From: Mark Andrews Date: Tue, 30 Sep 2003 06:00:40 +0000 (+0000) Subject: 1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY. X-Git-Tag: v9.2.4rc1~111^2~56 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=93d6dfaf66258337985427c86181f01fc51f0bb4;p=thirdparty%2Fbind9.git 1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY. --- diff --git a/CHANGES b/CHANGES index 9a715f35a44..df3e469d7cc 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ +1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY. + 1515. [func] Allow transfer source to be set in a server statement. [RT #6496] diff --git a/bin/dnssec/dnssec-makekeyset.c b/bin/dnssec/dnssec-makekeyset.c index 079c51d55f0..9cfb0e1589f 100644 --- a/bin/dnssec/dnssec-makekeyset.c +++ b/bin/dnssec/dnssec-makekeyset.c @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-makekeyset.c,v 1.59 2002/12/03 05:01:34 marka Exp $ */ +/* $Id: dnssec-makekeyset.c,v 1.60 2003/09/30 05:55:59 marka Exp $ */ #include @@ -296,7 +296,7 @@ main(int argc, char *argv[]) { fatal("failed to convert key %s to a DNS KEY: %s", argv[i], isc_result_totext(result)); isc_buffer_usedregion(&b, &r); - dns_rdata_fromregion(&rdata, rdclass, dns_rdatatype_key, &r); + dns_rdata_fromregion(&rdata, rdclass, dns_rdatatype_dnskey, &r); tuple = NULL; result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, domain, ttl, &rdata, &tuple); @@ -319,7 +319,7 @@ main(int argc, char *argv[]) { dns_fixedname_init(&tname); dns_rdataset_init(&rdataset); - result = dns_db_find(db, domain, version, dns_rdatatype_key, 0, 0, + result = dns_db_find(db, domain, version, dns_rdatatype_dnskey, 0, 0, NULL, dns_fixedname_name(&tname), &rdataset, NULL); check_result(result, "dns_db_find"); diff --git a/bin/dnssec/dnssec-signkey.c b/bin/dnssec/dnssec-signkey.c index f348e25afaf..5f432ac87dc 100644 --- a/bin/dnssec/dnssec-signkey.c +++ b/bin/dnssec/dnssec-signkey.c @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signkey.c,v 1.59 2003/07/25 00:01:04 marka Exp $ */ +/* $Id: dnssec-signkey.c,v 1.60 2003/09/30 05:55:59 marka Exp $ */ #include @@ -135,7 +135,7 @@ loadkeys(dns_name_t *name, dns_rdataset_t *rdataset) { } static dst_key_t * -findkey(dns_rdata_sig_t *sig) { +findkey(dns_rdata_rrsig_t *sig) { keynode_t *keynode; for (keynode = ISC_LIST_HEAD(keylist); keynode != NULL; @@ -172,7 +172,7 @@ main(int argc, char *argv[]) { dns_rdata_t rdata = DNS_RDATA_INIT; dns_rdata_t sigrdata = DNS_RDATA_INIT; dns_rdataset_t rdataset, sigrdataset; - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; isc_result_t result; isc_buffer_t b; isc_log_t *log = NULL; @@ -315,7 +315,7 @@ main(int argc, char *argv[]) { dns_rdataset_init(&rdataset); dns_rdataset_init(&sigrdataset); - result = dns_db_findrdataset(db, node, version, dns_rdatatype_key, 0, + result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey, 0, 0, &rdataset, &sigrdataset); if (result != ISC_R_SUCCESS) { char domainstr[DNS_NAME_FORMATSIZE]; @@ -407,8 +407,8 @@ main(int argc, char *argv[]) { dst_key_free(&key); } - result = dns_db_deleterdataset(db, node, version, dns_rdatatype_sig, - dns_rdatatype_key); + result = dns_db_deleterdataset(db, node, version, dns_rdatatype_rrsig, + dns_rdatatype_dnskey); check_result(result, "dns_db_deleterdataset"); result = dns_diff_apply(&diff, db, version); diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c index 421da9ef367..dc23114231d 100644 --- a/bin/dnssec/dnssec-signzone.c +++ b/bin/dnssec/dnssec-signzone.c @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-signzone.c,v 1.168 2003/04/17 03:45:49 marka Exp $ */ +/* $Id: dnssec-signzone.c,v 1.169 2003/09/30 05:56:00 marka Exp $ */ #include @@ -49,7 +49,7 @@ #include #include #include -#include +#include #include #include #include @@ -254,7 +254,7 @@ iszonekey(signer_key_t *key) { * that we've loaded already, and then see if there's a key on disk. */ static signer_key_t * -keythatsigned(dns_rdata_sig_t *sig) { +keythatsigned(dns_rdata_rrsig_t *sig) { isc_result_t result; dst_key_t *pubkey = NULL, *privkey = NULL; signer_key_t *key; @@ -298,7 +298,7 @@ expecttofindkey(dns_name_t *name) { char namestr[DNS_NAME_FORMATSIZE]; dns_fixedname_init(&fname); - result = dns_db_find(gdb, name, gversion, dns_rdatatype_key, options, + result = dns_db_find(gdb, name, gversion, dns_rdatatype_dnskey, options, 0, NULL, dns_fixedname_name(&fname), NULL, NULL); switch (result) { case ISC_R_SUCCESS: @@ -342,7 +342,7 @@ signset(dns_diff_t *diff, dns_dbnode_t *node, dns_name_t *name, { dns_rdataset_t sigset; dns_rdata_t sigrdata = DNS_RDATA_INIT; - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; signer_key_t *key; isc_result_t result; isc_boolean_t nosigs = ISC_FALSE; @@ -361,7 +361,7 @@ signset(dns_diff_t *diff, dns_dbnode_t *node, dns_name_t *name, ttl = ISC_MIN(set->ttl, endtime - starttime); dns_rdataset_init(&sigset); - result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_sig, + result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_rrsig, set->type, 0, &sigset, NULL); if (result == ISC_R_NOTFOUND) { result = ISC_R_SUCCESS; @@ -519,7 +519,7 @@ signset(dns_diff_t *diff, dns_dbnode_t *node, dns_name_t *name, continue; if (!(ignoreksk || key->isdsk || (key->isksk && - set->type == dns_rdatatype_key && + set->type == dns_rdatatype_dnskey && dns_name_equal(name, gorigin)))) continue; @@ -597,7 +597,7 @@ loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) { return (DNS_R_BADDB); } dns_rdataset_init(&keyset); - result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_key, 0, 0, + result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 0, 0, &keyset, NULL); if (result != ISC_R_SUCCESS) { dns_db_detachnode(db, &node); @@ -645,15 +645,15 @@ loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) { } static isc_boolean_t -nxt_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type, +nsec_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type, unsigned int val) { isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdata_nxt_t nxt; + dns_rdata_nsec_t nsec; unsigned int newlen; unsigned char bitmap[16]; - unsigned char nxtdata[16 + DNS_NAME_MAXWIRE]; + unsigned char nsecdata[16 + DNS_NAME_MAXWIRE]; isc_boolean_t answer = ISC_FALSE; INSIST(type < 128); @@ -661,22 +661,22 @@ nxt_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type, result = dns_rdataset_first(rdataset); check_result(result, "dns_rdataset_first()"); dns_rdataset_current(rdataset, &rdata); - result = dns_rdata_tostruct(&rdata, &nxt, NULL); + result = dns_rdata_tostruct(&rdata, &nsec, NULL); check_result(result, "dns_rdata_tostruct"); newlen = type / 8 + 1; - INSIST(nxt.len < sizeof(bitmap)); + INSIST(nsec.len < sizeof(bitmap)); INSIST(newlen < sizeof(bitmap)); memset(bitmap, 0, sizeof(bitmap)); - memcpy(bitmap, nxt.typebits, nxt.len); + memcpy(bitmap, nsec.typebits, nsec.len); set_bit(bitmap, type, val); while (newlen > 0 && bitmap[newlen - 1] == 0) newlen--; - if (newlen != nxt.len || - memcmp(nxt.typebits, bitmap, newlen) != 0) { + if (newlen != nsec.len || + memcmp(nsec.typebits, bitmap, newlen) != 0) { dns_rdata_t newrdata = DNS_RDATA_INIT; isc_buffer_t b; dns_diff_t diff; @@ -688,11 +688,11 @@ nxt_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type, check_result(result, "dns_difftuple_create"); dns_diff_append(&diff, &tuple); - nxt.typebits = bitmap; - nxt.len = newlen; - isc_buffer_init(&b, nxtdata, sizeof(nxtdata)); + nsec.typebits = bitmap; + nsec.len = newlen; + isc_buffer_init(&b, nsecdata, sizeof(nsecdata)); result = dns_rdata_fromstruct(&newrdata, rdata.rdclass, - dns_rdatatype_nxt, &nxt, + dns_rdatatype_nsec, &nsec, &b); check_result(result, "dns_rdata_fromstruct"); @@ -706,7 +706,7 @@ nxt_setbit(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdatatype_t type, dns_diff_clear(&diff); answer = ISC_TRUE; } - dns_rdata_freestruct(&nxt); + dns_rdata_freestruct(&nsec); return (answer); } @@ -745,7 +745,7 @@ delegation(dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp) { /* * Signs all records at a name. This mostly just signs each set individually, - * but also adds the SIG bit to any NXTs generated earlier, deals with + * but also adds the SIG bit to any NSECs generated earlier, deals with * parent/child KEY signatures, and handles other exceptional cases. */ static void @@ -811,7 +811,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) { } else if (dns_rdataset_isassociated(&sigdsset)) { result = dns_db_deleterdataset(gdb, node, gversion, - dns_rdatatype_sig, + dns_rdatatype_rrsig, dns_rdatatype_ds); check_result(result, "dns_db_deleterdataset"); dns_rdataset_disassociate(&sigdsset); @@ -821,25 +821,25 @@ signname(dns_dbnode_t *node, dns_name_t *name) { } /* - * Make sure that NXT bits are appropriately set. + * Make sure that NSEC bits are appropriately set. */ dns_rdataset_init(&rdataset); RUNTIME_CHECK(dns_db_findrdataset(gdb, node, gversion, - dns_rdatatype_nxt, 0, 0, &rdataset, + dns_rdatatype_nsec, 0, 0, &rdataset, NULL) == ISC_R_SUCCESS); if (!nokeys) - changed = nxt_setbit(name, &rdataset, dns_rdatatype_sig, 1); + changed = nsec_setbit(name, &rdataset, dns_rdatatype_rrsig, 1); if (changed) { dns_rdataset_disassociate(&rdataset); RUNTIME_CHECK(dns_db_findrdataset(gdb, node, gversion, - dns_rdatatype_nxt, 0, 0, + dns_rdatatype_nsec, 0, 0, &rdataset, NULL) == ISC_R_SUCCESS); } if (hasds) - (void)nxt_setbit(name, &rdataset, dns_rdatatype_ds, 1); + (void)nsec_setbit(name, &rdataset, dns_rdatatype_ds, 1); else - (void)nxt_setbit(name, &rdataset, dns_rdatatype_ds, 0); + (void)nsec_setbit(name, &rdataset, dns_rdatatype_ds, 0); dns_rdataset_disassociate(&rdataset); /* @@ -854,16 +854,16 @@ signname(dns_dbnode_t *node, dns_name_t *name) { dns_rdatasetiter_current(rdsiter, &rdataset); /* If this is a SIG set, skip it. */ - if (rdataset.type == dns_rdatatype_sig) + if (rdataset.type == dns_rdatatype_rrsig) goto skip; /* * If this name is a delegation point, skip all records - * except NXT and DS sets. Otherwise check that there + * except NSEC and DS sets. Otherwise check that there * isn't a DS record. */ if (isdelegation) { - if (rdataset.type != dns_rdatatype_nxt && + if (rdataset.type != dns_rdatatype_nsec && rdataset.type != dns_rdatatype_ds) goto skip; } else if (rdataset.type == dns_rdatatype_ds) { @@ -907,7 +907,7 @@ active_node(dns_dbnode_t *node) { result = dns_rdatasetiter_first(rdsiter); while (result == ISC_R_SUCCESS) { dns_rdatasetiter_current(rdsiter, &rdataset); - if (rdataset.type != dns_rdatatype_nxt) + if (rdataset.type != dns_rdatatype_nsec) active = ISC_TRUE; dns_rdataset_disassociate(&rdataset); if (!active) @@ -922,10 +922,10 @@ active_node(dns_dbnode_t *node) { if (!active) { /* - * Make sure there is no NXT record for this node. + * Make sure there is no NSEC record for this node. */ result = dns_db_deleterdataset(gdb, node, gversion, - dns_rdatatype_nxt, 0); + dns_rdatatype_nsec, 0); if (result == DNS_R_UNCHANGED) result = ISC_R_SUCCESS; check_result(result, "dns_db_deleterdataset"); @@ -983,7 +983,7 @@ cleannode(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) { isc_boolean_t destroy = ISC_FALSE; dns_rdatatype_t covers = 0; dns_rdatasetiter_current(rdsiter, &set); - if (set.type == dns_rdatatype_sig) { + if (set.type == dns_rdatatype_rrsig) { covers = set.covers; destroy = ISC_TRUE; } @@ -991,7 +991,7 @@ cleannode(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) { result = dns_rdatasetiter_next(rdsiter); if (destroy) { dresult = dns_db_deleterdataset(db, node, version, - dns_rdatatype_sig, + dns_rdatatype_rrsig, covers); check_result(dresult, "dns_db_deleterdataset"); } @@ -1035,7 +1035,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) { dns_name_t *name; dns_dbnode_t *node; sevent_t *sevent; - dns_rdataset_t nxt; + dns_rdataset_t nsec; isc_boolean_t found; isc_result_t result; @@ -1063,16 +1063,16 @@ assignwork(isc_task_t *task, isc_task_t *worker) { if (result != ISC_R_SUCCESS) fatal("failure iterating database: %s", isc_result_totext(result)); - dns_rdataset_init(&nxt); + dns_rdataset_init(&nsec); result = dns_db_findrdataset(gdb, node, gversion, - dns_rdatatype_nxt, 0, 0, - &nxt, NULL); + dns_rdatatype_nsec, 0, 0, + &nsec, NULL); if (result == ISC_R_SUCCESS) found = ISC_TRUE; else dumpnode(name, node); - if (dns_rdataset_isassociated(&nxt)) - dns_rdataset_disassociate(&nxt); + if (dns_rdataset_isassociated(&nsec)) + dns_rdataset_disassociate(&nsec); if (!found) dns_db_detachnode(gdb, &node); @@ -1161,10 +1161,10 @@ sign(isc_task_t *task, isc_event_t *event) { } /* - * Generate NXT records for the zone. + * Generate NSEC records for the zone. */ static void -nxtify(void) { +nsecify(void) { dns_dbiterator_t *dbiter = NULL; dns_dbnode_t *node = NULL, *nextnode = NULL; dns_fixedname_t fname, fnextname, fzonecut; @@ -1226,8 +1226,9 @@ nxtify(void) { } else if (result != ISC_R_SUCCESS) fatal("iterating through the database failed: %s", isc_result_totext(result)); - result = dns_nxt_build(gdb, gversion, node, nextname, zonettl); - check_result(result, "dns_nxt_build()"); + result = dns_nsec_build(gdb, gversion, node, nextname, + zonettl); + check_result(result, "dns_nsec_build()"); dns_db_detachnode(gdb, &node); } @@ -1327,7 +1328,7 @@ loadzonepubkeys(dns_db_t *db) { dns_rdataset_init(&rdataset); result = dns_db_findrdataset(db, node, currentversion, - dns_rdatatype_key, 0, 0, &rdataset, NULL); + dns_rdatatype_dnskey, 0, 0, &rdataset, NULL); if (result != ISC_R_SUCCESS) fatal("failed to find keys at the zone apex: %s", isc_result_totext(result)); @@ -1376,7 +1377,7 @@ warnifallksk(dns_db_t *db) { dns_rdataset_init(&rdataset); result = dns_db_findrdataset(db, node, currentversion, - dns_rdatatype_key, 0, 0, &rdataset, NULL); + dns_rdatatype_dnskey, 0, 0, &rdataset, NULL); if (result != ISC_R_SUCCESS) fatal("failed to find keys at the zone apex: %s", isc_result_totext(result)); @@ -1420,6 +1421,7 @@ writekeyset(void) { isc_region_t r; isc_result_t result; isc_boolean_t have_non_ksk = ISC_FALSE; + isc_boolean_t have_ksk = ISC_FALSE; isc_buffer_init(&namebuf, namestr, sizeof(namestr)); result = dns_name_tofilenametext(gorigin, ISC_FALSE, &namebuf); @@ -1448,18 +1450,26 @@ writekeyset(void) { break; } + for (key = ISC_LIST_HEAD(keylist); + key != NULL; + key = ISC_LIST_NEXT(key, link)) + if (key->isksk) { + have_ksk = ISC_TRUE; + break; + } + for (key = ISC_LIST_HEAD(keylist); key != NULL; key = ISC_LIST_NEXT(key, link)) { - if (have_non_ksk && !key->isksk) + if (have_ksk && have_non_ksk && !key->isksk) continue; dns_rdata_init(&rdata); isc_buffer_init(&b, keybuf, sizeof(keybuf)); result = dst_key_todns(key->key, &b); check_result(result, "dst_key_todns"); isc_buffer_usedregion(&b, &r); - dns_rdata_fromregion(&rdata, gclass, dns_rdatatype_key, &r); + dns_rdata_fromregion(&rdata, gclass, dns_rdatatype_dnskey, &r); result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, gorigin, zonettl, &rdata, &tuple); check_result(result, "dns_difftuple_create"); @@ -1824,6 +1834,7 @@ main(int argc, char *argv[]) { dst_key_name(newkey))) { /* Override key flags. */ + key->issigningkey = ISC_TRUE; key->isksk = ISC_TRUE; key->isdsk = ISC_FALSE; dst_key_free(&dkey); @@ -1853,7 +1864,7 @@ main(int argc, char *argv[]) { result = dns_db_newversion(gdb, &gversion); check_result(result, "dns_db_newversion()"); - nxtify(); + nsecify(); if (!nokeys) writekeyset(); diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index c0263c47e39..ed7e48c717f 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -16,7 +16,7 @@ - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. --> - + @@ -62,8 +62,8 @@ DESCRIPTION - dnssec-signzone signs a zone. It generates NXT - and SIG records and produces a signed version of the zone. If there + dnssec-signzone signs a zone. It generates NSEC + and RRSIG records and produces a signed version of the zone. If there is a signedkey file from the zone's parent, the parent's signatures will be incorporated into the generated signed zone file. The security status of delegations from the the @@ -129,7 +129,7 @@ -s start-time - Specify the date and time when the generated SIG records + Specify the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes @@ -145,7 +145,7 @@ -e end-time - Specify the date and time when the generated SIG records + Specify the date and time when the generated RRSIG records expire. As with , an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from @@ -184,7 +184,7 @@ When a previously signed zone is passed as input, records may be resigned. The option specifies the cycle interval as an offset from the current - time (in seconds). If a SIG record expires after the + time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced. @@ -194,7 +194,7 @@ or are specified, dnssec-signzone generates signatures that are valid for 30 days, with a cycle - interval of 7.5 days. Therefore, if any existing SIG records + interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they would be replaced. diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c index f25783d7434..8f80c745e14 100644 --- a/bin/dnssec/dnssectool.c +++ b/bin/dnssec/dnssectool.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssectool.c,v 1.37 2003/07/25 00:01:04 marka Exp $ */ +/* $Id: dnssectool.c,v 1.38 2003/09/30 05:56:00 marka Exp $ */ #include @@ -118,7 +118,7 @@ alg_format(const dns_secalg_t alg, char *cp, unsigned int size) { } void -sig_format(dns_rdata_sig_t *sig, char *cp, unsigned int size) { +sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) { char namestr[DNS_NAME_FORMATSIZE]; char algstr[DNS_NAME_FORMATSIZE]; diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h index c2254679e25..24776cb30f0 100644 --- a/bin/dnssec/dnssectool.h +++ b/bin/dnssec/dnssectool.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssectool.h,v 1.16 2001/09/21 00:17:01 bwelling Exp $ */ +/* $Id: dnssectool.h,v 1.17 2003/09/30 05:56:00 marka Exp $ */ #ifndef DNSSECTOOL_H #define DNSSECTOOL_H 1 @@ -48,7 +48,7 @@ alg_format(const dns_secalg_t alg, char *cp, unsigned int size); #define ALG_FORMATSIZE 10 void -sig_format(dns_rdata_sig_t *sig, char *cp, unsigned int size); +sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size); #define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + ALG_FORMATSIZE + sizeof("65535")) void diff --git a/bin/named/lwdgrbn.c b/bin/named/lwdgrbn.c index 4c366959c7b..d15009b154c 100644 --- a/bin/named/lwdgrbn.c +++ b/bin/named/lwdgrbn.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lwdgrbn.c,v 1.11 2001/01/24 01:42:41 bwelling Exp $ */ +/* $Id: lwdgrbn.c,v 1.12 2003/09/30 05:56:01 marka Exp $ */ #include @@ -100,7 +100,7 @@ iterate_node(lwres_grbnresponse_t *grbn, dns_db_t *db, dns_dbnode_t *node, dns_rdataset_init(&set); dns_rdatasetiter_current(iter, &set); - if (set.type != dns_rdatatype_sig) { + if (set.type != dns_rdatatype_rrsig) { dns_rdataset_disassociate(&set); continue; } diff --git a/bin/named/query.c b/bin/named/query.c index 1ad317f7f74..7388be2fb39 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.246 2003/07/29 22:05:01 jinmei Exp $ */ +/* $Id: query.c,v 1.247 2003/09/30 05:56:01 marka Exp $ */ #include @@ -1204,7 +1204,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { * XXXRTH We should lower the priority here. Alternatively, * we could raise the priority of glue records. */ - eresult = query_addadditional(client, name, dns_rdatatype_key); + eresult = query_addadditional(client, name, dns_rdatatype_dnskey); } else if (type == dns_rdatatype_srv && trdataset != NULL) { /* * If we're adding SRV records to the additional data @@ -1277,7 +1277,7 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname, * XXXRTH We should lower the priority here. Alternatively, * we could raise the priority of glue records. */ - (void)query_addadditional(client, fname, dns_rdatatype_key); + (void)query_addadditional(client, fname, dns_rdatatype_dnskey); } CTRACE("query_addrdataset: done"); } @@ -1779,10 +1779,10 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) { result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0, client->now, rdataset, sigrdataset); /* - * If we didn't find it, look for an NXT. */ + * If we didn't find it, look for an NSEC. */ if (result == ISC_R_NOTFOUND) result = dns_db_findrdataset(db, node, NULL, - dns_rdatatype_nxt, 0, client->now, + dns_rdatatype_nsec, 0, client->now, rdataset, sigrdataset); if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) goto cleanup; @@ -1855,7 +1855,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, goto cleanup; result = dns_db_find(db, name, NULL, - dns_rdatatype_nxt, options, 0, &node, + dns_rdatatype_nsec, options, 0, &node, fname, rdataset, sigrdataset); if (node != NULL) dns_db_detachnode(db, &node); @@ -1897,7 +1897,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, if (result != ISC_R_SUCCESS) continue; - result = dns_db_find(db, tname, NULL, dns_rdatatype_nxt, + result = dns_db_find(db, tname, NULL, dns_rdatatype_nsec, client->query.dboptions, 0, &node, fname, rdataset, sigrdataset); if (node != NULL) @@ -1932,13 +1932,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db, } static void -query_addnxrrsetnxt(ns_client_t *client, dns_db_t *db, dns_name_t **namep, +query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep, dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp) { dns_name_t *name; dns_rdataset_t *sigrdataset; dns_rdata_t sigrdata; - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; unsigned int labels; isc_buffer_t *dbuf, b; dns_name_t *fname; @@ -2316,7 +2316,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) is_zone = ISC_FALSE; qtype = event->qtype; - if (qtype == dns_rdatatype_sig) + if (qtype == dns_rdatatype_rrsig) type = dns_rdatatype_any; else type = qtype; @@ -2357,7 +2357,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) /* * If it's a SIG query, we'll iterate the node. */ - if (qtype == dns_rdatatype_sig) + if (qtype == dns_rdatatype_rrsig) type = dns_rdatatype_any; else type = qtype; @@ -2728,7 +2728,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) INSIST(is_zone); if (dns_rdataset_isassociated(rdataset)) { /* - * If we've got a NXT record, we need to save the + * If we've got a NSEC record, we need to save the * name now because we're going call query_addsoa() * below, and it needs to use the name buffer. */ @@ -2750,11 +2750,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) goto cleanup; } /* - * Add NXT record if we found one. + * Add NSEC record if we found one. */ if (WANTDNSSEC(client)) { if (dns_rdataset_isassociated(rdataset)) - query_addnxrrsetnxt(client, db, &fname, + query_addnxrrsetnsec(client, db, &fname, &rdataset, &sigrdataset); } goto cleanup; @@ -2765,7 +2765,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) INSIST(is_zone); if (dns_rdataset_isassociated(rdataset)) { /* - * If we've got a NXT record, we need to save the + * If we've got a NSEC record, we need to save the * name now because we're going call query_addsoa() * below, and it needs to use the name buffer. */ @@ -2793,7 +2793,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) goto cleanup; } /* - * Add NXT record if we found one. + * Add NSEC record if we found one. */ if (dns_rdataset_isassociated(rdataset)) { if (WANTDNSSEC(client)) { @@ -3092,7 +3092,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) /* * We didn't match any rdatasets. */ - if (qtype == dns_rdatatype_sig && + if (qtype == dns_rdatatype_rrsig && result == ISC_R_NOMORE) { /* * XXXRTH If this is a secure zone and we @@ -3162,7 +3162,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) } /* - * Add NXT records to the authority section if they're needed for + * Add NSEC records to the authority section if they're needed for * DNSSEC wildcard proofs. */ if (need_wildcardproof && dns_db_issecure(db)) @@ -3387,7 +3387,7 @@ ns_query_start(ns_client_t *client) { * to return data before validation has completed. */ if (message->flags & DNS_MESSAGEFLAG_CD || - qtype == dns_rdatatype_sig) + qtype == dns_rdatatype_rrsig) { client->query.dboptions |= DNS_DBFIND_PENDINGOK; client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE; diff --git a/bin/named/server.c b/bin/named/server.c index 66350a7325e..da71fffeeec 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.404 2003/09/25 18:16:43 jinmei Exp $ */ +/* $Id: server.c,v 1.405 2003/09/30 05:56:01 marka Exp $ */ #include @@ -192,7 +192,7 @@ configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key, dns_keytable_t *keytable, isc_mem_t *mctx) { dns_rdataclass_t viewclass; - dns_rdata_key_t keystruct; + dns_rdata_dnskey_t keystruct; isc_uint32_t flags, proto, alg; char *keystr, *keynamestr; unsigned char keydata[4096]; @@ -220,7 +220,7 @@ configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key, &viewclass)); } keystruct.common.rdclass = viewclass; - keystruct.common.rdtype = dns_rdatatype_key; + keystruct.common.rdtype = dns_rdatatype_dnskey; /* * The key data in keystruct is not dynamically allocated. */ diff --git a/bin/named/update.c b/bin/named/update.c index f04c7a1b9f5..0c002884469 100644 --- a/bin/named/update.c +++ b/bin/named/update.