summaryrefslogtreecommitdiff
path: root/dist/bind/lib/dns
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2004-11-06 23:53:21 +0000
committerchristos <christos@NetBSD.org>2004-11-06 23:53:21 +0000
commitdfd98c8a16d53dff0d1bdca29bcddc6571054129 (patch)
tree24f3891f470a8e79f037a71c4b43266f23767859 /dist/bind/lib/dns
parentaefec4290d9fd9e83eaf8b2b4ada33ff37ecaedb (diff)
Import bind-9.3.0
Diffstat (limited to 'dist/bind/lib/dns')
-rw-r--r--dist/bind/lib/dns/Makefile.in6
-rw-r--r--dist/bind/lib/dns/adb.c8
-rw-r--r--dist/bind/lib/dns/api2
-rw-r--r--dist/bind/lib/dns/byaddr.c5
-rw-r--r--dist/bind/lib/dns/dispatch.c129
-rw-r--r--dist/bind/lib/dns/dnssec.c6
-rw-r--r--dist/bind/lib/dns/include/dns/db.h14
-rw-r--r--dist/bind/lib/dns/include/dns/name.h13
-rw-r--r--dist/bind/lib/dns/include/dns/result.h7
-rw-r--r--dist/bind/lib/dns/include/dns/validator.h6
-rw-r--r--dist/bind/lib/dns/journal.c21
-rw-r--r--dist/bind/lib/dns/master.c7
-rw-r--r--dist/bind/lib/dns/masterdump.c17
-rw-r--r--dist/bind/lib/dns/message.c19
-rw-r--r--dist/bind/lib/dns/name.c21
-rw-r--r--dist/bind/lib/dns/rbtdb.c192
-rw-r--r--dist/bind/lib/dns/rdata/generic/rrsig_46.c8
-rw-r--r--dist/bind/lib/dns/resolver.c199
-rw-r--r--dist/bind/lib/dns/result.c7
-rw-r--r--dist/bind/lib/dns/sdb.c8
-rw-r--r--dist/bind/lib/dns/sec/dst/dst_api.c31
-rw-r--r--dist/bind/lib/dns/sec/dst/dst_result.c5
-rw-r--r--dist/bind/lib/dns/sec/dst/include/dst/dst.h6
-rw-r--r--dist/bind/lib/dns/sec/dst/include/dst/result.h7
-rw-r--r--dist/bind/lib/dns/time.c5
-rw-r--r--dist/bind/lib/dns/tkey.c14
-rw-r--r--dist/bind/lib/dns/validator.c280
-rw-r--r--dist/bind/lib/dns/zone.c62
28 files changed, 821 insertions, 284 deletions
diff --git a/dist/bind/lib/dns/Makefile.in b/dist/bind/lib/dns/Makefile.in
index 15996afc583..eb1fd61f172 100644
--- a/dist/bind/lib/dns/Makefile.in
+++ b/dist/bind/lib/dns/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# Id: Makefile.in,v 1.126.2.3.2.14 2004/04/15 00:34:52 marka Exp
+# Id: Makefile.in,v 1.126.2.3.2.15 2004/07/20 07:01:57 marka Exp
srcdir = @srcdir@
VPATH = @srcdir@
@@ -107,7 +107,7 @@ libdns.@SA@: ${OBJS}
libdns.la: ${OBJS}
${LIBTOOL_MODE_LINK} \
- ${CC} ${ALL_CFLAGS} -o libdns.la -rpath ${libdir} \
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
@@ -151,7 +151,7 @@ code.h: gen
./gen -s ${srcdir} > code.h
gen: gen.c
- ${CC} ${ALL_CFLAGS} -o $@ ${srcdir}/gen.c ${LIBS}
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ${srcdir}/gen.c ${LIBS}
rbtdb64.@O@: rbtdb.c
diff --git a/dist/bind/lib/dns/adb.c b/dist/bind/lib/dns/adb.c
index 0272a008f23..192e0c3f170 100644
--- a/dist/bind/lib/dns/adb.c
+++ b/dist/bind/lib/dns/adb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: adb.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */
+/* $NetBSD: adb.c,v 1.1.1.2 2004/11/06 23:55:35 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: adb.c,v 1.181.2.11.2.17 2004/03/10 02:55:57 marka Exp */
+/* Id: adb.c,v 1.181.2.11.2.19 2004/09/01 05:19:57 marka Exp */
/*
* Implementation notes
@@ -1009,6 +1009,8 @@ set_target(dns_adb_t *adb, dns_name_t *name, dns_name_t *fname,
dns_fixedname_init(&fixed2);
new_target = dns_fixedname_name(&fixed2);
dns_name_split(name, nlabels, prefix, NULL);
+ result = dns_name_concatenate(prefix, &dname.dname, new_target,
+ NULL);
dns_rdata_freestruct(&dname);
if (result != ISC_R_SUCCESS)
return (result);
@@ -1581,7 +1583,7 @@ find_name_and_lock(dns_adb_t *adb, dns_name_t *name,
dns_adbname_t *adbname;
int bucket;
- bucket = dns_fullname_hash(name, ISC_FALSE) % NBUCKETS;
+ bucket = dns_name_fullhash(name, ISC_FALSE) % NBUCKETS;
if (*bucketp == DNS_ADB_INVALIDBUCKET) {
LOCK(&adb->namelocks[bucket]);
diff --git a/dist/bind/lib/dns/api b/dist/bind/lib/dns/api
index a8be9070823..444e0c5cd0c 100644
--- a/dist/bind/lib/dns/api
+++ b/dist/bind/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 14
+LIBINTERFACE = 20
LIBREVISION = 0
LIBAGE = 0
diff --git a/dist/bind/lib/dns/byaddr.c b/dist/bind/lib/dns/byaddr.c
index 1cfdc079098..f2183f852a0 100644
--- a/dist/bind/lib/dns/byaddr.c
+++ b/dist/bind/lib/dns/byaddr.c
@@ -1,4 +1,4 @@
-/* $NetBSD: byaddr.c,v 1.1.1.1 2004/05/17 23:44:48 christos Exp $ */
+/* $NetBSD: byaddr.c,v 1.1.1.2 2004/11/06 23:55:34 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,12 +17,13 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: byaddr.c,v 1.29.2.1.2.7 2004/03/09 05:21:08 marka Exp */
+/* Id: byaddr.c,v 1.29.2.1.2.8 2004/08/28 06:25:18 marka Exp */
#include <config.h>
#include <isc/mem.h>
#include <isc/netaddr.h>
+#include <isc/print.h>
#include <isc/string.h> /* Required for HP/UX (and others?) */
#include <isc/task.h>
#include <isc/util.h>
diff --git a/dist/bind/lib/dns/dispatch.c b/dist/bind/lib/dns/dispatch.c
index e9d05054697..cd600f90bd3 100644
--- a/dist/bind/lib/dns/dispatch.c
+++ b/dist/bind/lib/dns/dispatch.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dispatch.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */
+/* $NetBSD: dispatch.c,v 1.1.1.2 2004/11/06 23:55:36 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dispatch.c,v 1.101.2.6.2.7 2004/04/15 02:10:39 marka Exp */
+/* Id: dispatch.c,v 1.101.2.6.2.10 2004/09/01 04:27:41 marka Exp */
#include <config.h>
@@ -157,14 +157,14 @@ static isc_boolean_t destroy_disp_ok(dns_dispatch_t *);
static void destroy_disp(isc_task_t *task, isc_event_t *event);
static void udp_recv(isc_task_t *, isc_event_t *);
static void tcp_recv(isc_task_t *, isc_event_t *);
-static inline void startrecv(dns_dispatch_t *);
+static void startrecv(dns_dispatch_t *);
static dns_messageid_t dns_randomid(dns_qid_t *);
static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t);
static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len);
static void *allocate_udp_buffer(dns_dispatch_t *disp);
static inline void free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev);
static inline dns_dispatchevent_t *allocate_event(dns_dispatch_t *disp);
-static void do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp);
+static void do_cancel(dns_dispatch_t *disp);
static dns_dispentry_t *linear_first(dns_qid_t *disp);
static dns_dispentry_t *linear_next(dns_qid_t *disp,
dns_dispentry_t *resp);
@@ -629,26 +629,25 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
/* query */
free_buffer(disp, ev->region.base, ev->region.length);
goto restart;
- } else {
- /* response */
- bucket = dns_hash(qid, &ev->address, id);
- LOCK(&qid->lock);
- resp = bucket_search(qid, &ev->address, id, bucket);
- UNLOCK(&qid->lock);
- dispatch_log(disp, LVL(90),
- "search for response in bucket %d: %s",
- bucket, (resp == NULL ? "not found" : "found"));
-
- if (resp == NULL) {
- free_buffer(disp, ev->region.base, ev->region.length);
- goto restart;
- }
- queue_response = resp->item_out;
- rev = allocate_event(resp->disp);
- if (rev == NULL) {
- free_buffer(disp, ev->region.base, ev->region.length);
- goto restart;
- }
+ }
+
+ /* response */
+ bucket = dns_hash(qid, &ev->address, id);
+ LOCK(&qid->lock);
+ resp = bucket_search(qid, &ev->address, id, bucket);
+ dispatch_log(disp, LVL(90),
+ "search for response in bucket %d: %s",
+ bucket, (resp == NULL ? "not found" : "found"));
+
+ if (resp == NULL) {
+ free_buffer(disp, ev->region.base, ev->region.length);
+ goto unlock;
+ }
+ queue_response = resp->item_out;
+ rev = allocate_event(resp->disp);
+ if (rev == NULL) {
+ free_buffer(disp, ev->region.base, ev->region.length);
+ goto unlock;
}
/*
@@ -676,6 +675,8 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
resp->item_out = ISC_TRUE;
isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
}
+ unlock:
+ UNLOCK(&qid->lock);
/*
* Restart recv() to get the next packet.
