3890. [bug] RRSIG sets that were not loaded in a single transaction

                        at start up where not being correctly added to
                        re-signing heaps.  [RT #36302]

(cherry picked from commit 63e1ac1e0915dd1089493d6d092d39a3da817e59)

diff --git a/CHANGES b/CHANGES
index 7db3ca05aa2c419a80a59288ba5e2dc4338dceac..e88d8be5a9ec68fff72327c802d73f7978e64379 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3890.  [bug]           RRSIG sets that were not loaded in a single transaction
+                       at start up where not being correctly added to
+                       re-signing heaps.  [RT #36302]
+
 3889.  [port]          hurd: configure fixes as per:
                        https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746540
 

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index e9b6f3101bec7aeaad7140132152e9c9f38d8b0e..e4c927dc3a42f257149a31e25f4e3082e8e749c9 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -70,3 +70,4 @@ rm -f signing.out*
 rm -f canonical?.*
 rm -f ns3/siginterval.conf
 rm -f ns4/named_dump.db
+rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 31009452bdce6ef3d694e34908454a824cb24dce..88e6e87181090cf3ed54dea259dbb4374b7ba5c2 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -24,6 +24,7 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL sign.sh )
 (cd ../ns6 && $SHELL sign.sh )
+(cd ../ns7 && $SHELL sign.sh )
 
 cp ../ns2/dsset-example. .
 cp ../ns2/dsset-dlv. .

diff --git a/bin/tests/system/dnssec/ns7/named.conf b/bin/tests/system/dnssec/ns7/named.conf
index be4fd196deda3634b2cf22dd82353f352a219073..84f8a0d5c4e0d313defb190cfa6ab2a535924394 100644 (file)
--- a/bin/tests/system/dnssec/ns7/named.conf
+++ b/bin/tests/system/dnssec/ns7/named.conf
@@ -75,4 +75,10 @@ zone "nosoa.secure.example" {
        file "nosoa.secure.example.db";
 };
 
+zone "split-rrsig" {
+       type master;
+       file "split-rrsig.db.signed";
+       allow-update { any; };
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns7/sign.sh b/bin/tests/system/dnssec/ns7/sign.sh
new file mode 100644 (file)
index 0000000..0e40241
--- /dev/null
+++ b/bin/tests/system/dnssec/ns7/sign.sh
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: sign.sh,v 1.43 2011/11/04 05:36:28 each Exp $
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+zone=split-rrsig
+infile=split-rrsig.in
+zonefile=split-rrsig.db
+
+k1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 768 -n zone $zone`
+k2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 768 -n zone $zone`
+
+cat $infile $k1.key $k2.key >$zonefile
+
+$SIGNER -P -3 - -A -r $RANDFILE -o $zone -O full -f $zonefile.unsplit -e now-3600 -s now-7200 $zonefile > /dev/null 2>&1
+awk 'BEGIN { r = ""; }
+     $4 == "RRSIG" && $5 == "SOA" && r == "" { r = $0; next; }
+     { print }
+     END { print r }' $zonefile.unsplit > $zonefile.signed

diff --git a/bin/tests/system/dnssec/ns7/split-rrsig.in b/bin/tests/system/dnssec/ns7/split-rrsig.in
new file mode 100644 (file)
index 0000000..419d993
--- /dev/null
+++ b/bin/tests/system/dnssec/ns7/split-rrsig.in
@@ -0,0 +1,10 @@
+split-rrsig.           3660    IN SOA  . . (
+                                       1          ; serial
+                                       3600       ; refresh (1 hour)
+                                       3600       ; retry (1 hour)
+                                       3600       ; expire (1 hour)
+                                       3600       ; minimum (1 hour)
+                                       )
+                       3660    NS      ns.example.
+a.split-rrsig.         3660    IN A    192.0.2.2
+b.split-rrsig.         3660    IN A    192.0.2.2

diff --git a/bin/tests/system/dnssec/setup.sh b/bin/tests/system/dnssec/setup.sh
index 12a5f8503d9d27f5f0de87aa3c368e9e13a7d002..797e011a063e652478218cb7ff54cf8876055653 100644 (file)
--- a/bin/tests/system/dnssec/setup.sh
+++ b/bin/tests/system/dnssec/setup.sh
@@ -29,4 +29,3 @@ echo "a.bogus.example.        A       10.0.0.22" >>../ns3/bogus.example.db.signed
 cd ../ns3 && cp -f siginterval1.conf siginterval.conf
 cd ../ns4 && cp -f named1.conf named.conf
 cd ../ns5 && cp -f trusted.conf.bad trusted.conf
-

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index c5684601a0aca32ac82492a6bd37589480fabae5..6faaa5de443122127070e05407da7262fd29d245 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -2459,5 +2459,13 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:check that split rrsigs are handled ($n)"
+ret=0
+$DIG $DIGOPTS split-rrsig soa @10.53.0.7 > dig.out.test$n || ret=1
+awk 'BEGIN { ok=0; } $4 == "SOA" { if ($7 > 1) ok=1; } END { if (!ok) exit(1); }' dig.out.test$n || ret=1 
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 54e3a1a341e060e236d0a5fd702a3e65899e7e8d..58cb7bcba8c9cfc9af132c151b2771784dd2acf5 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6367,6 +6367,19 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
                         */
                        newheader->down = NULL;
                        free_rdataset(rbtdb, rbtdb->common.mctx, header);
+
+                       idx = newheader->node->locknum;
+                       if (IS_CACHE(rbtdb)) {
+                               ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
+                                                newheader, link);
+                               INSIST(rbtdb->heaps != NULL);
+                               (void)isc_heap_insert(rbtdb->heaps[idx],
+                                                     newheader);
+                       } else if (RESIGN(newheader)) {
+                               result = resign_insert(rbtdb, idx, newheader);
+                               if (result != ISC_R_SUCCESS)
+                                       return (result);
+                       }
                } else {
                        newheader->down = topheader;
                        topheader->next = newheader;