERR(dns_name_totext(&prefix, sub, target));
+
+ for (i = 0; i < sr.length; i++) {
+ if (sr.base[i] != 0)
+ for (j = 0; j < 8; j++)
+ if ((sr.base[i] & (0x80 >> j)) != 0) {
+ dns_rdatatype_t t = i * 8 + j;
+ RETERR(str_totext(" ", target));
+ if (dns_rdatatype_isknown(t)) {
+ RETERR(dns_rdatatype_totext(t,
+ target));
+ } else {
+ char buf[sizeof("65535")];
+ sprintf(buf, "%u", t);
+ RETERR(str_totext(buf,
+ target));
+ }
+ }
+ }
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_nsec(ARGS_FROMWIRE) {
+ isc_region_t sr;
+ dns_name_t name;
+
+ REQUIRE(type == 47);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+
+ dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+
+ dns_name_init(&name, NULL);
+ RETERR(dns_name_fromwire(&name, source, dctx, downcase, target));
+
+ isc_buffer_activeregion(source, &sr);
+ /* XXXRTH Enforce RFC 2535 length rules if bit 0 is not set. */
+ if (sr.length > 8 * 1024)
+ return (DNS_R_EXTRADATA);
+ RETERR(mem_tobuffer(target, sr.base, sr.length));
+ isc_buffer_forward(source, sr.length);
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+towire_nsec(ARGS_TOWIRE) {
+ isc_region_t sr;
+ dns_name_t name;
+ dns_offsets_t offsets;
+
+ REQUIRE(rdata->type == 47);
+ REQUIRE(rdata->length != 0);
+
+ dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+ dns_name_init(&name, offsets);
+ dns_rdata_toregion(rdata, &sr);
+ dns_name_fromregion(&name, &sr);
+ isc_region_consume(&sr, name_length(&name));
+ RETERR(dns_name_towire(&name, cctx, target));
+
+ return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static inline int
+compare_nsec(ARGS_COMPARE) {
+ isc_region_t r1;
+ isc_region_t r2;
+
+ REQUIRE(rdata1->type == rdata2->type);
+ REQUIRE(rdata1->rdclass == rdata2->rdclass);
+ REQUIRE(rdata1->type == 47);
+ REQUIRE(rdata1->length != 0);
+ REQUIRE(rdata2->length != 0);
+
+ dns_rdata_toregion(rdata1, &r1);
+ dns_rdata_toregion(rdata2, &r2);
+ return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_nsec(ARGS_FROMSTRUCT) {
+ dns_rdata_nsec_t *nsec = source;
+ isc_region_t region;
+
+ REQUIRE(type == 47);
+ REQUIRE(source != NULL);
+ REQUIRE(nsec->common.rdtype == type);
+ REQUIRE(nsec->common.rdclass == rdclass);
+ REQUIRE(nsec->typebits != NULL || nsec->len == 0);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+
+ dns_name_toregion(&nsec->next, ®ion);
+ RETERR(isc_buffer_copyregion(target, ®ion));
+
+ return (mem_tobuffer(target, nsec->typebits, nsec->len));
+}
+
+static inline isc_result_t
+tostruct_nsec(ARGS_TOSTRUCT) {
+ isc_region_t region;
+ dns_rdata_nsec_t *nsec = target;
+ dns_name_t name;
+
+ REQUIRE(rdata->type == 47);
+ REQUIRE(target != NULL);
+ REQUIRE(rdata->length != 0);
+
+ nsec->common.rdclass = rdata->rdclass;
+ nsec->common.rdtype = rdata->type;
+ ISC_LINK_INIT(&nsec->common, link);
+
+ dns_name_init(&name, NULL);
+ dns_rdata_toregion(rdata, ®ion);
+ dns_name_fromregion(&name, ®ion);
+ isc_region_consume(®ion, name_length(&name));
+ dns_name_init(&nsec->next, NULL);
+ RETERR(name_duporclone(&name, mctx, &nsec->next));
+
+ nsec->len = region.length;
+ nsec->typebits = mem_maybedup(mctx, region.base, region.length);
+ if (nsec->typebits == NULL)
+ goto cleanup;
+
+ nsec->mctx = mctx;
+ return (ISC_R_SUCCESS);
+
+ cleanup:
+ if (mctx != NULL)
+ dns_name_free(&nsec->next, mctx);
+ return (ISC_R_NOMEMORY);
+}
+
+static inline void
+freestruct_nsec(ARGS_FREESTRUCT) {
+ dns_rdata_nsec_t *nsec = source;
+
+ REQUIRE(source != NULL);
+ REQUIRE(nsec->common.rdtype == 47);
+
+ if (nsec->mctx == NULL)
+ return;
+
+ dns_name_free(&nsec->next, nsec->mctx);
+ if (nsec->typebits != NULL)
+ isc_mem_free(nsec->mctx, nsec->typebits);
+ nsec->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_nsec(ARGS_ADDLDATA) {
+ REQUIRE(rdata->type == 47);
+
+ UNUSED(rdata);
+ UNUSED(add);
+ UNUSED(arg);
+
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_nsec(ARGS_DIGEST) {
+ isc_region_t r;
+
+ REQUIRE(rdata->type == 47);
+
+ dns_rdata_toregion(rdata, &r);
+ return ((digest)(arg, &r));
+}
+
+#endif /* RDATA_GENERIC_NSEC_47_C */
--- /dev/null
+/*
+ * Copyright (C) 1999-2002 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_NSEC_47_H
+#define GENERIC_NSEC_47_H 1
+
+/* $Id: nsec_47.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/* RFC 2535 */
+
+typedef struct dns_rdata_nsec {
+ dns_rdatacommon_t common;
+ isc_mem_t *mctx;
+ dns_name_t next;
+ unsigned char *typebits;
+ isc_uint16_t len;
+} dns_rdata_nsec_t;
+
+#endif /* GENERIC_NSEC_47_H */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nxt_30.c,v 1.56 2003/04/17 03:43:35 marka Exp $ */
+/* $Id: nxt_30.c,v 1.57 2003/09/30 05:56:17 marka Exp $ */
/* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
* The attributes do not include DNS_RDATATYPEATTR_SINGLETON
* because we must be able to handle a parent/child NXT pair.
