From: Evan Hunt <each@isc.org>
Date: Wed, 26 Sep 2012 01:19:17 +0000 (-0700)
Subject:     handle nonexistent managed-keys-directory
X-Git-Tag: v9.10.0a1~871
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=05284949f73d496092c6f21f1ef9d788075fa2db;p=thirdparty%2Fbind9.git

handle nonexistent managed-keys-directory

3378.	[bug]		Handle missing 'managed-keys-directory' better.
			[RT #30625]
---

diff --git a/CHANGES b/CHANGES
index 05156a6df72..bc9e223f0ce 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3378.	[bug]		Handle missing 'managed-keys-directory' better.
+			[RT #30625]
+
 3377.	[bug]		Removed spurious newline from NSEC3 multiline
 			output. [RT #31044]
 
diff --git a/bin/named/server.c b/bin/named/server.c
index 65224527486..27e676489e0 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -808,7 +808,17 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	 */
 	obj = NULL;
 	(void)ns_config_get(maps, "managed-keys-directory", &obj);
-	directory = obj != NULL ? cfg_obj_asstring(obj) : NULL;
+	directory = (obj != NULL ? cfg_obj_asstring(obj) : NULL);
+	if (directory != NULL)
+		result = isc_file_isdirectory(directory);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "invalid managed-keys-directory %s: %s",
+			      directory, isc_result_totext(result));
+		goto cleanup;
+
+	}
 	CHECK(add_keydata_zone(view, directory, ns_g_mctx));
 
   cleanup:
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 58110a6dac8..ca622cf5474 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3599,6 +3599,13 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 	}
 
  failure:
+	if (result != ISC_R_SUCCESS &&
+	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "unable to synchronize managed keys: %s",
+			     dns_result_totext(result));
+		isc_time_settoepoch(&zone->refreshkeytime);
+	}
 	if (keynode != NULL)
 		dns_keytable_detachkeynode(sr, &keynode);
 	if (sr != NULL)
@@ -8597,10 +8604,12 @@ zone_maintenance(dns_zone_t *zone) {
 	 */
 	switch (zone->type) {
 	case dns_zone_key:
-		if (isc_time_compare(&now, &zone->refreshkeytime) >= 0 &&
-		    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING))
-			zone_refreshkeys(zone);
+		if (isc_time_compare(&now, &zone->refreshkeytime) >= 0) {
+			if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
+			    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING)) {
+				zone_refreshkeys(zone);
+			}
+		}
 		break;
 	case dns_zone_master:
 		if (!isc_time_isepoch(&zone->refreshkeytime) &&
diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 03bdb23cad3..923ae87f242 100644
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -220,6 +220,22 @@ isc_file_isplainfilefd(int fd);
  *		These occur when stat returns -1 and an errno.
  */
 
+isc_result_t
+isc_file_isdirectory(const char *name);
+/*!<
+ * \brief Check that 'name' exists and is a directory.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *		Success, file is a directory.
+ *\li	#ISC_R_INVALIDFILE
+ *		File is not a directory.
+ *\li	#ISC_R_FILENOTFOUND
+ *		File does not exist.
+ *\li	#other ISC_R_* errors translated from errno
+ *		These occur when stat returns -1 and an errno.
+ */
+
 isc_boolean_t
 isc_file_iscurrentdir(const char *filename);
 /*!<
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index 8c2b86972b7..9688dc28e48 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -460,6 +460,25 @@ isc_file_isplainfilefd(int fd) {
 	return(ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_file_isdirectory(const char *filename) {
+	/*
+	 * This function returns success if filename exists and is a
+	 * directory.
+	 */
+	struct stat filestat;
+	memset(&filestat,0,sizeof(struct stat));
+
+	if ((stat(filename, &filestat)) == -1)
+		return(isc__errno2result(errno));
+
+	if(! S_ISDIR(filestat.st_mode))
+		return(ISC_R_INVALIDFILE);
+
+	return(ISC_R_SUCCESS);
+}
+
+
 isc_boolean_t
 isc_file_isabsolute(const char *filename) {
 	REQUIRE(filename != NULL);
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index 65a900d0699..bcbb2bb9fa2 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -496,6 +496,24 @@ isc_file_isplainfilefd(int fd) {
 	return(ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_file_isdirectory(const char *filename) {
+	/*
+	 * This function returns success if filename is a directory.
+	 */
+	struct stat filestat;
+	memset(&filestat,0,sizeof(struct stat));
+
+	if ((stat(filename, &filestat)) == -1)
+		return(isc__errno2result(errno));
+
+	if(! S_ISDIR(filestat.st_mode))
+		return(ISC_R_INVALIDFILE);
+
+	return(ISC_R_SUCCESS);
+}
+
+
 isc_boolean_t
 isc_file_isabsolute(const char *filename) {
 	REQUIRE(filename != NULL);
diff --git a/lib/isc/win32/libisc.def b/lib/isc/win32/libisc.def
index a6ac6186d1a..d1dedfa261c 100644
--- a/lib/isc/win32/libisc.def
+++ b/lib/isc/win32/libisc.def
@@ -230,6 +230,7 @@ isc_file_getsizefd
 isc_file_isabsolute
 isc_file_ischdiridempotent
 isc_file_iscurrentdir
+isc_file_isdirectory
 isc_file_isplainfile
 isc_file_isplainfilefd
 isc_file_mktemplate