@@ -748,7 +749,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
case ISC_R_EOF:
dispatch_log(disp, LVL(90), "shutting down on EOF");
- do_cancel(disp, NULL);
+ do_cancel(disp);
break;
case ISC_R_CONNECTIONRESET:
@@ -762,7 +763,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
dispatch_log(disp, level, "shutting down due to TCP "
"receive error: %s: %s", buf,
isc_result_totext(tcpmsg->result));
- do_cancel(disp, NULL);
+ do_cancel(disp);
break;
}
@@ -818,27 +819,26 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
* Query.
*/
goto restart;
- } else {
- /*
- * Response.
- */
- bucket = dns_hash(qid, &tcpmsg->address, id);
- LOCK(&qid->lock);
- resp = bucket_search(qid, &tcpmsg->address, id, bucket);
- UNLOCK(&qid->lock);
- dispatch_log(disp, LVL(90),
- "search for response in bucket %d: %s",
- bucket, (resp == NULL ? "not found" : "found"));
-
- if (resp == NULL)
- goto restart;
- queue_response = resp->item_out;
- rev = allocate_event(disp);
- if (rev == NULL)
- goto restart;
}
/*
+ * Response.
+ */
+ bucket = dns_hash(qid, &tcpmsg->address, id);
+ LOCK(&qid->lock);
+ resp = bucket_search(qid, &tcpmsg->address, id, bucket);
+ dispatch_log(disp, LVL(90),
+ "search for response in bucket %d: %s",
+ bucket, (resp == NULL ? "not found" : "found"));
+
+ if (resp == NULL)
+ goto unlock;
+ queue_response = resp->item_out;
+ rev = allocate_event(disp);
+ if (rev == NULL)
+ goto unlock;
+
+ /*
* At this point, rev contains the event we want to fill in, and
* resp contains the information on the place to send it to.
* Send the event off.
@@ -860,6 +860,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
resp->item_out = ISC_TRUE;
isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
}
+ unlock:
+ UNLOCK(&qid->lock);
/*
* Restart recv() to get the next packet.
@@ -907,7 +909,7 @@ startrecv(dns_dispatch_t *disp) {
free_buffer(disp, region.base, region.length);
disp->shutdown_why = res;
disp->shutting_down = 1;
- do_cancel(disp, NULL);
+ do_cancel(disp);
return;
}
INSIST(disp->recv_pending == 0);
@@ -920,7 +922,7 @@ startrecv(dns_dispatch_t *disp) {
if (res != ISC_R_SUCCESS) {
disp->shutdown_why = res;
disp->shutting_down = 1;
- do_cancel(disp, NULL);
+ do_cancel(disp);
return;
}
INSIST(disp->recv_pending == 0);
@@ -1296,7 +1298,7 @@ local_addr_match(dns_dispatch_t *disp, isc_sockaddr_t *addr) {
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
- return (isc_sockaddr_equal(&disp->local, &sockaddr));
+ return (isc_sockaddr_equal(&sockaddr, addr));
}
/*
@@ -2020,7 +2022,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
res->magic = 0;
isc_mempool_put(disp->mgr->rpool, res);
if (disp->shutting_down == 1)
- do_cancel(disp, NULL);
+ do_cancel(disp);
else
startrecv(disp);
@@ -2031,8 +2033,9 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
}
static void
-do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+do_cancel(dns_dispatch_t *disp) {
dns_dispatchevent_t *ev;
+ dns_dispentry_t *resp;
dns_qid_t *qid;
if (disp->shutdown_out == 1)
@@ -2043,28 +2046,16 @@ do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) {
/*
* Search for the first response handler without packets outstanding.
*/
- if (resp == NULL) {
- LOCK(&qid->lock);
- resp = linear_first(qid);
- if (resp == NULL) {
- /* no first item? */
- UNLOCK(&qid->lock);
- return;
- }
- do {
- if (resp->item_out == ISC_FALSE)
- break;
-
- resp = linear_next(qid, resp);
- } while (resp != NULL);
- UNLOCK(&qid->lock);
- }
-
+ LOCK(&qid->lock);
+ for (resp = linear_first(qid);
+ resp != NULL && resp->item_out != ISC_FALSE;
+ /* Empty. */)
+ resp = linear_next(qid, resp);
/*
* No one to send the cancel event to, so nothing to do.
*/
if (resp == NULL)
- return;
+ goto unlock;
/*
* Send the shutdown failsafe event to this resp.
@@ -2081,6 +2072,8 @@ do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) {
ev, resp->task);
resp->item_out = ISC_TRUE;
isc_task_send(resp->task, ISC_EVENT_PTR(&ev));
+ unlock:
+ UNLOCK(&qid->lock);
}
isc_socket_t *
@@ -2116,7 +2109,7 @@ dns_dispatch_cancel(dns_dispatch_t *disp) {
disp->shutdown_why = ISC_R_CANCELED;
disp->shutting_down = 1;
- do_cancel(disp, NULL);
+ do_cancel(disp);
UNLOCK(&disp->lock);
diff --git a/dist/bind/lib/dns/dnssec.c b/dist/bind/lib/dns/dnssec.c
index 51f85529fe8..4787f308974 100644
--- a/dist/bind/lib/dns/dnssec.c
+++ b/dist/bind/lib/dns/dnssec.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dnssec.c,v 1.1.1.1 2004/05/17 23:44:50 christos Exp $ */
+/* $NetBSD: dnssec.c,v 1.1.1.2 2004/11/06 23:55:36 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -18,7 +18,7 @@
*/
/*
- * Id: dnssec.c,v 1.69.2.5.2.6 2004/03/08 21:06:26 marka Exp
+ * Id: dnssec.c,v 1.69.2.5.2.7 2004/06/11 00:30:54 marka Exp
*/
@@ -136,6 +136,8 @@ dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
INSIST(mctx != NULL);
INSIST(key != NULL);
INSIST(*key == NULL);
+ REQUIRE(rdata->type == dns_rdatatype_key ||
+ rdata->type == dns_rdatatype_dnskey);
dns_rdata_toregion(rdata, &r);
isc_buffer_init(&b, r.base, r.length);
diff --git a/dist/bind/lib/dns/include/dns/db.h b/dist/bind/lib/dns/include/dns/db.h
index 58e78ffb09c..c2ca6510acb 100644
--- a/dist/bind/lib/dns/include/dns/db.h
+++ b/dist/bind/lib/dns/include/dns/db.h
@@ -1,4 +1,4 @@
-/* $NetBSD: db.h,v 1.1.1.1 2004/05/17 23:44:57 christos Exp $ */
+/* $NetBSD: db.h,v 1.1.1.2 2004/11/06 23:55:44 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: db.h,v 1.67.12.7 2004/03/08 09:04:35 marka Exp */
+/* Id: db.h,v 1.67.12.8 2004/05/14 05:06:41 marka Exp */
#ifndef DNS_DB_H
#define DNS_DB_H 1
@@ -190,6 +190,7 @@ struct dns_db {
#define DNS_DBFIND_PENDINGOK 0x08
#define DNS_DBFIND_NOEXACT 0x10
#define DNS_DBFIND_FORCENSEC 0x20
+#define DNS_DBFIND_COVERINGNSEC 0x40
/*
* Options that can be specified for dns_db_addrdataset().
@@ -649,6 +650,12 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
* is only necessary when querying a database that was not secure
* when created.
*
+ * If the DNS_DBFIND_COVERINGNSEC option is set, then look for a
+ * NSEC record that potentially covers 'name' if a answer cannot
+ * be found. Note the returned NSEC needs to be checked to ensure
+ * that it is correct. This only affects answers returned from the
+ * cache.
+ *
* To respond to a query for SIG records, the caller should create a
* rdataset iterator and extract the signatures from each rdataset.
*
@@ -772,6 +779,9 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
* DNS_R_EMPTYNAME The name exists but there is
* no data at the name.
*
+ * DNS_R_COVERINGNSEC The returned data is a NSEC
+ * that potentially covers 'name'.
+ *
* Error results:
*
* ISC_R_NOMEMORY
diff --git a/dist/bind/lib/dns/include/dns/name.h b/dist/bind/lib/dns/include/dns/name.h
index a3aa4e93b69..7370f151227 100644
--- a/dist/bind/lib/dns/include/dns/name.h
+++ b/dist/bind/lib/dns/include/dns/name.h
@@ -1,4 +1,4 @@
-/* $NetBSD: name.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */
+/* $NetBSD: name.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: name.h,v 1.95.2.3.2.8 2004/03/16 12:57:17 marka Exp */
+/* Id: name.h,v 1.95.2.3.2.11 2004/09/01 05:19:59 marka Exp */
#ifndef DNS_NAME_H
#define DNS_NAME_H 1
@@ -314,7 +314,7 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive);
*/
unsigned int
-dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive);
+dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive);
/*
* Provide a hash value for 'name'. Unlike dns_name_hash(), this function
* always takes into account of the entire name to calculate the hash value.