*/
-#define RRTYPE_NXT_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+#define RRTYPE_NXT_ATTRIBUTES (0)
static inline isc_result_t
fromtext_nxt(ARGS_FROMTEXT) {
--- /dev/null
+/*
+ * Copyright (C) 1999-2002 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: rrsig_46.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
+
+/* RFC 2535 */
+
+#ifndef RDATA_GENERIC_RRSIG_46_C
+#define RDATA_GENERIC_RRSIG_46_C
+
+#define RRTYPE_RRSIG_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+
+static inline isc_result_t
+fromtext_rrsig(ARGS_FROMTEXT) {
+ isc_token_t token;
+ unsigned char c;
+ long i;
+ dns_rdatatype_t covered;
+ char *e;
+ isc_result_t result;
+ dns_name_t name;
+ isc_buffer_t buffer;
+ isc_uint32_t time_signed, time_expire;
+
+ REQUIRE(type == 46);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+ UNUSED(callbacks);
+
+ /*
+ * Type covered.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ result = dns_rdatatype_fromtext(&covered, &token.value.as_textregion);
+ if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) {
+ i = strtol(DNS_AS_STR(token), &e, 10);
+ if (i < 0 || i > 65535)
+ RETTOK(ISC_R_RANGE);
+ if (*e != 0)
+ RETTOK(result);
+ covered = (dns_rdatatype_t)i;
+ }
+ RETERR(uint16_tobuffer(covered, target));
+
+ /*
+ * Algorithm.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
+ RETERR(mem_tobuffer(target, &c, 1));
+
+ /*
+ * Labels.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+ ISC_FALSE));
+ if (token.value.as_ulong > 0xff)
+ RETTOK(ISC_R_RANGE);
+ c = (unsigned char)token.value.as_ulong;
+ RETERR(mem_tobuffer(target, &c, 1));
+
+ /*
+ * Original ttl.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+ ISC_FALSE));
+ RETERR(uint32_tobuffer(token.value.as_ulong, target));
+
+ /*
+ * Signature expiration.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_expire));
+ RETERR(uint32_tobuffer(time_expire, target));
+
+ /*
+ * Time signed.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_signed));
+ RETERR(uint32_tobuffer(time_signed, target));
+
+ /*
+ * Key footprint.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+ ISC_FALSE));
+ RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+ /*
+ * Signer.
+ */
+ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ ISC_FALSE));
+ dns_name_init(&name, NULL);
+ buffer_fromregion(&buffer, &token.value.as_region);
+ origin = (origin != NULL) ? origin : dns_rootname;
+ RETTOK(dns_name_fromtext(&name, &buffer, origin, downcase, target));
+
+ /*
+ * Sig.
+ */
+ return (isc_base64_tobuffer(lexer, target, -1));
+}
+
+static inline isc_result_t
+totext_rrsig(ARGS_TOTEXT) {
+ isc_region_t sr;
+ char buf[sizeof("4294967295")];
+ dns_rdatatype_t covered;
+ unsigned long ttl;
+ unsigned long when;
+ unsigned long exp;
+ unsigned long foot;
+ dns_name_t name;
+ dns_name_t prefix;
+ isc_boolean_t sub;
+
+ REQUIRE(rdata->type == 46);
+ REQUIRE(rdata->length != 0);
+
+ dns_rdata_toregion(rdata, &sr);
+
+ /*
+ * Type covered.
+ */
+ covered = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+ /*
+ * XXXAG We should have something like dns_rdatatype_isknown()
+ * that does the right thing with type 0.
+ */
+ if (dns_rdatatype_isknown(covered) && covered != 0) {
+ RETERR(dns_rdatatype_totext(covered, target));
+ } else {
+ char buf[sizeof("65535")];
+ sprintf(buf, "%u", covered);
+ RETERR(str_totext(buf, target));
+ }
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Algorithm.
+ */
+ sprintf(buf, "%u", sr.base[0]);
+ isc_region_consume(&sr, 1);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Labels.
+ */
+ sprintf(buf, "%u", sr.base[0]);
+ isc_region_consume(&sr, 1);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Ttl.
+ */
+ ttl = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+ sprintf(buf, "%lu", ttl);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Sig exp.
+ */
+ exp = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+ RETERR(dns_time32_totext(exp, target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" (", target));
+ RETERR(str_totext(tctx->linebreak, target));
+
+ /*
+ * Time signed.
+ */
+ when = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+ RETERR(dns_time32_totext(when, target));
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Footprint.
+ */
+ foot = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+ sprintf(buf, "%lu", foot);
+ RETERR(str_totext(buf, target));
+ RETERR(str_totext(" ", target));
+
+ /*
+ * Signer.
+ */
+ dns_name_init(&name, NULL);
+ dns_name_init(&prefix, NULL);
+ dns_name_fromregion(&name, &sr);
+ isc_region_consume(&sr, name_length(&name));
+ sub = name_prefix(&name, tctx->origin, &prefix);
+ RETERR(dns_name_totext(&prefix, sub, target));
+
+ /*
+ * Sig.
+ */
+ RETERR(str_totext(tctx->linebreak, target));
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" )", target));
+
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_rrsig(ARGS_FROMWIRE) {
+ isc_region_t sr;
+ dns_name_t name;
+
+ REQUIRE(type == 46);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+
+ dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+
+ isc_buffer_activeregion(source, &sr);
+ /*
+ * type covered: 2
+ * algorithm: 1
+ * labels: 1
+ * original ttl: 4
+ * signature expiration: 4
+ * time signed: 4
+ * key footprint: 2
+ */
+ if (sr.length < 18)
+ return (ISC_R_UNEXPECTEDEND);
+
+ isc_buffer_forward(source, 18);
+ RETERR(mem_tobuffer(target, sr.base, 18));
+
+ /*
+ * Signer.
+ */
+ dns_name_init(&name, NULL);
+ RETERR(dns_name_fromwire(&name, source, dctx, downcase, target));
+
+ /*
+ * Sig.
+ */
+ isc_buffer_activeregion(source, &sr);
+ isc_buffer_forward(source, sr.length);
+ return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static inline isc_result_t
+towire_rrsig(ARGS_TOWIRE) {
+ isc_region_t sr;
+ dns_name_t name;
+ dns_offsets_t offsets;
+
+ REQUIRE(rdata->type == 46);
+ REQUIRE(rdata->length != 0);
+
+ dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+ dns_rdata_toregion(rdata, &sr);
+ /*
+ * type covered: 2
+ * algorithm: 1
+ * labels: 1
+ * original ttl: 4
+ * signature expiration: 4
+ * time signed: 4
+ * key footprint: 2
+ */
+ RETERR(mem_tobuffer(target, sr.base, 18));
+ isc_region_consume(&sr, 18);
+
+ /*
+ * Signer.
+ */
+ dns_name_init(&name, offsets);
+ dns_name_fromregion(&name, &sr);
+ isc_region_consume(&sr, name_length(&name));
+ RETERR(dns_name_towire(&name, cctx, target));
+
+ /*
+ * Signature.
+ */
+ return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static inline int
+compare_rrsig(ARGS_COMPARE) {
+ isc_region_t r1;
+ isc_region_t r2;
+
+ REQUIRE(rdata1->type == rdata2->type);
+ REQUIRE(rdata1->rdclass == rdata2->rdclass);
+ REQUIRE(rdata1->type == 46);
+ REQUIRE(rdata1->length != 0);
+ REQUIRE(rdata2->length != 0);
+
+ dns_rdata_toregion(rdata1, &r1);
+ dns_rdata_toregion(rdata2, &r2);
+ return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_rrsig(ARGS_FROMSTRUCT) {
+ dns_rdata_rrsig_t *sig = source;
+
+ REQUIRE(type == 46);
+ REQUIRE(source != NULL);
+ REQUIRE(sig->common.rdtype == type);
+ REQUIRE(sig->common.rdclass == rdclass);
+ REQUIRE(sig->signature != NULL || sig->siglen == 0);
+
+ UNUSED(type);
+ UNUSED(rdclass);
+
+ /*
+ * Type covered.