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: update.c,v 1.105 2003/01/21 05:18:11 marka Exp $ */ +/* $Id: update.c,v 1.106 2003/09/30 05:56:02 marka Exp $ */ #include @@ -32,7 +32,7 @@ #include #include #include -#include +#include #include #include #include @@ -698,11 +698,11 @@ ssu_checkrule(void *data, dns_rdataset_t *rrset) { isc_boolean_t result; /* - * If we're deleting all records, it's ok to delete SIG and NXT even + * If we're deleting all records, it's ok to delete RRSIG and NSEC even * if we're normally not allowed to. */ - if (rrset->type == dns_rdatatype_sig || - rrset->type == dns_rdatatype_nxt) + if (rrset->type == dns_rdatatype_rrsig || + rrset->type == dns_rdatatype_nsec) return (ISC_TRUE); result = dns_ssutable_checkrules(ssuinfo->table, ssuinfo->signer, ssuinfo->name, rrset->type); @@ -850,7 +850,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db, this name and type */ *typep = type = t->rdata.type; - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) covers = dns_rdata_covers(&t->rdata); else covers = 0; @@ -997,7 +997,7 @@ rr_equal_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { * Return true iff 'update_rr' should replace 'db_rr' according * to the special RFC2136 rules for CNAME, SOA, and WKS records. * - * RFC2136 does not mention NXT or DNAME, but multiple NXTs or DNAMEs + * RFC2136 does not mention NSEC or DNAME, but multiple NSECs or DNAMEs * make little sense, so we replace those, too. */ static isc_boolean_t @@ -1010,7 +1010,7 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) { return (ISC_TRUE); if (db_rr->type == dns_rdatatype_soa) return (ISC_TRUE); - if (db_rr->type == dns_rdatatype_nxt) + if (db_rr->type == dns_rdatatype_nsec) return (ISC_TRUE); if (db_rr->type == dns_rdatatype_wks) { /* @@ -1272,7 +1272,7 @@ check_soa_increment(dns_db_t *db, dns_dbversion_t *ver, /**************************************************************************/ /* - * Incremental updating of NXTs and SIGs. + * Incremental updating of NSECs and RRSIGs. */ #define MAXZONEKEYS 32 /* Maximum number of zone keys supported. */ @@ -1329,20 +1329,20 @@ namelist_append_subdomain(dns_db_t *db, dns_name_t *name, dns_diff_t *affected) /* - * Helper function for non_nxt_rrset_exists(). + * Helper function for non_nsec_rrset_exists(). */ static isc_result_t -is_non_nxt_action(void *data, dns_rdataset_t *rrset) { +is_non_nsec_action(void *data, dns_rdataset_t *rrset) { UNUSED(data); - if (!(rrset->type == dns_rdatatype_nxt || - (rrset->type == dns_rdatatype_sig && - rrset->covers == dns_rdatatype_nxt))) + if (!(rrset->type == dns_rdatatype_nsec || + (rrset->type == dns_rdatatype_rrsig && + rrset->covers == dns_rdatatype_nsec))) return (ISC_R_EXISTS); return (ISC_R_SUCCESS); } /* - * Check whether there is an rrset other than a NXT or SIG NXT, + * Check whether there is an rrset other than a NSEC or RRSIG NSEC, * i.e., anything that justifies the continued existence of a name * after a secure update. * @@ -1350,12 +1350,12 @@ is_non_nxt_action(void *data, dns_rdataset_t *rrset) { * Otherwise, set it to ISC_FALSE. */ static isc_result_t -non_nxt_rrset_exists(dns_db_t *db, dns_dbversion_t *ver, +non_nsec_rrset_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, isc_boolean_t *exists) { isc_result_t result; result = foreach_rrset(db, ver, name, - is_non_nxt_action, NULL); + is_non_nsec_action, NULL); RETURN_EXISTENCE_FLAG; } @@ -1411,7 +1411,7 @@ is_glue(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, return (ISC_R_SUCCESS); } else if (result == DNS_R_ZONECUT) { /* - * We are at the zonecut. The name will have an NXT, but + * We are at the zonecut. The name will have an NSEC, but * non-delegation will be omitted from the type bit map. */ *flag = ISC_FALSE; @@ -1425,9 +1425,9 @@ is_glue(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, } /* - * Find the next/previous name that has a NXT record. + * Find the next/previous name that has a NSEC record. * In other words, skip empty database nodes and names that - * have had their NXTs removed because they are obscured by + * have had their NSECs removed because they are obscured by * a zone cut. */ static isc_result_t @@ -1437,7 +1437,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, { isc_result_t result; dns_dbiterator_t *dbit = NULL; - isc_boolean_t has_nxt; + isc_boolean_t has_nsec; unsigned int wraps = 0; CHECK(dns_db_createiterator(db, ISC_FALSE, &dbit)); @@ -1461,7 +1461,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, wraps++; if (wraps == 2) { update_log(client, zone, ISC_LOG_ERROR, - "secure zone with no NXTs"); + "secure zone with no NSECs"); result = DNS_R_BADZONE; goto failure; } @@ -1477,9 +1477,9 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, */ CHECK(dns_dbiterator_pause(dbit)); CHECK(rrset_exists(db, ver, newname, - dns_rdatatype_nxt, 0, &has_nxt)); + dns_rdatatype_nsec, 0, &has_nsec)); - } while (! has_nxt); + } while (! has_nsec); failure: if (dbit != NULL) dns_dbiterator_destroy(&dbit); @@ -1488,16 +1488,16 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, } /* - * Add a NXT record for "name", recording the change in "diff". - * The existing NXT is removed. + * Add a NSEC record for "name", recording the change in "diff". + * The existing NSEC is removed. */ static isc_result_t -add_nxt(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, +add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff) { isc_result_t result; dns_dbnode_t *node = NULL; - unsigned char buffer[DNS_NXT_BUFFERSIZE]; + unsigned char buffer[DNS_NSEC_BUFFERSIZE]; dns_rdata_t rdata = DNS_RDATA_INIT; dns_difftuple_t *tuple = NULL; dns_fixedname_t fixedname; @@ -1507,25 +1507,25 @@ add_nxt(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, target = dns_fixedname_name(&fixedname); /* - * Find the successor name, aka NXT target. + * Find the successor name, aka NSEC target. */ CHECK(next_active(client, zone, db, ver, name, target, ISC_TRUE)); /* - * Create the NXT RDATA. + * Create the NSEC RDATA. */ CHECK(dns_db_findnode(db, name, ISC_FALSE, &node)); dns_rdata_init(&rdata); - CHECK(dns_nxt_buildrdata(db, ver, node, target, buffer, &rdata)); + CHECK(dns_nsec_buildrdata(db, ver, node, target, buffer, &rdata)); dns_db_detachnode(db, &node); /* - * Delete the old NXT and record the change. + * Delete the old NSEC and record the change. */ - CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nxt, 0, + CHECK(delete_if(true_p, db, ver, name, dns_rdatatype_nsec, 0, NULL, diff)); /* - * Add the new NXT and record the change. + * Add the new NSEC and record the change. */ CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 3600, /* XXXRTH */ @@ -1540,10 +1540,10 @@ add_nxt(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, } /* - * Add a placeholder NXT record for "name", recording the change in "diff". + * Add a placeholder NSEC record for "name", recording the change in "diff". */ static isc_result_t -add_placeholder_nxt(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, +add_placeholder_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff) { isc_result_t result; dns_difftuple_t *tuple = NULL; @@ -1553,7 +1553,7 @@ add_placeholder_nxt(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, r.base = data; r.length = sizeof(data); - dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nxt, &r); + dns_rdata_fromregion(&rdata, dns_db_class(db), dns_rdatatype_nsec, &r); CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 0, &rdata, &tuple)); CHECK(do_one_tuple(&tuple, db, ver, diff)); @@ -1579,7 +1579,7 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, } /* - * Add SIG records for an RRset, recording the change in "diff". + * Add RRSIG records for an RRset, recording the change in "diff". */ static isc_result_t add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, @@ -1606,12 +1606,12 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_db_detachnode(db, &node); for (i = 0; i < nkeys; i++) { - /* Calculate the signature, creating a SIG RDATA. */ + /* Calculate the signature, creating a RRSIG RDATA. */ CHECK(dns_dnssec_sign(name, &rdataset, keys[i], &inception, &expire, mctx, &buffer, &sig_rdata)); - /* Update the database and journal with the SIG. */ + /* Update the database and journal with the RRSIG. */ /* XXX inefficient - will cause dataset merging */ CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name, rdataset.ttl, &sig_rdata)); @@ -1627,15 +1627,15 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, } /* - * Update SIG and NXT records affected by an update. The original - * update, including the SOA serial update but exluding the SIG & NXT + * Update RRSIG and NSEC records affected by an update. The original + * update, including the SOA serial update but exluding the RRSIG & NSEC * changes, is in "diff" and has already been applied to "newver" of "db". * The database version prior to the update is "oldver". * - * The necessary SIG and NXT changes will be applied to "newver" + * The necessary RRSIG and NSEC changes will be applied to "newver" * and added (as a minimal diff) to "diff". * - * The SIGs generated will be valid for 'sigvalidityinterval' seconds. + * The RRSIGs generated will be valid for 'sigvalidityinterval' seconds. */ static isc_result_t update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, @@ -1647,8 +1647,8 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, dns_diff_t diffnames; dns_diff_t affected; dns_diff_t sig_diff; - dns_diff_t nxt_diff; - dns_diff_t nxt_mindiff; + dns_diff_t nsec_diff; + dns_diff_t nsec_mindiff; isc_boolean_t flag; dst_key_t *zone_keys[MAXZONEKEYS]; unsigned int nkeys = 0; @@ -1659,8 +1659,8 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, dns_diff_init(client->mctx, &affected); dns_diff_init(client->mctx, &sig_diff); - dns_diff_init(client->mctx, &nxt_diff); - dns_diff_init(client->mctx, &nxt_mindiff); + dns_diff_init(client->mctx, &nsec_diff); + dns_diff_init(client->mctx, &nsec_mindiff); result = find_zone_keys(zone, db, newver, client->mctx, MAXZONEKEYS, zone_keys, &nkeys); @@ -1676,7 +1676,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, /* * Find all RRsets directly affected by the update, and - * update their SIGs. Also build a list of names affected + * update their RRSIGs. Also build a list of names affected * by the update in "diffnames". */ CHECK(dns_diff_sort(diff, temp_order)); @@ -1697,17 +1697,17 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, * affected by the update. */ - /* Don't sign SIGs. */ - if (type == dns_rdatatype_sig) + /* Don't sign RRSIGs. */ + if (type == dns_rdatatype_rrsig) goto skip; /* - * Delete all old SIGs covering this type, since they + * Delete all old RRSIGs covering this type, since they * are all invalid when the signed RRset has changed. * We may not be able to recreate all of them - tough. */ CHECK(delete_if(true_p, db, newver, name, - dns_rdatatype_sig, type, + dns_rdatatype_rrsig, type, NULL, &sig_diff)); /* @@ -1732,12 +1732,12 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, } } - /* Remove orphaned NXTs and SIG NXTs. */ + /* Remove orphaned NSECs and RRSIG NSECs. */ for (t = ISC_LIST_HEAD(diffnames.tuples); t != NULL; t = ISC_LIST_NEXT(t, link)) { - CHECK(non_nxt_rrset_exists(db, newver, &t->name, &flag)); + CHECK(non_nsec_rrset_exists(db, newver, &t->name, &flag)); if (! flag) { CHECK(delete_if(true_p, db, newver, &t->name, dns_rdatatype_any, 0, @@ -1747,7 +1747,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, /* * When a name is created or deleted, its predecessor needs to - * have its NXT updated. + * have its NSEC updated. */ for (t = ISC_LIST_HEAD(diffnames.tuples); t != NULL; @@ -1769,7 +1769,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, * Find the predecessor. * When names become obscured or unobscured in this update * transaction, we may find the wrong predecessor because - * the NXTs have not yet been updated to reflect the delegation + * the NSECs have not yet been updated to reflect the delegation * change. This should not matter because in this case, * the correct predecessor is either the delegation node or * a newly unobscured node, and those nodes are on the @@ -1804,7 +1804,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, continue; /* * There was a delegation change. Mark all subdomains - * of t->name as potentially needing a NXT update. + * of t->name as potentially needing a NSEC update. */ CHECK(namelist_append_subdomain(db, &t->name, &affected)); } @@ -1815,11 +1815,11 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, CHECK(uniqify_name_list(&affected)); /* - * Determine which names should have NXTs, and delete/create - * NXTs to make it so. We don't know the final NXT targets yet, - * so we just create placeholder NXTs with arbitrary contents + * Determine which names should have NSECs, and delete/create + * NSECs to make it so. We don't know the final NSEC targets yet, + * so we just create placeholder NSECs with arbitrary contents * to indicate that their respective owner names should be part of - * the NXT chain. + * the NSEC chain. */ for (t = ISC_LIST_HEAD(affected.tuples); t != NULL; @@ -1833,25 +1833,25 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, if (flag) { /* * This name is obscured. Delete any - * existing NXT record. + * existing NSEC record. */ CHECK(delete_if(true_p, db, newver, &t->name, - dns_rdatatype_nxt, 0, - NULL, &nxt_diff)); + dns_rdatatype_nsec, 0, + NULL, &nsec_diff)); } else { /* - * This name is not obscured. It should have a NXT. + * This name is not obscured. It should have a NSEC. */ CHECK(rrset_exists(db, newver, &t->name, - dns_rdatatype_nxt, 0, &flag)); + dns_rdatatype_nsec, 0, &flag)); if (! flag) - CHECK(add_placeholder_nxt(db, newver, &t->name, + CHECK(add_placeholder_nsec(db, newver, &t->name, diff)); } } /* - * Now we know which names are part of the NXT chain. + * Now we know which names are part of the NSEC chain. * Make them all point at their correct targets. */ for (t = ISC_LIST_HEAD(affected.tuples); @@ -1859,50 +1859,50 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, t = ISC_LIST_NEXT(t, link)) { CHECK(rrset_exists(db, newver, &t->name, - dns_rdatatype_nxt, 0, &flag)); + dns_rdatatype_nsec, 0, &flag)); if (flag) { /* - * There is a NXT, but we don't know if it is correct. + * There is a NSEC, but we don't know if it is correct. * Delete it and create a correct one to be sure. * If the update was unnecessary, the diff minimization * will take care of eliminating it from the journal, * IXFRs, etc. * - * The SIG bit should always be set in the NXTs - * we generate, because they will all get SIG NXTs. + * The RRSIG bit should always be set in the NSECs + * we generate, because they will all get RRSIG NSECs. * (XXX what if the zone keys are missing?). - * Because the SIG NXTs have not necessarily been + * Because the RRSIG NSECs have not necessarily been * created yet, the correctness of the bit mask relies - * on the assumption that NXTs are only created if + * on the assumption that NSECs are only created if * there is other data, and if there is other data, - * there are other SIGs. + * there are other RRSIGs. */ - CHECK(add_nxt(client, zone, db, newver, - &t->name, &nxt_diff)); + CHECK(add_nsec(client, zone, db, newver, + &t->name, &nsec_diff)); } } /* - * Minimize the set of NXT updates so that we don't - * have to regenerate the SIG NXTs for NXTs that were + * Minimize the set of NSEC updates so that we don't + * have to regenerate the RRSIG NSECs for NSECs that were * replaced with identical ones. */ - while ((t = ISC_LIST_HEAD(nxt_diff.tuples)) != NULL) { - ISC_LIST_UNLINK(nxt_diff.tuples, t, link); - dns_diff_appendminimal(&nxt_mindiff, &t); + while ((t = ISC_LIST_HEAD(nsec_diff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_diff.tuples, t, link); + dns_diff_appendminimal(&nsec_mindiff, &t); } - /* Update SIG NXTs. */ - for (t = ISC_LIST_HEAD(nxt_mindiff.tuples); + /* Update RRSIG NSECs. */ + for (t = ISC_LIST_HEAD(nsec_mindiff.tuples); t != NULL; t = ISC_LIST_NEXT(t, link)) { if (t->op == DNS_DIFFOP_DEL) { CHECK(delete_if(true_p, db, newver, &t->name, - dns_rdatatype_sig, dns_rdatatype_nxt, + dns_rdatatype_rrsig, dns_rdatatype_nsec, NULL, &sig_diff)); } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nxt, + CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec, &sig_diff, zone_keys, nkeys, client->mctx, inception, expire)); } else { @@ -1915,19 +1915,19 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db, ISC_LIST_UNLINK(sig_diff.tuples, t, link); dns_diff_appendminimal(diff, &t); } - while ((t = ISC_LIST_HEAD(nxt_mindiff.tuples)) != NULL) { - ISC_LIST_UNLINK(nxt_mindiff.tuples, t, link); + while ((t = ISC_LIST_HEAD(nsec_mindiff.tuples)) != NULL) { + ISC_LIST_UNLINK(nsec_mindiff.tuples, t, link); dns_diff_appendminimal(diff, &t); } INSIST(ISC_LIST_EMPTY(sig_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nxt_diff.tuples)); - INSIST(ISC_LIST_EMPTY(nxt_mindiff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_diff.tuples)); + INSIST(ISC_LIST_EMPTY(nsec_mindiff.tuples)); failure: dns_diff_clear(&sig_diff); - dns_diff_clear(&nxt_diff); - dns_diff_clear(&nxt_mindiff); + dns_diff_clear(&nsec_diff); + dns_diff_clear(&nsec_mindiff); dns_diff_clear(&affected); dns_diff_clear(&diffnames); @@ -2311,17 +2311,17 @@ update_action(isc_task_t *task, isc_event_t *event) { /* * draft-ietf-dnsind-simple-secure-update-01 says * "Unlike traditional dynamic update, the client - * is forbidden from updating NXT records." + * is forbidden from updating NSEC records." */ if (dns_db_issecure(db)) { - if (rdata.type == dns_rdatatype_nxt) { + if (rdata.type == dns_rdatatype_nsec) { FAILC(DNS_R_REFUSED, - "explicit NXT updates are not allowed " + "explicit NSEC updates are not allowed " "in secure zones"); } - else if (rdata.type == dns_rdatatype_sig) { + else if (rdata.type == dns_rdatatype_rrsig) { FAILC(DNS_R_REFUSED, - "explicit SIG updates are currently not " + "explicit RRSIG updates are currently not " "supported in secure zones"); } } @@ -2569,7 +2569,7 @@ update_action(isc_task_t *task, isc_event_t *event) { /* * If any changes were made, increment the SOA serial number, - * update SIGs and NXTs (if zone is secure), and write the update + * update RRSIGs and NSECs (if zone is secure), and write the update * to the journal. */ if (! ISC_LIST_EMPTY(diff.tuples)) { @@ -2593,7 +2593,7 @@ update_action(isc_task_t *task, isc_event_t *event) { if (result != ISC_R_SUCCESS) { update_log(client, zone, ISC_LOG_ERROR, - "SIG/NXT update failed: %s", + "RRSIG/NSEC update failed: %s", isc_result_totext(result)); goto failure; } diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index 51dc5e87444..b1e5298127f 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -16,7 +16,7 @@ - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. --> - + @@ -500,7 +500,7 @@ This ensures that when the CNAME is added, it cannot conflict with the long-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have -SIG, KEY and NXT records.) +RRSIG, DNSKEY and NSEC records.) diff --git a/bin/tests/Makefile.in b/bin/tests/Makefile.in index 5ff6936876c..05704e38add 100644 --- a/bin/tests/Makefile.in +++ b/bin/tests/Makefile.in @@ -13,7 +13,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.117 2002/12/27 03:29:32 marka Exp $ +# $Id: Makefile.in,v 1.118 2003/09/30 05:56:02 marka Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -74,7 +74,7 @@ XTARGETS = adb_test@EXEEXT@ \ master_test@EXEEXT@ \ mempool_test@EXEEXT@ \ name_test@EXEEXT@ \ - nxtify@EXEEXT@ \ + nsecify@EXEEXT@ \ ratelimiter_test@EXEEXT@ \ rbt_test@EXEEXT@ \ rdata_test@EXEEXT@ \ @@ -112,7 +112,7 @@ SRCS = adb_test.c \ master_test.c \ mempool_test.c \ name_test.c \ - nxtify.c \ + nsecify.c \ printmsg.c \ ratelimiter_test.c \ rbt_test.c \ @@ -139,8 +139,8 @@ adb_test@EXEEXT@: adb_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS} ${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ adb_test.@O@ \ ${DNSLIBS} ${ISCLIBS} ${LIBS} -nxtify@EXEEXT@: nxtify.