@@ -575,6 +575,9 @@ dns_name_getlabelsequence(const dns_name_t *source, unsigned int first,
* Notes:
* Numbering starts at 0.
*
+ * Given "rc.vix.com.", the label 0 is "rc", and label 3 is the
+ * root label.
+ *
* 'target' refers to the same memory as 'source', so 'source'
* must not be changed while 'target' is still in use.
*
@@ -1216,7 +1219,7 @@ do { \
do { \
(r)->base = (n)->ndata; \
(r)->length = (n)->length; \
-} while (0);
+} while (0)
#define DNS_NAME_SPLIT(n, l, p, s) \
do { \
@@ -1228,7 +1231,7 @@ do { \
dns_name_getlabelsequence(_n, 0, _n->labels - _l, _p); \
if (_s != NULL) \
dns_name_getlabelsequence(_n, _n->labels - _l, _l, _s); \
-} while (0);
+} while (0)
#ifdef DNS_NAME_USEINLINE
diff --git a/dist/bind/lib/dns/include/dns/result.h b/dist/bind/lib/dns/include/dns/result.h
index d2fc5c76b58..bf98b76e610 100644
--- a/dist/bind/lib/dns/include/dns/result.h
+++ b/dist/bind/lib/dns/include/dns/result.h
@@ -1,4 +1,4 @@
-/* $NetBSD: result.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */
+/* $NetBSD: result.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: result.h,v 1.81.2.7.2.12 2004/04/15 23:56:32 marka Exp */
+/* Id: result.h,v 1.81.2.7.2.13 2004/05/14 05:06:41 marka Exp */
#ifndef DNS_RESULT_H
#define DNS_RESULT_H 1
@@ -144,8 +144,9 @@
#define DNS_R_DYNAMIC (ISC_RESULTCLASS_DNS + 98)
#define DNS_R_UNKNOWNCOMMAND (ISC_RESULTCLASS_DNS + 99)
#define DNS_R_MUSTBESECURE (ISC_RESULTCLASS_DNS + 100)
+#define DNS_R_COVERINGNSEC (ISC_RESULTCLASS_DNS + 101)
-#define DNS_R_NRESULTS 101 /* Number of results */
+#define DNS_R_NRESULTS 102 /* Number of results */
/*
* DNS wire format rcodes.
diff --git a/dist/bind/lib/dns/include/dns/validator.h b/dist/bind/lib/dns/include/dns/validator.h
index 578222d3cbe..98ca73586c8 100644
--- a/dist/bind/lib/dns/include/dns/validator.h
+++ b/dist/bind/lib/dns/include/dns/validator.h
@@ -1,4 +1,4 @@
-/* $NetBSD: validator.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */
+/* $NetBSD: validator.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: validator.h,v 1.18.12.6 2004/04/15 23:56:33 marka Exp */
+/* Id: validator.h,v 1.18.12.7 2004/05/14 05:06:41 marka Exp */
#ifndef DNS_VALIDATOR_H
#define DNS_VALIDATOR_H 1
@@ -123,6 +123,8 @@ struct dns_validator {
dns_fixedname_t wild;
ISC_LINK(dns_validator_t) link;
dns_rdataset_t * dlv;
+ dns_fixedname_t dlvsep;
+ isc_boolean_t havedlvsep;
isc_boolean_t mustbesecure;
};
diff --git a/dist/bind/lib/dns/journal.c b/dist/bind/lib/dns/journal.c
index 42a331c07c7..7433e39e7f1 100644
--- a/dist/bind/lib/dns/journal.c
+++ b/dist/bind/lib/dns/journal.c
@@ -1,4 +1,4 @@
-/* $NetBSD: journal.c,v 1.1.1.1 2004/05/17 23:44:50 christos Exp $ */
+/* $NetBSD: journal.c,v 1.1.1.2 2004/11/06 23:55:37 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: journal.c,v 1.77.2.1.10.6 2004/03/08 09:04:30 marka Exp */
+/* Id: journal.c,v 1.77.2.1.10.8 2004/05/14 05:27:47 marka Exp */
#include <config.h>
@@ -1824,10 +1824,16 @@ dns_db_diff(isc_mem_t *mctx,
dns_fixedname_init(&fixname[0]);
dns_fixedname_init(&fixname[1]);
- CHECK(dns_journal_open(mctx, journal_filename, ISC_TRUE, &journal));
+ result = dns_journal_open(mctx, journal_filename, ISC_TRUE, &journal);
+ if (result != ISC_R_SUCCESS)
+ return (result);
- CHECK(dns_db_createiterator(db[0], ISC_FALSE, &dbit[0]));
- CHECK(dns_db_createiterator(db[1], ISC_FALSE, &dbit[1]));
+ result = dns_db_createiterator(db[0], ISC_FALSE, &dbit[0]);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup_journal;
+ result = dns_db_createiterator(db[1], ISC_FALSE, &dbit[1]);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup_interator0;
itresult[0] = dns_dbiterator_first(dbit[0]);
itresult[1] = dns_dbiterator_first(dbit[1]);
@@ -1900,8 +1906,10 @@ dns_db_diff(isc_mem_t *mctx,
failure:
dns_diff_clear(&resultdiff);
- dns_dbiterator_destroy(&dbit[0]);
dns_dbiterator_destroy(&dbit[1]);
+ cleanup_interator0:
+ dns_dbiterator_destroy(&dbit[0]);
+ cleanup_journal:
dns_journal_destroy(&journal);
return (result);
}
@@ -2117,6 +2125,7 @@ index_to_disk(dns_journal_t *j) {
}
INSIST(p == j->rawindex + rawbytes);
+ CHECK(journal_seek(j, sizeof(journal_rawheader_t)));
CHECK(journal_write(j, j->rawindex, rawbytes));
}
failure:
diff --git a/dist/bind/lib/dns/master.c b/dist/bind/lib/dns/master.c
index 50b796512c5..43a6d2f64ec 100644
--- a/dist/bind/lib/dns/master.c
+++ b/dist/bind/lib/dns/master.c
@@ -1,4 +1,4 @@
-/* $NetBSD: master.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */
+/* $NetBSD: master.c,v 1.1.1.2 2004/11/06 23:55:37 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: master.c,v 1.122.2.8.2.13 2004/03/08 02:07:53 marka Exp */
+/* Id: master.c,v 1.122.2.8.2.14 2004/05/05 01:32:16 marka Exp */
#include <config.h>
@@ -1647,7 +1647,8 @@ load(dns_loadctx_t *lctx) {
}
- if (type == dns_rdatatype_rrsig)
+ if (type == dns_rdatatype_rrsig ||
+ type == dns_rdatatype_sig)
covers = dns_rdata_covers(&rdata[rdcount]);
else
covers = 0;
diff --git a/dist/bind/lib/dns/masterdump.c b/dist/bind/lib/dns/masterdump.c
index ab3cf3d2e28..f3457bbda06 100644
--- a/dist/bind/lib/dns/masterdump.c
+++ b/dist/bind/lib/dns/masterdump.c
@@ -1,4 +1,4 @@
-/* $NetBSD: masterdump.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */
+/* $NetBSD: masterdump.c,v 1.1.1.2 2004/11/06 23:55:35 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: masterdump.c,v 1.56.2.5.2.10 2004/03/08 09:04:30 marka Exp */
+/* Id: masterdump.c,v 1.56.2.5.2.12 2004/08/28 06:25:19 marka Exp */
#include <config.h>
@@ -27,6 +27,7 @@
#include <isc/file.h>
#include <isc/magic.h>
#include <isc/mem.h>
+#include <isc/print.h>
#include <isc/stdio.h>
#include <isc/string.h>
#include <isc/task.h>
@@ -981,6 +982,7 @@ closeandrename(FILE *f, isc_result_t result, const char *temp, const char *file)
static void
dump_quantum(isc_task_t *task, isc_event_t *event) {
isc_result_t result;
+ isc_result_t tresult;
dns_dumpctx_t *dctx;
REQUIRE(event != NULL);
@@ -996,11 +998,12 @@ dump_quantum(isc_task_t *task, isc_event_t *event) {
return;
}
- if (dctx->file != NULL)
- result = closeandrename(dctx->f, result,
- dctx->tmpfile, dctx->file);
- if (dctx->version != NULL)
- dns_db_closeversion(dctx->db, &dctx->version, ISC_FALSE);
+ if (dctx->file != NULL) {
+ tresult = closeandrename(dctx->f, result,
+ dctx->tmpfile, dctx->file);
+ if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
+ result = tresult;
+ }
(dctx->done)(dctx->done_arg, result);
isc_event_free(&event);
dns_dumpctx_detach(&dctx);
diff --git a/dist/bind/lib/dns/message.c b/dist/bind/lib/dns/message.c
index 693930d1863..30be78789fe 100644
--- a/dist/bind/lib/dns/message.c
+++ b/dist/bind/lib/dns/message.c
@@ -1,4 +1,4 @@
-/* $NetBSD: message.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */
+/* $NetBSD: message.c,v 1.1.1.2 2004/11/06 23:55:38 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: message.c,v 1.194.2.10.2.16 2004/03/10 00:48:49 marka Exp */
+/* Id: message.c,v 1.194.2.10.2.17 2004/05/05 01:32:16 marka Exp */
/***
*** Imports
@@ -1290,18 +1290,16 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
if (result != ISC_R_SUCCESS)
goto cleanup;
rdata->rdclass = rdclass;
+ issigzero = ISC_FALSE;
if (rdtype == dns_rdatatype_rrsig &&
rdata->flags == 0) {
covers = dns_rdata_covers(rdata);
if (covers == 0)
DO_FORMERR;
- } else
- covers = 0;
-
- issigzero = ISC_FALSE;
- if (rdtype == dns_rdatatype_sig /* SIG(0) */ &&
- rdata->flags == 0) {
- if (dns_rdata_covers(rdata) == 0) {
+ } else if (rdtype == dns_rdatatype_sig /* SIG(0) */ &&
+ rdata->flags == 0) {
+ covers = dns_rdata_covers(rdata);
+ if (covers == 0) {
if (sectionid != DNS_SECTION_ADDITIONAL ||
count != msg->counts[sectionid] - 1)
DO_FORMERR;
@@ -1310,7 +1308,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
skip_type_search = ISC_TRUE;
issigzero = ISC_TRUE;
}
- }
+ } else
+ covers = 0;
/*
* If we are doing a dynamic update or this is a meta-type,
diff --git a/dist/bind/lib/dns/name.c b/dist/bind/lib/dns/name.c
index 8f6261e96f1..dac5874e8f4 100644
--- a/dist/bind/lib/dns/name.c
+++ b/dist/bind/lib/dns/name.c
@@ -1,4 +1,4 @@
-/* $NetBSD: name.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */
+/* $NetBSD: name.c,v 1.1.1.2 2004/11/06 23:55:38 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: name.c,v 1.127.2.7.2.10 2004/04/19 21:55:38 marka Exp */
+/* Id: name.c,v 1.127.2.7.2.11 2004/09/01 05:19:59 marka Exp */
#include <config.h>
@@ -181,6 +181,9 @@ static dns_name_t wild =
/* XXXDCL make const? */
LIBDNS_EXTERNAL_DATA dns_name_t *dns_wildcardname = &wild;
+unsigned int
+dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive);
+
static void
set_offsets(const dns_name_t *name, unsigned char *offsets,
dns_name_t *set_name);
@@ -432,7 +435,7 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
}
unsigned int
-dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
+dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive) {
/*
* Provide a hash value for 'name'.
