Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Add CHANGES entry
4973. [func] verifyzone() and the functions it uses were moved to
libdns and refactored to prevent exit() from being
called upon failure. A side effect of that is that
dnssec-signzone and dnssec-verify now check for memory
leaks upon shutdown. [GL #266]
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Propagate dns_zoneverify_dnssec() errors to callers
Since exit() is no longer called upon any dns_zoneverify_dnssec() error,
verification failures should be signalled to callers. Make
dns_zoneverify_dnssec() return an isc_result_t and handle both success
and error appropriately in bin/dnssec/dnssec-signzone.c and
bin/dnssec/dnssec-verify.c. This enables memory leak detection during
shutdown of these tools and causes dnssec-signzone to print signing
statistics even when zone verification fails.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Properly handle record_found() errors
record_found() returns an isc_result_t, but its value is not checked.
Modify the only call site of record_found() so that its errors are
properly handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon record_nsec3() errors
Replace the fprintf() call inside record_nsec3() with a
zoneverify_log_error() call. Remove the "mctx" argument of
record_nsec3() as it can be extracted from "vctx".
Modify one of the record_nsec3() call sites so that its errors are
properly handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon match_nsec3() errors
Make match_nsec3() return the verification result through a separate
pointer, thus making it possible to signal errors using function
return value. Replace all check_result() and fprintf() calls inside
match_nsec3() with zoneverify_log_error() calls and error handling code.
Modify all call sites of match_nsec3() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon isoptout() errors
Replace all check_result() calls inside isoptout() with
zoneverify_log_error() calls and error handling code. Enable isoptout()
to signal errors to the caller using its return value.
Modify the call site of isoptout() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon NSEC3 verification errors
Make verifynsec3(), verifynsec3s(), and verifyemptynodes() return the
verification result through a separate pointer, thus making it possible
to signal errors using function return values. Replace all
check_result() and fprintf() calls inside these functions with
zoneverify_log_error() calls and error handling code.
Modify all call sites of verifynsec3(), verifynsec3s(), and
verifyemptynodes() so that their errors are properly handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon verifynsec() errors
Make verifynsec() return the verification result through a separate
pointer, thus making it possible to signal errors using function
return value. Replace all check_result() and fprintf() calls inside
verifynsec() with zoneverify_log_error() calls and error handling code.
Modify the call site of verifynsec() so that its errors are properly
handled.
Rename "tresult" to "tvresult" in order to improve variable naming
consistency between functions.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon check_no_rrsig() errors
Replace all check_result() and fprintf() calls inside check_no_rrsig()
with zoneverify_log_error() calls and error handling code. Enable
check_no_rrsig() to signal errors to the caller using its return
value.
Modify the call site of check_no_rrsig() so that its errors are properly
handled.
Define buffer size using a named constant rather than a plain integer.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon verifyset() errors
Replace all check_result() and fprintf() calls inside verifyset() with
zoneverify_log_error() calls and error handling code. Enable
verifyset() to signal errors to the caller using its return value.
Modify the call site of verifyset() so that its errors are properly
handled.
Define buffer sizes using named constants rather than plain integers.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon verifynode() errors
Make verifynode() return the verification result through a separate
pointer, thus making it possible to signal errors using function
return value. Replace all fatal() and check_result() calls inside
verifynode() with zoneverify_log_error() calls and error handling code.
Add a REQUIRE assertion to emphasize verifynode() may be called with
some of its arguments set to NULL.
Modify all call sites of verifynode() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon is_empty() errors
Replace the check_result() call inside is_empty() with a
zoneverify_log_error() call and error handling code. Enable is_empty()
to signal errors to the caller using its return value.
Modify the call site of is_empty() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon check_no_nsec() errors
Replace the fatal() call inside check_no_nsec() with a
zoneverify_log_error() call. Enable check_no_nsec() to signal errors to
the caller using its return value.
Modify all call sites of check_no_nsec() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon verify_nodes() errors
Replace all fatal(), check_result(), and check_dns_dbiterator_current()
calls inside verify_nodes() with zoneverify_log_error() calls and error
handling code. Enable verify_nodes() to signal errors to the caller
using its return value.
Modify the call site of verify_nodes() so that its errors are properly
handled.
Free all heap elements upon verification context cleanup as a
verification error may prevent them from being freed elsewhere.
Remove the check_dns_dbiterator_current() macro as it is no longer used
anywhere in lib/dns/zoneverify.c.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon check_bad_algorithms() errors
Replace all fatal() and fprintf() calls inside check_bad_algorithms()
with zoneverify_print() calls and error handling code. Enable
check_bad_algorithms() to signal errors to the caller using its return
value.
Modify the call site of check_bad_algorithms() so that its errors are
properly handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon check_dnskey() errors
Replace all fatal() and check_result() calls inside check_dnskey() with
zoneverify_log_error() calls and error handling code. Enable
check_dnskey() to signal errors to the caller using its return value.
Modify the call site of check_dnskey() so that its errors are properly
handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not call exit() upon check_apex_rrsets() errors
Replace all fatal() calls inside check_apex_rrsets() with
zoneverify_log_error() calls and error handling code. Enable
check_apex_rrsets() to signal errors to the caller using its return
value.
Modify the call site of check_apex_rrsets() so that its errors are
properly handled.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Use RUNTIME_CHECK instead of check_result() where it is safe to do so
Replace calls to check_result() with RUNTIME_CHECK assertions for all
dns_rdata_tostruct() calls in lib/dns/zoneverify.c as this function
cannot fail when the "mctx" argument is NULL (and that is the case for
all call sites of this function throughout lib/dns/zoneverify.c).