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS} - ${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ nxtify.@O@ \ +nsecify@EXEEXT@: nsecify.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS} + ${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ nsecify.@O@ \ ${DNSLIBS} ${ISCLIBS} ${LIBS} byaddr_test@EXEEXT@: byaddr_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS} diff --git a/bin/tests/master/master6.data b/bin/tests/master/master6.data index 7441c59cd25..a9a37bbf8e1 100644 --- a/bin/tests/master/master6.data +++ b/bin/tests/master/master6.data @@ -7,7 +7,7 @@ $TTL 1000 604800 ;expiration 3600 ) ;minimum -secure1 3600 IN KEY ( +secure1 3600 IN DNSKEY ( FLAG2|FLAG4|FLAG5|NTYP3|FLAG8|FLAG9|FLAG10|FLAG11|SIG15 3 3 ArT0a8FtOZWEONG2YQVl9+RA34op30JPz4NPEroCxm2yImT2 @@ -19,7 +19,7 @@ secure1 3600 IN KEY ( /7YMt8VUkA8/8UCszBBT7XAJ3OFjiMO8mvxrZZFzvwJlPBQ1 oFq/TNZlSe+N ) -secure2 3600 in key ( +secure2 3600 in DNSKEY ( flag2|flag4|flag5|ntyp3|flag8|flag9|flag10|flag11|sig15 3 3 ArT0a8FtOZWEONG2YQVl9+RA34op30JPz4NPEroCxm2yImT2 diff --git a/bin/tests/master/master7.data b/bin/tests/master/master7.data index deb5824b4be..2638b5d77b3 100644 --- a/bin/tests/master/master7.data +++ b/bin/tests/master/master7.data @@ -7,11 +7,11 @@ $TTL 1000 604800 ;expiration 3600 ) ;minimum -secure1 3600 IN KEY ( +secure1 3600 IN DNSKEY ( NOKEY|FLAG2|FLAG4|FLAG5|NTYP3|FLAG8|FLAG9|FLAG10|FLAG11|SIG15 3 3 ) -secure2 3600 in key ( +secure2 3600 in DNSKEY ( nokey|flag2|flag4|flag5|ntyp3|flag8|flag9|flag10|flag11|sig15 3 3 ) diff --git a/bin/tests/master/t_master.c b/bin/tests/master/t_master.c index b5ab8333a53..3264ab09b33 100644 --- a/bin/tests/master/t_master.c +++ b/bin/tests/master/t_master.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: t_master.c,v 1.30 2001/05/22 01:44:36 gson Exp $ */ +/* $Id: t_master.c,v 1.31 2003/09/30 05:56:03 marka Exp $ */ #include @@ -237,7 +237,7 @@ t5() { } static const char *a6 = - "dns_master_loadfile understands KEY RR specifications " + "dns_master_loadfile understands DNSKEY RR specifications " "containing key material"; static void @@ -251,7 +251,7 @@ t6() { } static const char *a7 = - "dns_master_loadfile understands KEY RR specifications " + "dns_master_loadfile understands DNSKEY RR specifications " "containing no key material"; static void @@ -323,8 +323,8 @@ testspec_t T_testlist[] = { { t3, "DNS_NOOWNER" }, { t4, "DNS_NOTTL" }, { t5, "DNS_BADCLASS" }, - { t6, "KEY RR 1" }, - { t7, "KEY RR 2" }, + { t6, "DNSKEY RR 1" }, + { t7, "DNSKEY RR 2" }, { t8, "$INCLUDE" }, { t9, "$INCLUDE w/ DNS_BADCLASS" }, { t10, "non empty blank lines" }, diff --git a/bin/tests/names/dns_label_countbits_data b/bin/tests/names/dns_label_countbits_data deleted file mode 100644 index 0888eff5ac6..00000000000 --- a/bin/tests/names/dns_label_countbits_data +++ /dev/null @@ -1,7 +0,0 @@ -# -# format of file is -# -\[x42/7] 0 7 -a.b.c.\[x42/7] 3 7 -\[o033/9] 0 9 -\[b01001/5] 0 5 diff --git a/bin/tests/names/dns_label_getbit_data b/bin/tests/names/dns_label_getbit_data deleted file mode 100644 index 51240432b38..00000000000 --- a/bin/tests/names/dns_label_getbit_data +++ /dev/null @@ -1,10 +0,0 @@ -# -# format is: -# -# -\[x42/7] 0 6 1 -a.b.c.\[x42/7] 3 5 0 -\[o033/9] 0 2 0 -\[o033/9] 0 3 0 -\[o033/9] 0 4 1 -\[b0101/4] 0 1 1 diff --git a/bin/tests/names/dns_name_countlabels_data b/bin/tests/names/dns_name_countlabels_data index e5ce8dfd8bc..f11c3873f45 100644 --- a/bin/tests/names/dns_name_countlabels_data +++ b/bin/tests/names/dns_name_countlabels_data @@ -8,6 +8,3 @@ c.d. 3 a.b.c.d 4 a.b.c 3 . 1 -\[b1100110].b.\[xab].a 4 -\[b1100110].b.\[xab].a. 5 -\[b1100110].\[xa2].\[o031].a. 3 diff --git a/bin/tests/names/dns_name_fromregion_data b/bin/tests/names/dns_name_fromregion_data index 64cf117cbe6..32b42204834 100644 --- a/bin/tests/names/dns_name_fromregion_data +++ b/bin/tests/names/dns_name_fromregion_data @@ -6,7 +6,6 @@ # # and where: exp_nlabels and exp_nbits are not tested if < 0 # -#c.d.\[x31].abc.\[b110011] a.b.c.d. a.b.c.d.[A].[aaa. Ba\x\aa.b.c\[\[o\\.Z diff --git a/bin/tests/names/dns_name_hash_data b/bin/tests/names/dns_name_hash_data index 879ec2d8e29..093ba45bbf5 100644 --- a/bin/tests/names/dns_name_hash_data +++ b/bin/tests/names/dns_name_hash_data @@ -10,4 +10,3 @@ # case insensitive hash of testname2, otherwise cishm != 0 # a.b.c.d a.b.c.d. 0 0 -\[x42/7].A. \[x42/7].a. 0 1 diff --git a/bin/tests/names/dns_name_isabsolute_data b/bin/tests/names/dns_name_isabsolute_data index b387c7f3185..a17c9b8a19c 100644 --- a/bin/tests/names/dns_name_isabsolute_data +++ b/bin/tests/names/dns_name_isabsolute_data @@ -3,6 +3,6 @@ # format is: # # -\[x42/7]. 1 -a.b.c.\[x42/7] 0 -\[o033/9].z. 1 +x. 1 +a.b.c.d 0 +x.z. 1 diff --git a/bin/tests/names/dns_name_toregion_data b/bin/tests/names/dns_name_toregion_data index 24d0d3ceaf6..00c10f49f93 100644 --- a/bin/tests/names/dns_name_toregion_data +++ b/bin/tests/names/dns_name_toregion_data @@ -3,7 +3,6 @@ # format: # # -c.d.\[x31].abc.\[b110011] a.b.c.d. a.b.c.d.[A].[aaa. Ba\x\aa.b.c\[\[o\\.Z diff --git a/bin/tests/nxtify.c b/bin/tests/nsecify.c similarity index 94% rename from bin/tests/nxtify.c rename to bin/tests/nsecify.c index 78bdfb47f20..88f60772783 100644 --- a/bin/tests/nxtify.c +++ b/bin/tests/nsecify.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nxtify.c,v 1.20 2001/11/27 01:55:20 gson Exp $ */ +/* $Id: nsecify.c,v 1.2 2003/09/30 06:00:38 marka Exp $ */ #include @@ -27,7 +27,7 @@ #include #include #include -#include +#include #include #include #include @@ -63,7 +63,7 @@ active_node(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) { result = dns_rdatasetiter_first(rdsiter); while (result == ISC_R_SUCCESS) { dns_rdatasetiter_current(rdsiter, &rdataset); - if (rdataset.type != dns_rdatatype_nxt) + if (rdataset.type != dns_rdatatype_nsec) active = ISC_TRUE; dns_rdataset_disassociate(&rdataset); if (!active) @@ -77,10 +77,10 @@ active_node(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) { if (!active) { /* - * Make sure there is no NXT record for this node. + * Make sure there is no NSEC record for this node. */ result = dns_db_deleterdataset(db, node, version, - dns_rdatatype_nxt, 0); + dns_rdatatype_nsec, 0); if (result == DNS_R_UNCHANGED) result = ISC_R_SUCCESS; check_result(result, "dns_db_deleterdataset"); @@ -112,7 +112,7 @@ next_active(dns_db_t *db, dns_dbversion_t *version, dns_dbiterator_t *dbiter, } static void -nxtify(char *filename) { +nsecify(char *filename) { isc_result_t result; dns_db_t *db; dns_dbversion_t *wversion; @@ -172,7 +172,7 @@ nxtify(char *filename) { target = NULL; /* Make compiler happy. */ fatal("db iteration failed"); } - dns_nxt_build(db, wversion, node, target, 3600); /* XXX BEW */ + dns_nsec_build(db, wversion, node, target, 3600); /* XXX BEW */ dns_db_detachnode(db, &node); node = nextnode; } @@ -206,7 +206,7 @@ main(int argc, char *argv[]) { argv++; for (i = 0; i < argc; i++) - nxtify(argv[i]); + nsecify(argv[i]); /* isc_mem_stats(mctx, stdout); */ isc_mem_destroy(&mctx); diff --git a/bin/tests/rbt/dns_rbt_addname_1_data b/bin/tests/rbt/dns_rbt_addname_1_data index b7475ed6b12..89dca408eb8 100644 --- a/bin/tests/rbt/dns_rbt_addname_1_data +++ b/bin/tests/rbt/dns_rbt_addname_1_data @@ -4,6 +4,3 @@ # format is: # dns_rbt.data add new.name ISC_R_SUCCESS -dns_rbt.data add \[x42/7].name ISC_R_SUCCESS -dns_rbt.data add \[b11011].name ISC_R_SUCCESS -dns_rbt.data add \[o033/9].name ISC_R_SUCCESS diff --git a/bin/tests/rbt/dns_rbt_bitstring.data b/bin/tests/rbt/dns_rbt_bitstring.data index 34afb7b98c4..2b34cc63288 100644 --- a/bin/tests/rbt/dns_rbt_bitstring.data +++ b/bin/tests/rbt/dns_rbt_bitstring.data @@ -1,12 +1,6 @@ a.vix.com b.vix.com c.vix.com -\[x42/7].vix.com -a.\[x42/7].com -a.vix.\[x42/7] -\[b011011].vix.com -a.\[b011011].com -a.vix.\[b011011].com a.a.vix.com a.a.a.vix.com a.a.a.a.vix.com diff --git a/bin/tests/rbt/dns_rbt_deletename_1_data b/bin/tests/rbt/dns_rbt_deletename_1_data index 5a34481baa6..2e00e502ab4 100644 --- a/bin/tests/rbt/dns_rbt_deletename_1_data +++ b/bin/tests/rbt/dns_rbt_deletename_1_data @@ -4,6 +4,3 @@ # format is: # dns_rbt.data delete a.vix.com ISC_R_SUCCESS -dns_rbt_bitstring.data delete \[x42/7].vix.com ISC_R_SUCCESS -dns_rbt_bitstring.data delete a.\[x42/7].com ISC_R_SUCCESS -dns_rbt_bitstring.data delete a.vix.\[x42/7] ISC_R_SUCCESS diff --git a/bin/tests/rbt/dns_rbt_deletename_2_data b/bin/tests/rbt/dns_rbt_deletename_2_data index a3d195b2462..0b1fdb7b6cc 100644 --- a/bin/tests/rbt/dns_rbt_deletename_2_data +++ b/bin/tests/rbt/dns_rbt_deletename_2_data @@ -4,6 +4,3 @@ # format is: # dns_rbt.data delete new.name ISC_R_NOTFOUND -dns_rbt.data delete \[x42/7].vix.com ISC_R_NOTFOUND -dns_rbt.data delete a.\[x42/7].com ISC_R_NOTFOUND -dns_rbt.data delete a.vix.\[x42/7] ISC_R_NOTFOUND diff --git a/bin/tests/rbt/dns_rbt_findname_1_data b/bin/tests/rbt/dns_rbt_findname_1_data index e478c67529c..2a3728dd080 100644 --- a/bin/tests/rbt/dns_rbt_findname_1_data +++ b/bin/tests/rbt/dns_rbt_findname_1_data @@ -4,6 +4,3 @@ # format is: # dns_rbt.data search a.vix.com ISC_R_SUCCESS -dns_rbt_bitstring.data search \[x42/7].vix.com ISC_R_SUCCESS -dns_rbt_bitstring.data search a.\[x42/7].com ISC_R_SUCCESS -dns_rbt_bitstring.data search a.vix.\[x42/7] ISC_R_SUCCESS diff --git a/bin/tests/rbt/dns_rbt_findname_2_data b/bin/tests/rbt/dns_rbt_findname_2_data index 7bf35406ccf..eb3d467b300 100644 --- a/bin/tests/rbt/dns_rbt_findname_2_data +++ b/bin/tests/rbt/dns_rbt_findname_2_data @@ -4,6 +4,3 @@ # format is: # dns_rbt.data search not.used.here ISC_R_NOTFOUND -dns_rbt.data search \[x42/7].vix.com ISC_R_NOTFOUND -dns_rbt.data search a.\[x42/7].com ISC_R_NOTFOUND -dns_rbt.data search a.vix.\[x42/7] ISC_R_NOTFOUND diff --git a/bin/tests/rbt/dns_rbt_findname_3_data b/bin/tests/rbt/dns_rbt_findname_3_data index 71274db3051..4ea2db301af 100644 --- a/bin/tests/rbt/dns_rbt_findname_3_data +++ b/bin/tests/rbt/dns_rbt_findname_3_data @@ -4,4 +4,3 @@ # format is: # dns_rbt.data search a.b.vix.com DNS_R_PARTIALMATCH -dns_rbt_bitstring.data search b.a.\[x42/7].com DNS_R_PARTIALMATCH diff --git a/bin/tests/rdata_test.c b/bin/tests/rdata_test.c index 22568f2bdf5..5d9da69b064 100644 --- a/bin/tests/rdata_test.c +++ b/bin/tests/rdata_test.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdata_test.c,v 1.38 2002/03/06 07:41:25 marka Exp $ */ +/* $Id: rdata_test.c,v 1.39 2003/09/30 05:56:02 marka Exp $ */ #include @@ -284,6 +284,21 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx, result = dns_rdata_tostruct(rdata, sp = &x25, NULL); break; } + case dns_rdatatype_nsec: { + dns_rdata_nsec_t nsec; + result = dns_rdata_tostruct(rdata, sp = &nsec, NULL); + break; + } + case dns_rdatatype_rrsig: { + dns_rdata_rrsig_t rrsig; + result = dns_rdata_tostruct(rdata, sp = &rrsig, NULL); + break; + } + case dns_rdatatype_dnskey: { + dns_rdata_dnskey_t dnskey; + result = dns_rdata_tostruct(rdata, sp = &dnskey, NULL); + break; + } default: result = ISC_R_NOTIMPLEMENTED; break; @@ -526,6 +541,21 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx, result = dns_rdata_tostruct(rdata, sp = &x25, mctx); break; } + case dns_rdatatype_nsec: { + dns_rdata_nsec_t nsec; + result = dns_rdata_tostruct(rdata, sp = &nsec, mctx); + break; + } + case dns_rdatatype_rrsig: { + dns_rdata_rrsig_t rrsig; + result = dns_rdata_tostruct(rdata, sp = &rrsig, mctx); + break; + } + case dns_rdatatype_dnskey: { + dns_rdata_dnskey_t dnskey; + result = dns_rdata_tostruct(rdata, sp = &dnskey, mctx); + break; + } default: result = ISC_R_NOTIMPLEMENTED; break; @@ -798,6 +828,21 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx, result = dns_rdata_fromstruct(rdata2, rdc, rdt, &x25, b); break; } + case dns_rdatatype_nsec: { + dns_rdata_nsec_t nsec; + result = dns_rdata_fromstruct(rdata2, rdc, rdt, &nsec, b); + break; + } + case dns_rdatatype_rrsig: { + dns_rdata_rrsig_t rrsig; + result = dns_rdata_fromstruct(rdata2, rdc, rdt, &rrsig, b); + break; + } + case dns_rdatatype_dnskey: { + dns_rdata_dnskey_t dnskey; + result = dns_rdata_fromstruct(rdata2, rdc, rdt, &dnskey, b); + break; + } default: result = ISC_R_NOTIMPLEMENTED; break; diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in index 5d62fd16e0a..e933537313d 100644 --- a/bin/tests/system/conf.sh.in +++ b/bin/tests/system/conf.sh.in @@ -15,7 +15,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: conf.sh.in,v 1.24 2002/06/17 04:01:10 marka Exp $ +# $Id: conf.sh.in,v 1.25 2003/09/30 05:56:06 marka Exp $ # # Common configuration data for system tests, to be sourced into @@ -40,9 +40,10 @@ SIGNER=$TOP/bin/dnssec/dnssec-signzone # The "stress" test is not run by default since it creates enough # load on the machine to make it unusable to other users. +# v6synth SUBDIRS="cacheclean dnssec forward glue ixfr limits lwresd \ masterfile notify nsupdate resolver sortlist stub tkey \ - unknown upforwd v6synth views xfer xferquota" + unknown upforwd views xfer xferquota" # PERL will be an empty string if no perl interpreter was found. PERL=@PERL@ diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh index c99aa35abab..3187e6a0bdb 100644 --- a/bin/tests/system/dnssec/ns1/sign.sh +++ b/bin/tests/system/dnssec/ns1/sign.sh @@ -15,7 +15,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: sign.sh,v 1.14 2002/06/17 04:01:12 marka Exp $ +# $Id: sign.sh,v 1.15 2003/09/30 05:56:06 marka Exp $ SYSTEMTESTTOP=../.. . $SYSTEMTESTTOP/conf.sh @@ -34,7 +34,7 @@ keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone` cat $infile $keyname.key > $zonefile -$SIGNER -r $RANDFILE -o $zone $zonefile > /dev/null +$SIGNER -g -r $RANDFILE -o $zone $zonefile > /dev/null # Configure the resolving server with a trusted key. diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh index cd21bdf6963..78bd6b9af09 100644 --- a/bin/tests/system/dnssec/ns2/sign.sh +++ b/bin/tests/system/dnssec/ns2/sign.sh @@ -15,7 +15,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: sign.sh,v 1.21 2002/07/19 06:20:24 marka Exp $ +# $Id: sign.sh,v 1.22 2003/09/30 05:56:07 marka Exp $ SYSTEMTESTTOP=../.. . $SYSTEMTESTTOP/conf.sh @@ -40,7 +40,7 @@ keyname2=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone` cat $infile $keyname1.key $keyname2.key >$zonefile -$SIGNER -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null +$SIGNER -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null # Sign the privately secure file @@ -52,4 +52,4 @@ privkeyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $privzone` cat $privinfile $privkeyname.key >$privzonefile -$SIGNER -r $RANDFILE -o $privzone $privzonefile > /dev/null +$SIGNER -g -r $RANDFILE -o $privzone $privzonefile > /dev/null diff --git a/bin/tests/system/genzone.sh b/bin/tests/system/genzone.sh index 33a84791e2c..6c2dcf2aba4 100644 --- a/bin/tests/system/genzone.sh +++ b/bin/tests/system/genzone.sh @@ -15,7 +15,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: genzone.sh,v 1.3 2002/02/20 03:33:46 marka Exp $ +# $Id: genzone.sh,v 1.4 2003/09/30 05:56:06 marka Exp $ # # Set up a test zone @@ -156,17 +156,17 @@ nsap-ptr01 NSAP-PTR foo. nsap-ptr01 NSAP-PTR . ; type 24 -sig01 SIG NXT 1 3 ( 3600 20000102030405 - 19961211100908 2143 foo.nil. - MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I - kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t - VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= ) +;sig01 SIG NXT 1 3 ( 3600 20000102030405 +; 19961211100908 2143 foo.nil. +; MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I +; kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t +; VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= ) ; type 25 -key01 KEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY - 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV - sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg - a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= ) +;key01 KEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY +; 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV +; sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg +; a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= ) ; type 26 px01 PX 65535 foo. bar. @@ -182,10 +182,10 @@ loc02 LOC 60 09 00.000 N 24 39 00.000 E 10.00m 20.00m ( 2000.00m 20.00m ) ; type 30 -nxt01 NXT a.secure.nil. ( NS SOA MX SIG KEY LOC NXT ) -nxt02 NXT . NXT NSAP-PTR -nxt03 NXT . 1 -nxt04 NXT . 127 +;nxt01 NXT a.secure.nil. ( NS SOA MX RRSIG KEY LOC NXT ) +;nxt02 NXT . NXT NSAP-PTR +;nxt03 NXT . 1 +;nxt04 NXT . 127 ; type 33 srv01 SRV 0 0 0 . @@ -219,6 +219,25 @@ dname03 DNAME . ; type 41 ; OPT is a meta-type and should never occur in master files. +; type 46 +rrsig01 RRSIG NSEC 1 3 ( 3600 20000102030405 + 19961211100908 2143 foo.nil. + MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I + kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t + VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= ) + +; type 47 +nsec01 NSEC a.secure.nil. ( NS SOA MX RRSIG DNSKEY LOC NSEC ) +nsec02 NSEC . NSEC NSAP-PTR +nsec03 NSEC . 1 +nsec04 NSEC . 127 + +; type 48 +dnskey01 DNSKEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY + 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV + sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg + a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= ) + ; type 249 ; TKEY is a meta-type and should never occur in master files. ; The text representation is not specified in the draft. diff --git a/bin/tests/system/glue/tests.sh b/bin/tests/system/glue/tests.sh index e0b0728384b..ce26f1792ac 100644 --- a/bin/tests/system/glue/tests.sh +++ b/bin/tests/system/glue/tests.sh @@ -15,7 +15,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: tests.sh,v 1.5 2001/01/09 21:43:18 bwelling Exp $ +# $Id: tests.sh,v 1.6 2003/09/30 05:56:07 marka Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -34,7 +34,7 @@ echo "I:testing that we find glue A RRs we are authoritative for" $DIG +norec @10.53.0.1 -p 5300 foo.bar.xx. a >dig.out || status=1 $PERL ../digcomp.pl xx.good dig.out || status=1 -echo "I:testing that we find glue A/AAAA/A6 RRs in the cache" +echo "I:testing that we find glue A/AAAA RRs in the cache" $DIG +norec @10.53.0.1 -p 5300 foo.bar.yy. a >dig.out || status=1 $PERL ../digcomp.pl yy.good dig.out || status=1 diff --git a/bin/tests/system/glue/yy.good b/bin/tests/system/glue/yy.good index c4222fc9ad2..fd97e3d420d 100644 --- a/bin/tests/system/glue/yy.good +++ b/bin/tests/system/glue/yy.good @@ -13,6 +13,5 @@ yy. 172800 IN NS ns.zz. ;; ADDITIONAL SECTION: ns.zz. 3463 IN A 10.0.0.1 -ns.zz. 86263 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff ns.zz. 86263 IN AAAA 10::1 diff --git a/bin/tests/system/lwresd/ns1/example1.db b/bin/tests/system/lwresd/ns1/example1.db index 939fb6c5c71..726d7df76dc 100644 --- a/bin/tests/system/lwresd/ns1/example1.db +++ b/bin/tests/system/lwresd/ns1/example1.db @@ -13,7 +13,7 @@ ; NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION ; WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -; $Id: example1.db,v 1.13 2003/07/08 05:17:20 marka Exp $ +; $Id: example1.db,v 1.14 2003/09/30 05:56:08 marka Exp $ $TTL 300 ; 5 minutes @ IN SOA mname1. . ( @@ -33,6 +33,6 @@ b AAAA eeee:eeee:eeee:eeee:ffff:ffff:ffff:ffff 8.8.7.7 DNAME net 0.0.f.f.e.e.d.d.c.c.b.b.a.a.9.9.net PTR dname e A 10.0.1.1 - SIG A 1 1 300 20001202003412 ( + RRSIG A 1 1 300 20001202003412 ( 20001102003412 1 example. abcd ) diff --git a/bin/tests/system/nsupdate/knowngood.ns1.after b/bin/tests/system/nsupdate/knowngood.ns1.after index 9d3544038d3..0d815925227 100644 --- a/bin/tests/system/nsupdate/knowngood.ns1.after +++ b/bin/tests/system/nsupdate/knowngood.ns1.after @@ -6,10 +6,7 @@ a.example.nil. 300 IN TXT "foo foo foo" a.example.nil. 300 IN PTR foo.net. a01.example.nil. 3600 IN A 0.0.0.0 a02.example.nil. 3600 IN A 255.255.255.255 -a601.example.nil. 3600 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -a601.example.nil. 3600 IN A6 64 ::ffff:ffff:ffff:ffff foo. -a601.example.nil. 3600 IN A6 127 ::1 foo. -a601.example.nil. 3600 IN A6 128 . +a601.example.nil. 3600 IN AAAA ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff afsdb01.example.nil. 3600 IN AFSDB 0 hostname.example.nil. afsdb02.example.nil. 3600 IN AFSDB 65535 . b.example.nil. 300 IN CNAME foo.net. diff --git a/bin/tests/system/nsupdate/knowngood.ns1.before b/bin/tests/system/nsupdate/knowngood.ns1.before index 9ef5e55e2e6..3b0e30c31a6 100644 --- a/bin/tests/system/nsupdate/knowngood.ns1.before +++ b/bin/tests/system/nsupdate/knowngood.ns1.before @@ -6,10 +6,7 @@ a.example.nil. 300 IN TXT "foo foo foo" a.example.nil. 300 IN PTR foo.net. a01.example.nil. 3600 IN A 0.0.0.0 a02.example.nil. 3600 IN A 255.255.255.255 -a601.example.nil. 3600 IN A6 0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -a601.example.nil. 3600 IN A6 64 ::ffff:ffff:ffff:ffff foo. -a601.example.nil. 3600 IN A6 127 ::1 foo. -a601.example.nil. 3600 IN A6 128 . +a601.example.nil. 3600 IN AAAA ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff afsdb01.example.nil. 3600 IN AFSDB 0 hostname.example.nil. afsdb02.example.nil. 3600 IN AFSDB 65535 . b.example.nil. 300 IN CNAME foo.net. diff --git a/bin/tests/system/xfer/dig1.good b/bin/tests/system/xfer/dig1.good index 6ff87baa628..1e62b3ace00 100644 --- a/bin/tests/system/xfer/dig1.good +++ b/bin/tests/system/xfer/dig1.good @@ -24,7 +24,7 @@ isdn01.example. 3600 IN ISDN "isdn-address" isdn02.example. 3600 IN ISDN "isdn-address" "subaddress" isdn03.example. 3600 IN ISDN "isdn-address" isdn04.example. 3600 IN ISDN "isdn-address" "subaddress" -key01.example. 3600 IN KEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= +dnskey01.example. 3600 IN DNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= kx01.example. 3600 IN KX 10 kdc.example. kx02.example. 3600 IN KX 10 . loc01.example. 3600 IN LOC 60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m @@ -47,10 +47,10 @@ nsap-ptr01.example. 3600 IN NSAP-PTR . nsap-ptr01.example. 3600 IN NSAP-PTR foo. nsap01.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100 nsap02.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100 -nxt01.example. 3600 IN NXT a.secure.nil. NS SOA MX SIG KEY LOC NXT -nxt02.example. 3600 IN NXT . NSAP-PTR NXT -nxt03.example. 3600 IN NXT . A -nxt04.example. 3600 IN NXT . 127 +nsec01.example. 3600 IN NSEC a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY +nsec02.example. 3600 IN NSEC . NSAP-PTR NSEC +nsec03.example. 3600 IN NSEC . A +nsec04.example. 3600 IN NSEC . 127 ptr01.example. 3600 IN PTR example. px01.example. 3600 IN PX 65535 foo. bar. px02.example. 