*/
@@ -446,6 +449,18 @@ dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
}
unsigned int
+dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
+ /*
+ * This function was deprecated due to the breakage of the name space
+ * convention. We only keep this internally to provide binary backward
+ * compatibility.
+ */
+ REQUIRE(VALID_NAME(name));
+
+ return (dns_name_fullhash(name, case_sensitive));
+}
+
+unsigned int
dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive) {
unsigned char *offsets;
dns_offsets_t odata;
diff --git a/dist/bind/lib/dns/rbtdb.c b/dist/bind/lib/dns/rbtdb.c
index 87e9f72f227..181af9195c7 100644
--- a/dist/bind/lib/dns/rbtdb.c
+++ b/dist/bind/lib/dns/rbtdb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rbtdb.c,v 1.1.1.1 2004/05/17 23:44:52 christos Exp $ */
+/* $NetBSD: rbtdb.c,v 1.1.1.2 2004/11/06 23:55:39 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rbtdb.c,v 1.168.2.11.2.12 2004/03/08 02:07:55 marka Exp */
+/* Id: rbtdb.c,v 1.168.2.11.2.16 2004/05/23 11:07:23 marka Exp */
/*
* Principal Author: Bob Halley
@@ -844,8 +844,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
/*
* If this is a NONEXISTENT rdataset, we can delete it.
*/
- if ((current->attributes & RDATASET_ATTR_NONEXISTENT)
- != 0) {
+ if (NONEXISTENT(current)) {
if (top_prev != NULL)
top_prev->next = current->next;
else
@@ -1064,9 +1063,13 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
* isn't being used by anyone, we can clean
* it up.
*/
- if (rbtdb->current_version->references == 0)
+ if (rbtdb->current_version->references == 0) {
cleanup_version =
rbtdb->current_version;
+ APPENDLIST(version->changed_list,
+ cleanup_version->changed_list,
+ link);
+ }
/*
* Become the current version.
*/
@@ -1079,6 +1082,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
* We're rolling back this transaction.
*/
cleanup_list = version->changed_list;
+ ISC_LIST_INIT(version->changed_list);
rollback = ISC_TRUE;
cleanup_version = version;
rbtdb->future_version = NULL;
@@ -1099,6 +1103,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
if (least_greater == NULL)
least_greater = rbtdb->current_version;
+ INSIST(version->serial < least_greater->serial);
/*
* Is this the least open version?
*/
@@ -1119,16 +1124,19 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
version->changed_list,
link);
}
- }
+ } else if (version->serial == rbtdb->least_serial)
+ INSIST(EMPTY(version->changed_list));
UNLINK(rbtdb->open_versions, version, link);
}
}
least_serial = rbtdb->least_serial;
UNLOCK(&rbtdb->lock);
- if (cleanup_version != NULL)
+ if (cleanup_version != NULL) {
+ INSIST(EMPTY(cleanup_version->changed_list));
isc_mem_put(rbtdb->common.mctx, cleanup_version,
sizeof(*cleanup_version));
+ }
if (!EMPTY(cleanup_list)) {
for (changed = HEAD(cleanup_list);
@@ -1933,8 +1941,7 @@ find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
* Is this a "this rdataset doesn't
* exist" record?
*/
- if ((header->attributes &
- RDATASET_ATTR_NONEXISTENT) != 0)
+ if (NONEXISTENT(header))
header = NULL;
break;
} else
@@ -2206,8 +2213,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
* Is this a "this rdataset doesn't
* exist" record?
*/
- if ((header->attributes &
- RDATASET_ATTR_NONEXISTENT) != 0)
+ if (NONEXISTENT(header))
header = NULL;
break;
} else
@@ -2660,8 +2666,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
node->dirty = 1;
header_prev = header;
}
- } else if ((header->attributes &
- RDATASET_ATTR_NONEXISTENT) == 0) {
+ } else if (EXISTS(header)) {
/*
* We've found an extant rdataset. See if
* we're interested in it.
@@ -2738,6 +2743,104 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
}
static isc_result_t
+find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
+ isc_stdtime_t now, dns_name_t *foundname,
+ dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+{
+ dns_rbtnode_t *node;
+ rdatasetheader_t *header, *header_next, *header_prev;
+ rdatasetheader_t *found, *foundsig;
+ isc_boolean_t empty_node;
+ isc_result_t result;
+ dns_fixedname_t fname, forigin;
+ dns_name_t *name, *origin;
+ rbtdb_rdatatype_t matchtype, sigmatchtype, nsectype;
+
+ matchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_nsec, 0);
+ nsectype = RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_nsec);
+ sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig,
+ dns_rdatatype_nsec);
+
+ do {
+ node = NULL;
+ dns_fixedname_init(&fname);
+ name = dns_fixedname_name(&fname);
+ dns_fixedname_init(&forigin);
+ origin = dns_fixedname_name(&forigin);
+ result = dns_rbtnodechain_current(&search->chain, name,
+ origin, &node);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+ LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+ found = NULL;
+ foundsig = NULL;
+ empty_node = ISC_TRUE;
+ header_prev = NULL;
+ for (header = node->data;
+ header != NULL;
+ header = header_next) {
+ header_next = header->next;
+ if (header->ttl <= now) {
+ /*
+ * This rdataset is stale. If no one else is
+ * using the node, we can clean it up right
+ * now, otherwise we mark it as stale, and the
+ * node as dirty, so it will get cleaned up
+ * later.
+ */
+ if (node->references == 0) {
+ INSIST(header->down == NULL);
+ if (header_prev != NULL)
+ header_prev->next =
+ header->next;
+ else
+ node->data = header->next;
+ free_rdataset(search->rbtdb->common.mctx,
+ header);
+ } else {
+ header->attributes |=
+ RDATASET_ATTR_STALE;
+ node->dirty = 1;
+ header_prev = header;
+ }
+ continue;
+ }
+ if (NONEXISTENT(header) || NXDOMAIN(header)) {
+ header_prev = header;
+ continue;
+ }
+ empty_node = ISC_FALSE;
+ if (header->type == matchtype)
+ found = header;
+ else if (header->type == sigmatchtype)
+ foundsig = header;
+ header_prev = header;
+ }
+ if (found != NULL) {
+ result = dns_name_concatenate(name, origin,
+ foundname, NULL);
+ if (result != ISC_R_SUCCESS)
+ goto unlock_node;
+ bind_rdataset(search->rbtdb, node, found,
+ now, rdataset);
+ if (foundsig != NULL)
+ bind_rdataset(search->rbtdb, node, foundsig,
+ now, sigrdataset);
+ new_reference(search->rbtdb, node);
+ *nodep = node;
+ result = DNS_R_COVERINGNSEC;
+ } else if (!empty_node) {
+ result = ISC_R_NOTFOUND;
+ }else
+ result = dns_rbtnodechain_prev(&search->chain, NULL,
+ NULL);
+ unlock_node:
+ UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+ } while (empty_node && result == ISC_R_SUCCESS);
+ return (result);
+}
+
+static isc_result_t
cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
dns_dbnode_t **nodep, dns_name_t *foundname,
@@ -2752,7 +2855,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
rdatasetheader_t *header, *header_prev, *header_next;
rdatasetheader_t *found, *nsheader;
rdatasetheader_t *foundsig, *nssig, *cnamesig;
- rbtdb_rdatatype_t sigtype, nsecype;
+ rbtdb_rdatatype_t sigtype, nsectype;
UNUSED(version);
@@ -2787,6 +2890,13 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
cache_zonecut_callback, &search);
if (result == DNS_R_PARTIALMATCH) {
+ if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0) {
+ result = find_coveringnsec(&search, nodep, now,
+ foundname, rdataset,
+ sigrdataset);
+ if (result == DNS_R_COVERINGNSEC)
+ goto tree_exit;
+ }
if (search.zonecut != NULL) {
result = setup_delegation(&search, nodep, foundname,
rdataset, sigrdataset);
@@ -2820,7 +2930,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
found = NULL;
foundsig = NULL;
sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
- nsecype = RBTDB_RDATATYPE_VALUE(0, type);
+ nsectype = RBTDB_RDATATYPE_VALUE(0, type);
nsheader = NULL;
nssig = NULL;
cnamesig = NULL;
@@ -2848,8 +2958,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
node->dirty = 1;
header_prev = header;
}
- } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT)
- == 0) {
+ } else if (EXISTS(header)) {
/*
* We now know that there is at least one active
* non-stale rdataset at this node.