+ */
+ RETERR(uint16_tobuffer(sig->covered, target));
+
+ /*
+ * Algorithm.
+ */
+ RETERR(uint8_tobuffer(sig->algorithm, target));
+
+ /*
+ * Labels.
+ */
+ RETERR(uint8_tobuffer(sig->labels, target));
+
+ /*
+ * Original TTL.
+ */
+ RETERR(uint32_tobuffer(sig->originalttl, target));
+
+ /*
+ * Expire time.
+ */
+ RETERR(uint32_tobuffer(sig->timeexpire, target));
+
+ /*
+ * Time signed.
+ */
+ RETERR(uint32_tobuffer(sig->timesigned, target));
+
+ /*
+ * Key ID.
+ */
+ RETERR(uint16_tobuffer(sig->keyid, target));
+
+ /*
+ * Signer name.
+ */
+ RETERR(name_tobuffer(&sig->signer, target));
+
+ /*
+ * Signature.
+ */
+ return (mem_tobuffer(target, sig->signature, sig->siglen));
+}
+
+static inline isc_result_t
+tostruct_rrsig(ARGS_TOSTRUCT) {
+ isc_region_t sr;
+ dns_rdata_rrsig_t *sig = target;
+ dns_name_t signer;
+
+ REQUIRE(rdata->type == 46);
+ REQUIRE(target != NULL);
+ REQUIRE(rdata->length != 0);
+
+ sig->common.rdclass = rdata->rdclass;
+ sig->common.rdtype = rdata->type;
+ ISC_LINK_INIT(&sig->common, link);
+
+ dns_rdata_toregion(rdata, &sr);
+
+ /*
+ * Type covered.
+ */
+ sig->covered = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+
+ /*
+ * Algorithm.
+ */
+ sig->algorithm = uint8_fromregion(&sr);
+ isc_region_consume(&sr, 1);
+
+ /*
+ * Labels.
+ */
+ sig->labels = uint8_fromregion(&sr);
+ isc_region_consume(&sr, 1);
+
+ /*
+ * Original TTL.
+ */
+ sig->originalttl = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+
+ /*
+ * Expire time.
+ */
+ sig->timeexpire = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+
+ /*
+ * Time signed.
+ */
+ sig->timesigned = uint32_fromregion(&sr);
+ isc_region_consume(&sr, 4);
+
+ /*
+ * Key ID.
+ */
+ sig->keyid = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
+
+ dns_name_init(&signer, NULL);
+ dns_name_fromregion(&signer, &sr);
+ dns_name_init(&sig->signer, NULL);
+ RETERR(name_duporclone(&signer, mctx, &sig->signer));
+ isc_region_consume(&sr, name_length(&sig->signer));
+
+ /*
+ * Signature.
+ */
+ sig->siglen = sr.length;
+ sig->signature = mem_maybedup(mctx, sr.base, sig->siglen);
+ if (sig->signature == NULL)
+ goto cleanup;
+
+
+ sig->mctx = mctx;
+ return (ISC_R_SUCCESS);
+
+ cleanup:
+ if (mctx != NULL)
+ dns_name_free(&sig->signer, mctx);
+ return (ISC_R_NOMEMORY);
+}
+
+static inline void
+freestruct_rrsig(ARGS_FREESTRUCT) {
+ dns_rdata_rrsig_t *sig = (dns_rdata_rrsig_t *) source;
+
+ REQUIRE(source != NULL);
+ REQUIRE(sig->common.rdtype == 46);
+
+ if (sig->mctx == NULL)
+ return;
+
+ dns_name_free(&sig->signer, sig->mctx);
+ if (sig->signature != NULL)
+ isc_mem_free(sig->mctx, sig->signature);
+ sig->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_rrsig(ARGS_ADDLDATA) {
+ REQUIRE(rdata->type == 46);
+
+ UNUSED(rdata);
+ UNUSED(add);
+ UNUSED(arg);
+
+ return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_rrsig(ARGS_DIGEST) {
+
+ REQUIRE(rdata->type == 46);
+
+ UNUSED(rdata);
+ UNUSED(digest);
+ UNUSED(arg);
+
+ return (ISC_R_NOTIMPLEMENTED);
+}
+
+static inline dns_rdatatype_t
+covers_rrsig(dns_rdata_t *rdata) {
+ dns_rdatatype_t type;
+ isc_region_t r;
+
+ REQUIRE(rdata->type == 46);
+
+ dns_rdata_toregion(rdata, &r);
+ type = uint16_fromregion(&r);
+
+ return (type);
+}
+
+#endif /* RDATA_GENERIC_RRSIG_46_C */
--- /dev/null
+/*
+ * Copyright (C) 1999-2001 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_DNSSIG_46_H
+#define GENERIC_DNSSIG_46_H 1
+
+/* $Id: rrsig_46.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */
+
+/* RFC 2535 */
+typedef struct dns_rdata_rrsig {
+ dns_rdatacommon_t common;
+ isc_mem_t * mctx;
+ dns_rdatatype_t covered;
+ dns_secalg_t algorithm;
+ isc_uint8_t labels;
+ isc_uint32_t originalttl;
+ isc_uint32_t timeexpire;
+ isc_uint32_t timesigned;
+ isc_uint16_t keyid;
+ dns_name_t signer;
+ isc_uint16_t siglen;
+ unsigned char * signature;
+} dns_rdata_rrsig_t;
+
+
+#endif /* GENERIC_DNSSIG_46_H */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: sig_24.c,v 1.59 2003/07/25 00:01:09 marka Exp $ */
+/* $Id: sig_24.c,v 1.60 2003/09/30 05:56:18 marka Exp $ */
/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
#ifndef RDATA_GENERIC_SIG_24_C
#define RDATA_GENERIC_SIG_24_C
-#define RRTYPE_SIG_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
+#define RRTYPE_SIG_ATTRIBUTES (0)
static inline isc_result_t
fromtext_sig(ARGS_FROMTEXT) {
#ifndef GENERIC_TKEY_249_H
#define GENERIC_TKEY_249_H 1
-/* $Id: tkey_249.h,v 1.18 2001/01/09 21:54:50 bwelling Exp $ */
+/* $Id: tkey_249.h,v 1.19 2003/09/30 05:56:18 marka Exp $ */
/* draft-ietf-dnsind-tkey-00.txt */
-typedef struct dns_rdata_key {
+typedef struct dns_rdata_tkey {
dns_rdatacommon_t common;
isc_mem_t * mctx;
dns_name_t algorithm;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rdataset.c,v 1.67 2003/02/26 23:52:29 marka Exp $ */
+/* $Id: rdataset.c,v 1.68 2003/09/30 05:56:12 marka Exp $ */
#include <config.h>
count > 1 &&
(!WANT_FIXED(rdataset) || order != NULL) &&
count <= MAX_SHUFFLE &&
- rdataset->type != dns_rdatatype_sig)
+ rdataset->type != dns_rdatatype_rrsig)
{
shuffle = ISC_TRUE;
/*
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: resolver.c,v 1.268 2003/09/21 13:05:16 marka Exp $ */
+/* $Id: resolver.c,v 1.269 2003/09/30 05:56:13 marka Exp $ */
#include <config.h>
INSIST(result != ISC_R_SUCCESS ||
dns_rdataset_isassociated(event->rdataset) ||
fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_sig);
+ fctx->type == dns_rdatatype_rrsig);
isc_task_sendanddetach(&task, (isc_event_t **)&event);
}
if (hevent != NULL) {
if (!negative && !chaining &&
(fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_sig)) {
+ fctx->type == dns_rdatatype_rrsig)) {
/*
* Don't bind rdatasets; the caller
* will iterate the node.