3600 IN PX 65535 . . @@ -58,7 +58,7 @@ rp01.example. 3600 IN RP mbox-dname.example. txt-dname.example. rp02.example. 3600 IN RP . . rt01.example. 3600 IN RT 0 intermediate-host.example. rt02.example. 3600 IN RT 65535 . -sig01.example. 3600 IN SIG NXT 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= +rrsig01.example. 3600 IN RRSIG NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= srv01.example. 3600 IN SRV 0 0 0 . srv02.example. 3600 IN SRV 65535 65535 65535 old-slow-box.example. txt01.example. 3600 IN TXT "foo" diff --git a/bin/tests/system/xfer/dig2.good b/bin/tests/system/xfer/dig2.good index ae4ee3820ed..4e5e62a160c 100644 --- a/bin/tests/system/xfer/dig2.good +++ b/bin/tests/system/xfer/dig2.good @@ -24,7 +24,7 @@ isdn01.example. 3600 IN ISDN "isdn-address" isdn02.example. 3600 IN ISDN "isdn-address" "subaddress" isdn03.example. 3600 IN ISDN "isdn-address" isdn04.example. 3600 IN ISDN "isdn-address" "subaddress" -key01.example. 3600 IN KEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= +dnskey01.example. 3600 IN DNSKEY 512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= kx01.example. 3600 IN KX 10 kdc.example. kx02.example. 3600 IN KX 10 . loc01.example. 3600 IN LOC 60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m @@ -47,10 +47,10 @@ nsap-ptr01.example. 3600 IN NSAP-PTR . nsap-ptr01.example. 3600 IN NSAP-PTR foo. nsap01.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100 nsap02.example. 3600 IN NSAP 0x47000580005a0000000001e133ffffff00016100 -nxt01.example. 3600 IN NXT a.secure.nil. NS SOA MX SIG KEY LOC NXT -nxt02.example. 3600 IN NXT . NSAP-PTR NXT -nxt03.example. 3600 IN NXT . A -nxt04.example. 3600 IN NXT . 127 +nsec01.example. 3600 IN NSEC a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY +nsec02.example. 3600 IN NSEC . NSAP-PTR NSEC +nsec03.example. 3600 IN NSEC . A +nsec04.example. 3600 IN NSEC . 127 ptr01.example. 3600 IN PTR example. px01.example. 3600 IN PX 65535 foo. bar. px02.example. 3600 IN PX 65535 . . @@ -58,7 +58,7 @@ rp01.example. 3600 IN RP mbox-dname.example. txt-dname.example. rp02.example. 3600 IN RP . . rt01.example. 3600 IN RT 0 intermediate-host.example. rt02.example. 3600 IN RT 65535 . -sig01.example. 3600 IN SIG NXT 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= +rrsig01.example. 3600 IN RRSIG NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= srv01.example. 3600 IN SRV 0 0 0 . srv02.example. 3600 IN SRV 65535 65535 65535 old-slow-box.example. txt01.example. 3600 IN TXT "foo" diff --git a/bin/tests/system/xferquota/ns2/example.db b/bin/tests/system/xferquota/ns2/example.db index 442d73587aa..5fae2cd3a86 100644 --- a/bin/tests/system/xferquota/ns2/example.db +++ b/bin/tests/system/xferquota/ns2/example.db @@ -13,7 +13,7 @@ ; NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION ; WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -; $Id: example.db,v 1.8 2002/11/27 09:52:50 marka Exp $ +; $Id: example.db,v 1.9 2003/09/30 05:56:10 marka Exp $ $ORIGIN . $TTL 300 ; 5 minutes @@ -75,7 +75,7 @@ isdn01 ISDN "isdn-address" isdn02 ISDN "isdn-address" "subaddress" isdn03 ISDN "isdn-address" isdn04 ISDN "isdn-address" "subaddress" -key01 KEY 512 255 1 ( +dnskey01 DNSKEY 512 255 1 ( AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aR yzWZriO6i2odGWWQVucZqKVsENW91IOW4vqudngPZsY3 GvQ/xVA8/7pyFj6b7Esga60zyGW6LFe9r8n6paHrlG5o @@ -100,10 +100,10 @@ nsap-ptr01 NSAP-PTR foo. NSAP-PTR . nsap01 NSAP 0x47000580005a0000000001e133ffffff00016100 nsap02 NSAP 0x47000580005a0000000001e133ffffff00016100 -nxt01 NXT a.secure ( NS SOA MX SIG KEY LOC NXT ) -nxt02 NXT . ( NSAP-PTR NXT ) -nxt03 NXT . ( A ) -nxt04 NXT . ( 127 ) +nsec01 NSEC a.secure ( NS SOA MX RRSIG DNSKEY LOC NSEC ) +nsec02 NSEC . ( NSAP-PTR NSEC ) +nsec03 NSEC . ( A ) +nsec04 NSEC . ( 127 ) ptr01 PTR example. px01 PX 65535 foo. bar. px02 PX 65535 . . @@ -117,7 +117,7 @@ $ORIGIN s.example. ns A 73.80.65.49 $ORIGIN example. $TTL 3600 ; 1 hour -sig01 SIG NXT 1 3 3600 20000102030405 ( +rrsig01 RRSIG NSEC 1 3 3600 20000102030405 ( 19961211100908 2143 foo MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgi WCn/GxHhai6VAuHAoNUz4YoU1tVfSCSqQYn6//11U6Nl @@ -140,7 +140,7 @@ txt10 TXT "foo bar" txt11 TXT "\"foo\"" txt12 TXT "\"foo\"" $TTL 300 ; 5 minutes -u TXT "txt-not-in-nxt" +u TXT "txt-not-in-nsec" $ORIGIN u.example. a A 73.80.65.49 b A 73.80.65.49 diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in index 54a6ccff18b..fe25f3aed01 100644 --- a/lib/dns/Makefile.in +++ b/lib/dns/Makefile.in @@ -13,7 +13,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.137 2003/02/26 05:05:15 marka Exp $ +# $Id: Makefile.in,v 1.138 2003/09/30 05:56:10 marka Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -49,7 +49,7 @@ OBJS = acl.@O@ adb.@O@ byaddr.@O@ \ dnssec.@O@ ds.@O@ forward.@O@ journal.@O@ keytable.@O@ \ lib.@O@ log.@O@ lookup.@O@ \ master.@O@ masterdump.@O@ message.@O@ \ - name.@O@ ncache.@O@ nxt.@O@ order.@O@ peer.@O@ portlist.@O@ \ + name.@O@ ncache.@O@ nsec.@O@ order.@O@ peer.@O@ portlist.@O@ \ rbt.@O@ rbtdb.@O@ rbtdb64.@O@ rdata.@O@ rdatalist.@O@ \ rdataset.@O@ rdatasetiter.@O@ rdataslab.@O@ request.@O@ \ resolver.@O@ result.@O@ rootns.@O@ sdb.@O@ soa.@O@ ssu.@O@ \ @@ -65,7 +65,7 @@ SRCS = acl.c adb.c byaddr.c \ dnssec.c ds.c forward.c journal.c keytable.c \ lib.c log.c lookup.c \ master.c masterdump.c message.c \ - name.c ncache.c nxt.c order.c peer.c portlist.c \ + name.c ncache.c nsec.c order.c peer.c portlist.c \ rbt.c rbtdb.c rbtdb64.c rdata.c rdatalist.c \ rdataset.c rdatasetiter.c rdataslab.c request.c \ resolver.c result.c rootns.c sdb.c soa.c ssu.c \ diff --git a/lib/dns/cache.c b/lib/dns/cache.c index 376d86fe773..7870336e0eb 100644 --- a/lib/dns/cache.c +++ b/lib/dns/cache.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: cache.c,v 1.53 2002/05/23 04:32:28 marka Exp $ */ +/* $Id: cache.c,v 1.54 2003/09/30 05:56:10 marka Exp $ */ #include @@ -1026,7 +1026,7 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) { dns_rdatatype_t covers; dns_rdataset_current(&rdataset, &rdata); - if (rdata.type == dns_rdatatype_sig) + if (rdata.type == dns_rdatatype_rrsig) covers = dns_rdata_covers(&rdata); else covers = 0; diff --git a/lib/dns/db.c b/lib/dns/db.c index 3801d53ae63..97d188d7050 100644 --- a/lib/dns/db.c +++ b/lib/dns/db.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: db.c,v 1.70 2001/09/04 12:17:13 marka Exp $ */ +/* $Id: db.c,v 1.71 2003/09/30 05:56:10 marka Exp $ */ /*** *** Imports @@ -447,7 +447,7 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ REQUIRE(DNS_DB_VALID(db)); - REQUIRE(type != dns_rdatatype_sig); + REQUIRE(type != dns_rdatatype_rrsig); REQUIRE(nodep == NULL || (nodep != NULL && *nodep == NULL)); REQUIRE(dns_name_hasbuffer(foundname)); REQUIRE(rdataset == NULL || @@ -576,7 +576,7 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, REQUIRE(node != NULL); REQUIRE(DNS_RDATASET_VALID(rdataset)); REQUIRE(! dns_rdataset_isassociated(rdataset)); - REQUIRE(covers == 0 || type == dns_rdatatype_sig); + REQUIRE(covers == 0 || type == dns_rdatatype_rrsig); REQUIRE(type != dns_rdatatype_any); REQUIRE(sigrdataset == NULL || (DNS_RDATASET_VALID(sigrdataset) && diff --git a/lib/dns/diff.c b/lib/dns/diff.c index 6cb4a6ad343..e80182bf670 100644 --- a/lib/dns/diff.c +++ b/lib/dns/diff.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: diff.c,v 1.6 2002/08/06 14:33:08 marka Exp $ */ +/* $Id: diff.c,v 1.7 2003/09/30 05:56:10 marka Exp $ */ #include @@ -44,7 +44,7 @@ static dns_rdatatype_t rdata_covers(dns_rdata_t *rdata) { - return (rdata->type == dns_rdatatype_sig ? + return (rdata->type == dns_rdatatype_rrsig ? dns_rdata_covers(rdata) : 0); } diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c index 71de26d0b63..9045a205762 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c @@ -16,7 +16,7 @@ */ /* - * $Id: dnssec.c,v 1.76 2002/11/15 21:25:21 marka Exp $ + * $Id: dnssec.c,v 1.77 2003/09/30 05:56:10 marka Exp $ */ @@ -142,7 +142,7 @@ dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx, } static isc_result_t -digest_sig(dst_context_t *ctx, dns_rdata_t *sigrdata, dns_rdata_sig_t *sig) { +digest_sig(dst_context_t *ctx, dns_rdata_t *sigrdata, dns_rdata_rrsig_t *sig) { isc_region_t r; isc_result_t ret; dns_fixedname_t fname; @@ -167,7 +167,7 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, isc_stdtime_t *inception, isc_stdtime_t *expire, isc_mem_t *mctx, isc_buffer_t *buffer, dns_rdata_t *sigrdata) { - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; dns_rdata_t tmpsigrdata; dns_rdata_t *rdatas; int nrdatas, i; @@ -204,7 +204,7 @@ dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, sig.mctx = mctx; sig.common.rdclass = set->rdclass; - sig.common.rdtype = dns_rdatatype_sig; + sig.common.rdtype = dns_rdatatype_rrsig; ISC_LINK_INIT(&sig.common, link); dns_name_init(&sig.signer, NULL); @@ -341,7 +341,7 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, isc_boolean_t ignoretime, isc_mem_t *mctx, dns_rdata_t *sigrdata) { - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; dns_fixedname_t fnewname; isc_region_t r; isc_buffer_t envbuf; @@ -358,7 +358,7 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, REQUIRE(set != NULL); REQUIRE(key != NULL); REQUIRE(mctx != NULL); - REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_sig); + REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_rrsig); ret = dns_rdata_tostruct(sigrdata, &sig, NULL); if (ret != ISC_R_SUCCESS) @@ -511,7 +511,7 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver, *nkeys = 0; dns_rdataset_init(&rdataset); - RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_key, 0, 0, + RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0, &rdataset, NULL)); RETERR(dns_rdataset_first(&rdataset)); while (result == ISC_R_SUCCESS && count < maxkeys) { @@ -569,7 +569,7 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, isc_result_t dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { - dns_rdata_sig_t sig; + dns_rdata_sig_t sig; /* SIG(0) */ unsigned char data[512]; unsigned char header[DNS_MESSAGE_HEADERLEN]; isc_buffer_t headerbuf, databuf, sigbuf; @@ -593,11 +593,11 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { mctx = msg->mctx; - memset(&sig, 0, sizeof(dns_rdata_sig_t)); + memset(&sig, 0, sizeof(sig)); sig.mctx = mctx; sig.common.rdclass = dns_rdataclass_any; - sig.common.rdtype = dns_rdatatype_sig; + sig.common.rdtype = dns_rdatatype_sig; /* SIG(0) */ ISC_LINK_INIT(&sig.common, link); sig.covered = 0; @@ -627,7 +627,8 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { * is identical to dns format. */ RETERR(dns_rdata_fromstruct(NULL, dns_rdataclass_any, - dns_rdatatype_sig, &sig, &databuf)); + dns_rdatatype_sig /* SIG(0) */, + &sig, &databuf)); isc_buffer_usedregion(&databuf, &r); RETERR(dst_context_adddata(ctx, &r)); @@ -668,7 +669,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { RETERR(dns_message_gettemprdata(msg, &rdata)); RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024)); RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any, - dns_rdatatype_sig, &sig, dynbuf)); + dns_rdatatype_rrsig, &sig, dynbuf)); isc_mem_put(mctx, sig.signature, sig.siglen); signeedsfree = ISC_FALSE; @@ -678,7 +679,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { datalist = NULL; RETERR(dns_message_gettemprdatalist(msg, &datalist)); datalist->rdclass = dns_rdataclass_any; - datalist->type = dns_rdatatype_sig; + datalist->type = dns_rdatatype_rrsig; datalist->covers = 0; datalist->ttl = 0; ISC_LIST_INIT(datalist->rdata); @@ -706,7 +707,7 @@ isc_result_t dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg, dst_key_t *key) { - dns_rdata_sig_t sig; + dns_rdata_rrsig_t sig; unsigned char header[DNS_MESSAGE_HEADERLEN]; dns_rdata_t rdata = DNS_RDATA_INIT; isc_region_t r, source_r, sig_r, header_r; diff --git a/lib/dns/ds.c b/lib/dns/ds.c index c89e1027220..6dba3949593 100644 --- a/lib/dns/ds.c +++ b/lib/dns/ds.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ds.c,v 1.2 2002/06/17 04:01:18 marka Exp $ */ +/* $Id: ds.c,v 1.3 2003/09/30 05:56:10 marka Exp $ */ #include @@ -48,6 +48,9 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key, isc_buffer_t b; dns_rdata_ds_t ds; + REQUIRE(key != NULL); + REQUIRE(key->type == dns_rdatatype_dnskey); + if (digest_type != DNS_DSDIGEST_SHA1) return (ISC_R_NOTIMPLEMENTED); diff --git a/lib/dns/include/dns/Makefile.in b/lib/dns/include/dns/Makefile.in index 8a0bfe54245..45c76b0cfe1 100644 --- a/lib/dns/include/dns/Makefile.in +++ b/lib/dns/include/dns/Makefile.in @@ -13,7 +13,7 @@ # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.48 2003/02/26 05:05:15 marka Exp $ +# $Id: Makefile.in,v 1.49 2003/09/30 05:56:16 marka Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -27,7 +27,7 @@ HEADERS = acl.h adb.h byaddr.h cache.h callbacks.h \ dnssec.h ds.h events.h fixedname.h journal.h keyflags.h \ keytable.h keyvalues.h lib.h log.h master.h masterdump.h \ message.h name.h ncache.h \ - nxt.h peer.h portlist.h rbt.h rcode.h \ + nsec.h peer.h portlist.h rbt.h rcode.h \ rdata.h rdataclass.h rdatalist.h rdataset.h rdatasetiter.h \ rdataslab.h rdatatype.h request.h resolver.h result.h \ rootns.h sdb.h secalg.h secproto.h soa.h ssu.h \ diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h index 0b7311640fe..9a3b9ddf3e5 100644 --- a/lib/dns/include/dns/db.h +++ b/lib/dns/include/dns/db.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: db.h,v 1.72 2003/02/26 01:21:09 marka Exp $ */ +/* $Id: db.h,v 1.73 2003/09/30 05:56:16 marka Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -186,7 +186,7 @@ struct dns_db { #define DNS_DBFIND_NOWILD 0x04 #define DNS_DBFIND_PENDINGOK 0x08 #define DNS_DBFIND_NOEXACT 0x10 -#define DNS_DBFIND_FORCENXT 0x20 +#define DNS_DBFIND_FORCENSEC 0x20 /* * Options that can be specified for dns_db_addrdataset(). @@ -642,8 +642,8 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * If the DNS_DBFIND_NOWILD option is set, then wildcard matching will * be disabled. This option is only meaningful for zone databases. * - * If the DNS_DBFIND_FORCENXT option is set, the database is assumed to - * have NXT records, and these will be returned when appropriate. This + * If the DNS_DBFIND_FORCENSEC option is set, the database is assumed to + * have NSEC records, and these will be returned when appropriate. This * is only necessary when querying a database that was not secure * when created. * @@ -775,7 +775,7 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * ISC_R_NOMEMORY * * DNS_R_BADDB Data that is required to be - * present in the DB, e.g. an NXT + * present in the DB, e.g. an NSEC * record in a secure zone, is not * present. * diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h index 816ba99fe9d..993df733582 100644 --- a/lib/dns/include/dns/message.h +++ b/lib/dns/include/dns/message.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: message.h,v 1.111 2003/01/10 02:43:56 marka Exp $ */ +/* $Id: message.h,v 1.112 2003/09/30 05:56:16 marka Exp $ */ #ifndef DNS_MESSAGE_H #define DNS_MESSAGE_H 1 @@ -680,7 +680,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section, * * 'type' be a valid type. * - * If 'type' is dns_rdatatype_sig, 'covers' must be a valid type. + * If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type. * Otherwise it should be 0. * * Returns: @@ -702,7 +702,7 @@ dns_message_findtype(dns_name_t *name, dns_rdatatype_t type, * * 'type' be a valid type, and NOT dns_rdatatype_any. * - * If 'type' is dns_rdatatype_sig, 'covers' must be a valid type. + * If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type. * Otherwise it should be 0. * * Returns: diff --git a/lib/dns/include/dns/nxt.h b/lib/dns/include/dns/nsec.h similarity index 59% rename from lib/dns/include/dns/nxt.h rename to lib/dns/include/dns/nsec.h index 03c20d40312..79edc882146 100644 --- a/lib/dns/include/dns/nxt.h +++ b/lib/dns/include/dns/nsec.h @@ -15,54 +15,54 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nxt.h,v 1.12 2001/01/09 21:53:08 bwelling Exp $ */ +/* $Id: nsec.h,v 1.2 2003/09/30 06:00:39 marka Exp $ */ -#ifndef DNS_NXT_H -#define DNS_NXT_H 1 +#ifndef DNS_NSEC_H +#define DNS_NSEC_H 1 #include #include -#define DNS_NXT_BUFFERSIZE (256 + 16) +#define DNS_NSEC_BUFFERSIZE (256 + 16) ISC_LANG_BEGINDECLS isc_result_t -dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, - dns_dbnode_t *node, dns_name_t *target, - unsigned char *buffer, dns_rdata_t *rdata); +dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, + dns_dbnode_t *node, dns_name_t *target, + unsigned char *buffer, dns_rdata_t *rdata); /* - * Build the rdata of a NXT record. + * Build the rdata of a NSEC record. * * Requires: * buffer Points to a temporary buffer of at least - * DNS_NXT_BUFFERSIZE bytes. + * DNS_NSEC_BUFFERSIZE bytes. * rdata Points to an initialized dns_rdata_t. * * Ensures: - * *rdata Contains a valid NXT rdata. The 'data' member refers + * *rdata Contains a valid NSEC rdata. The 'data' member refers * to 'buffer'. */ isc_result_t -dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, - dns_name_t *target, dns_ttl_t ttl); +dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, + dns_name_t *target, dns_ttl_t ttl); /* - * Build a NXT record and add it to a database. + * Build a NSEC record and add it to a database. */ isc_boolean_t -dns_nxt_typepresent(dns_rdata_t *nxt, dns_rdatatype_t type); +dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type); /* - * Determine if a type is marked as present in an NXT record. + * Determine if a type is marked as present in an NSEC record. * * Requires: - * 'nxt' points to a valid rdataset of type NXT + * 'nsec' points to a valid rdataset of type NSEC * 'type' < 128 * */ ISC_LANG_ENDDECLS -#endif /* DNS_NXT_H */ +#endif /* DNS_NSEC_H */ diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h index 9a6f859c13d..ea4cc630bf0 100644 --- a/lib/dns/include/dns/rdata.h +++ b/lib/dns/include/dns/rdata.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdata.h,v 1.56 2003/07/30 00:54:27 marka Exp $ */ +/* $Id: rdata.h,v 1.57 2003/09/30 05:56:17 marka Exp $ */ #ifndef DNS_RDATA_H #define DNS_RDATA_H 1 @@ -502,7 +502,7 @@ isc_boolean_t dns_rdatatype_iszonecutauth(dns_rdatatype_t type); /* * Return true iff rdata of type 'type' is considered authoritative - * data (not glue) in the NXT chain when it occurs in the parent zone + * data (not glue) in the NSEC chain when it occurs in the parent zone * at a zone cut. * * Requires: @@ -631,7 +631,7 @@ dns_rdatatype_attributes(dns_rdatatype_t rdtype); #define DNS_RDATATYPEATTR_EXCLUSIVE 0x00000002U /* Is a meta type */ #define DNS_RDATATYPEATTR_META 0x00000004U -/* Is a DNSSEC type, like SIG or NXT */ +/* Is a DNSSEC type, like RRSIG or NSEC */ #define DNS_RDATATYPEATTR_DNSSEC 0x00000008U /* Is a zone cut authority type */ #define DNS_RDATATYPEATTR_ZONECUTAUTH 0x00000010U diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h index 40419c2d7f1..af77d270b26 100644 --- a/lib/dns/include/dns/result.h +++ b/lib/dns/include/dns/result.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: result.h,v 1.98 2003/04/17 03:43:35 marka Exp $ */ +/* $Id: result.h,v 1.99 2003/09/30 05:56:17 marka Exp $ */ #ifndef DNS_RESULT_H #define DNS_RESULT_H 1 @@ -101,7 +101,7 @@ #define DNS_R_ALIAS (ISC_RESULTCLASS_DNS + 57) #define DNS_R_USETCP (ISC_RESULTCLASS_DNS + 58) #define DNS_R_NOVALIDSIG (ISC_RESULTCLASS_DNS + 59) -#define DNS_R_NOVALIDNXT (ISC_RESULTCLASS_DNS + 60) +#define DNS_R_NOVALIDNSEC (ISC_RESULTCLASS_DNS + 60) #define DNS_R_NOTINSECURE (ISC_RESULTCLASS_DNS + 61) #define DNS_R_UNKNOWNSERVICE (ISC_RESULTCLASS_DNS + 62) #define DNS_R_RECOVERABLE (ISC_RESULTCLASS_DNS + 63) diff --git a/lib/dns/include/dns/ssu.h b/lib/dns/include/dns/ssu.h index 0438284975c..764a89925a8 100644 --- a/lib/dns/include/dns/ssu.h +++ b/lib/dns/include/dns/ssu.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ssu.h,v 1.11 2001/01/09 21:53:29 bwelling Exp $ */ +/* $Id: ssu.h,v 1.12 2003/09/30 05:56:17 marka Exp $ */ #ifndef DNS_SSU_H #define DNS_SSU_H 1 @@ -89,10 +89,10 @@ dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant, * to be updated matches the signing identity. * * If 'ntypes' is 0, this rule applies to all types except - * NS, SOA, SIG, and NXT. + * NS, SOA, RRSIG, and NSEC. * * If 'types' includes ANY, this rule applies to all types - * except NXT. + * except NSEC. * * Requires: * 'table' is a valid SSU table diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h index c10015bc28e..bcd37cb09ad 100644 --- a/lib/dns/include/dns/validator.h +++ b/lib/dns/include/dns/validator.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.h,v 1.23 2003/04/10 02:06:51 marka Exp $ */ +/* $Id: validator.h,v 1.24 2003/09/30 05:56:17 marka Exp $ */ #ifndef DNS_VALIDATOR_H #define DNS_VALIDATOR_H 1 @@ -54,7 +54,7 @@ #include #include #include -#include /* for dns_rdata_sig_t */ +#include /* for dns_rdata_rrsig_t */ #include @@ -99,7 +99,7 @@ struct dns_validator { dns_keytable_t * keytable; dns_keynode_t * keynode; dst_key_t * key; - dns_rdata_sig_t * siginfo; + dns_rdata_rrsig_t * siginfo; isc_task_t * task; isc_taskaction_t action; void * arg; @@ -109,7 +109,7 @@ struct dns_validator { dns_rdataset_t * keyset; dns_rdataset_t * dsset; dns_rdataset_t * soaset; - dns_rdataset_t * nxtset; + dns_rdataset_t * nsecset; dns_name_t * soaname; dns_rdataset_t frdataset; dns_rdataset_t fsigrdataset; @@ -138,7 +138,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, * null key. * * The complete response message may be given in 'message', - * to make available any authority section NXTs that may be + * to make available any authority section NSECs that may be * needed for validation of a response resulting from a * wildcard expansion (though no such wildcard validation * is implemented yet). If the complete response message diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h index ab0d41b18fc..6ef9b036697 100644 --- a/lib/dns/include/dns/view.h +++ b/lib/dns/include/dns/view.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: view.h,v 1.86 2003/09/19 14:35:03 marka Exp $ */ +/* $Id: view.h,v 1.87 2003/09/30 05:56:17 marka Exp $ */ #ifndef DNS_VIEW_H #define DNS_VIEW_H 1 @@ -487,7 +487,7 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, * 'name' is valid name. * * 'type' is a valid dns_rdatatype_t, and is not a meta query type - * (e.g. dns_rdatatype_any), or dns_rdatatype_sig. + * (e.g. dns_rdatatype_any), or dns_rdatatype_rrsig. * * 'rdataset' is a valid, disassociated rdataset. * diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c index cadc5038d47..a93f81a31e4 100644 --- a/lib/dns/lookup.c +++ b/lib/dns/lookup.