@@ -2891,7 +3000,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
*/
foundsig = header;
} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
- header->type == nsecype) {
+ header->type == nsectype) {
/*
* We've found a negative cache entry.
*/
@@ -3116,8 +3225,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
node->dirty = 1;
header_prev = header;
}
- } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT)
- == 0) {
+ } else if (EXISTS(header)) {
/*
* If we found a type we were looking for, remember
* it.
@@ -3180,6 +3288,7 @@ attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
dns_rbtnode_t *node = (dns_rbtnode_t *)source;
REQUIRE(VALID_RBTDB(rbtdb));
+ REQUIRE(targetp != NULL && *targetp == NULL);
LOCK(&rbtdb->node_locks[node->locknum].lock);
INSIST(node->references > 0);
@@ -3450,8 +3559,7 @@ zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
* Is this a "this rdataset doesn't
* exist" record?
*/
- if ((header->attributes &
- RDATASET_ATTR_NONEXISTENT) != 0)
+ if (NONEXISTENT(header))
header = NULL;
break;
} else
@@ -3501,7 +3609,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
rdatasetheader_t *header, *header_next, *found, *foundsig;
- rbtdb_rdatatype_t matchtype, sigmatchtype, nsecype;
+ rbtdb_rdatatype_t matchtype, sigmatchtype, nsectype;
isc_result_t result;
REQUIRE(VALID_RBTDB(rbtdb));
@@ -3519,7 +3627,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
found = NULL;
foundsig = NULL;
matchtype = RBTDB_RDATATYPE_VALUE(type, covers);
- nsecype = RBTDB_RDATATYPE_VALUE(0, type);
+ nsectype = RBTDB_RDATATYPE_VALUE(0, type);
if (covers == 0)
sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
else
@@ -3536,12 +3644,11 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
*/
header->attributes |= RDATASET_ATTR_STALE;
rbtnode->dirty = 1;
- } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT) ==
- 0) {
+ } else if (EXISTS(header)) {
if (header->type == matchtype)
found = header;
else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
- header->type == nsecype)
+ header->type == nsectype)
found = header;
else if (header->type == sigmatchtype)
foundsig = header;
@@ -3671,10 +3778,13 @@ cname_and_other_data(dns_rbtnode_t *node, rbtdb_serial_t serial) {
* or RRSIG CNAME.
*/
rdtype = RBTDB_RDATATYPE_BASE(header->type);
- if (rdtype == dns_rdatatype_rrsig)
+ if (rdtype == dns_rdatatype_rrsig ||
+ rdtype == dns_rdatatype_sig)
rdtype = RBTDB_RDATATYPE_EXT(header->type);
if (rdtype != dns_rdatatype_nsec &&
rdtype != dns_rdatatype_dnskey &&
+ rdtype != dns_rdatatype_nxt &&
+ rdtype != dns_rdatatype_key &&
rdtype != dns_rdatatype_cname) {
/*
* We've found a type that isn't
@@ -3718,7 +3828,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
isc_boolean_t header_nx;
isc_boolean_t newheader_nx;
isc_boolean_t merge;
- dns_rdatatype_t nsecype, rdtype, covers;
+ dns_rdatatype_t nsectype, rdtype, covers;
dns_trust_t trust;
/*
@@ -3756,7 +3866,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
newheader_nx = NONEXISTENT(newheader) ? ISC_TRUE : ISC_FALSE;
topheader_prev = NULL;
- nsecype = 0;
+ nsectype = 0;
if (rbtversion == NULL && !newheader_nx) {
rdtype = RBTDB_RDATATYPE_BASE(newheader->type);
if (rdtype == 0) {
@@ -3783,7 +3893,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
rbtnode->dirty = 1;
goto find_header;
}
- nsecype = RBTDB_RDATATYPE_VALUE(covers, 0);
+ nsectype = RBTDB_RDATATYPE_VALUE(covers, 0);
} else {
/*
* We're adding something that isn't a
@@ -3823,7 +3933,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
topheader = NULL;
goto find_header;
}
- nsecype = RBTDB_RDATATYPE_VALUE(0, rdtype);
+ nsectype = RBTDB_RDATATYPE_VALUE(0, rdtype);
}
}
@@ -3831,7 +3941,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
topheader != NULL;
topheader = topheader->next) {
if (topheader->type == newheader->type ||
- topheader->type == nsecype)
+ topheader->type == nsectype)
break;
topheader_prev = topheader;
}
@@ -4092,8 +4202,10 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
RUNTIME_CHECK(result == ISC_R_SUCCESS);
noqname = isc_mem_get(mctx, sizeof(*noqname));
- if (noqname == NULL)
- return (ISC_R_NOMEMORY);
+ if (noqname == NULL) {
+ result = ISC_R_NOMEMORY;
+ goto cleanup;
+ }
dns_name_init(&noqname->name, NULL);
noqname->nsec = NULL;
noqname->nsecsig = NULL;
@@ -4114,6 +4226,8 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
return (ISC_R_SUCCESS);
cleanup:
+ dns_rdataset_disassociate(&nsec);
+ dns_rdataset_disassociate(&nsecsig);
free_noqname(mctx, &noqname);
return(result);
}
@@ -4956,7 +5070,7 @@ static void
rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
dns_db_t *db = source->private1;
dns_dbnode_t *node = source->private2;
- dns_dbnode_t *cloned_node;
+ dns_dbnode_t *cloned_node = NULL;
attachnode(db, node, &cloned_node);
*target = *source;
@@ -4987,9 +5101,8 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
dns_dbnode_t *cloned_node;
struct noqname *noqname = rdataset->private6;
+ cloned_node = NULL;
attachnode(db, node, &cloned_node);
- attachnode(db, node, &cloned_node);
-
nsec->methods = &rdataset_methods;
nsec->rdclass = db->rdclass;
nsec->type = dns_rdatatype_nsec;
@@ -5003,6 +5116,8 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
nsec->private5 = NULL;
nsec->private6 = NULL;
+ cloned_node = NULL;
+ attachnode(db, node, &cloned_node);
nsecsig->methods = &rdataset_methods;
nsecsig->rdclass = db->rdclass;
nsecsig->type = dns_rdatatype_rrsig;
@@ -5021,7 +5136,6 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
return (ISC_R_SUCCESS);
}
-
/*
* Rdataset Iterator Methods
*/
diff --git a/dist/bind/lib/dns/rdata/generic/rrsig_46.c b/dist/bind/lib/dns/rdata/generic/rrsig_46.c
index 3089a64f38b..887bec85d5a 100644
--- a/dist/bind/lib/dns/rdata/generic/rrsig_46.c
+++ b/dist/bind/lib/dns/rdata/generic/rrsig_46.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rrsig_46.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */
+/* $NetBSD: rrsig_46.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rrsig_46.c,v 1.4.2.2 2004/03/16 12:38:14 marka Exp */
+/* Id: rrsig_46.c,v 1.4.2.3 2004/06/24 00:58:06 marka Exp */
/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
@@ -156,8 +156,8 @@ totext_rrsig(ARGS_TOTEXT) {
if (dns_rdatatype_isknown(covered) && covered != 0) {
RETERR(dns_rdatatype_totext(covered, target));
} else {
- char buf[sizeof("65535")];
- sprintf(buf, "%u", covered);
+ char buf[sizeof("TYPE65535")];
+ sprintf(buf, "TYPE%u", covered);
RETERR(str_totext(buf, target));
}
RETERR(str_totext(" ", target));
diff --git a/dist/bind/lib/dns/resolver.c b/dist/bind/lib/dns/resolver.c
index 4b953db42f1..ee58adf8d24 100644
--- a/dist/bind/lib/dns/resolver.c
+++ b/dist/bind/lib/dns/resolver.c
@@ -1,4 +1,4 @@
-/* $NetBSD: resolver.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */
+/* $NetBSD: resolver.c,v 1.1.1.2 2004/11/06 23:55:41 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,10 +17,11 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: resolver.c,v 1.218.2.18.4.36 2004/04/19 23:41:33 marka Exp */
+/* Id: resolver.c,v 1.218.2.18.4.43 2004/08/28 06:25:19 marka Exp */
#include <config.h>
+#include <isc/print.h>
#include <isc/string.h>
#include <isc/task.h>
#include <isc/timer.h>
@@ -67,25 +68,28 @@
DNS_LOGCATEGORY_RESOLVER, \
DNS_LOGMODULE_RESOLVER, \
ISC_LOG_DEBUG(3), \
- "fctx %p: %s", fctx, (m))
+ "fctx %p(%s'): %s", fctx, fctx->info, (m))
#define FCTXTRACE2(m1, m2) \
isc_log_write(dns_lctx, \
DNS_LOGCATEGORY_RESOLVER, \
DNS_LOGMODULE_RESOLVER, \
ISC_LOG_DEBUG(3), \
- "fctx %p: %s %s", fctx, (m1), (m2))
+ "fctx %p(%s): %s %s", \
+ fctx, fctx->info, (m1), (m2))
#define FTRACE(m) isc_log_write(dns_lctx, \
DNS_LOGCATEGORY_RESOLVER, \
DNS_LOGMODULE_RESOLVER, \
ISC_LOG_DEBUG(3), \
- "fetch %p (fctx %p): %s", \
- fetch, fetch->private, (m))
+ "fetch %p (fctx %p(%s)): %s", \
+ fetch, fetch->private, \
+ fetch->private->info, (m))
#define QTRACE(m) isc_log_write(dns_lctx, \
DNS_LOGCATEGORY_RESOLVER, \
DNS_LOGMODULE_RESOLVER, \
ISC_LOG_DEBUG(3), \
- "resquery %p (fctx %p): %s", \
- query, query->fctx, (m))
+ "resquery %p (fctx %p(%s)): %s", \
+ query, query->fctx, \
+ query->fctx->info, (m))
#else
#define RTRACE(m)
#define RRTRACE(r, m)
@@ -154,6 +158,7 @@ struct fetchctx {
dns_rdatatype_t type;
unsigned int options;
unsigned int bucketnum;
+ char * info;
/* Locked by appropriate bucket lock. */
fetchstate state;
isc_boolean_t want_shutdown;
@@ -1123,6 +1128,8 @@ resquery_send(resquery_t *query) {
&secure_domain);
if (result != ISC_R_SUCCESS)
secure_domain = ISC_FALSE;
+ if (res->view->dlv != NULL)
+ secure_domain = ISC_TRUE;
if (secure_domain)
fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
} else
@@ -1817,8 +1824,23 @@ fctx_getaddresses(fetchctx_t *fctx) {
sa = ISC_LIST_HEAD(fctx->forwarders);
if (sa == NULL) {
dns_forwarders_t *forwarders = NULL;
- result = dns_fwdtable_find(fctx->res->view->fwdtable,
- &fctx->name, &forwarders);
+ dns_name_t *name = &fctx->name;
+ dns_name_t suffix;
+ unsigned int labels;
+
+ /*
+ * DS records are found in the parent server.