if (vevent->sigrdataset != NULL)
(void)dns_db_deleterdataset(fctx->cache,
node, NULL,
- dns_rdatatype_sig,
+ dns_rdatatype_rrsig,
vevent->type);
}
result = vevent->result;
if (!ISC_LIST_EMPTY(fctx->validators)) {
INSIST(!negative);
INSIST(fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_sig);
+ fctx->type == dns_rdatatype_rrsig);
/*
* Don't send a response yet - we have
* more rdatasets that still need to
* and we must set up the rdatasets.
*/
if ((fctx->type != dns_rdatatype_any &&
- fctx->type != dns_rdatatype_sig) ||
+ fctx->type != dns_rdatatype_rrsig) ||
(name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
ardataset = event->rdataset;
asigrdataset = event->sigrdataset;
* SIGs are validated as part of validating the
* type they cover.
*/
- if (rdataset->type == dns_rdatatype_sig)
+ if (rdataset->type == dns_rdatatype_rrsig)
continue;
/*
* Find the SIG for this rdataset, if we have it.
for (sigrdataset = ISC_LIST_HEAD(name->list);
sigrdataset != NULL;
sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
- if (sigrdataset->type == dns_rdatatype_sig &&
+ if (sigrdataset->type == dns_rdatatype_rrsig &&
sigrdataset->covers == rdataset->type)
break;
}
if (ANSWER(rdataset) && need_validation) {
if (fctx->type != dns_rdatatype_any &&
- fctx->type != dns_rdatatype_sig) {
+ fctx->type != dns_rdatatype_rrsig) {
/*
* This is The Answer. We will
* validate it, but first we cache
}
if (rdataset->trust == dns_trust_glue &&
(rdataset->type == dns_rdatatype_ns ||
- (rdataset->type == dns_rdatatype_sig &&
+ (rdataset->type == dns_rdatatype_rrsig &&
rdataset->covers == dns_rdatatype_ns))) {
/*
* If the trust level is 'dns_trust_glue'
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link)) {
- if (rdataset->type == dns_rdatatype_sig)
+ if (rdataset->type == dns_rdatatype_rrsig)
rtype = rdataset->covers;
else
rtype = rdataset->type;
*/
rdataset = NULL;
result = dns_message_findtype(name,
- dns_rdatatype_sig,
+ dns_rdatatype_rrsig,
type, &rdataset);
if (result == ISC_R_SUCCESS)
mark_related(name, rdataset, external,
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link)) {
type = rdataset->type;
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
type = rdataset->covers;
if (((type == dns_rdatatype_ns ||
type == dns_rdatatype_soa) &&
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link)) {
type = rdataset->type;
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
type = rdataset->covers;
if (type == dns_rdatatype_soa ||
- type == dns_rdatatype_nxt) {
+ type == dns_rdatatype_nsec) {
/*
- * SOA, SIG SOA, NXT, or SIG NXT.
+ * SOA, RRSIG SOA, NSEC, or RRSIG NSEC.
*
* Only one SOA is allowed.
*/
*/
found = ISC_TRUE;
aflag = DNS_RDATASETATTR_ANSWER;
- } else if (rdataset->type == dns_rdatatype_sig
+ } else if (rdataset->type == dns_rdatatype_rrsig
&& rdataset->covers == type
&& !found_cname) {
/*
* Getting a CNAME response for some
* query types is an error.
*/
- if (type == dns_rdatatype_sig ||
- type == dns_rdatatype_key ||
- type == dns_rdatatype_nxt)
+ if (type == dns_rdatatype_rrsig ||
+ type == dns_rdatatype_dnskey ||
+ type == dns_rdatatype_nsec)
return (DNS_R_FORMERR);
found = ISC_TRUE;
found_cname = ISC_TRUE;
&tname);
if (result != ISC_R_SUCCESS)
return (result);
- } else if (rdataset->type == dns_rdatatype_sig
+ } else if (rdataset->type == dns_rdatatype_rrsig
&& rdataset->covers ==
dns_rdatatype_cname
&& !found_type) {
return (result);
else
found_dname = ISC_TRUE;
- } else if (rdataset->type == dns_rdatatype_sig
+ } else if (rdataset->type == dns_rdatatype_rrsig
&& rdataset->covers ==
dns_rdatatype_dname) {
/*
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link)) {
if (rdataset->type == dns_rdatatype_ns ||
- (rdataset->type == dns_rdatatype_sig &&
+ (rdataset->type == dns_rdatatype_rrsig &&
rdataset->covers == dns_rdatatype_ns)) {
name->attributes |=
DNS_NAMEATTR_CACHE;
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: result.c,v 1.108 2003/04/17 03:43:35 marka Exp $ */
+/* $Id: result.c,v 1.109 2003/09/30 05:56:13 marka Exp $ */
#include <config.h>
"tsig verify failure", /* 38 DNS_R_TSIGVERIFYFAILURE */
"tsig indicates error", /* 39 DNS_R_TSIGERRORSET */
- "SIG failed to verify", /* 40 DNS_R_SIGINVALID */
- "SIG has expired", /* 41 DNS_R_SIGEXPIRED */
- "SIG validity period has not begun", /* 42 DNS_R_SIGFUTURE */
+ "RRSIG failed to verify", /* 40 DNS_R_SIGINVALID */
+ "RRSIG has expired", /* 41 DNS_R_SIGEXPIRED */
+ "RRSIG validity period has not begun", /* 42 DNS_R_SIGFUTURE */
"key is unauthorized to sign data", /* 43 DNS_R_KEYUNAUTHORIZED */
"invalid time", /* 44 DNS_R_INVALIDTIME */
"no journal", /* 56 DNS_R_NOJOURNAL */
"alias", /* 57 DNS_R_ALIAS */
"use TCP", /* 58 DNS_R_USETCP */
- "no valid SIG", /* 59 DNS_R_NOVALIDSIG */
+ "no valid RRSIG", /* 59 DNS_R_NOVALIDSIG */
- "no valid NXT", /* 60 DNS_R_NOVALIDNXT */
+ "no valid NSEC", /* 60 DNS_R_NOVALIDNSEC */
"not insecure", /* 61 DNS_R_NOTINSECURE */
"unknown service", /* 62 DNS_R_UNKNOWNSERVICE */
"recoverable error occurred", /* 63 DNS_R_RECOVERABLE */
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: sdb.c,v 1.39 2003/09/17 05:34:55 marka Exp $ */
+/* $Id: sdb.c,v 1.40 2003/09/30 05:56:13 marka Exp $ */
#include <config.h>
UNUSED(now);
UNUSED(sigrdataset);
- if (type == dns_rdatatype_sig)