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: lookup.c,v 1.10 2001/11/12 19:05:17 gson Exp $ */ +/* $Id: lookup.c,v 1.11 2003/09/30 05:56:10 marka Exp $ */ #include @@ -168,7 +168,7 @@ view_find(dns_lookup_t *lookup, dns_name_t *foundname) { dns_name_t *name = dns_fixedname_name(&lookup->name); dns_rdatatype_t type; - if (lookup->type == dns_rdatatype_sig) + if (lookup->type == dns_rdatatype_rrsig) type = dns_rdatatype_any; else type = lookup->type; diff --git a/lib/dns/master.c b/lib/dns/master.c index 7e291be95d1..8a9d69155dd 100644 --- a/lib/dns/master.c +++ b/lib/dns/master.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: master.c,v 1.145 2003/04/17 11:31:02 marka Exp $ */ +/* $Id: master.c,v 1.146 2003/09/30 05:56:11 marka Exp $ */ #include @@ -104,6 +104,7 @@ struct dns_loadctx { isc_boolean_t ttl_known; isc_boolean_t default_ttl_known; isc_boolean_t warn_1035; + isc_boolean_t warn_tcr; isc_boolean_t warn_sigexpired; isc_boolean_t seen_include; isc_uint32_t ttl; @@ -483,6 +484,7 @@ loadctx_create(isc_mem_t *mctx, unsigned int options, dns_name_t *top, lctx->default_ttl_known = ISC_FALSE; lctx->default_ttl = 0; lctx->warn_1035 = ISC_TRUE; /* XXX Argument? */ + lctx->warn_tcr = ISC_TRUE; /* XXX Argument? */ lctx->warn_sigexpired = ISC_TRUE; /* XXX Argument? */ lctx->options = options; lctx->seen_include = ISC_FALSE; @@ -1559,7 +1561,7 @@ load(dns_loadctx_t *lctx) { } - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) covers = dns_rdata_covers(&rdata[rdcount]); else covers = 0; @@ -1604,8 +1606,8 @@ load(dns_loadctx_t *lctx) { lctx->warn_1035 = ISC_FALSE; } - if (type == dns_rdatatype_sig && lctx->warn_sigexpired) { - dns_rdata_sig_t sig; + if (type == dns_rdatatype_rrsig && lctx->warn_sigexpired) { + dns_rdata_rrsig_t sig; (void)dns_rdata_tostruct(&rdata[rdcount], &sig, NULL); if (isc_serial_lt(sig.timeexpire, now)) { (*callbacks->warn)(callbacks, @@ -1616,6 +1618,14 @@ load(dns_loadctx_t *lctx) { } } + if ((type == dns_rdatatype_sig || type == dns_rdatatype_nxt) && + lctx->warn_tcr && (lctx->options & DNS_MASTER_ZONE) != 0 && + (lctx->options & DNS_MASTER_SLAVE) == 0) { + (*callbacks->warn)(callbacks, "%s:%lu: old style DNSSEC " + " zone detected", source, line); + lctx->warn_tcr = ISC_FALSE; + } + if ((lctx->options & DNS_MASTER_AGETTL) != 0) { /* * Adjust the TTL for $DATE. If the RR has already diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c index c4499e4c567..6286e0fa762 100644 --- a/lib/dns/masterdump.c +++ b/lib/dns/masterdump.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: masterdump.c,v 1.68 2003/06/18 05:42:45 marka Exp $ */ +/* $Id: masterdump.c,v 1.69 2003/09/30 05:56:12 marka Exp $ */ #include @@ -715,7 +715,7 @@ static int dump_order(const dns_rdataset_t *rds) { int t; int sig; - if (rds->type == dns_rdatatype_sig) { + if (rds->type == dns_rdatatype_rrsig) { t = rds->covers; sig = 1; } else { diff --git a/lib/dns/message.c b/lib/dns/message.c index b284f23cc0b..dedbf4f7dc2 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: message.c,v 1.218 2003/09/11 01:49:16 marka Exp $ */ +/* $Id: message.c,v 1.219 2003/09/30 05:56:12 marka Exp $ */ /*** *** Imports @@ -1187,7 +1187,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, if (msg->opcode != dns_opcode_update && rdtype != dns_rdatatype_tsig && rdtype != dns_rdatatype_opt - && rdtype != dns_rdatatype_key /* in a TKEY query */ + && rdtype != dns_rdatatype_dnskey /* in a TKEY query */ && rdtype != dns_rdatatype_sig /* SIG(0) */ && rdtype != dns_rdatatype_tkey /* Win2000 TKEY */ && msg->rdclass != rdclass) @@ -1288,10 +1288,18 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, if (result != ISC_R_SUCCESS) goto cleanup; rdata->rdclass = rdclass; - issigzero = ISC_FALSE; - if (rdtype == dns_rdatatype_sig && rdata->flags == 0) { + if (rdtype == dns_rdatatype_rrsig && + rdata->flags == 0) { covers = dns_rdata_covers(rdata); - if (covers == 0) { + if (covers == 0) + DO_FORMERR; + } else + covers = 0; + + issigzero = ISC_FALSE; + if (rdtype == dns_rdatatype_sig /* SIG(0) */ && + rdata->flags == 0) { + if (dns_rdata_covers(rdata) == 0) { if (sectionid != DNS_SECTION_ADDITIONAL || count != msg->counts[sectionid] - 1) DO_FORMERR; @@ -1300,8 +1308,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, skip_type_search = ISC_TRUE; issigzero = ISC_TRUE; } - } else - covers = 0; + } /* * If we are doing a dynamic update or this is a meta-type, @@ -1715,8 +1722,8 @@ wrong_priority(dns_rdataset_t *rds, int pass, dns_rdatatype_t preferred_glue) { else pass_needed = 3; break; - case dns_rdatatype_sig: - case dns_rdatatype_key: + case dns_rdatatype_rrsig: + case dns_rdatatype_dnskey: pass_needed = 2; break; default: @@ -2826,8 +2833,8 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) { if (view == NULL) return (DNS_R_KEYUNAUTHORIZED); result = dns_view_simplefind(view, &sig.signer, - dns_rdatatype_key, 0, 0, - ISC_FALSE, &keyset, NULL); + dns_rdatatype_key /* SIG(0) */, + 0, 0, ISC_FALSE, &keyset, NULL); if (result != ISC_R_SUCCESS) { /* XXXBEW Should possibly create a fetch here */ diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c index bba7ab0ecde..88c21c76978 100644 --- a/lib/dns/ncache.c +++ b/lib/dns/ncache.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ncache.c,v 1.33 2003/09/17 05:24:42 marka Exp $ */ +/* $Id: ncache.c,v 1.34 2003/09/30 05:56:12 marka Exp $ */ #include @@ -137,10 +137,10 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, DNS_RDATASETATTR_NCACHE) == 0) continue; type = rdataset->type; - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) type = rdataset->covers; if (type == dns_rdatatype_soa || - type == dns_rdatatype_nxt) { + type == dns_rdatatype_nsec) { if (ttl > rdataset->ttl) ttl = rdataset->ttl; if (trust > rdataset->trust) @@ -491,7 +491,7 @@ dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name, REQUIRE(ncacherdataset->type == 0); REQUIRE(name != NULL); REQUIRE(!dns_rdataset_isassociated(rdataset)); - REQUIRE(type != dns_rdatatype_sig); + REQUIRE(type != dns_rdatatype_rrsig); result = dns_rdataset_first(ncacherdataset); if (result != ISC_R_SUCCESS) diff --git a/lib/dns/nxt.c b/lib/dns/nsec.c similarity index 73% rename from lib/dns/nxt.c rename to lib/dns/nsec.c index 296f279c6bf..5997b4a103c 100644 --- a/lib/dns/nxt.c +++ b/lib/dns/nsec.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nxt.c,v 1.26 2001/01/09 21:51:09 bwelling Exp $ */ +/* $Id: nsec.c,v 1.2 2003/09/30 06:00:39 marka Exp $ */ #include @@ -23,7 +23,7 @@ #include #include -#include +#include #include #include #include @@ -62,26 +62,26 @@ bit_isset(unsigned char *array, unsigned int index) { } isc_result_t -dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, - dns_dbnode_t *node, dns_name_t *target, - unsigned char *buffer, dns_rdata_t *rdata) +dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, + dns_dbnode_t *node, dns_name_t *target, + unsigned char *buffer, dns_rdata_t *rdata) { isc_result_t result; dns_rdataset_t rdataset; isc_region_t r; int i; - unsigned char *nxt_bits; + unsigned char *nsec_bits; unsigned int max_type; dns_rdatasetiter_t *rdsiter; - memset(buffer, 0, DNS_NXT_BUFFERSIZE); + memset(buffer, 0, DNS_NSEC_BUFFERSIZE); dns_name_toregion(target, &r); memcpy(buffer, r.base, r.length); r.base = buffer; - nxt_bits = r.base + r.length; - set_bit(nxt_bits, dns_rdatatype_nxt, 1); - max_type = dns_rdatatype_nxt; + nsec_bits = r.base + r.length; + set_bit(nsec_bits, dns_rdatatype_nsec, 1); + max_type = dns_rdatatype_nsec; dns_rdataset_init(&rdataset); rdsiter = NULL; result = dns_db_allrdatasets(db, node, version, 0, &rdsiter); @@ -95,10 +95,10 @@ dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, if (rdataset.type > 127) /* XXX "rdataset type too large" */ return (ISC_R_RANGE); - if (rdataset.type != dns_rdatatype_nxt) { + if (rdataset.type != dns_rdatatype_nsec) { if (rdataset.type > max_type) max_type = rdataset.type; - set_bit(nxt_bits, rdataset.type, 1); + set_bit(nsec_bits, rdataset.type, 1); } dns_rdataset_disassociate(&rdataset); } @@ -106,12 +106,12 @@ dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, /* * At zone cuts, deny the existence of glue in the parent zone. */ - if (bit_isset(nxt_bits, dns_rdatatype_ns) && - ! bit_isset(nxt_bits, dns_rdatatype_soa)) { + if (bit_isset(nsec_bits, dns_rdatatype_ns) && + ! bit_isset(nsec_bits, dns_rdatatype_soa)) { for (i = 0; i < 128; i++) { - if (bit_isset(nxt_bits, i) && + if (bit_isset(nsec_bits, i) && ! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i)) - set_bit(nxt_bits, i, 0); + set_bit(nsec_bits, i, 0); } } @@ -120,10 +120,10 @@ dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, return (result); r.length += ((max_type + 7) / 8); - INSIST(r.length <= DNS_NXT_BUFFERSIZE); + INSIST(r.length <= DNS_NSEC_BUFFERSIZE); dns_rdata_fromregion(rdata, dns_db_class(db), - dns_rdatatype_nxt, + dns_rdatatype_nsec, &r); return (ISC_R_SUCCESS); @@ -131,22 +131,22 @@ dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version, isc_result_t -dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, - dns_name_t *target, dns_ttl_t ttl) +dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, + dns_name_t *target, dns_ttl_t ttl) { isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; - unsigned char data[DNS_NXT_BUFFERSIZE]; + unsigned char data[DNS_NSEC_BUFFERSIZE]; dns_rdatalist_t rdatalist; dns_rdataset_t rdataset; dns_rdataset_init(&rdataset); dns_rdata_init(&rdata); - RETERR(dns_nxt_buildrdata(db, version, node, target, data, &rdata)); + RETERR(dns_nsec_buildrdata(db, version, node, target, data, &rdata)); rdatalist.rdclass = dns_db_class(db); - rdatalist.type = dns_rdatatype_nxt; + rdatalist.type = dns_rdatatype_nsec; rdatalist.covers = 0; rdatalist.ttl = ttl; ISC_LIST_INIT(rdatalist.rdata); @@ -164,23 +164,23 @@ dns_nxt_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node, } isc_boolean_t -dns_nxt_typepresent(dns_rdata_t *nxt, dns_rdatatype_t type) { - dns_rdata_nxt_t nxtstruct; +dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) { + dns_rdata_nsec_t nsecstruct; isc_result_t result; isc_boolean_t present; - REQUIRE(nxt != NULL); - REQUIRE(nxt->type == dns_rdatatype_nxt); + REQUIRE(nsec != NULL); + REQUIRE(nsec->type == dns_rdatatype_nsec); REQUIRE(type < 128); /* This should never fail */ - result = dns_rdata_tostruct(nxt, &nxtstruct, NULL); + result = dns_rdata_tostruct(nsec, &nsecstruct, NULL); INSIST(result == ISC_R_SUCCESS); - if (type >= nxtstruct.len * 8) + if (type >= nsecstruct.len * 8) present = ISC_FALSE; else - present = ISC_TF(bit_isset(nxtstruct.typebits, type)); - dns_rdata_freestruct(&nxt); + present = ISC_TF(bit_isset(nsecstruct.typebits, type)); + dns_rdata_freestruct(&nsec); return (present); } diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index 267f5cc2bc4..752820e1f12 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rbtdb.c,v 1.187 2003/04/17 01:56:34 marka Exp $ */ +/* $Id: rbtdb.c,v 1.188 2003/09/30 05:56:12 marka Exp $ */ /* * Principal Author: Bob Halley @@ -83,14 +83,14 @@ typedef isc_uint32_t rbtdb_rdatatype_t; #define RBTDB_RDATATYPE_EXT(type) ((dns_rdatatype_t)((type) >> 16)) #define RBTDB_RDATATYPE_VALUE(b, e) (((e) << 16) | (b)) -#define RBTDB_RDATATYPE_SIGNXT \ - RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_nxt) +#define RBTDB_RDATATYPE_SIGNSEC \ + RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec) #define RBTDB_RDATATYPE_SIGNS \ - RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_ns) + RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns) #define RBTDB_RDATATYPE_SIGCNAME \ - RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_cname) + RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname) #define RBTDB_RDATATYPE_SIGDNAME \ - RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_dname) + RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname) #define RBTDB_RDATATYPE_NCACHEANY \ RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_any) @@ -1778,9 +1778,9 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep, } static inline isc_result_t -find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, - dns_name_t *foundname, dns_rdataset_t *rdataset, - dns_rdataset_t *sigrdataset, isc_boolean_t need_sig) +find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep, + dns_name_t *foundname, dns_rdataset_t *rdataset, + dns_rdataset_t *sigrdataset, isc_boolean_t need_sig) { dns_rbtnode_t *node; rdatasetheader_t *header, *header_next, *found, *foundsig; @@ -1808,7 +1808,7 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, header = header_next) { header_next = header->next; /* - * Look for an active, extant NXT or SIG NXT. + * Look for an active, extant NSEC or RRSIG NSEC. */ do { if (header->serial <= search->serial && @@ -1830,12 +1830,12 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, * active rdataset at this node. */ empty_node = ISC_FALSE; - if (header->type == dns_rdatatype_nxt) { + if (header->type == dns_rdatatype_nsec) { found = header; if (foundsig != NULL) break; } else if (header->type == - RBTDB_RDATATYPE_SIGNXT) { + RBTDB_RDATATYPE_SIGNSEC) { foundsig = header; if (found != NULL) break; @@ -1847,10 +1847,10 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, (foundsig != NULL || !need_sig)) { /* - * We've found the right NXT record. + * We've found the right NSEC record. * * Note: for this to really be the right - * NXT record, it's essential that the NXT + * NSEC record, it's essential that the NSEC * records of any nodes obscured by a zone * cut have been removed; we assume this is * the case. @@ -1875,8 +1875,8 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, } } else if (found == NULL && foundsig == NULL) { /* - * This node is active, but has no NXT or - * SIG NXT. That means it's glue or + * This node is active, but has no NSEC or + * RRSIG NSEC. That means it's glue or * other obscured zone data that isn't * relevant for our search. Treat the * node as if it were empty and keep looking. @@ -1887,7 +1887,7 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, } else { /* * We found an active node, but either the - * NXT or the SIG NXT is missing. This + * NSEC or the RRSIG NSEC is missing. This * shouldn't happen. */ result = DNS_R_BADDB; @@ -1905,7 +1905,7 @@ find_closest_nxt(rbtdb_search_t *search, dns_dbnode_t **nodep, /* * If the result is ISC_R_NOMORE, then we got to the beginning of - * the database and didn't find a NXT record. This shouldn't + * the database and didn't find a NSEC record. This shouldn't * happen. */ if (result == ISC_R_NOMORE) @@ -1930,8 +1930,8 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, isc_boolean_t wild; isc_boolean_t empty_node; isc_mutex_t *lock; - rdatasetheader_t *header, *header_next, *found, *nxtheader; - rdatasetheader_t *foundsig, *cnamesig, *nxtsig; + rdatasetheader_t *header, *header_next, *found, *nsecheader; + rdatasetheader_t *foundsig, *cnamesig, *nsecsig; rbtdb_rdatatype_t sigtype; isc_boolean_t active; dns_rbtnodechain_t chain; @@ -2017,9 +2017,9 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * beneath a zonecut, and there's no matching wildcard. */ if (search.rbtdb->secure || - (search.options & DNS_DBFIND_FORCENXT) != 0) + (search.options & DNS_DBFIND_FORCENSEC) != 0) { - result = find_closest_nxt(&search, nodep, foundname, + result = find_closest_nsec(&search, nodep, foundname, rdataset, sigrdataset, search.rbtdb->secure); if (result == ISC_R_SUCCESS) @@ -2059,10 +2059,10 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * Certain DNSSEC types are not subject to CNAME matching * (RFC 2535, section 2.3.5). * - * We don't check for SIG, because we don't store SIG records + * We don't check for RRSIG, because we don't store RRSIG records * directly. */ - if (type == dns_rdatatype_key || type == dns_rdatatype_nxt) + if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec) cname_ok = ISC_FALSE; /* @@ -2073,9 +2073,9 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, found = NULL; foundsig = NULL; - sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type); - nxtheader = NULL; - nxtsig = NULL; + sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); + nsecheader = NULL; + nsecsig = NULL; cnamesig = NULL; empty_node = ISC_TRUE; for (header = node->data; header != NULL; header = header_next) { @@ -2122,8 +2122,8 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, maybe_zonecut = ISC_FALSE; at_zonecut = ISC_TRUE; if ((search.options & DNS_DBFIND_GLUEOK) == 0 - && type != dns_rdatatype_nxt - && type != dns_rdatatype_key) { + && type != dns_rdatatype_nsec + && type != dns_rdatatype_dnskey) { /* * Glue is not OK, but any answer we * could return would be glue. Return @@ -2154,7 +2154,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * We may be finding a CNAME instead * of the desired type. * - * If we've already got the CNAME SIG, + * If we've already got the CNAME RRSIG, * use it, otherwise change sigtype * so that we find it. */ @@ -2171,7 +2171,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, break; } else if (header->type == sigtype) { /* - * We've found the SIG rdataset for our + * We've found the RRSIG rdataset for our * target type. Remember it. */ foundsig = header; @@ -2180,19 +2180,19 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ if (!maybe_zonecut && found != NULL) break; - } else if (header->type == dns_rdatatype_nxt) { + } else if (header->type == dns_rdatatype_nsec) { /* - * Remember a NXT rdataset even if we're + * Remember a NSEC rdataset even if we're * not specifically looking for it, because * we might need it later. */ - nxtheader = header; - } else if (header->type == RBTDB_RDATATYPE_SIGNXT) { + nsecheader = header; + } else if (header->type == RBTDB_RDATATYPE_SIGNSEC) { /* - * If we need the NXT rdataset, we'll also + * If we need the NSEC rdataset, we'll also * need its signature. */ - nxtsig = header; + nsecsig = header; } else if (cname_ok && header->type == RBTDB_RDATATYPE_SIGCNAME) { /* @@ -2238,10 +2238,10 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ result = DNS_R_NXRRSET; if (search.rbtdb->secure && - (nxtheader == NULL || nxtsig == NULL)) { + (nsecheader == NULL || nsecsig == NULL)) { /* - * The zone is secure but there's no NXT, - * or the NXT has no signature! + * The zone is secure but there's no NSEC, + * or the NSEC has no signature! */ if (!wild) { result = DNS_R_BADDB; @@ -2249,18 +2249,18 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, } UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock)); - result = find_closest_nxt(&search, nodep, foundname, + result = find_closest_nsec(&search, nodep, foundname, rdataset, sigrdataset, search.rbtdb->secure); if (result == ISC_R_SUCCESS) result = DNS_R_EMPTYWILD; goto tree_exit; } - if ((search.options & DNS_DBFIND_FORCENXT) != 0 && - nxtheader == NULL) + if ((search.options & DNS_DBFIND_FORCENSEC) != 0 && + nsecheader == NULL) { /* - * There's no NXT record, and we were told + * There's no NSEC record, and we were told * to find one. */ result = DNS_R_BADDB; @@ -2271,13 +2271,13 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, *nodep = node; } if (search.rbtdb->secure || - (search.options & DNS_DBFIND_FORCENXT) != 0) + (search.options & DNS_DBFIND_FORCENSEC) != 0) { - bind_rdataset(search.rbtdb, node, nxtheader, + bind_rdataset(search.rbtdb, node, nsecheader, 0, rdataset); - if (nxtsig != NULL) + if (nsecsig != NULL) bind_rdataset(search.rbtdb, node, - nxtsig, 0, sigrdataset); + nsecsig, 0, sigrdataset); } if (wild) foundname->attributes |= DNS_NAMEATTR_WILDCARD; @@ -2301,11 +2301,11 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, /* * If we're beneath a zone cut, we must indicate that the * result is glue, unless we're actually at the zone cut - * and the type is NXT or KEY. + * and the type is NSEC or KEY. */ if (search.zonecut == node) { - if (type == dns_rdatatype_nxt || - type == dns_rdatatype_key) + if (type == dns_rdatatype_nsec || + type == dns_rdatatype_dnskey) result = ISC_R_SUCCESS; else if (type == dns_rdatatype_any) result = DNS_R_ZONECUT; @@ -2424,7 +2424,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) { LOCK(&(search->rbtdb->node_locks[node->locknum].lock)); /* - * Look for a DNAME or SIG DNAME rdataset. + * Look for a DNAME or RRSIG DNAME rdataset. */ dname_header = NULL; sigdname_header = NULL; @@ -2512,7 +2512,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node, LOCK(&(rbtdb->node_locks[node->locknum].lock)); /* - * Look for NS and SIG NS rdatasets. + * Look for NS and RRSIG NS rdatasets. */ found = NULL; foundsig = NULL; @@ -2636,7 +2636,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, rdatasetheader_t *header, *header_prev, *header_next; rdatasetheader_t *found, *nsheader; rdatasetheader_t *foundsig, *nssig, *cnamesig; - rbtdb_rdatatype_t sigtype, nxtype; + rbtdb_rdatatype_t sigtype, nsecype; UNUSED(version); @@ -2689,10 +2689,10 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * Certain DNSSEC types are not subject to CNAME matching * (RFC 2535, section 2.3.5). * - * We don't check for SIG, because we don't store SIG records + * We don't check for RRSIG, because we don't store RRSIG records * directly. */ - if (type == dns_rdatatype_key || type == dns_rdatatype_nxt) + if (type == dns_rdatatype_dnskey || type == dns_rdatatype_nsec) cname_ok = ISC_FALSE; /* @@ -2703,8 +2703,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, found = NULL; foundsig = NULL; - sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type); - nxtype = RBTDB_RDATATYPE_VALUE(0, type); + sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); + nsecype = RBTDB_RDATATYPE_VALUE(0, type); nsheader = NULL; nssig = NULL; cnamesig = NULL; @@ -2757,7 +2757,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, cname_ok && cnamesig != NULL) { /* - * If we've already got the CNAME SIG, + * If we've already got the CNAME RRSIG, * use it, otherwise change sigtype * so that we find it. */ @@ -2770,12 +2770,12 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, } } else if (header->type == sigtype) { /* - * We've found the SIG rdataset for our + * We've found the RRSIG rdataset for our * target type. Remember it. */ foundsig = header; } else if (header->type == RBTDB_RDATATYPE_NCACHEANY || - header->type == nxtype) { + header->type == nsecype) { /* * We've found a negative cache entry. */ @@ -3303,7 +3303,7 @@ zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, foundsig = NULL; matchtype = RBTDB_RDATATYPE_VALUE(type, covers); if (covers == 0) - sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type); + sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); else sigmatchtype = 0; @@ -3366,7 +3366,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db; dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node; rdatasetheader_t *header, *header_next, *found, *foundsig; - rbtdb_rdatatype_t matchtype, sigmatchtype, nxtype; + rbtdb_rdatatype_t matchtype, sigmatchtype, nsecype; isc_result_t result; REQUIRE(VALID_RBTDB(rbtdb)); @@ -3384,9 +3384,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, found = NULL; foundsig = NULL; matchtype = RBTDB_RDATATYPE_VALUE(type, covers); - nxtype = RBTDB_RDATATYPE_VALUE(0, type); + nsecype = RBTDB_RDATATYPE_VALUE(0, type); if (covers == 0) - sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, type); + sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); else sigmatchtype = 0; @@ -3406,7 +3406,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, if (header->type == matchtype) found = header; else if (header->type == RBTDB_RDATATYPE_NCACHEANY || - header->type == nxtype) + header->type == nsecype) found = header; else if (header->type == sigmatchtype) foundsig = header; @@ -3531,17 +3531,18 @@ cname_and_other_data(dns_rbtnode_t *node, rbtdb_serial_t serial) { * Look for active extant "other data". * * "Other data" is any rdataset whose type is not - * KEY, SIG KEY, NXT, SIG NXT, or SIG CNAME. + * DNSKEY, RRSIG DNSKEY, NSEC, RRSIG NSEC, + * or RRSIG CNAME. */ rdtype = RBTDB_RDATATYPE_BASE(header->type); - if (rdtype == dns_rdatatype_sig) + if (rdtype == dns_rdatatype_rrsig) rdtype = RBTDB_RDATATYPE_EXT(header->type); - if (rdtype != dns_rdatatype_nxt && - rdtype != dns_rdatatype_key && + if (rdtype != dns_rdatatype_nsec && + rdtype != dns_rdatatype_dnskey && rdtype != dns_rdatatype_cname) { /* * We've found a type that isn't - * NXT, KEY, CNAME, or one of their + * NSEC, KEY, CNAME, or one of their * signatures. Is it active and extant? */ do { @@ -3581,7 +3582,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, isc_boolean_t header_nx; isc_boolean_t newheader_nx; isc_boolean_t merge; - dns_rdatatype_t nxtype, rdtype, covers; + dns_rdatatype_t nsecype, rdtype, covers; dns_trust_t trust; /* @@ -3619,7 +3620,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, newheader_nx = NONEXISTENT(newheader) ? ISC_TRUE : ISC_FALSE; topheader_prev = NULL; - nxtype = 0; + nsecype = 0; if (rbtversion == NULL && !newheader_nx) { rdtype = RBTDB_RDATATYPE_BASE(newheader->type); if (rdtype == 0) { @@ -3646,7 +3647,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, rbtnode->dirty = 1; goto find_header; } - nxtype = RBTDB_RDATATYPE_VALUE(covers, 0); + nsecype = RBTDB_RDATATYPE_VALUE(covers, 0); } else { /* * We're adding something that isn't a @@ -3686,7 +3687,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, topheader = NULL; goto find_header; } - nxtype = RBTDB_RDATATYPE_VALUE(0, rdtype); + nsecype = RBTDB_RDATATYPE_VALUE(0, rdtype); } } @@ -3694,7 +3695,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, topheader != NULL; topheader = topheader->next) { if (topheader->type == newheader->type || - topheader->type == nxtype) + topheader->type == nsecype) break; topheader_prev = topheader; } @@ -4145,7 +4146,7 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, if (type == dns_rdatatype_any) return (ISC_R_NOTIMPLEMENTED); - if (type == dns_rdatatype_sig && covers == 0) + if (type == dns_rdatatype_rrsig && covers == 0) return (ISC_R_NOTIMPLEMENTED); newheader = isc_mem_get(rbtdb->common.mctx, sizeof(*newheader)); @@ -4282,13 +4283,13 @@ beginload(dns_db_t *db, dns_addrdatasetfunc_t *addp, dns_dbload_t **dbloadp) { static isc_boolean_t iszonesecure(dns_db_t *db, dns_dbnode_t *origin) { dns_rdataset_t keyset; - dns_rdataset_t nxtset, signxtset; + dns_rdataset_t nsecset, signsecset; isc_boolean_t haszonekey = ISC_FALSE; - isc_boolean_t hasnxt = ISC_FALSE; + isc_boolean_t hasnsec = ISC_FALSE; isc_result_t result; dns_rdataset_init(&keyset); - result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_key, 0, + result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_dnskey, 0, 0, &keyset, NULL); if (result == ISC_R_SUCCESS) { dns_rdata_t keyrdata = DNS_RDATA_INIT; @@ -4306,18 +4307,18 @@ iszonesecure(dns_db_t *db, dns_dbnode_t *origin) { if (!haszonekey) return (ISC_FALSE); - dns_rdataset_init(&nxtset); - dns_rdataset_init(&signxtset); - result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_nxt, 0, - 0, &nxtset, &signxtset); + dns_rdataset_init(&nsecset); + dns_rdataset_init(&signsecset); + result = dns_db_findrdataset(db, origin, NULL, dns_rdatatype_nsec, 0, + 0, &nsecset, &signsecset); if (result == ISC_R_SUCCESS) { - if (dns_rdataset_isassociated(&signxtset)) { - hasnxt = ISC_TRUE; - dns_rdataset_disassociate(&signxtset); + if (dns_rdataset_isassociated(&signsecset)) { + hasnsec = ISC_TRUE; + dns_rdataset_disassociate(&signsecset); } - dns_rdataset_disassociate(&nxtset); + dns_rdataset_disassociate(&nsecset); } - return (hasnxt); + return (hasnsec); } @@ -4800,7 +4801,7 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) { * Note: unlike everywhere else, we * check for now > header->ttl instead * of now >= header->ttl. This allows - * ANY and SIG queries for 0 TTL + * ANY and RRSIG queries for 0 TTL * rdatasets to work. */ if (NONEXISTENT(header) || @@ -4863,7 +4864,7 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) { * Note: unlike everywhere else, we * check for now > header->ttl instead * of now >= header->ttl. This allows - * ANY and SIG queries for 0 TTL + * ANY and RRSIG queries for 0 TTL * rdatasets to work. */ if ((header->attributes & diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c index e0385052e97..73951c9d4a3 100644 --- a/lib/dns/rdata.c +++ b/lib/dns/rdata.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdata.c,v 1.179 2003/09/11 01:49:16 marka Exp $ */ +/* $Id: rdata.c,v 1.180 2003/09/30 05:56:12 marka Exp $ */ #include #include @@ -2012,6 +2012,8 @@ fromtext_error(void (*callback)(dns_rdatacallbacks_t *, const char *, ...), dns_rdatatype_t dns_rdata_covers(dns_rdata_t *rdata) { + if (rdata->type == 46) + return (covers_rrsig(rdata)); return (covers_sig(rdata)); } diff --git a/lib/dns/rdata/generic/dnskey_48.c b/lib/dns/rdata/generic/dnskey_48.c new file mode 100644 index 00000000000..be9963fe9a8 --- /dev/null +++ b/lib/dns/rdata/generic/dnskey_48.c @@ -0,0 +1,287 @@ +/* + * Copyright (C) 1999-2002 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: dnskey_48.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* + * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley. + */ + +/* RFC 2535 */ + +#ifndef RDATA_GENERIC_DNSKEY_48_C +#define RDATA_GENERIC_DNSKEY_48_C + +#include + +#define RRTYPE_DNSKEY_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) + +static inline isc_result_t +fromtext_dnskey(ARGS_FROMTEXT) { + isc_token_t token; + dns_secalg_t alg; + dns_secproto_t proto; + dns_keyflags_t flags; + + REQUIRE(type == 48); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(origin); + UNUSED(downcase); + UNUSED(callbacks); + + /* flags */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_keyflags_fromtext(&flags, &token.value.as_textregion)); + RETERR(uint16_tobuffer(flags, target)); + + /* protocol */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_secproto_fromtext(&proto, &token.value.as_textregion)); + RETERR(mem_tobuffer(target, &proto, 1)); + + /* algorithm */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion)); + RETERR(mem_tobuffer(target, &alg, 1)); + + /* No Key? */ + if ((flags & 0xc000) == 0xc000) + return (ISC_R_SUCCESS); + + return (isc_base64_tobuffer(lexer, target, -1)); +} + +static inline isc_result_t +totext_dnskey(ARGS_TOTEXT) { + isc_region_t sr; + char buf[sizeof("64000")]; + unsigned int flags; + unsigned char algorithm; + + REQUIRE(rdata->type == 48); + REQUIRE(rdata->length != 0); + + dns_rdata_toregion(rdata, &sr); + + /* flags */ + flags = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + sprintf(buf, "%u", flags); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* protocol */ + sprintf(buf, "%u", sr.base[0]); + isc_region_consume(&sr, 1); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* algorithm */ + algorithm = sr.base[0]; + sprintf(buf, "%u", algorithm); + isc_region_consume(&sr, 1); + RETERR(str_totext(buf, target)); + + /* No Key? */ + if ((flags & 0xc000) == 0xc000) + return (ISC_R_SUCCESS); + + /* key */ + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" (", target)); + RETERR(str_totext(tctx->linebreak, target)); + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); + + if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) + RETERR(str_totext(tctx->linebreak, target)); + else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" ", target)); + + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(")", target)); + + if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) { + isc_region_t tmpr; + + RETERR(str_totext(" ; key id = ", target)); + dns_rdata_toregion(rdata, &tmpr); + sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm)); + RETERR(str_totext(buf, target)); + } + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +fromwire_dnskey(ARGS_FROMWIRE) { + isc_region_t sr; + + REQUIRE(type == 48); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(dctx); + UNUSED(downcase); + + isc_buffer_activeregion(source, &sr); + if (sr.length < 4) + return (ISC_R_UNEXPECTEDEND); + + isc_buffer_forward(source, sr.length); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline isc_result_t +towire_dnskey(ARGS_TOWIRE) { + isc_region_t sr; + + REQUIRE(rdata->type == 48); + REQUIRE(rdata->length != 0); + + UNUSED(cctx); + + dns_rdata_toregion(rdata, &sr); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_dnskey(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == 48); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_dnskey(ARGS_FROMSTRUCT) { + dns_rdata_dnskey_t *dnskey = source; + + REQUIRE(type == 48); + REQUIRE(source != NULL); + REQUIRE(dnskey->common.rdtype == type); + REQUIRE(dnskey->common.rdclass == rdclass); + + UNUSED(type); + UNUSED(rdclass); + + /* Flags */ + RETERR(uint16_tobuffer(dnskey->flags, target)); + + /* Protocol */ + RETERR(uint8_tobuffer(dnskey->protocol, target)); + + /* Algorithm */ + RETERR(uint8_tobuffer(dnskey->algorithm, target)); + + /* Data */ + return (mem_tobuffer(target, dnskey->data, dnskey->datalen)); +} + +static inline isc_result_t +tostruct_dnskey(ARGS_TOSTRUCT) { + dns_rdata_dnskey_t *dnskey = target; + isc_region_t sr; + + REQUIRE(rdata->type == 48); + REQUIRE(target != NULL); + REQUIRE(rdata->length != 0); + + dnskey->common.rdclass = rdata->rdclass; + dnskey->common.rdtype = rdata->type; + ISC_LINK_INIT(&dnskey->common, link); + + dns_rdata_toregion(rdata, &sr); + + /* Flags */ + if (sr.length < 2) + return (ISC_R_UNEXPECTEDEND); + dnskey->flags = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + + /* Protocol */ + if (sr.length < 1) + return (ISC_R_UNEXPECTEDEND); + dnskey->protocol = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* Algorithm */ + if (sr.length < 1) + return (ISC_R_UNEXPECTEDEND); + dnskey->algorithm = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* Data */ + dnskey->datalen = sr.length; + dnskey->data = mem_maybedup(mctx, sr.base, dnskey->datalen); + if (dnskey->data == NULL) + return (ISC_R_NOMEMORY); + + dnskey->mctx = mctx; + return (ISC_R_SUCCESS); +} + +static inline void +freestruct_dnskey(ARGS_FREESTRUCT) { + dns_rdata_dnskey_t *dnskey = (dns_rdata_dnskey_t *) source; + + REQUIRE(source != NULL); + REQUIRE(dnskey->common.rdtype == 48); + + if (dnskey->mctx == NULL) + return; + + if (dnskey->data != NULL) + isc_mem_free(dnskey->mctx, dnskey->data); + dnskey->mctx = NULL; +} + +static inline isc_result_t +additionaldata_dnskey(ARGS_ADDLDATA) { + REQUIRE(rdata->type == 48); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_dnskey(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == 48); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +#endif /* RDATA_GENERIC_DNSKEY_48_C */ diff --git a/lib/dns/rdata/generic/dnskey_48.h b/lib/dns/rdata/generic/dnskey_48.h new file mode 100644 index 00000000000..0c932ffd38f --- /dev/null +++ b/lib/dns/rdata/generic/dnskey_48.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 1999-2001 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_DNSKEY_48_H +#define GENERIC_DNSKEY_48_H 1 + +/* $Id: dnskey_48.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* RFC 2535 */ + +typedef struct dns_rdata_dnskey { + dns_rdatacommon_t common; + isc_mem_t * mctx; + isc_uint16_t flags; + isc_uint8_t protocol; + isc_uint8_t algorithm; + isc_uint16_t datalen; + unsigned char * data; +} dns_rdata_dnskey_t; + + +#endif /* GENERIC_DNSKEY_48_H */ diff --git a/lib/dns/rdata/generic/key_25.c b/lib/dns/rdata/generic/key_25.c index 4b1ade26eb8..df26d53959e 100644 --- a/lib/dns/rdata/generic/key_25.c +++ b/lib/dns/rdata/generic/key_25.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: key_25.c,v 1.44 2002/02/20 03:34:51 marka Exp $ */ +/* $Id: key_25.c,v 1.45 2003/09/30 05:56:17 marka Exp $ */ /* * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley. @@ -28,7 +28,7 @@ #include -#define RRTYPE_KEY_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) +#define RRTYPE_KEY_ATTRIBUTES (0) static inline isc_result_t fromtext_key(ARGS_FROMTEXT) { diff --git a/lib/dns/rdata/generic/nsec_47.c b/lib/dns/rdata/generic/nsec_47.c new file mode 100644 index 00000000000..5fdff5d8a58 --- /dev/null +++ b/lib/dns/rdata/generic/nsec_47.c @@ -0,0 +1,280 @@ +/* + * Copyright (C) 1999-2002 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: nsec_47.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */ + +/* RFC 2535 */ + +#ifndef RDATA_GENERIC_NSEC_47_C +#define RDATA_GENERIC_NSEC_47_C + +/* + * The attributes do not include DNS_RDATATYPEATTR_SINGLETON + * because we must be able to handle a parent/child NSEC pair. + */ +#define RRTYPE_NSEC_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) + +static inline isc_result_t +fromtext_nsec(ARGS_FROMTEXT) { + isc_token_t token; + dns_name_t name; + isc_buffer_t buffer; + char *e; + unsigned char bm[8*1024]; /* 64k bits */ + dns_rdatatype_t covered; + dns_rdatatype_t maxcovered = 0; + isc_boolean_t first = ISC_TRUE; + long n; + + REQUIRE(type == 47); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(callbacks); + + /* + * Next domain. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + dns_name_init(&name, NULL); + buffer_fromregion(&buffer, &token.value.as_region); + origin = (origin != NULL) ? origin : dns_rootname; + RETTOK(dns_name_fromtext(&name, &buffer, origin, downcase, target)); + + memset(bm, 0, sizeof(bm)); + do { + RETERR(isc_lex_getmastertoken(lexer, &token, + isc_tokentype_string, ISC_TRUE)); + if (token.type != isc_tokentype_string) + break; + n = strtol(DNS_AS_STR(token), &e, 10); + if (e != DNS_AS_STR(token) && *e == '\0') { + covered = (dns_rdatatype_t)n; + } else if (dns_rdatatype_fromtext(&covered, + &token.value.as_textregion) == DNS_R_UNKNOWN) + RETTOK(DNS_R_UNKNOWN); + /* + * NSEC is only specified for types 1..127. + */ + if (covered < 1 || covered > 127) + return (ISC_R_RANGE); + if (first || covered > maxcovered) + maxcovered = covered; + first = ISC_FALSE; + bm[covered/8] |= (0x80>>(covered%8)); + } while (1); + isc_lex_ungettoken(lexer, &token); + if (first) + return (ISC_R_SUCCESS); + n = (maxcovered + 8) / 8; + return (mem_tobuffer(target, bm, n)); +} + +static inline isc_result_t +totext_nsec(ARGS_TOTEXT) { + isc_region_t sr; + unsigned int i, j; + dns_name_t name; + dns_name_t prefix; + isc_boolean_t sub; + + REQUIRE(rdata->type == 47); + REQUIRE(rdata->length != 0); + + dns_name_init(&name, NULL); + dns_name_init(&prefix, NULL); + dns_rdata_toregion(rdata, &sr); + dns_name_fromregion(&name, &sr); + isc_region_consume(&sr, name_length(&name)); + sub = name_prefix(&name, tctx->origin, &prefix); + RETERR(dns_name_totext(&prefix, sub, target)); + + for (i = 0; i < sr.length; i++) { + if (sr.base[i] != 0) + for (j = 0; j < 8; j++) + if ((sr.base[i] & (0x80 >> j)) != 0) { + dns_rdatatype_t t = i * 8 + j; + RETERR(str_totext(" ", target)); + if (dns_rdatatype_isknown(t)) { + RETERR(dns_rdatatype_totext(t, + target)); + } else { + char buf[sizeof("65535")]; + sprintf(buf, "%u", t); + RETERR(str_totext(buf, + target)); + } + } + } + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +fromwire_nsec(ARGS_FROMWIRE) { + isc_region_t sr; + dns_name_t name; + + REQUIRE(type == 47); + + UNUSED(type); + UNUSED(rdclass); + + dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); + + dns_name_init(&name, NULL); + RETERR(dns_name_fromwire(&name, source, dctx, downcase, target)); + + isc_buffer_activeregion(source, &sr); + /* XXXRTH Enforce RFC 2535 length rules if bit 0 is not set. */ + if (sr.length > 8 * 1024) + return (DNS_R_EXTRADATA); + RETERR(mem_tobuffer(target, sr.base, sr.length)); + isc_buffer_forward(source, sr.length); + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +towire_nsec(ARGS_TOWIRE) { + isc_region_t sr; + dns_name_t name; + dns_offsets_t offsets; + + REQUIRE(rdata->type == 47); + REQUIRE(rdata->length != 0); + + dns_compress_setmethods(cctx, DNS_COMPRESS_NONE); + dns_name_init(&name, offsets); + dns_rdata_toregion(rdata, &sr); + dns_name_fromregion(&name, &sr); + isc_region_consume(&sr, name_length(&name)); + RETERR(dns_name_towire(&name, cctx, target)); + + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_nsec(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == 47); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_nsec(ARGS_FROMSTRUCT) { + dns_rdata_nsec_t *nsec = source; + isc_region_t region; + + REQUIRE(type == 47); + REQUIRE(source != NULL); + REQUIRE(nsec->common.rdtype == type); + REQUIRE(nsec->common.rdclass == rdclass); + REQUIRE(nsec->typebits != NULL || nsec->len == 0); + + UNUSED(type); + UNUSED(rdclass); + + dns_name_toregion(&nsec->next, ®ion); + RETERR(isc_buffer_copyregion(target, ®ion)); + + return (mem_tobuffer(target, nsec->typebits, nsec->len)); +} + +static inline isc_result_t +tostruct_nsec(ARGS_TOSTRUCT) { + isc_region_t region; + dns_rdata_nsec_t *nsec = target; + dns_name_t name; + + REQUIRE(rdata->type == 47); + REQUIRE(target != NULL); + REQUIRE(rdata->length != 0); + + nsec->common.rdclass = rdata->rdclass; + nsec->common.rdtype = rdata->type; + ISC_LINK_INIT(&nsec->common, link); + + dns_name_init(&name, NULL); + dns_rdata_toregion(rdata, ®ion); + dns_name_fromregion(&name, ®ion); + isc_region_consume(®ion, name_length(&name)); + dns_name_init(&nsec->next, NULL); + RETERR(name_duporclone(&name, mctx, &nsec->next)); + + nsec->len = region.length; + nsec->typebits = mem_maybedup(mctx, region.base, region.length); + if (nsec->typebits == NULL) + goto cleanup; + + nsec->mctx = mctx; + return (ISC_R_SUCCESS); + + cleanup: + if (mctx != NULL) + dns_name_free(&nsec->next, mctx); + return (ISC_R_NOMEMORY); +} + +static inline void +freestruct_nsec(ARGS_FREESTRUCT) { + dns_rdata_nsec_t *nsec = source; + + REQUIRE(source != NULL); + REQUIRE(nsec->common.rdtype == 47); + + if (nsec->mctx == NULL) + return; + + dns_name_free(&nsec->next, nsec->mctx); + if (nsec->typebits != NULL) + isc_mem_free(nsec->mctx, nsec->typebits); + nsec->mctx = NULL; +} + +static inline isc_result_t +additionaldata_nsec(ARGS_ADDLDATA) { + REQUIRE(rdata->type == 47); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_nsec(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == 47); + + dns_rdata_toregion(rdata, &r); + return ((digest)(arg, &r)); +} + +#endif /* RDATA_GENERIC_NSEC_47_C */ diff --git a/lib/dns/rdata/generic/nsec_47.h b/lib/dns/rdata/generic/nsec_47.h new file mode 100644 index 00000000000..565925f1acf --- /dev/null +++ b/lib/dns/rdata/generic/nsec_47.h @@ -0,0 +1,33 @@ +/* + * Copyright (C) 1999-2002 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_NSEC_47_H +#define GENERIC_NSEC_47_H 1 + +/* $Id: nsec_47.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* RFC 2535 */ + +typedef struct dns_rdata_nsec { + dns_rdatacommon_t common; + isc_mem_t *mctx; + dns_name_t next; + unsigned char *typebits; + isc_uint16_t len; +} dns_rdata_nsec_t; + +#endif /* GENERIC_NSEC_47_H */ diff --git a/lib/dns/rdata/generic/nxt_30.c b/lib/dns/rdata/generic/nxt_30.c index e96dd1297bf..132e4535da2 100644 --- a/lib/dns/rdata/generic/nxt_30.c +++ b/lib/dns/rdata/generic/nxt_30.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nxt_30.c,v 1.56 2003/04/17 03:43:35 marka Exp $ */ +/* $Id: nxt_30.c,v 1.57 2003/09/30 05:56:17 marka Exp $ */ /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */ @@ -28,7 +28,7 @@ * The attributes do not include DNS_RDATATYPEATTR_SINGLETON * because we must be able to handle a parent/child NXT pair. */ -#define RRTYPE_NXT_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) +#define RRTYPE_NXT_ATTRIBUTES (0) static inline isc_result_t fromtext_nxt(ARGS_FROMTEXT) { diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c new file mode 100644 index 00000000000..402a4442742 --- /dev/null +++ b/lib/dns/rdata/generic/rrsig_46.c @@ -0,0 +1,526 @@ +/* + * Copyright (C) 1999-2002 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* $Id: rrsig_46.c,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */ + +/* RFC 2535 */ + +#ifndef RDATA_GENERIC_RRSIG_46_C +#define RDATA_GENERIC_RRSIG_46_C + +#define RRTYPE_RRSIG_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) + +static inline isc_result_t +fromtext_rrsig(ARGS_FROMTEXT) { + isc_token_t token; + unsigned char c; + long i; + dns_rdatatype_t covered; + char *e; + isc_result_t result; + dns_name_t name; + isc_buffer_t buffer; + isc_uint32_t time_signed, time_expire; + + REQUIRE(type == 46); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(callbacks); + + /* + * Type covered. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + result = dns_rdatatype_fromtext(&covered, &token.value.as_textregion); + if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) { + i = strtol(DNS_AS_STR(token), &e, 10); + if (i < 0 || i > 65535) + RETTOK(ISC_R_RANGE); + if (*e != 0) + RETTOK(result); + covered = (dns_rdatatype_t)i; + } + RETERR(uint16_tobuffer(covered, target)); + + /* + * Algorithm. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion)); + RETERR(mem_tobuffer(target, &c, 1)); + + /* + * Labels. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + if (token.value.as_ulong > 0xff) + RETTOK(ISC_R_RANGE); + c = (unsigned char)token.value.as_ulong; + RETERR(mem_tobuffer(target, &c, 1)); + + /* + * Original ttl. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + RETERR(uint32_tobuffer(token.value.as_ulong, target)); + + /* + * Signature expiration. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_expire)); + RETERR(uint32_tobuffer(time_expire, target)); + + /* + * Time signed. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + RETTOK(dns_time32_fromtext(DNS_AS_STR(token), &time_signed)); + RETERR(uint32_tobuffer(time_signed, target)); + + /* + * Key footprint. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + RETERR(uint16_tobuffer(token.value.as_ulong, target)); + + /* + * Signer. + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + ISC_FALSE)); + dns_name_init(&name, NULL); + buffer_fromregion(&buffer, &token.value.as_region); + origin = (origin != NULL) ? origin : dns_rootname; + RETTOK(dns_name_fromtext(&name, &buffer, origin, downcase, target)); + + /* + * Sig. + */ + return (isc_base64_tobuffer(lexer, target, -1)); +} + +static inline isc_result_t +totext_rrsig(ARGS_TOTEXT) { + isc_region_t sr; + char buf[sizeof("4294967295")]; + dns_rdatatype_t covered; + unsigned long ttl; + unsigned long when; + unsigned long exp; + unsigned long foot; + dns_name_t name; + dns_name_t prefix; + isc_boolean_t sub; + + REQUIRE(rdata->type == 46); + REQUIRE(rdata->length != 0); + + dns_rdata_toregion(rdata, &sr); + + /* + * Type covered. + */ + covered = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + /* + * XXXAG We should have something like dns_rdatatype_isknown() + * that does the right thing with type 0. + */ + if (dns_rdatatype_isknown(covered) && covered != 0) { + RETERR(dns_rdatatype_totext(covered, target)); + } else { + char buf[sizeof("65535")]; + sprintf(buf, "%u", covered); + RETERR(str_totext(buf, target)); + } + RETERR(str_totext(" ", target)); + + /* + * Algorithm. + */ + sprintf(buf, "%u", sr.base[0]); + isc_region_consume(&sr, 1); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* + * Labels. + */ + sprintf(buf, "%u", sr.base[0]); + isc_region_consume(&sr, 1); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* + * Ttl. + */ + ttl = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + sprintf(buf, "%lu", ttl); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* + * Sig exp. + */ + exp = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + RETERR(dns_time32_totext(exp, target)); + + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" (", target)); + RETERR(str_totext(tctx->linebreak, target)); + + /* + * Time signed. + */ + when = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + RETERR(dns_time32_totext(when, target)); + RETERR(str_totext(" ", target)); + + /* + * Footprint. + */ + foot = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + sprintf(buf, "%lu", foot); + RETERR(str_totext(buf, target)); + RETERR(str_totext(" ", target)); + + /* + * Signer. + */ + dns_name_init(&name, NULL); + dns_name_init(&prefix, NULL); + dns_name_fromregion(&name, &sr); + isc_region_consume(&sr, name_length(&name)); + sub = name_prefix(&name, tctx->origin, &prefix); + RETERR(dns_name_totext(&prefix, sub, target)); + + /* + * Sig. + */ + RETERR(str_totext(tctx->linebreak, target)); + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" )", target)); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +fromwire_rrsig(ARGS_FROMWIRE) { + isc_region_t sr; + dns_name_t name; + + REQUIRE(type == 46); + + UNUSED(type); + UNUSED(rdclass); + + dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); + + isc_buffer_activeregion(source, &sr); + /* + * type covered: 2 + * algorithm: 1 + * labels: 1 + * original ttl: 4 + * signature expiration: 4 + * time signed: 4 + * key footprint: 2 + */ + if (sr.length < 18) + return (ISC_R_UNEXPECTEDEND); + + isc_buffer_forward(source, 18); + RETERR(mem_tobuffer(target, sr.base, 18)); + + /* + * Signer. + */ + dns_name_init(&name, NULL); + RETERR(dns_name_fromwire(&name, source, dctx, downcase, target)); + + /* + * Sig. + */ + isc_buffer_activeregion(source, &sr); + isc_buffer_forward(source, sr.length); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline isc_result_t +towire_rrsig(ARGS_TOWIRE) { + isc_region_t sr; + dns_name_t name; + dns_offsets_t offsets; + + REQUIRE(rdata->type == 46); + REQUIRE(rdata->length != 0); + + dns_compress_setmethods(cctx, DNS_COMPRESS_NONE); + dns_rdata_toregion(rdata, &sr); + /* + * type covered: 2 + * algorithm: 1 + * labels: 1 + * original ttl: 4 + * signature expiration: 4 + * time signed: 4 + * key footprint: 2 + */ + RETERR(mem_tobuffer(target, sr.base, 18)); + isc_region_consume(&sr, 18); + + /* + * Signer. + */ + dns_name_init(&name, offsets); + dns_name_fromregion(&name, &sr); + isc_region_consume(&sr, name_length(&name)); + RETERR(dns_name_towire(&name, cctx, target)); + + /* + * Signature. + */ + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_rrsig(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == 46); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_rrsig(ARGS_FROMSTRUCT) { + dns_rdata_rrsig_t *sig = source; + + REQUIRE(type == 46); + REQUIRE(source != NULL); + REQUIRE(sig->common.rdtype == type); + REQUIRE(sig->common.rdclass == rdclass); + REQUIRE(sig->signature != NULL || sig->siglen == 0); + + UNUSED(type); + UNUSED(rdclass); + + /* + * Type covered. + */ + RETERR(uint16_tobuffer(sig->covered, target)); + + /* + * Algorithm. + */ + RETERR(uint8_tobuffer(sig->algorithm, target)); + + /* + * Labels. + */ + RETERR(uint8_tobuffer(sig->labels, target)); + + /* + * Original TTL. + */ + RETERR(uint32_tobuffer(sig->originalttl, target)); + + /* + * Expire time. + */ + RETERR(uint32_tobuffer(sig->timeexpire, target)); + + /* + * Time signed. + */ + RETERR(uint32_tobuffer(sig->timesigned, target)); + + /* + * Key ID. + */ + RETERR(uint16_tobuffer(sig->keyid, target)); + + /* + * Signer name. + */ + RETERR(name_tobuffer(&sig->signer, target)); + + /* + * Signature. + */ + return (mem_tobuffer(target, sig->signature, sig->siglen)); +} + +static inline isc_result_t +tostruct_rrsig(ARGS_TOSTRUCT) { + isc_region_t sr; + dns_rdata_rrsig_t *sig = target; + dns_name_t signer; + + REQUIRE(rdata->type == 46); + REQUIRE(target != NULL); + REQUIRE(rdata->length != 0); + + sig->common.rdclass = rdata->rdclass; + sig->common.rdtype = rdata->type; + ISC_LINK_INIT(&sig->common, link); + + dns_rdata_toregion(rdata, &sr); + + /* + * Type covered. + */ + sig->covered = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + + /* + * Algorithm. + */ + sig->algorithm = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* + * Labels. + */ + sig->labels = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* + * Original TTL. + */ + sig->originalttl = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + + /* + * Expire time. + */ + sig->timeexpire = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + + /* + * Time signed. + */ + sig->timesigned = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + + /* + * Key ID. + */ + sig->keyid = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + + dns_name_init(&signer, NULL); + dns_name_fromregion(&signer, &sr); + dns_name_init(&sig->signer, NULL); + RETERR(name_duporclone(&signer, mctx, &sig->signer)); + isc_region_consume(&sr, name_length(&sig->signer)); + + /* + * Signature. + */ + sig->siglen = sr.length; + sig->signature = mem_maybedup(mctx, sr.base, sig->siglen); + if (sig->signature == NULL) + goto cleanup; + + + sig->mctx = mctx; + return (ISC_R_SUCCESS); + + cleanup: + if (mctx != NULL) + dns_name_free(&sig->signer, mctx); + return (ISC_R_NOMEMORY); +} + +static inline void +freestruct_rrsig(ARGS_FREESTRUCT) { + dns_rdata_rrsig_t *sig = (dns_rdata_rrsig_t *) source; + + REQUIRE(source != NULL); + REQUIRE(sig->common.rdtype == 46); + + if (sig->mctx == NULL) + return; + + dns_name_free(&sig->signer, sig->mctx); + if (sig->signature != NULL) + isc_mem_free(sig->mctx, sig->signature); + sig->mctx = NULL; +} + +static inline isc_result_t +additionaldata_rrsig(ARGS_ADDLDATA) { + REQUIRE(rdata->type == 46); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_rrsig(ARGS_DIGEST) { + + REQUIRE(rdata->type == 46); + + UNUSED(rdata); + UNUSED(digest); + UNUSED(arg); + + return (ISC_R_NOTIMPLEMENTED); +} + +static inline dns_rdatatype_t +covers_rrsig(dns_rdata_t *rdata) { + dns_rdatatype_t type; + isc_region_t r; + + REQUIRE(rdata->type == 46); + + dns_rdata_toregion(rdata, &r); + type = uint16_fromregion(&r); + + return (type); +} + +#endif /* RDATA_GENERIC_RRSIG_46_C */ diff --git a/lib/dns/rdata/generic/rrsig_46.h b/lib/dns/rdata/generic/rrsig_46.h new file mode 100644 index 00000000000..8f4c0439b06 --- /dev/null +++ b/lib/dns/rdata/generic/rrsig_46.h @@ -0,0 +1,40 @@ +/* + * Copyright (C) 1999-2001 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM + * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL + * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING + * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION + * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_DNSSIG_46_H +#define GENERIC_DNSSIG_46_H 1 + +/* $Id: rrsig_46.h,v 1.2 2003/09/30 06:00:40 marka Exp $ */ + +/* RFC 2535 */ +typedef struct dns_rdata_rrsig { + dns_rdatacommon_t common; + isc_mem_t * mctx; + dns_rdatatype_t covered; + dns_secalg_t algorithm; + isc_uint8_t labels; + isc_uint32_t originalttl; + isc_uint32_t timeexpire; + isc_uint32_t timesigned; + isc_uint16_t keyid; + dns_name_t signer; + isc_uint16_t siglen; + unsigned char * signature; +} dns_rdata_rrsig_t; + + +#endif /* GENERIC_DNSSIG_46_H */ diff --git a/lib/dns/rdata/generic/sig_24.c b/lib/dns/rdata/generic/sig_24.c index 490cca652e7..587ac2bd170 100644 --- a/lib/dns/rdata/generic/sig_24.c +++ b/lib/dns/rdata/generic/sig_24.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sig_24.c,v 1.59 2003/07/25 00:01:09 marka Exp $ */ +/* $Id: sig_24.c,v 1.60 2003/09/30 05:56:18 marka Exp $ */ /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */ @@ -24,7 +24,7 @@ #ifndef RDATA_GENERIC_SIG_24_C #define RDATA_GENERIC_SIG_24_C -#define RRTYPE_SIG_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC) +#define RRTYPE_SIG_ATTRIBUTES (0) static inline isc_result_t fromtext_sig(ARGS_FROMTEXT) { diff --git a/lib/dns/rdata/generic/tkey_249.h b/lib/dns/rdata/generic/tkey_249.h index 2fdeb679120..accf5dd8029 100644 --- a/lib/dns/rdata/generic/tkey_249.h +++ b/lib/dns/rdata/generic/tkey_249.h @@ -18,11 +18,11 @@ #ifndef GENERIC_TKEY_249_H #define GENERIC_TKEY_249_H 1 -/* $Id: tkey_249.h,v 1.18 2001/01/09 21:54:50 bwelling Exp $ */ +/* $Id: tkey_249.h,v 1.19 2003/09/30 05:56:18 marka Exp $ */ /* draft-ietf-dnsind-tkey-00.txt */ -typedef struct dns_rdata_key { +typedef struct dns_rdata_tkey { dns_rdatacommon_t common; isc_mem_t * mctx; dns_name_t algorithm; diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c index 20dde2baf1a..f36834ced51 100644 --- a/lib/dns/rdataset.c +++ b/lib/dns/rdataset.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: rdataset.c,v 1.67 2003/02/26 23:52:29 marka Exp $ */ +/* $Id: rdataset.c,v 1.68 2003/09/30 05:56:12 marka Exp $ */ #include @@ -334,7 +334,7 @@ towiresorted(dns_rdataset_t *rdataset, dns_name_t *owner_name, count > 1 && (!WANT_FIXED(rdataset) || order != NULL) && count <= MAX_SHUFFLE && - rdataset->type != dns_rdatatype_sig) + rdataset->type != dns_rdatatype_rrsig) { shuffle = ISC_TRUE; /* diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 8c174a4509e..ef85dcfd4c1 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: resolver.c,v 1.268 2003/09/21 13:05:16 marka Exp $ */ +/* $Id: resolver.c,v 1.269 2003/09/30 05:56:13 marka Exp $ */ #include @@ -711,7 +711,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { INSIST(result != ISC_R_SUCCESS || dns_rdataset_isassociated(event->rdataset) || fctx->type == dns_rdatatype_any || - fctx->type == dns_rdatatype_sig); + fctx->type == dns_rdatatype_rrsig); isc_task_sendanddetach(&task, (isc_event_t **)&event); } @@ -3001,7 +3001,7 @@ validated(isc_task_t *task, isc_event_t *event) { if (hevent != NULL) { if (!negative && !chaining && (fctx->type == dns_rdatatype_any || - fctx->type == dns_rdatatype_sig)) { + fctx->type == dns_rdatatype_rrsig)) { /* * Don't bind rdatasets; the caller * will iterate the node. @@ -3024,7 +3024,7 @@ validated(isc_task_t *task, isc_event_t *event) { if (vevent->sigrdataset != NULL) (void)dns_db_deleterdataset(fctx->cache, node, NULL, - dns_rdatatype_sig, + dns_rdatatype_rrsig, vevent->type); } result = vevent->result; @@ -3106,7 +3106,7 @@ validated(isc_task_t *task, isc_event_t *event) { if (!ISC_LIST_EMPTY(fctx->validators)) { INSIST(!negative); INSIST(fctx->type == dns_rdatatype_any || - fctx->type == dns_rdatatype_sig); + fctx->type == dns_rdatatype_rrsig); /* * Don't send a response yet - we have * more rdatasets that still need to @@ -3211,7 +3211,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { * and we must set up the rdatasets. */ if ((fctx->type != dns_rdatatype_any && - fctx->type != dns_rdatatype_sig) || + fctx->type != dns_rdatatype_rrsig) || (name->attributes & DNS_NAMEATTR_CHAINING) != 0) { ardataset = event->rdataset; asigrdataset = event->sigrdataset; @@ -3251,7 +3251,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { * SIGs are validated as part of validating the * type they cover. */ - if (rdataset->type == dns_rdatatype_sig) + if (rdataset->type == dns_rdatatype_rrsig) continue; /* * Find the SIG for this rdataset, if we have it. @@ -3259,7 +3259,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) { - if (sigrdataset->type == dns_rdatatype_sig && + if (sigrdataset->type == dns_rdatatype_rrsig && sigrdataset->covers == rdataset->type) break; } @@ -3318,7 +3318,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { if (ANSWER(rdataset) && need_validation) { if (fctx->type != dns_rdatatype_any && - fctx->type != dns_rdatatype_sig) { + fctx->type != dns_rdatatype_rrsig) { /* * This is The Answer. We will * validate it, but first we cache @@ -3380,7 +3380,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { } if (rdataset->trust == dns_trust_glue && (rdataset->type == dns_rdatatype_ns || - (rdataset->type == dns_rdatatype_sig && + (rdataset->type == dns_rdatatype_rrsig && rdataset->covers == dns_rdatatype_ns))) { /* * If the trust level is 'dns_trust_glue' @@ -3750,7 +3750,7 @@ check_related(void *arg, dns_name_t *addname, dns_rdatatype_t type) { for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { - if (rdataset->type == dns_rdatatype_sig) + if (rdataset->type == dns_rdatatype_rrsig) rtype = rdataset->covers; else rtype = rdataset->type; @@ -3769,7 +3769,7 @@ check_related(void *arg, dns_name_t *addname, dns_rdatatype_t type) { */ rdataset = NULL; result = dns_message_findtype(name, - dns_rdatatype_sig, + dns_rdatatype_rrsig, type, &rdataset); if (result == ISC_R_SUCCESS) mark_related(name, rdataset, external, @@ -3975,7 +3975,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname, rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { type = rdataset->type; - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) type = rdataset->covers; if (((type == dns_rdatatype_ns || type == dns_rdatatype_soa) && @@ -4006,12 +4006,12 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname, rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { type = rdataset->type; - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) type = rdataset->covers; if (type == dns_rdatatype_soa || - type == dns_rdatatype_nxt) { + type == dns_rdatatype_nsec) { /* - * SOA, SIG SOA, NXT, or SIG NXT. + * SOA, RRSIG SOA, NSEC, or RRSIG NSEC. * * Only one SOA is allowed. */ @@ -4253,7 +4253,7 @@ answer_response(fetchctx_t *fctx) { */ found = ISC_TRUE; aflag = DNS_RDATASETATTR_ANSWER; - } else if (rdataset->type == dns_rdatatype_sig + } else if (rdataset->type == dns_rdatatype_rrsig && rdataset->covers == type && !found_cname) { /* @@ -4273,9 +4273,9 @@ answer_response(fetchctx_t *fctx) { * Getting a CNAME response for some * query types is an error. */ - if (type == dns_rdatatype_sig || - type == dns_rdatatype_key || - type == dns_rdatatype_nxt) + if (type == dns_rdatatype_rrsig || + type == dns_rdatatype_dnskey || + type == dns_rdatatype_nsec) return (DNS_R_FORMERR); found = ISC_TRUE; found_cname = ISC_TRUE; @@ -4285,7 +4285,7 @@ answer_response(fetchctx_t *fctx) { &tname); if (result != ISC_R_SUCCESS) return (result); - } else if (rdataset->type == dns_rdatatype_sig + } else if (rdataset->type == dns_rdatatype_rrsig && rdataset->covers == dns_rdatatype_cname && !found_type) { @@ -4417,7 +4417,7 @@ answer_response(fetchctx_t *fctx) { return (result); else found_dname = ISC_TRUE; - } else if (rdataset->type == dns_rdatatype_sig + } else if (rdataset->type == dns_rdatatype_rrsig && rdataset->covers == dns_rdatatype_dname) { /* @@ -4553,7 +4553,7 @@ answer_response(fetchctx_t *fctx) { rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { if (rdataset->type == dns_rdatatype_ns || - (rdataset->type == dns_rdatatype_sig && + (rdataset->type == dns_rdatatype_rrsig && rdataset->covers == dns_rdatatype_ns)) { name->attributes |= DNS_NAMEATTR_CACHE; diff --git a/lib/dns/result.c b/lib/dns/result.c index 0078afe4ff8..eee5f6a223c 100644 --- a/lib/dns/result.c +++ b/lib/dns/result.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: result.c,v 1.108 2003/04/17 03:43:35 marka Exp $ */ +/* $Id: result.c,v 1.109 2003/09/30 05:56:13 marka Exp $ */ #include @@ -78,9 +78,9 @@ static const char *text[DNS_R_NRESULTS] = { "tsig verify failure", /* 38 DNS_R_TSIGVERIFYFAILURE */ "tsig indicates error", /* 39 DNS_R_TSIGERRORSET */ - "SIG failed to verify", /* 40 DNS_R_SIGINVALID */ - "SIG has expired", /* 41 DNS_R_SIGEXPIRED */ - "SIG validity period has not begun", /* 42 DNS_R_SIGFUTURE */ + "RRSIG failed to verify", /* 40 DNS_R_SIGINVALID */ + "RRSIG has expired", /* 41 DNS_R_SIGEXPIRED */ + "RRSIG validity period has not begun", /* 42 DNS_R_SIGFUTURE */ "key is unauthorized to sign data", /* 43 DNS_R_KEYUNAUTHORIZED */ "invalid time", /* 44 DNS_R_INVALIDTIME */ @@ -100,9 +100,9 @@ static const char *text[DNS_R_NRESULTS] = { "no journal", /* 56 DNS_R_NOJOURNAL */ "alias", /* 57 DNS_R_ALIAS */ "use TCP", /* 58 DNS_R_USETCP */ - "no valid SIG", /* 59 DNS_R_NOVALIDSIG */ + "no valid RRSIG", /* 59 DNS_R_NOVALIDSIG */ - "no valid NXT", /* 60 DNS_R_NOVALIDNXT */ + "no valid NSEC", /* 60 DNS_R_NOVALIDNSEC */ "not insecure", /* 61 DNS_R_NOTINSECURE */ "unknown service", /* 62 DNS_R_UNKNOWNSERVICE */ "recoverable error occurred", /* 63 DNS_R_RECOVERABLE */ diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c index fb46b880886..fc019fabd47 100644 --- a/lib/dns/sdb.c +++ b/lib/dns/sdb.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sdb.c,v 1.39 2003/09/17 05:34:55 marka Exp $ */ +/* $Id: sdb.c,v 1.40 2003/09/30 05:56:13 marka Exp $ */ #include @@ -1085,7 +1085,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, UNUSED(now); UNUSED(sigrdataset); - if (type == dns_rdatatype_sig) + if (type == dns_rdatatype_rrsig) return (ISC_R_NOTIMPLEMENTED); list = ISC_LIST_HEAD(sdbnode->lists); diff --git a/lib/dns/sec/dst/dst_api.c b/lib/dns/sec/dst/dst_api.c index 1d2539617c8..40a7acea81c 100644 --- a/lib/dns/sec/dst/dst_api.c +++ b/lib/dns/sec/dst/dst_api.c @@ -19,7 +19,7 @@ /* * Principal Author: Brian Wellington - * $Id: dst_api.c,v 1.107 2003/07/25 00:01:11 marka Exp $ + * $Id: dst_api.c,v 1.108 2003/09/30 05:56:18 marka Exp $ */ #include @@ -845,6 +845,7 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) { isc_lexspecials_t specials; isc_uint32_t ttl; isc_result_t result; + dns_rdatatype_t type; newfilenamelen = strlen(filename) + 5; newfilename = isc_mem_get(mctx, newfilenamelen); @@ -916,12 +917,16 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) { if (token.type != isc_tokentype_string) BADTOKEN(); - if (strcasecmp(DST_AS_STR(token), "KEY") != 0) + if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0) + type = dns_rdatatype_dnskey; + else if (strcasecmp(DST_AS_STR(token), "KEY") == 0) + type = dns_rdatatype_key; + else BADTOKEN(); isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf)); - ret = dns_rdata_fromtext(&rdata, rdclass, dns_rdatatype_key, - lex, NULL, ISC_FALSE, mctx, &b, NULL); + ret = dns_rdata_fromtext(&rdata, rdclass, type, lex, NULL, + ISC_FALSE, mctx, &b, NULL); if (ret != ISC_R_SUCCESS) goto cleanup; @@ -984,7 +989,7 @@ write_public_key(const dst_key_t *key, const char *directory) { return (ret); isc_buffer_usedregion(&keyb, &r); - dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_key, &r); + dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_dnskey, &r); ret = dns_rdata_totext(&rdata, (dns_name_t *) NULL, &textb); if (ret != ISC_R_SUCCESS) @@ -1025,7 +1030,7 @@ write_public_key(const dst_key_t *key, const char *directory) { isc_buffer_usedregion(&classb, &r); fwrite(r.base, 1, r.length, fp); - fprintf(fp, " KEY "); + fprintf(fp, " DNSKEY "); isc_buffer_usedregion(&textb, &r); fwrite(r.base, 1, r.length, fp); diff --git a/lib/dns/sec/dst/opensslrsa_link.c b/lib/dns/sec/dst/opensslrsa_link.c index b9e19e6eca2..7add1798de4 100644 --- a/lib/dns/sec/dst/opensslrsa_link.c +++ b/lib/dns/sec/dst/opensslrsa_link.c @@ -17,7 +17,7 @@ /* * Principal Author: Brian Wellington - * $Id: opensslrsa_link.c,v 1.26 2003/07/24 06:08:20 marka Exp $ + * $Id: opensslrsa_link.c,v 1.27 2003/09/30 05:56:18 marka Exp $ */ #ifdef OPENSSL @@ -40,6 +40,14 @@ #include #include + /* + * XXXMPA Temporarially disable RSA_BLINDING as it requires + * good quality random data that cannot currently be guarenteed. + * XXXMPA Find which versions of openssl use pseudo random data + * and set RSA_FLAG_BLINDING for those. + */ + +#if 0 #if OPENSSL_VERSION_NUMBER < 0x0090601fL #define SET_FLAGS(rsa) \ do { \ @@ -52,6 +60,20 @@ (rsa)->flags |= RSA_FLAG_BLINDING; \ } while (0) #endif +#endif + +#if OPENSSL_VERSION_NUMBER < 0x0090601fL +#define SET_FLAGS(rsa) \ + do { \ + (rsa)->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE); \ + (rsa)->flags &= ~RSA_FLAG_BLINDING; \ + } while (0) +#else +#define SET_FLAGS(rsa) \ + do { \ + (rsa)->flags &= ~RSA_FLAG_BLINDING; \ + } while (0) +#endif static isc_result_t opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data); @@ -123,10 +145,14 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { isc_region_t r; /* note: ISC_SHA1_DIGESTLENGTH > ISC_MD5_DIGESTLENGTH */ unsigned char digest[ISC_SHA1_DIGESTLENGTH]; - unsigned int siglen; + unsigned int siglen = 0; int