+ * Strip label to get the correct forwarder (if any).
+ */
+ if (fctx->type == dns_rdatatype_ds &&
+ dns_name_countlabels(name) > 1) {
+ dns_name_init(&suffix, NULL);
+ labels = dns_name_countlabels(name);
+ dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
+ name = &suffix;
+ }
+ result = dns_fwdtable_find(fctx->res->view->fwdtable, name,
+ &forwarders);
if (result == ISC_R_SUCCESS) {
sa = ISC_LIST_HEAD(forwarders->addrs);
fctx->fwdpolicy = forwarders->fwdpolicy;
@@ -2055,7 +2077,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr)
static inline dns_adbaddrinfo_t *
fctx_nextaddress(fetchctx_t *fctx) {
- dns_adbfind_t *find;
+ dns_adbfind_t *find, *start;
dns_adbaddrinfo_t *addrinfo;
dns_adbaddrinfo_t *faddrinfo;
@@ -2098,23 +2120,26 @@ fctx_nextaddress(fetchctx_t *fctx) {
* Find the first unmarked addrinfo.
*/
addrinfo = NULL;
- while (find != fctx->find) {
- for (addrinfo = ISC_LIST_HEAD(find->list);
- addrinfo != NULL;
- addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
- if (!UNMARKED(addrinfo))
- continue;
- possibly_mark(fctx, addrinfo);
- if (UNMARKED(addrinfo)) {
- addrinfo->flags |= FCTX_ADDRINFO_MARK;
- break;
+ if (find != NULL) {
+ start = find;
+ do {
+ for (addrinfo = ISC_LIST_HEAD(find->list);
+ addrinfo != NULL;
+ addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+ if (!UNMARKED(addrinfo))
+ continue;
+ possibly_mark(fctx, addrinfo);
+ if (UNMARKED(addrinfo)) {
+ addrinfo->flags |= FCTX_ADDRINFO_MARK;
+ break;
+ }
}
- }
- if (addrinfo != NULL)
- break;
- find = ISC_LIST_NEXT(find, publink);
- if (find != fctx->find && find == NULL)
- find = ISC_LIST_HEAD(fctx->finds);
+ if (addrinfo != NULL)
+ break;
+ find = ISC_LIST_NEXT(find, publink);
+ if (find == NULL)
+ find = ISC_LIST_HEAD(fctx->finds);
+ } while (find != start);
}
fctx->find = find;
@@ -2140,23 +2165,26 @@ fctx_nextaddress(fetchctx_t *fctx) {
* Find the first unmarked addrinfo.
*/
addrinfo = NULL;
- while (find != fctx->altfind) {
- for (addrinfo = ISC_LIST_HEAD(find->list);
- addrinfo != NULL;
- addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
- if (!UNMARKED(addrinfo))
- continue;
- possibly_mark(fctx, addrinfo);
- if (UNMARKED(addrinfo)) {
- addrinfo->flags |= FCTX_ADDRINFO_MARK;
- break;
+ if (find != NULL) {
+ start = find;
+ do {
+ for (addrinfo = ISC_LIST_HEAD(find->list);
+ addrinfo != NULL;
+ addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+ if (!UNMARKED(addrinfo))
+ continue;
+ possibly_mark(fctx, addrinfo);
+ if (UNMARKED(addrinfo)) {
+ addrinfo->flags |= FCTX_ADDRINFO_MARK;
+ break;
+ }
}
- }
- if (addrinfo != NULL)
- break;
- find = ISC_LIST_NEXT(find, publink);
- if (find != fctx->altfind && find == NULL)
- find = ISC_LIST_HEAD(fctx->altfinds);
+ if (addrinfo != NULL)
+ break;
+ find = ISC_LIST_NEXT(find, publink);
+ if (find == NULL)
+ find = ISC_LIST_HEAD(fctx->altfinds);
+ } while (find != start);
}
faddrinfo = addrinfo;
@@ -2289,6 +2317,7 @@ fctx_destroy(fetchctx_t *fctx) {
dns_name_free(&fctx->name, res->mctx);
dns_db_detach(&fctx->cache);
dns_adb_detach(&fctx->adb);
+ isc_mem_free(res->mctx, fctx->info);
isc_mem_put(res->mctx, fctx, sizeof(*fctx));
LOCK(&res->nlock);
@@ -2577,6 +2606,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
isc_interval_t interval;
dns_fixedname_t qdomain;
unsigned int findoptions = 0;
+ char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE];
+ char typebuf[DNS_RDATATYPE_FORMATSIZE];
+ dns_name_t suffix;
/*
* Caller must be holding the lock for bucket number 'bucketnum'.
@@ -2586,11 +2618,18 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
fctx = isc_mem_get(res->mctx, sizeof(*fctx));
if (fctx == NULL)
return (ISC_R_NOMEMORY);
+ dns_name_format(name, buf, sizeof(buf));
+ dns_rdatatype_format(type, typebuf, sizeof(typebuf));
+ strcat(buf, "/"); /* checked */
+ strcat(buf, typebuf); /* checked */
+ fctx->info = isc_mem_strdup(res->mctx, buf);
+ if (fctx->info == NULL)
+ goto cleanup_fetch;
FCTXTRACE("create");
dns_name_init(&fctx->name, NULL);
result = dns_name_dup(name, res->mctx, &fctx->name);
if (result != ISC_R_SUCCESS)
- goto cleanup_fetch;
+ goto cleanup_info;
dns_name_init(&fctx->domain, NULL);
dns_rdataset_init(&fctx->nameservers);
@@ -2629,8 +2668,21 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
if (domain == NULL) {
dns_forwarders_t *forwarders = NULL;
- result = dns_fwdtable_find(fctx->res->view->fwdtable,
- &fctx->name, &forwarders);
+ unsigned int labels;
+
+ /*
+ * DS records are found in the parent server.
+ * Strip label to get the correct forwarder (if any).
+ */
+ if (fctx->type == dns_rdatatype_ds &&
+ dns_name_countlabels(name) > 1) {
+ dns_name_init(&suffix, NULL);
+ labels = dns_name_countlabels(name);
+ dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
+ name = &suffix;
+ }
+ result = dns_fwdtable_find(fctx->res->view->fwdtable, name,
+ &forwarders);
if (result == ISC_R_SUCCESS)
fctx->fwdpolicy = forwarders->fwdpolicy;
@@ -2763,6 +2815,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
cleanup_name:
dns_name_free(&fctx->name, res->mctx);
+ cleanup_info:
+ isc_mem_free(res->mctx, fctx->info);
+
cleanup_fetch:
isc_mem_put(res->mctx, fctx, sizeof(*fctx));
@@ -3093,7 +3148,6 @@ validated(isc_task_t *task, isc_event_t *event) {
ardataset, &eresult);
if (result != ISC_R_SUCCESS)
goto noanswer_response;
-
goto answer_response;
}
@@ -3154,8 +3208,9 @@ validated(isc_task_t *task, isc_event_t *event) {
goto cleanup_event;
}
+ answer_response:
/*
- * Cache any NS records that happened to be validate.