+ if (type == dns_rdatatype_rrsig)
return (ISC_R_NOTIMPLEMENTED);
list = ISC_LIST_HEAD(sdbnode->lists);
/*
* Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.107 2003/07/25 00:01:11 marka Exp $
+ * $Id: dst_api.c,v 1.108 2003/09/30 05:56:18 marka Exp $
*/
#include <config.h>
isc_lexspecials_t specials;
isc_uint32_t ttl;
isc_result_t result;
+ dns_rdatatype_t type;
newfilenamelen = strlen(filename) + 5;
newfilename = isc_mem_get(mctx, newfilenamelen);
if (token.type != isc_tokentype_string)
BADTOKEN();
- if (strcasecmp(DST_AS_STR(token), "KEY") != 0)
+ if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0)
+ type = dns_rdatatype_dnskey;
+ else if (strcasecmp(DST_AS_STR(token), "KEY") == 0)
+ type = dns_rdatatype_key;
+ else
BADTOKEN();
isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
- ret = dns_rdata_fromtext(&rdata, rdclass, dns_rdatatype_key,
- lex, NULL, ISC_FALSE, mctx, &b, NULL);
+ ret = dns_rdata_fromtext(&rdata, rdclass, type, lex, NULL,
+ ISC_FALSE, mctx, &b, NULL);
if (ret != ISC_R_SUCCESS)
goto cleanup;
return (ret);
isc_buffer_usedregion(&keyb, &r);
- dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_key, &r);
+ dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_dnskey, &r);
ret = dns_rdata_totext(&rdata, (dns_name_t *) NULL, &textb);
if (ret != ISC_R_SUCCESS)
isc_buffer_usedregion(&classb, &r);
fwrite(r.base, 1, r.length, fp);
- fprintf(fp, " KEY ");
+ fprintf(fp, " DNSKEY ");
isc_buffer_usedregion(&textb, &r);
fwrite(r.base, 1, r.length, fp);
/*
* Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.26 2003/07/24 06:08:20 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.27 2003/09/30 05:56:18 marka Exp $
*/
#ifdef OPENSSL
#include <openssl/objects.h>
#include <openssl/rsa.h>
+ /*
+ * XXXMPA Temporarially disable RSA_BLINDING as it requires
+ * good quality random data that cannot currently be guarenteed.
+ * XXXMPA Find which versions of openssl use pseudo random data
+ * and set RSA_FLAG_BLINDING for those.
+ */
+
+#if 0
#if OPENSSL_VERSION_NUMBER < 0x0090601fL
#define SET_FLAGS(rsa) \
do { \
(rsa)->flags |= RSA_FLAG_BLINDING; \
} while (0)
#endif
+#endif
+
+#if OPENSSL_VERSION_NUMBER < 0x0090601fL
+#define SET_FLAGS(rsa) \
+ do { \
+ (rsa)->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE); \
+ (rsa)->flags &= ~RSA_FLAG_BLINDING; \
+ } while (0)
+#else
+#define SET_FLAGS(rsa) \
+ do { \
+ (rsa)->flags &= ~RSA_FLAG_BLINDING; \
+ } while (0)
+#endif
static isc_result_t opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data);
isc_region_t r;
/* note: ISC_SHA1_DIGESTLENGTH > ISC_MD5_DIGESTLENGTH */
unsigned char digest[ISC_SHA1_DIGESTLENGTH];
- unsigned int siglen;
+ unsigned int siglen = 0;
int status;
int type;
unsigned int digestlen;
+ char *message;
+ unsigned long err;
+ const char* file;
+ int line;
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1);
}
status = RSA_sign(type, digest, digestlen, r.base, &siglen, rsa);
- if (status == 0)
+ if (status == 0) {
+ err = ERR_peek_error_line(&file, &line);
+ if (err != 0) {
+ message = ERR_error_string(err, NULL);
+ fprintf(stderr, "%s:%s:%d\n", message,
+ file ? file : "", line);
+ }
return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ }
isc_buffer_add(sig, siglen);
*/
/*
- * $Id: ssu.c,v 1.22 2001/08/28 03:58:08 marka Exp $
+ * $Id: ssu.c,v 1.23 2003/09/30 05:56:13 marka Exp $
* Principal Author: Brian Wellington
*/
isusertype(dns_rdatatype_t type) {
return (ISC_TF(type != dns_rdatatype_ns &&
type != dns_rdatatype_soa &&
- type != dns_rdatatype_sig));
+ type != dns_rdatatype_rrsig));
}
isc_boolean_t
*/
/*
- * $Id: tkey.c,v 1.74 2001/12/03 19:44:08 gson Exp $
+ * $Id: tkey.c,v 1.75 2003/09/30 05:56:13 marka Exp $
*/
#include <config.h>
keyname = NULL;
dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
keyset = NULL;
- result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
+ result = dns_message_findtype(keyname, dns_rdatatype_dnskey, 0,
&keyset);
if (result != ISC_R_SUCCESS)
continue;
RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
- dns_rdatatype_key, &ourkeyr);
+ dns_rdatatype_dnskey, &ourkeyr);
dns_name_init(&ourname, NULL);
dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
RETERR(dst_key_todns(key, dynbuf));
isc_buffer_usedregion(dynbuf, &r);
dns_rdata_fromregion(rdata, dns_rdataclass_any,
- dns_rdatatype_key, &r);
+ dns_rdatatype_dnskey, &r);
dns_message_takebuffer(msg, &dynbuf);
dns_name_init(&keyname, NULL);
ourkeyname = NULL;
ourkeyset = NULL;
RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
- dns_rdatatype_key, 0, &ourkeyname,
+ dns_rdatatype_dnskey, 0, &ourkeyname,
&ourkeyset));
result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
if (dns_name_equal(theirkeyname, ourkeyname))
goto next;
theirkeyset = NULL;
- result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
+ result = dns_message_findtype(theirkeyname, dns_rdatatype_dnskey,
0, &theirkeyset);
if (result == ISC_R_SUCCESS) {
RETERR(dns_rdataset_first(theirkeyset));
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: validator.c,v 1.112 2003/02/27 00:19:04 marka Exp $ */
+/* $Id: validator.c,v 1.113 2003/09/30 05:56:14 marka Exp $ */
#include <config.h>
#include <dns/log.h>
#include <dns/message.h>
#include <dns/ncache.h>
-#include <dns/nxt.h>
+#include <dns/nsec.h>
#include <dns/rdata.h>