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Extract check_bad_algorithms() from dns_zoneverify_dnssec()
Extract the part of dns_zoneverify_dnssec() responsible for checking
whether the zone is fully signed using all active algorithms to a
separate function.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Extract verify_nodes() from dns_zoneverify_dnssec()
Extract the part of dns_zoneverify_dnssec() responsible for verifying
DNSSEC signatures against the DNSKEY RRset at zone apex and checking
consistency of NSEC/NSEC3 chains to a separate function.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Extract determine_active_algorithms() from dns_zoneverify_dnssec()
Extract the part of dns_zoneverify_dnssec() responsible for determining
and printing a list of DNSSEC algorithms active in the verified zone to
a separate function.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Extract check_dnskey_sigs() from check_dnskey()
Extract the part of check_dnskey() responsible for determining active
algorithms in the verified zone based on the signatures at zone apex to
a separate function.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Extract check_apex_rrsets() from dns_zoneverify_dnssec()
Extract the part of dns_zoneverify_dnssec() responsible for fetching and
preliminarily checking DNSKEY, SOA, NSEC, and NSEC3PARAM RRsets from
zone apex to a separate function.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Implement zoneverify_log_error() and zoneverify_print()
These functions will be used in the process of replacing fatal(),
check_result(), and fprintf() calls throughout lib/dns/zoneverify.c with
code that does not call exit(). They are intended for:
- zoneverify_log_error(): logging problems encountered while
performing zone verification,
- zoneverify_print(): printing status messages and reports which are
only useful in standalone tools.
To make using dns_zone_logv() possible, add a new "zone" argument to
dns_zoneverify_dnssec() that standalone tools are expected to set to
NULL.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Move algorithm tables to the verification context structure
Tables representing algorithm use in the verified zone are commonly
accessed throughout dns_zoneverify_dnssec(). Move them into the
structure representing a verification context. While this does not
really simplify currently existing code, it will facilitate passing data
around between smaller functions that dns_zoneverify_dnssec() is about
to get split into.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Move commonly used dns_rdataset_t structures to the verification context structure
Eight structures representing four RRsets and their signatures are
commonly accessed throughout dns_zoneverify_dnssec(). Move them into
the structure representing a verification context. While this does not
really simplify currently existing code, it will facilitate passing data
around between smaller functions that dns_zoneverify_dnssec() is about
to get split into.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Move commonly used variables to the verification context structure
Move variables commonly used throughout dns_zoneverify_dnssec() and its
helper functions to the structure representing a verification context in
order to reduce the number of arguments passed between functions.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Do not use static variables in lib/dns/zoneverify.c
Make dns_zoneverify_dnssec() eligible for multithreaded use by replacing
the static variables it accesses with a stack-allocated structure
containing these variables. Implement setup and cleanup routines for
that structure, ensuring no error in these routines causes exit() to be
called any more. Pass a pointer to that structure to functions
requiring access to variables which were previously static.
Michał Kępień [Fri, 15 Jun 2018 07:59:20 +0000 (09:59 +0200)]
Move verifyzone() and its dependencies into lib/dns/zoneverify.c
This commit only moves code around, with the following exceptions:
- the check_dns_dbiterator_current() macro and functions
is_delegation() and has_dname() were removed from
bin/dnssec/dnssectool.{c,h} and duplicated in two locations:
bin/dnssec/dnssec-signzone.c and lib/dns/zoneverify.c; these
functions are used both by the code in bin/dnssec/dnssec-signzone.c
and verifyzone(), but are not a good fit for being exported by a
code module responsible for zone verification,
- fatal() and check_result() were duplicated in lib/dns/zoneverify.c
as static functions which do not use the "program" variable any more
(as it is only set by the tools in bin/dnssec/); this is a temporary
step which only aims to prevent compilation from breaking - these
duplicate functions will be removed once lib/dns/zoneverify.c is
refactored not to use them,
- the list of header files included by lib/dns/zoneverify.c was
expanded to encompass all header files that are actually used by the
code in that file,
- a description of the purpose of the commented out "fields" inside
struct nsec3_chain_fixed was added.
Michał Kępień [Wed, 13 Jun 2018 10:19:54 +0000 (12:19 +0200)]
Treat records below a DNAME as out-of-zone data
DNAME records indicate bottom of zone and thus no records below a DNAME
should be DNSSEC-signed or included in NSEC(3) chains. Add a helper
function, has_dname(), for detecting DNAME records at a given node.
Prevent signing DNAME-obscured records. Check that DNAME-obscured
records are not signed.
Michał Kępień [Wed, 13 Jun 2018 05:47:12 +0000 (07:47 +0200)]
Add helper variables in mkeys system test
The keyfile and key ID for the original managed key do not change
throughout the mkeys system test. Keep them in helper variables to
prevent calling "cat" multiple times and improve code readability.
Michał Kępień [Wed, 13 Jun 2018 05:47:12 +0000 (07:47 +0200)]
Replace duplicated code snippet with calls to helper functions
Reduce code duplication by replacing a code snippet repeated throughout
system tests using "trusted-keys" and/or "managed-keys" configuration
sections with calls to keyfile_to_{managed,trusted}_keys() helper
functions.
Michał Kępień [Wed, 13 Jun 2018 05:47:12 +0000 (07:47 +0200)]
Add helper functions for converting keyfile data into configuration sections
Add a set of helper functions for system test scripts which enable
converting key data from a set of keyfiles to either a "trusted-keys"
section or a "managed-keys" section suitable for including in a
resolver's configuration file.
projects / thirdparty / bind9.git / log