+ * Cache any NS/NSEC records that happened to be validated.
*/
result = dns_message_firstname(fctx->rmessage, DNS_SECTION_AUTHORITY);
while (result == ISC_R_SUCCESS) {
@@ -3165,14 +3220,15 @@ validated(isc_task_t *task, isc_event_t *event) {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link)) {
- if (rdataset->type != dns_rdatatype_ns ||
+ if ((rdataset->type != dns_rdatatype_ns &&
+ rdataset->type != dns_rdatatype_nsec) ||
rdataset->trust != dns_trust_secure)
continue;
for (sigrdataset = ISC_LIST_HEAD(name->list);
sigrdataset != NULL;
sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
if (sigrdataset->type != dns_rdatatype_rrsig ||
- sigrdataset->covers != dns_rdatatype_ns)
+ sigrdataset->covers != rdataset->type)
continue;
break;
}
@@ -3199,7 +3255,6 @@ validated(isc_task_t *task, isc_event_t *event) {
result = ISC_R_SUCCESS;
- answer_response:
/*
* Respond with an answer, positive or negative,
* as opposed to an error. 'node' must be non-NULL.
@@ -3264,6 +3319,9 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
if (result != ISC_R_SUCCESS)
return (result);
+ if (res->view->dlv != NULL)
+ secure_domain = ISC_TRUE;
+
if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
need_validation = ISC_FALSE;
else
@@ -3688,6 +3746,9 @@ ncache_message(fetchctx_t *fctx, dns_rdatatype_t covers, isc_stdtime_t now) {
if (result != ISC_R_SUCCESS)
return (result);
+ if (res->view->dlv != NULL)
+ secure_domain = ISC_TRUE;
+
if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
need_validation = ISC_FALSE;
else
@@ -4693,6 +4754,9 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
isc_boolean_t bucket_empty = ISC_FALSE;
isc_boolean_t locked = ISC_FALSE;
unsigned int bucketnum;
+ dns_rdataset_t nameservers;
+ dns_fixedname_t fixed;
+ dns_name_t *domain;
REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
fevent = (dns_fetchevent_t *)event;
@@ -4708,15 +4772,17 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
if (fevent->db != NULL)
dns_db_detach(&fevent->db);
- dns_resolver_destroyfetch(&fctx->nsfetch);
+ dns_rdataset_init(&nameservers);
bucketnum = fctx->bucketnum;
- if (fevent->result == ISC_R_CANCELED)
+ if (fevent->result == ISC_R_CANCELED) {
+ dns_resolver_destroyfetch(&fctx->nsfetch);
fctx_done(fctx, ISC_R_CANCELED);
- else if (fevent->result == ISC_R_SUCCESS) {
+ } else if (fevent->result == ISC_R_SUCCESS) {
FCTXTRACE("resuming DS lookup");
+ dns_resolver_destroyfetch(&fctx->nsfetch);
if (dns_rdataset_isassociated(&fctx->nameservers))
dns_rdataset_disassociate(&fctx->nameservers);
dns_rdataset_clone(fevent->rdataset, &fctx->nameservers);
@@ -4735,22 +4801,29 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
} else {
unsigned int n;
+ /*
+ * Retrieve state from fctx->nsfetch before we destroy it.
+ */
+ dns_fixedname_init(&fixed);
+ domain = dns_fixedname_name(&fixed);
+ dns_name_copy(&fctx->nsfetch->private->domain, domain, NULL);
+ dns_rdataset_clone(&fctx->nsfetch->private->nameservers,
+ &nameservers);
+ dns_resolver_destroyfetch(&fctx->nsfetch);
+ if (dns_name_equal(&fctx->nsname, domain)) {
+ fctx_done(fctx, DNS_R_SERVFAIL);
+ goto cleanup;
+ }
n = dns_name_countlabels(&fctx->nsname);
dns_name_getlabelsequence(&fctx->nsname, 1, n - 1,
&fctx->nsname);
- if (dns_name_equal(&fctx->nsname, &fctx->domain)) {
- fctx_done(fctx, DNS_R_SERVFAIL);
- goto cleanup;
- }
if (dns_rdataset_isassociated(fevent->rdataset))
dns_rdataset_disassociate(fevent->rdataset);
FCTXTRACE("continuing to look for parent's NS records");
result = dns_resolver_createfetch(fctx->res, &fctx->nsname,
- dns_rdatatype_ns,
- &fctx->domain,
- &fctx->nameservers, NULL,
- 0, task,
+ dns_rdatatype_ns, domain,
+ &nameservers, NULL, 0, task,
resume_dslookup, fctx,
&fctx->nsrrset, NULL,
&fctx->nsfetch);
@@ -4764,6 +4837,8 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
}
cleanup:
+ if (dns_rdataset_isassociated(&nameservers))
+ dns_rdataset_disassociate(&nameservers);
if (dns_rdataset_isassociated(fevent->rdataset))
dns_rdataset_disassociate(fevent->rdataset);
INSIST(fevent->sigrdataset == NULL);
diff --git a/dist/bind/lib/dns/result.c b/dist/bind/lib/dns/result.c
index 09163c77492..f4b2ecdb8e9 100644
--- a/dist/bind/lib/dns/result.c
+++ b/dist/bind/lib/dns/result.c
@@ -1,4 +1,4 @@
-/* $NetBSD: result.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */
+/* $NetBSD: result.c,v 1.1.1.2 2004/11/06 23:55:41 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: result.c,v 1.90.2.9.2.12 2004/04/15 23:56:30 marka Exp */
+/* Id: result.c,v 1.90.2.9.2.13 2004/05/14 05:06:39 marka Exp */
#include <config.h>
@@ -152,7 +152,8 @@ static const char *text[DNS_R_NRESULTS] = {
"dynamic zone", /* 98 DNS_R_DYNAMIC */
"unknown command", /* 99 DNS_R_UNKNOWNCOMMAND */
- "must-be-secure" /* 100 DNS_R_MUSTBESECURE */
+ "must-be-secure", /* 100 DNS_R_MUSTBESECURE */
+ "covering NSEC record returned" /* 101 DNS_R_COVERINGNSEC */
};
static const char *rcode_text[DNS_R_NRCODERESULTS] = {
diff --git a/dist/bind/lib/dns/sdb.c b/dist/bind/lib/dns/sdb.c
index 97a429bcfde..34c04ba8cba 100644
--- a/dist/bind/lib/dns/sdb.c
+++ b/dist/bind/lib/dns/sdb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sdb.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */
+/* $NetBSD: sdb.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sdb.c,v 1.35.12.7 2004/03/08 21:06:27 marka Exp */
+/* Id: sdb.c,v 1.35.12.8 2004/07/22 04:01:58 marka Exp */
#include <config.h>
@@ -631,10 +631,10 @@ attachversion(dns_db_t *db, dns_dbversion_t *source,
dns_dbversion_t **targetp)
{
REQUIRE(source != NULL && source == (void *) &dummy);
+ REQUIRE(targetp != NULL && *targetp == NULL);
UNUSED(db);
- UNUSED(source);
- UNUSED(targetp);
+ *targetp = source;
return;
}
diff --git a/dist/bind/lib/dns/sec/dst/dst_api.c b/dist/bind/lib/dns/sec/dst/dst_api.c
index d8f11f5c9d2..9321870a205 100644
--- a/dist/bind/lib/dns/sec/dst/dst_api.c
+++ b/dist/bind/lib/dns/sec/dst/dst_api.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dst_api.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */
+/* $NetBSD: dst_api.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */
/*
* Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -20,7 +20,7 @@
/*
* Principal Author: Brian Wellington
- * Id: dst_api.c,v 1.88.2.3.2.12 2004/03/16 05:50:22 marka Exp
+ * Id: dst_api.c,v 1.88.2.3.2.15 2004/06/16 01:05:01 marka Exp
*/
#include <config.h>
@@ -72,6 +72,7 @@ static dst_key_t * get_key_struct(dns_name_t *name,
dns_rdataclass_t rdclass,
isc_mem_t *mctx);
static isc_result_t read_public_key(const char *filename,
+ int type,
isc_mem_t *mctx,
dst_key_t **keyp);
static isc_result_t write_public_key(const dst_key_t *key, int type,
@@ -147,9 +148,11 @@ dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
RETERR(dst__openssl_init());
RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5]));
RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1]));
+#ifdef HAVE_OPENSSL_DSA
RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA]));
- RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
#endif
+ RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
+#endif /* OPENSSL */
#ifdef GSSAPI
RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
#endif
@@ -391,7 +394,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
REQUIRE(mctx != NULL);
REQUIRE(keyp != NULL && *keyp == NULL);
- result = read_public_key(filename, mctx, &pubkey);
+ result = read_public_key(filename, type, mctx, &pubkey);
if (result != ISC_R_SUCCESS)
return (result);
@@ -825,7 +828,9 @@ get_key_struct(dns_name_t *name, unsigned int alg,
* Reads a public key from disk
*/
static isc_result_t
-read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) {
+read_public_key(const char *filename, int type,
+ isc_mem_t *mctx, dst_key_t **keyp)