#include <dns/rdatastruct.h>
#include <dns/rdataset.h>
destroy(dns_validator_t *val);
static isc_result_t
-get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
+get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
dns_rdataset_t *rdataset);
static isc_result_t
validatezonekey(dns_validator_t *val, isc_boolean_t resume);
static isc_result_t
-nxtvalidate(dns_validator_t *val, isc_boolean_t resume);
+nsecvalidate(dns_validator_t *val, isc_boolean_t resume);
static isc_result_t
proveunsecure(dns_validator_t *val, isc_boolean_t resume);
dns_rdataset_clone(rdataset, &set);
else {
result = dns_ncache_getrdataset(rdataset, name,
- dns_rdatatype_nxt, &set);
+ dns_rdatatype_nsec, &set);
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
}
- INSIST(set.type == dns_rdatatype_nxt);
+ INSIST(set.type == dns_rdatatype_nsec);
found = ISC_FALSE;
result = dns_rdataset_first(&set);
if (result == ISC_R_SUCCESS) {
dns_rdataset_current(&set, &rdata);
- found = dns_nxt_typepresent(&rdata, dns_rdatatype_ns);
+ found = dns_nsec_typepresent(&rdata, dns_rdatatype_ns);
}
dns_rdataset_disassociate(&set);
return (found);
}
static isc_boolean_t
-nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname,
- dns_rdataset_t *nxtset)
+nsecprovesnonexistence(dns_validator_t *val, dns_name_t *nsecname,
+ dns_rdataset_t *nsecset)
{
int order;
dns_rdata_t rdata = DNS_RDATA_INIT;
else
isnxdomain = ISC_FALSE;
- result = dns_rdataset_first(nxtset);
+ result = dns_rdataset_first(nsecset);
if (result != ISC_R_SUCCESS) {
validator_log(val, ISC_LOG_DEBUG(3),
- "failure processing NXT set");
+ "failure processing NSEC set");
return (ISC_FALSE);
}
- dns_rdataset_current(nxtset, &rdata);
+ dns_rdataset_current(nsecset, &rdata);
- validator_log(val, ISC_LOG_DEBUG(3), "looking for relevant nxt");
- relation = dns_name_fullcompare(val->event->name, nxtname,
+ validator_log(val, ISC_LOG_DEBUG(3), "looking for relevant nsec");
+ relation = dns_name_fullcompare(val->event->name, nsecname,
&order, &olabels, &bits);
if (order == 0) {
/*
*/
if (isnxdomain) {
validator_log(val, ISC_LOG_DEBUG(3),
- "NXT record seen at nonexistent name");
+ "NSEC record seen at nonexistent name");
return (ISC_FALSE);
}
if (val->event->type >= 128) {
return (ISC_FALSE);
}
- if (dns_nxt_typepresent(&rdata, val->event->type)) {
+ if (dns_nsec_typepresent(&rdata, val->event->type)) {
validator_log(val, ISC_LOG_DEBUG(3),
"type should not be present");
return (ISC_FALSE);
}
- validator_log(val, ISC_LOG_DEBUG(3), "nxt bitmask ok");
+ validator_log(val, ISC_LOG_DEBUG(3), "nsec bitmask ok");
} else if (order > 0) {
- dns_rdata_nxt_t nxt;
+ dns_rdata_nsec_t nsec;
/*
- * The NXT owner name is less than the nonexistent name.
+ * The NSEC owner name is less than the nonexistent name.
*/
if (!isnxdomain) {
/*
* Is this a empty node?
*/
- result = dns_rdata_tostruct(&rdata, &nxt, NULL);
+ result = dns_rdata_tostruct(&rdata, &nsec, NULL);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
- relation = dns_name_fullcompare(&nxt.next,
+ relation = dns_name_fullcompare(&nsec.next,
val->event->name,
&order, &nlabels,
&bits);
if (order > 0 && relation == dns_namereln_subdomain) {
- dns_rdata_freestruct(&nxt);
+ dns_rdata_freestruct(&nsec);
validator_log(val, ISC_LOG_DEBUG(3),
- "nxt proves empty node, ok");
+ "nsec proves empty node, ok");
return (ISC_TRUE);
}
/*
* Look for empty wildcard matches.
*/
- labels = dns_name_countlabels(&nxt.next);
+ labels = dns_name_countlabels(&nsec.next);
if (nlabels >= olabels && nlabels + 1 < labels) {
dns_name_t wild;
dns_name_init(&wild, NULL);
- dns_name_getlabelsequence(&nxt.next,
+ dns_name_getlabelsequence(&nsec.next,
labels - 1 - nlabels,
nlabels + 1,
&wild);
if (dns_name_iswildcard(&wild)) {
- dns_rdata_freestruct(&nxt);
+ dns_rdata_freestruct(&nsec);
validator_log(val, ISC_LOG_DEBUG(3),
- "nxt proves empty wildcard, ok");
+ "nsec proves empty wildcard, ok");
return (ISC_TRUE);
}
}
/*
* We are not a empty name.
*/
- dns_rdata_freestruct(&nxt);
+ dns_rdata_freestruct(&nsec);
validator_log(val, ISC_LOG_DEBUG(3),
- "missing NXT record at name");
+ "missing NSEC record at name");
return (ISC_FALSE);
}
- if (dns_name_issubdomain(val->event->name, nxtname) &&
- dns_nxt_typepresent(&rdata, dns_rdatatype_ns) &&
- !dns_nxt_typepresent(&rdata, dns_rdatatype_soa))
+ if (dns_name_issubdomain(val->event->name, nsecname) &&
+ dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&
+ !dns_nsec_typepresent(&rdata, dns_rdatatype_soa))
{
/*
- * This NXT record is from somewhere higher in
+ * This NSEC record is from somewhere higher in
* the DNS, and at the parent of a delegation.
* It can not be legitimately used here.
*/
validator_log(val, ISC_LOG_DEBUG(3),
- "ignoring parent nxt");
+ "ignoring parent nsec");
return (ISC_FALSE);
}
- result = dns_rdata_tostruct(&rdata, &nxt, NULL);
+ result = dns_rdata_tostruct(&rdata, &nsec, NULL);
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
dns_rdata_reset(&rdata);
- relation = dns_name_fullcompare(&nxt.next, val->event->name,
+ relation = dns_name_fullcompare(&nsec.next, val->event->name,
&order, &nlabels, &bits);
if (order <= 0) {
/*
- * The NXT next name is less than the nonexistent
+ * The NSEC next name is less than the nonexistent
* name. This is only ok if the next name is the zone
* name.