status; int type; unsigned int digestlen; + char *message; + unsigned long err; + const char* file; + int line; REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 || dctx->key->key_alg == DST_ALG_RSASHA1); @@ -149,8 +175,15 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) { } status = RSA_sign(type, digest, digestlen, r.base, &siglen, rsa); - if (status == 0) + if (status == 0) { + err = ERR_peek_error_line(&file, &line); + if (err != 0) { + message = ERR_error_string(err, NULL); + fprintf(stderr, "%s:%s:%d\n", message, + file ? file : "", line); + } return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); + } isc_buffer_add(sig, siglen); diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c index 796c9cf1cd4..5c9c3111934 100644 --- a/lib/dns/ssu.c +++ b/lib/dns/ssu.c @@ -16,7 +16,7 @@ */ /* - * $Id: ssu.c,v 1.22 2001/08/28 03:58:08 marka Exp $ + * $Id: ssu.c,v 1.23 2003/09/30 05:56:13 marka Exp $ * Principal Author: Brian Wellington */ @@ -240,7 +240,7 @@ static inline isc_boolean_t isusertype(dns_rdatatype_t type) { return (ISC_TF(type != dns_rdatatype_ns && type != dns_rdatatype_soa && - type != dns_rdatatype_sig)); + type != dns_rdatatype_rrsig)); } isc_boolean_t diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c index 56a17afbf99..40b41aad8e9 100644 --- a/lib/dns/tkey.c +++ b/lib/dns/tkey.c @@ -16,7 +16,7 @@ */ /* - * $Id: tkey.c,v 1.74 2001/12/03 19:44:08 gson Exp $ + * $Id: tkey.c,v 1.75 2003/09/30 05:56:13 marka Exp $ */ #include @@ -285,7 +285,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name, keyname = NULL; dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname); keyset = NULL; - result = dns_message_findtype(keyname, dns_rdatatype_key, 0, + result = dns_message_findtype(keyname, dns_rdatatype_dnskey, 0, &keyset); if (result != ISC_R_SUCCESS) continue; @@ -333,7 +333,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name, RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf)); isc_buffer_usedregion(&ourkeybuf, &ourkeyr); dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any, - dns_rdatatype_key, &ourkeyr); + dns_rdatatype_dnskey, &ourkeyr); dns_name_init(&ourname, NULL); dns_name_clone(dst_key_name(tctx->dhkey), &ourname); @@ -877,7 +877,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name, RETERR(dst_key_todns(key, dynbuf)); isc_buffer_usedregion(dynbuf, &r); dns_rdata_fromregion(rdata, dns_rdataclass_any, - dns_rdatatype_key, &r); + dns_rdatatype_dnskey, &r); dns_message_takebuffer(msg, &dynbuf); dns_name_init(&keyname, NULL); @@ -1049,7 +1049,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg, ourkeyname = NULL; ourkeyset = NULL; RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname, - dns_rdatatype_key, 0, &ourkeyname, + dns_rdatatype_dnskey, 0, &ourkeyname, &ourkeyset)); result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER); @@ -1060,7 +1060,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg, if (dns_name_equal(theirkeyname, ourkeyname)) goto next; theirkeyset = NULL; - result = dns_message_findtype(theirkeyname, dns_rdatatype_key, + result = dns_message_findtype(theirkeyname, dns_rdatatype_dnskey, 0, &theirkeyset); if (result == ISC_R_SUCCESS) { RETERR(dns_rdataset_first(theirkeyset)); diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 9649ae5fdd0..fd8d08df2b6 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.112 2003/02/27 00:19:04 marka Exp $ */ +/* $Id: validator.c,v 1.113 2003/09/30 05:56:14 marka Exp $ */ #include @@ -32,7 +32,7 @@ #include #include #include -#include +#include #include #include #include @@ -56,7 +56,7 @@ static void destroy(dns_validator_t *val); static isc_result_t -get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo, +get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo, dns_rdataset_t *rdataset); static isc_result_t @@ -66,7 +66,7 @@ static isc_result_t validatezonekey(dns_validator_t *val, isc_boolean_t resume); static isc_result_t -nxtvalidate(dns_validator_t *val, isc_boolean_t resume); +nsecvalidate(dns_validator_t *val, isc_boolean_t resume); static isc_result_t proveunsecure(dns_validator_t *val, isc_boolean_t resume); @@ -159,18 +159,18 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdataset_clone(rdataset, &set); else { result = dns_ncache_getrdataset(rdataset, name, - dns_rdatatype_nxt, &set); + dns_rdatatype_nsec, &set); if (result != ISC_R_SUCCESS) return (ISC_FALSE); } - INSIST(set.type == dns_rdatatype_nxt); + INSIST(set.type == dns_rdatatype_nsec); found = ISC_FALSE; result = dns_rdataset_first(&set); if (result == ISC_R_SUCCESS) { dns_rdataset_current(&set, &rdata); - found = dns_nxt_typepresent(&rdata, dns_rdatatype_ns); + found = dns_nsec_typepresent(&rdata, dns_rdatatype_ns); } dns_rdataset_disassociate(&set); return (found); @@ -433,8 +433,8 @@ dsvalidated(isc_task_t *task, isc_event_t *event) { } static isc_boolean_t -nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname, - dns_rdataset_t *nxtset) +nsecprovesnonexistence(dns_validator_t *val, dns_name_t *nsecname, + dns_rdataset_t *nsecset) { int order; dns_rdata_t rdata = DNS_RDATA_INIT; @@ -450,16 +450,16 @@ nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname, else isnxdomain = ISC_FALSE; - result = dns_rdataset_first(nxtset); + result = dns_rdataset_first(nsecset); if (result != ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "failure processing NXT set"); + "failure processing NSEC set"); return (ISC_FALSE); } - dns_rdataset_current(nxtset, &rdata); + dns_rdataset_current(nsecset, &rdata); - validator_log(val, ISC_LOG_DEBUG(3), "looking for relevant nxt"); - relation = dns_name_fullcompare(val->event->name, nxtname, + validator_log(val, ISC_LOG_DEBUG(3), "looking for relevant nsec"); + relation = dns_name_fullcompare(val->event->name, nsecname, &order, &olabels, &bits); if (order == 0) { /* @@ -467,7 +467,7 @@ nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname, */ if (isnxdomain) { validator_log(val, ISC_LOG_DEBUG(3), - "NXT record seen at nonexistent name"); + "NSEC record seen at nonexistent name"); return (ISC_FALSE); } if (val->event->type >= 128) { @@ -476,107 +476,107 @@ nxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname, return (ISC_FALSE); } - if (dns_nxt_typepresent(&rdata, val->event->type)) { + if (dns_nsec_typepresent(&rdata, val->event->type)) { validator_log(val, ISC_LOG_DEBUG(3), "type should not be present"); return (ISC_FALSE); } - validator_log(val, ISC_LOG_DEBUG(3), "nxt bitmask ok"); + validator_log(val, ISC_LOG_DEBUG(3), "nsec bitmask ok"); } else if (order > 0) { - dns_rdata_nxt_t nxt; + dns_rdata_nsec_t nsec; /* - * The NXT owner name is less than the nonexistent name. + * The NSEC owner name is less than the nonexistent name. */ if (!isnxdomain) { /* * Is this a empty node? */ - result = dns_rdata_tostruct(&rdata, &nxt, NULL); + result = dns_rdata_tostruct(&rdata, &nsec, NULL); RUNTIME_CHECK(result == ISC_R_SUCCESS); - relation = dns_name_fullcompare(&nxt.next, + relation = dns_name_fullcompare(&nsec.next, val->event->name, &order, &nlabels, &bits); if (order > 0 && relation == dns_namereln_subdomain) { - dns_rdata_freestruct(&nxt); + dns_rdata_freestruct(&nsec); validator_log(val, ISC_LOG_DEBUG(3), - "nxt proves empty node, ok"); + "nsec proves empty node, ok"); return (ISC_TRUE); } /* * Look for empty wildcard matches. */ - labels = dns_name_countlabels(&nxt.next); + labels = dns_name_countlabels(&nsec.next); if (nlabels >= olabels && nlabels + 1 < labels) { dns_name_t wild; dns_name_init(&wild, NULL); - dns_name_getlabelsequence(&nxt.next, + dns_name_getlabelsequence(&nsec.next, labels - 1 - nlabels, nlabels + 1, &wild); if (dns_name_iswildcard(&wild)) { - dns_rdata_freestruct(&nxt); + dns_rdata_freestruct(&nsec); validator_log(val, ISC_LOG_DEBUG(3), - "nxt proves empty wildcard, ok"); + "nsec proves empty wildcard, ok"); return (ISC_TRUE); } } /* * We are not a empty name. */ - dns_rdata_freestruct(&nxt); + dns_rdata_freestruct(&nsec); validator_log(val, ISC_LOG_DEBUG(3), - "missing NXT record at name"); + "missing NSEC record at name"); return (ISC_FALSE); } - if (dns_name_issubdomain(val->event->name, nxtname) && - dns_nxt_typepresent(&rdata, dns_rdatatype_ns) && - !dns_nxt_typepresent(&rdata, dns_rdatatype_soa)) + if (dns_name_issubdomain(val->event->name, nsecname) && + dns_nsec_typepresent(&rdata, dns_rdatatype_ns) && + !dns_nsec_typepresent(&rdata, dns_rdatatype_soa)) { /* - * This NXT record is from somewhere higher in + * This NSEC record is from somewhere higher in * the DNS, and at the parent of a delegation. * It can not be legitimately used here. */ validator_log(val, ISC_LOG_DEBUG(3), - "ignoring parent nxt"); + "ignoring parent nsec"); return (ISC_FALSE); } - result = dns_rdata_tostruct(&rdata, &nxt, NULL); + result = dns_rdata_tostruct(&rdata, &nsec, NULL); if (result != ISC_R_SUCCESS) return (ISC_FALSE); dns_rdata_reset(&rdata); - relation = dns_name_fullcompare(&nxt.next, val->event->name, + relation = dns_name_fullcompare(&nsec.next, val->event->name, &order, &nlabels, &bits); if (order <= 0) { /* - * The NXT next name is less than the nonexistent + * The NSEC next name is less than the nonexistent * name. This is only ok if the next name is the zone * name. */ - if (!dns_name_equal(val->soaname, &nxt.next)) { + if (!dns_name_equal(val->soaname, &nsec.next)) { validator_log(val, ISC_LOG_DEBUG(3), "next name is not greater"); - dns_rdata_freestruct(&nxt); + dns_rdata_freestruct(&nsec); return (ISC_FALSE); } validator_log(val, ISC_LOG_DEBUG(3), - "nxt points to zone apex, ok"); + "nsec points to zone apex, ok"); } else if (relation == dns_namereln_subdomain) { validator_log(val, ISC_LOG_DEBUG(3), - "nxt proves empty node, bad"); - dns_rdata_freestruct(&nxt); + "nsec proves empty node, bad"); + dns_rdata_freestruct(&nsec); return (ISC_FALSE); } - dns_rdata_freestruct(&nxt); - validator_log(val, ISC_LOG_DEBUG(3), "nxt range ok"); + dns_rdata_freestruct(&nsec); + validator_log(val, ISC_LOG_DEBUG(3), "nsec range ok"); } else { validator_log(val, ISC_LOG_DEBUG(3), - "nxt owner name is not less"); + "nsec owner name is not less"); /* - * The NXT owner name is greater than the supposedly - * nonexistent name. This NXT is irrelevant. + * The NSEC owner name is greater than the supposedly + * nonexistent name. This NSEC is irrelevant. */ return (ISC_FALSE); } @@ -612,17 +612,17 @@ authvalidated(isc_task_t *task, isc_event_t *event) { if (result == ISC_R_CANCELED) validator_done(val, result); else { - result = nxtvalidate(val, ISC_TRUE); + result = nsecvalidate(val, ISC_TRUE); if (result != DNS_R_WAIT) validator_done(val, result); } } else { - if (val->soaname != NULL && val->nxtset != NULL && + if (val->soaname != NULL && val->nsecset != NULL && (val->attributes & VALATTR_FOUNDNONEXISTENCE) == 0 && - nxtprovesnonexistence(val, devent->name, rdataset)) + nsecprovesnonexistence(val, devent->name, rdataset)) val->attributes |= VALATTR_FOUNDNONEXISTENCE; - result = nxtvalidate(val, ISC_TRUE); + result = nsecvalidate(val, ISC_TRUE); if (result != DNS_R_WAIT) validator_done(val, result); } @@ -757,7 +757,7 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type, * If val->key is non-NULL, this returns the next matching key. */ static isc_result_t -get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo, +get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo, dns_rdataset_t *rdataset) { isc_result_t result; @@ -818,7 +818,7 @@ get_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo, } static isc_result_t -get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { +get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) { isc_result_t result; unsigned int nbits, nlabels; int order; @@ -841,7 +841,7 @@ get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { * If this is a self-signed keyset, it must not be a zone key * (since get_key is not called from validatezonekey). */ - if (val->event->rdataset->type == dns_rdatatype_key) + if (val->event->rdataset->type == dns_rdatatype_dnskey) return (DNS_R_CONTINUE); /* @@ -855,7 +855,7 @@ get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { /* * Do we know about this key? */ - result = view_find(val, &siginfo->signer, dns_rdatatype_key); + result = view_find(val, &siginfo->signer, dns_rdatatype_dnskey); if (result == ISC_R_SUCCESS) { /* * We have an rrset for the given keyname. @@ -868,7 +868,7 @@ get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { * We know the key but haven't validated it yet. */ result = create_validator(val, &siginfo->signer, - dns_rdatatype_key, + dns_rdatatype_dnskey, &val->frdataset, &val->fsigrdataset, keyvalidated, @@ -910,7 +910,7 @@ get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { /* * We don't know anything about this key. */ - result = create_fetch(val, &siginfo->signer, dns_rdatatype_key, + result = create_fetch(val, &siginfo->signer, dns_rdatatype_dnskey, fetch_callback_validator, "get_key"); if (result != ISC_R_SUCCESS) return (result); @@ -936,7 +936,7 @@ get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) { } static dns_keytag_t -compute_keytag(dns_rdata_t *rdata, dns_rdata_key_t *key) { +compute_keytag(dns_rdata_t *rdata, dns_rdata_dnskey_t *key) { isc_region_t r; dns_rdata_toregion(rdata, &r); @@ -951,15 +951,15 @@ isselfsigned(dns_validator_t *val) { dns_rdataset_t *rdataset, *sigrdataset; dns_rdata_t rdata = DNS_RDATA_INIT; dns_rdata_t sigrdata = DNS_RDATA_INIT; - dns_rdata_key_t key; - dns_rdata_sig_t sig; + dns_rdata_dnskey_t key; + dns_rdata_rrsig_t sig; dns_keytag_t keytag; isc_result_t result; rdataset = val->event->rdataset; sigrdataset = val->event->sigrdataset; - INSIST(rdataset->type == dns_rdatatype_key); + INSIST(rdataset->type == dns_rdatatype_dnskey); for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; @@ -1168,8 +1168,8 @@ validatezonekey(dns_validator_t *val, isc_boolean_t resume) { unsigned char dsbuf[DNS_DS_BUFFERSIZE]; dns_keytag_t keytag; dns_rdata_ds_t ds; - dns_rdata_key_t key; - dns_rdata_sig_t sig; + dns_rdata_dnskey_t key; + dns_rdata_rrsig_t sig; dst_key_t *dstkey; UNUSED(resume); @@ -1407,14 +1407,14 @@ start_positive_validation(dns_validator_t *val) { /* * If this is not a key, go straight into validate(). */ - if (val->event->type != dns_rdatatype_key || !isselfsigned(val)) + if (val->event->type != dns_rdatatype_dnskey || !isselfsigned(val)) return (validate(val, ISC_FALSE)); return (validatezonekey(val, ISC_FALSE)); } static isc_result_t -nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { +nsecvalidate(dns_validator_t *val, isc_boolean_t resume) { dns_name_t *name; dns_message_t *message = val->event->message; isc_result_t result; @@ -1423,7 +1423,7 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); else { result = ISC_R_SUCCESS; - validator_log(val, ISC_LOG_DEBUG(3), "resuming nxtvalidate"); + validator_log(val, ISC_LOG_DEBUG(3), "resuming nsecvalidate"); } for (; @@ -1446,21 +1446,21 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { - if (rdataset->type == dns_rdatatype_sig) + if (rdataset->type == dns_rdatatype_rrsig) continue; if (rdataset->type == dns_rdatatype_soa) { val->soaset = rdataset; val->soaname = name; - } else if (rdataset->type == dns_rdatatype_nxt) - val->nxtset = rdataset; + } else if (rdataset->type == dns_rdatatype_nsec) + val->nsecset = rdataset; for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) { - if (sigrdataset->type == dns_rdatatype_sig && + if (sigrdataset->type == dns_rdatatype_rrsig && sigrdataset->covers == rdataset->type) break; } @@ -1472,24 +1472,24 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { * things could happen. A query for data in the zone * would lead to a query for the zone key, which * would return a negative answer, which would contain - * an SOA and an NXT signed by the missing key, which + * an SOA and an NSEC signed by the missing key, which * would trigger another query for the KEY (since the * first one is still in progress), and go into an * infinite loop. Avoid that. */ - if (val->event->type == dns_rdatatype_key && + if (val->event->type == dns_rdatatype_dnskey && dns_name_equal(name, val->event->name)) { - dns_rdata_t nxt = DNS_RDATA_INIT; + dns_rdata_t nsec = DNS_RDATA_INIT; - if (rdataset->type != dns_rdatatype_nxt) + if (rdataset->type != dns_rdatatype_nsec) continue; result = dns_rdataset_first(rdataset); if (result != ISC_R_SUCCESS) return (result); - dns_rdataset_current(rdataset, &nxt); - if (dns_nxt_typepresent(&nxt, + dns_rdataset_current(rdataset, &nsec); + if (dns_nsec_typepresent(&nsec, dns_rdatatype_soa)) continue; } @@ -1497,7 +1497,7 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { result = create_validator(val, name, rdataset->type, rdataset, sigrdataset, authvalidated, - "nxtvalidate"); + "nsecvalidate"); if (result != ISC_R_SUCCESS) return (result); return (DNS_R_WAIT); @@ -1514,14 +1514,14 @@ nxtvalidate(dns_validator_t *val, isc_boolean_t resume) { result = create_validator(val, name, dns_rdatatype_soa, val->soaset, NULL, negauthvalidated, - "nxtvalidate"); + "nsecvalidate"); if (result != ISC_R_SUCCESS) return (result); return (DNS_R_WAIT); } validator_log(val, ISC_LOG_DEBUG(3), "nonexistence proof not found"); - return (DNS_R_NOVALIDNXT); + return (DNS_R_NOVALIDNSEC); } else { validator_log(val, ISC_LOG_DEBUG(3), "nonexistence proof found"); @@ -1628,10 +1628,10 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) { */ if (!dns_rdataset_isassociated(&val->frdataset)) { /* - * There should be an NXT here, since we + * There should be an NSEC here, since we * are still in a secure zone. */ - result = DNS_R_NOVALIDNXT; + result = DNS_R_NOVALIDNSEC; goto out; } else if (val->frdataset.trust < dns_trust_secure) { /* @@ -1731,7 +1731,7 @@ validator_start(isc_task_t *task, isc_event_t *event) { "attempting negative response validation"); val->attributes |= VALATTR_NEGATIVE; - result = nxtvalidate(val, ISC_FALSE); + result = nsecvalidate(val, ISC_FALSE); } else { /* * This shouldn't happen. @@ -1815,7 +1815,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, val->keyset = NULL; val->dsset = NULL; val->soaset = NULL; - val->nxtset = NULL; + val->nsecset = NULL; val->soaname = NULL; val->seensig = ISC_FALSE; dns_rdataset_init(&val->frdataset); diff --git a/lib/dns/view.c b/lib/dns/view.c index 356498501de..16db471416a 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: view.c,v 1.121 2003/09/19 13:27:18 marka Exp $ */ +/* $Id: view.c,v 1.122 2003/09/30 05:56:14 marka Exp $ */ #include @@ -669,7 +669,7 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, REQUIRE(DNS_VIEW_VALID(view)); REQUIRE(view->frozen); - REQUIRE(type != dns_rdatatype_sig); + REQUIRE(type != dns_rdatatype_rrsig); REQUIRE(rdataset != NULL); /* XXXBEW - remove this */ /* @@ -871,7 +871,7 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, rdataset, sigrdataset); if (result == DNS_R_NXDOMAIN) { /* - * The rdataset and sigrdataset of the relevant NXT record + * The rdataset and sigrdataset of the relevant NSEC record * may be returned, but the caller cannot use them because * foundname is not returned by this simplified API. We * disassociate them here to prevent any misuse by the caller. diff --git a/lib/dns/win32/libdns.def b/lib/dns/win32/libdns.def index 490712fc65e..9fc1715cfde 100644 --- a/lib/dns/win32/libdns.def +++ b/lib/dns/win32/libdns.def @@ -319,9 +319,9 @@ dns_name_format dns_name_copy dns_ncache_add dns_ncache_towire -dns_nxt_buildrdata -dns_nxt_build -dns_nxt_typepresent +dns_nsec_buildrdata +dns_nsec_build +dns_nsec_typepresent dns_soa_getserial dns_soa_setserial dns_soa_getminimum diff --git a/lib/dns/win32/libdns.dsp b/lib/dns/win32/libdns.dsp index c65351fe427..11438fd4f70 100644 --- a/lib/dns/win32/libdns.dsp +++ b/lib/dns/win32/libdns.dsp @@ -234,7 +234,7 @@ SOURCE=..\include\dns\ncache.h # End Source File # Begin Source File -SOURCE=..\include\dns\nxt.h +SOURCE=..\include\dns\nsec.h # End Source File # Begin Source File @@ -511,7 +511,7 @@ SOURCE=..\ncache.c # End Source File # Begin Source File -SOURCE=..\nxt.c +SOURCE=..\nsec.c # End Source File # Begin Source File diff --git a/lib/dns/win32/libdns.mak b/lib/dns/win32/libdns.mak index 4fdaab3e48a..bbb1e26ee84 100644 --- a/lib/dns/win32/libdns.mak +++ b/lib/dns/win32/libdns.mak @@ -79,7 +79,7 @@ CLEAN : -@erase "$(INTDIR)\message.obj" -@erase "$(INTDIR)\name.obj" -@erase "$(INTDIR)\ncache.obj" - -@erase "$(INTDIR)\nxt.obj" + -@erase "$(INTDIR)\nsec.obj" -@erase "$(INTDIR)\openssl_link.obj" -@erase "$(INTDIR)\openssldh_link.obj" -@erase "$(INTDIR)\openssldsa_link.obj" @@ -194,7 +194,7 @@ LINK32_OBJS= \ "$(INTDIR)\message.obj" \ "$(INTDIR)\name.obj" \ "$(INTDIR)\ncache.obj" \ - "$(INTDIR)\nxt.obj" \ + "$(INTDIR)\nsec.obj" \ "$(INTDIR)\order.obj" \ "$(INTDIR)\peer.obj" \ "$(INTDIR)\rbt.obj" \ @@ -336,8 +336,8 @@ CLEAN : -@erase "$(INTDIR)\name.sbr" -@erase "$(INTDIR)\ncache.obj" -@erase "$(INTDIR)\ncache.sbr" - -@erase "$(INTDIR)\nxt.obj" - -@erase "$(INTDIR)\nxt.sbr" + -@erase "$(INTDIR)\nsec.obj" + -@erase "$(INTDIR)\nsec.sbr" -@erase "$(INTDIR)\openssl_link.obj" -@erase "$(INTDIR)\openssl_link.sbr" -@erase "$(INTDIR)\openssldh_link.obj" @@ -486,7 +486,7 @@ BSC32_SBRS= \ "$(INTDIR)\message.sbr" \ "$(INTDIR)\name.sbr" \ "$(INTDIR)\ncache.sbr" \ - "$(INTDIR)\nxt.sbr" \ + "$(INTDIR)\nsec.sbr" \ "$(INTDIR)\order.sbr" \ "$(INTDIR)\peer.sbr" \ "$(INTDIR)\rbt.sbr" \ @@ -567,7 +567,7 @@ LINK32_OBJS= \ "$(INTDIR)\message.obj" \ "$(INTDIR)\name.obj" \ "$(INTDIR)\ncache.obj" \ - "$(INTDIR)\nxt.obj" \ + "$(INTDIR)\nsec.obj" \ "$(INTDIR)\order.obj" \ "$(INTDIR)\peer.obj" \ "$(INTDIR)\rbt.obj" \ @@ -1103,19 +1103,19 @@ SOURCE=..\ncache.c !ENDIF -SOURCE=..\nxt.c +SOURCE=..\nsec.c !IF "$(CFG)" == "libdns - Win32 Release" -"$(INTDIR)\nxt.obj" : $(SOURCE) "$(INTDIR)" +"$(INTDIR)\nsec.obj" : $(SOURCE) "$(INTDIR)" $(CPP) $(CPP_PROJ) $(SOURCE) !ELSEIF "$(CFG)" == "libdns - Win32 Debug" -"$(INTDIR)\nxt.obj" "$(INTDIR)\nxt.sbr" : $(SOURCE) "$(INTDIR)" +"$(INTDIR)\nsec.obj" "$(INTDIR)\nsec.sbr" : $(SOURCE) "$(INTDIR)" $(CPP) $(CPP_PROJ) $(SOURCE) diff --git a/lib/dns/zonekey.c b/lib/dns/zonekey.c index 0546b6fe023..df2584d3dda 100644 --- a/lib/dns/zonekey.c +++ b/lib/dns/zonekey.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zonekey.c,v 1.3 2001/02/26 02:49:19 bwelling Exp $ */ +/* $Id: zonekey.c,v 1.4 2003/09/30 05:56:14 marka Exp $ */ #include @@ -32,7 +32,7 @@ isc_boolean_t dns_zonekey_iszonekey(dns_rdata_t *keyrdata) { isc_result_t result; - dns_rdata_key_t key; + dns_rdata_dnskey_t key; isc_boolean_t iszonekey = ISC_TRUE; REQUIRE(keyrdata != NULL);