*/
- if (!dns_name_equal(val->soaname, &nxt.next)) {
+ if (!dns_name_equal(val->soaname, &nsec.next)) {
validator_log(val, ISC_LOG_DEBUG(3),
"next name is not greater");
- dns_rdata_freestruct(&nxt);
+ dns_rdata_freestruct(&nsec);
return (ISC_FALSE);
}
validator_log(val, ISC_LOG_DEBUG(3),
- "nxt points to zone apex, ok");
+ "nsec points to zone apex, ok");
} else if (relation == dns_namereln_subdomain) {
validator_log(val, ISC_LOG_DEBUG(3),
- "nxt proves empty node, bad");
- dns_rdata_freestruct(&nxt);
+ "nsec proves empty node, bad");
+ dns_rdata_freestruct(&nsec);
return (ISC_FALSE);
}
- dns_rdata_freestruct(&nxt);
- validator_log(val, ISC_LOG_DEBUG(3), "nxt range ok");
+ dns_rdata_freestruct(&nsec);
+ validator_log(val, ISC_LOG_DEBUG(3), "nsec range ok");
} else {
validator_log(val, ISC_LOG_DEBUG(3),
- "nxt owner name is not less");
+ "nsec owner name is not less");
/*
- * The NXT owner name is greater than the supposedly
- * nonexistent name. This NXT is irrelevant.
+ * The NSEC owner name is greater than the supposedly
+ * nonexistent name. This NSEC is irrelevant.
*/
return (ISC_FALSE);
}
if (result == ISC_R_CANCELED)
validator_done(val, result);
else {
- result = nxtvalidate(val, ISC_TRUE);
+ result = nsecvalidate(val, ISC_TRUE);
if (result != DNS_R_WAIT)
validator_done(val, result);
}
} else {
- if (val->soaname != NULL && val->nxtset != NULL &&
+ if (val->soaname != NULL && val->nsecset != NULL &&
(val->attributes & VALATTR_FOUNDNONEXISTENCE) == 0 &&
- nxtprovesnonexistence(val, devent->name, rdataset))
+ nsecprovesnonexistence(val, devent->name, rdataset))
val->attributes |= VALATTR_FOUNDNONEXISTENCE;
- result = nxtvalidate(val, ISC_TRUE);
+ result = nsecvalidate(val, ISC_TRUE);
if (result != DNS_R_WAIT)
validator_done(val, result);
}
* If val->key is non-NULL, this returns the next matching key.
*/
static isc_result_t
-get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
+get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
dns_rdataset_t *rdataset)
{
isc_result_t result;
}
static isc_result_t
-get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) {
+get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {
isc_result_t result;
unsigned int nbits, nlabels;
int order;
* If this is a self-signed keyset, it must not be a zone key
* (since get_key is not called from validatezonekey).
*/
- if (val->event->rdataset->type == dns_rdatatype_key)
+ if (val->event->rdataset->type == dns_rdatatype_dnskey)
return (DNS_R_CONTINUE);
/*
/*
* Do we know about this key?
*/
- result = view_find(val, &siginfo->signer, dns_rdatatype_key);
+ result = view_find(val, &siginfo->signer, dns_rdatatype_dnskey);
if (result == ISC_R_SUCCESS) {
/*
* We have an rrset for the given keyname.
* We know the key but haven't validated it yet.
*/
result = create_validator(val, &siginfo->signer,
- dns_rdatatype_key,
+ dns_rdatatype_dnskey,
&val->frdataset,
&val->fsigrdataset,
keyvalidated,
/*
* We don't know anything about this key.
*/
- result = create_fetch(val, &siginfo->signer, dns_rdatatype_key,
+ result = create_fetch(val, &siginfo->signer, dns_rdatatype_dnskey,
fetch_callback_validator, "get_key");
if (result != ISC_R_SUCCESS)
return (result);
}
static dns_keytag_t
-compute_keytag(dns_rdata_t *rdata, dns_rdata_key_t *key) {
+compute_keytag(dns_rdata_t *rdata, dns_rdata_dnskey_t *key) {
isc_region_t r;
dns_rdata_toregion(rdata, &r);
dns_rdataset_t *rdataset, *sigrdataset;
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdata_t sigrdata = DNS_RDATA_INIT;
- dns_rdata_key_t key;
- dns_rdata_sig_t sig;
+ dns_rdata_dnskey_t key;
+ dns_rdata_rrsig_t sig;
dns_keytag_t keytag;
isc_result_t result;
rdataset = val->event->rdataset;
sigrdataset = val->event->sigrdataset;
- INSIST(rdataset->type == dns_rdatatype_key);
+ INSIST(rdataset->type == dns_rdatatype_dnskey);
for (result = dns_rdataset_first(rdataset);
result == ISC_R_SUCCESS;
unsigned char dsbuf[DNS_DS_BUFFERSIZE];
dns_keytag_t keytag;
dns_rdata_ds_t ds;
- dns_rdata_key_t key;
- dns_rdata_sig_t sig;
+ dns_rdata_dnskey_t key;
+ dns_rdata_rrsig_t sig;
dst_key_t *dstkey;
UNUSED(resume);
/*
* If this is not a key, go straight into validate().
*/
- if (val->event->type != dns_rdatatype_key || !isselfsigned(val))
+ if (val->event->type != dns_rdatatype_dnskey || !isselfsigned(val))
return (validate(val, ISC_FALSE));
return (validatezonekey(val, ISC_FALSE));
}
static isc_result_t
-nxtvalidate(dns_validator_t *val, isc_boolean_t resume) {
+nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
dns_name_t *name;
dns_message_t *message = val->event->message;
isc_result_t result;
result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
else {
result = ISC_R_SUCCESS;
- validator_log(val, ISC_LOG_DEBUG(3), "resuming nxtvalidate");
+ validator_log(val, ISC_LOG_DEBUG(3), "resuming nsecvalidate");
}
for (;
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link))
{
- if (rdataset->type == dns_rdatatype_sig)
+ if (rdataset->type == dns_rdatatype_rrsig)
continue;
if (rdataset->type == dns_rdatatype_soa) {
val->soaset = rdataset;
val->soaname = name;
- } else if (rdataset->type == dns_rdatatype_nxt)
- val->nxtset = rdataset;
+ } else if (rdataset->type == dns_rdatatype_nsec)
+ val->nsecset = rdataset;
for (sigrdataset = ISC_LIST_HEAD(name->list);
sigrdataset != NULL;
sigrdataset = ISC_LIST_NEXT(sigrdataset,
link))
{
- if (sigrdataset->type == dns_rdatatype_sig &&
+ if (sigrdataset->type == dns_rdatatype_rrsig &&
sigrdataset->covers == rdataset->type)
break;
}
* things could happen. A query for data in the zone
* would lead to a query for the zone key, which
* would return a negative answer, which would contain
- * an SOA and an NXT signed by the missing key, which
+ * an SOA and an NSEC signed by the missing key, which
* would trigger another query for the KEY (since the
* first one is still in progress), and go into an
* infinite loop. Avoid that.
*/
- if (val->event->type == dns_rdatatype_key &&
+ if (val->event->type == dns_rdatatype_dnskey &&
dns_name_equal(name, val->event->name))
{
- dns_rdata_t nxt = DNS_RDATA_INIT;
+ dns_rdata_t nsec = DNS_RDATA_INIT;
- if (rdataset->type != dns_rdatatype_nxt)
+ if (rdataset->type != dns_rdatatype_nsec)
continue;
result = dns_rdataset_first(rdataset);
if (result != ISC_R_SUCCESS)
return (result);
- dns_rdataset_current(rdataset, &nxt);
- if (dns_nxt_typepresent(&nxt,
+ dns_rdataset_current(rdataset, &nsec);
+ if (dns_nsec_typepresent(&nsec,
dns_rdatatype_soa))
continue;
}
result = create_validator(val, name, rdataset->type,
rdataset, sigrdataset,
authvalidated,
- "nxtvalidate");
+ "nsecvalidate");
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
result = create_validator(val, name, dns_rdatatype_soa,
val->soaset, NULL,
negauthvalidated,
- "nxtvalidate");
+ "nsecvalidate");
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
}
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof not found");
- return (DNS_R_NOVALIDNXT);
+ return (DNS_R_NOVALIDNSEC);
} else {
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof found");
*/
if (!dns_rdataset_isassociated(&val->frdataset)) {
/*
- * There should be an NXT here, since we
+ * There should be an NSEC here, since we
* are still in a secure zone.
*/
- result = DNS_R_NOVALIDNXT;
+ result = DNS_R_NOVALIDNSEC;
goto out;
} else if (val->frdataset.trust < dns_trust_secure) {
/*
"attempting negative response validation");
val->attributes |= VALATTR_NEGATIVE;
- result = nxtvalidate(val, ISC_FALSE);
+ result = nsecvalidate(val, ISC_FALSE);
} else {
/*
* This shouldn't happen.
val->keyset = NULL;
val->dsset = NULL;
val->soaset = NULL;
- val->nxtset = NULL;
+ val->nsecset = NULL;
val->soaname = NULL;
val->seensig = ISC_FALSE;
dns_rdataset_init(&val->frdataset);
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: view.c,v 1.121 2003/09/19 13:27:18 marka Exp $ */
+/* $Id: view.c,v 1.122 2003/09/30 05:56:14 marka Exp $ */
#include <config.h>
REQUIRE(DNS_VIEW_VALID(view));
REQUIRE(view->frozen);
- REQUIRE(type != dns_rdatatype_sig);
+ REQUIRE(type != dns_rdatatype_rrsig);
REQUIRE(rdataset != NULL); /* XXXBEW - remove this */
/*
rdataset, sigrdataset);
if (result == DNS_R_NXDOMAIN) {
/*
- * The rdataset and sigrdataset of the relevant NXT record
+ * The rdataset and sigrdataset of the relevant NSEC record
* may be returned, but the caller cannot use them because
* foundname is not returned by this simplified API. We
* disassociate them here to prevent any misuse by the caller.
dns_name_copy
dns_ncache_add
dns_ncache_towire
-dns_nxt_buildrdata
-dns_nxt_build
-dns_nxt_typepresent
+dns_nsec_buildrdata
+dns_nsec_build
+dns_nsec_typepresent
dns_soa_getserial
dns_soa_setserial
dns_soa_getminimum
# End Source File
# Begin Source File
-SOURCE=..\include\dns\nxt.h
+SOURCE=..\include\dns\nsec.h
# End Source File
# Begin Source File
# End Source File
# Begin Source File
-SOURCE=..\nxt.c
+SOURCE=..\nsec.c
# End Source File
# Begin Source File
-@erase "$(INTDIR)\message.obj"
-@erase "$(INTDIR)\name.obj"
-@erase "$(INTDIR)\ncache.obj"
- -@erase "$(INTDIR)\nxt.obj"
+ -@erase "$(INTDIR)\nsec.obj"
-@erase "$(INTDIR)\openssl_link.obj"
-@erase "$(INTDIR)\openssldh_link.obj"
-@erase "$(INTDIR)\openssldsa_link.obj"
"$(INTDIR)\message.obj" \
"$(INTDIR)\name.obj" \
"$(INTDIR)\ncache.obj" \
- "$(INTDIR)\nxt.obj" \
+ "$(INTDIR)\nsec.obj" \
"$(INTDIR)\order.obj" \
"$(INTDIR)\peer.obj" \
"$(INTDIR)\rbt.obj" \
-@erase "$(INTDIR)\name.sbr"
-@erase "$(INTDIR)\ncache.obj"
-@erase "$(INTDIR)\ncache.sbr"
- -@erase "$(INTDIR)\nxt.obj"
- -@erase "$(INTDIR)\nxt.sbr"
+ -@erase "$(INTDIR)\nsec.obj"
+ -@erase "$(INTDIR)\nsec.sbr"
-@erase "$(INTDIR)\openssl_link.obj"
-@erase "$(INTDIR)\openssl_link.sbr"
-@erase "$(INTDIR)\openssldh_link.obj"
"$(INTDIR)\message.sbr" \
"$(INTDIR)\name.sbr" \
"$(INTDIR)\ncache.sbr" \
- "$(INTDIR)\nxt.sbr" \
+ "$(INTDIR)\nsec.sbr" \
"$(INTDIR)\order.sbr" \
"$(INTDIR)\peer.sbr" \
"$(INTDIR)\rbt.sbr" \
"$(INTDIR)\message.obj" \
"$(INTDIR)\name.obj" \
"$(INTDIR)\ncache.obj" \
- "$(INTDIR)\nxt.obj" \
+ "$(INTDIR)\nsec.obj" \
"$(INTDIR)\order.obj" \
"$(INTDIR)\peer.obj" \
"$(INTDIR)\rbt.obj" \
!ENDIF
-SOURCE=..\nxt.c
+SOURCE=..\nsec.c
!IF "$(CFG)" == "libdns - Win32 Release"
-"$(INTDIR)\nxt.obj" : $(SOURCE) "$(INTDIR)"
+"$(INTDIR)\nsec.obj" : $(SOURCE) "$(INTDIR)"
$(CPP) $(CPP_PROJ) $(SOURCE)
!ELSEIF "$(CFG)" == "libdns - Win32 Debug"
-"$(INTDIR)\nxt.obj" "$(INTDIR)\nxt.sbr" : $(SOURCE) "$(INTDIR)"
+"$(INTDIR)\nsec.obj" "$(INTDIR)\nsec.sbr" : $(SOURCE) "$(INTDIR)"
$(CPP) $(CPP_PROJ) $(SOURCE)
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: zonekey.c,v 1.3 2001/02/26 02:49:19 bwelling Exp $ */
+/* $Id: zonekey.c,v 1.4 2003/09/30 05:56:14 marka Exp $ */
#include <config.h>
isc_boolean_t
dns_zonekey_iszonekey(dns_rdata_t *keyrdata) {
isc_result_t result;
- dns_rdata_key_t key;
+ dns_rdata_dnskey_t key;
isc_boolean_t iszonekey = ISC_TRUE;
REQUIRE(keyrdata != NULL);
projects / thirdparty / bind9.git / commitdiff