+{
u_char rdatabuf[DST_KEY_MAXSIZE];
isc_buffer_t b;
dns_fixedname_t name;
@@ -840,7 +845,7 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) {
isc_lexspecials_t specials;
isc_uint32_t ttl;
isc_result_t result;
- dns_rdatatype_t type;
+ dns_rdatatype_t keytype;
newfilenamelen = strlen(filename) + 5;
newfilename = isc_mem_get(mctx, newfilenamelen);
@@ -913,14 +918,20 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) {
BADTOKEN();
if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0)
- type = dns_rdatatype_dnskey;
+ keytype = dns_rdatatype_dnskey;
else if (strcasecmp(DST_AS_STR(token), "KEY") == 0)
- type = dns_rdatatype_key; /* SIG(0) */
+ keytype = dns_rdatatype_key; /* SIG(0), TKEY */
else
BADTOKEN();
+ if (((type & DST_TYPE_KEY) != 0 && keytype != dns_rdatatype_key) ||
+ ((type & DST_TYPE_KEY) == 0 && keytype != dns_rdatatype_dnskey)) {
+ ret = DST_R_BADKEYTYPE;
+ goto cleanup;
+ }
+
isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
- ret = dns_rdata_fromtext(&rdata, rdclass, type, lex, NULL,
+ ret = dns_rdata_fromtext(&rdata, rdclass, keytype, lex, NULL,
ISC_FALSE, mctx, &b, NULL);
if (ret != ISC_R_SUCCESS)
goto cleanup;
@@ -1138,10 +1149,12 @@ algorithm_status(unsigned int alg) {
if (dst_algorithm_supported(alg))
return (ISC_R_SUCCESS);
+#ifndef OPENSSL
if (alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 ||
alg == DST_ALG_DSA || alg == DST_ALG_DH ||
alg == DST_ALG_HMACMD5)
return (DST_R_NOCRYPTO);
+#endif
return (DST_R_UNSUPPORTEDALG);
}
diff --git a/dist/bind/lib/dns/sec/dst/dst_result.c b/dist/bind/lib/dns/sec/dst/dst_result.c
index 18a8fd21efe..27a1460215a 100644
--- a/dist/bind/lib/dns/sec/dst/dst_result.c
+++ b/dist/bind/lib/dns/sec/dst/dst_result.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dst_result.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */
+/* $NetBSD: dst_result.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -19,7 +19,7 @@
/*
* Principal Author: Brian Wellington
- * Id: dst_result.c,v 1.18.2.1.8.1 2004/03/06 08:14:21 marka Exp
+ * Id: dst_result.c,v 1.18.2.1.8.2 2004/06/11 00:30:55 marka Exp
*/
#include <config.h>
@@ -51,6 +51,7 @@ static const char *text[DST_R_NRESULTS] = {
"not a key that can compute a secret", /* 17 */
"failure computing a shared secret", /* 18 */
"no randomness available", /* 19 */
+ "bad key type" /* 20 */
};
#define DST_RESULT_RESULTSET 2
diff --git a/dist/bind/lib/dns/sec/dst/include/dst/dst.h b/dist/bind/lib/dns/sec/dst/include/dst/dst.h
index 7c4cc965da3..87392da810b 100644
--- a/dist/bind/lib/dns/sec/dst/include/dst/dst.h
+++ b/dist/bind/lib/dns/sec/dst/include/dst/dst.h
@@ -1,4 +1,4 @@
-/* $NetBSD: dst.h,v 1.1.1.1 2004/05/17 23:45:01 christos Exp $ */
+/* $NetBSD: dst.h,v 1.1.1.2 2004/11/06 23:55:48 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dst.h,v 1.42.2.1.8.5 2004/03/10 02:55:59 marka Exp */
+/* Id: dst.h,v 1.42.2.1.8.6 2004/06/11 00:31:01 marka Exp */
#ifndef DST_DST_H
#define DST_DST_H 1
@@ -220,6 +220,7 @@ dst_key_fromfile(dns_name_t *name, dns_keytag_t id, unsigned int alg, int type,
* "id" is a valid key tag identifier.
* "alg" is a supported key algorithm.
* "type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union.
+ * DST_TYPE_KEY look for a KEY record otherwise DNSKEY
* "mctx" is a valid memory context.
* "keyp" is not NULL and "*keyp" is NULL.
*
@@ -242,6 +243,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
* Requires:
* "filename" is not NULL
* "type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union
+ * DST_TYPE_KEY look for a KEY record otherwise DNSKEY
* "mctx" is a valid memory context
* "keyp" is not NULL and "*keyp" is NULL.
*
diff --git a/dist/bind/lib/dns/sec/dst/include/dst/result.h b/dist/bind/lib/dns/sec/dst/include/dst/result.h
index 36bd3cd9f96..73d5d1d9e49 100644
--- a/dist/bind/lib/dns/sec/dst/include/dst/result.h
+++ b/dist/bind/lib/dns/sec/dst/include/dst/result.h
@@ -1,4 +1,4 @@
-/* $NetBSD: result.h,v 1.1.1.1 2004/05/17 23:45:01 christos Exp $ */
+/* $NetBSD: result.h,v 1.1.1.2 2004/11/06 23:55:48 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: result.h,v 1.20.206.1 2004/03/06 08:14:25 marka Exp */
+/* Id: result.h,v 1.20.206.2 2004/06/11 00:31:01 marka Exp */
#ifndef DST_RESULT_H
#define DST_RESULT_H 1
@@ -53,8 +53,9 @@
#define DST_R_KEYCANNOTCOMPUTESECRET (ISC_RESULTCLASS_DST + 17)
#define DST_R_COMPUTESECRETFAILURE (ISC_RESULTCLASS_DST + 18)
#define DST_R_NORANDOMNESS (ISC_RESULTCLASS_DST + 19)
+#define DST_R_BADKEYTYPE (ISC_RESULTCLASS_DST + 20)
-#define DST_R_NRESULTS 20 /* Number of results */
+#define DST_R_NRESULTS 21 /* Number of results */
ISC_LANG_BEGINDECLS
diff --git a/dist/bind/lib/dns/time.c b/dist/bind/lib/dns/time.c
index 7e1d13f343d..e216aeb41d9 100644
--- a/dist/bind/lib/dns/time.c
+++ b/dist/bind/lib/dns/time.c
@@ -1,4 +1,4 @@
-/* $NetBSD: time.c,v 1.1.1.1 2004/05/17 23:44:55 christos Exp $ */
+/* $NetBSD: time.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: time.c,v 1.18.2.4.2.7 2004/03/11 04:23:00 marka Exp */
+/* Id: time.c,v 1.18.2.4.2.8 2004/08/28 06:25:20 marka Exp */
#include <config.h>
@@ -25,6 +25,7 @@
#include <isc/string.h> /* Required for HP/UX (and others?) */
#include <time.h>
+#include <isc/print.h>
#include <isc/region.h>
#include <isc/stdtime.h>
#include <isc/util.h>
diff --git a/dist/bind/lib/dns/tkey.c b/dist/bind/lib/dns/tkey.c
index d03b2fa5338..4648741e1ac 100644
--- a/dist/bind/lib/dns/tkey.c
+++ b/dist/bind/lib/dns/tkey.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tkey.c,v 1.1.1.1 2004/05/17 23:44:55 christos Exp $ */
+/* $NetBSD: tkey.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -18,7 +18,7 @@
*/
/*
- * Id: tkey.c,v 1.71.2.1.10.4 2004/03/08 02:07:58 marka Exp
+ * Id: tkey.c,v 1.71.2.1.10.5 2004/06/11 00:30:54 marka Exp
*/
#include <config.h>
@@ -287,7 +287,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
keyname = NULL;
dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
keyset = NULL;
- result = dns_message_findtype(keyname, dns_rdatatype_dnskey, 0,
+ result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
&keyset);
if (result != ISC_R_SUCCESS)
continue;
@@ -335,7 +335,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
- dns_rdatatype_dnskey, &ourkeyr);
+ dns_rdatatype_key, &ourkeyr);
dns_name_init(&ourname, NULL);
dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
@@ -879,7 +879,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
RETERR(dst_key_todns(key, dynbuf));
isc_buffer_usedregion(dynbuf, &r);
dns_rdata_fromregion(rdata, dns_rdataclass_any,
- dns_rdatatype_dnskey, &r);
+ dns_rdatatype_key, &r);
dns_message_takebuffer(msg, &dynbuf);
dns_name_init(&keyname, NULL);
@@ -1051,7 +1051,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
ourkeyname = NULL;
ourkeyset = NULL;
RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
- dns_rdatatype_dnskey, 0, &ourkeyname,
+ dns_rdatatype_key, 0, &ourkeyname,
&ourkeyset));
result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
@@ -1062,7 +1062,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
if (dns_name_equal(theirkeyname, ourkeyname))
goto next;
theirkeyset = NULL;
- result = dns_message_findtype(theirkeyname, dns_rdatatype_dnskey,
+ result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
0, &theirkeyset);
if (result == ISC_R_SUCCESS) {
RETERR(dns_rdataset_first(theirkeyset));
diff --git a/dist/bind/lib/dns/validator.c b/dist/bind/lib/dns/validator.c
index f5ae6f87430..cbba995a3c9 100644
--- a/dist/bind/lib/dns/validator.c
+++ b/dist/bind/lib/dns/validator.c
@@ -1,4 +1,4 @@
-/* $NetBSD: validator.c,v 1.1.1.1 2004/05/17 23:44:53 christos Exp $ */
+/* $NetBSD: validator.c,v 1.1.1.2 2004/11/06 23:55:40 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: validator.c,v 1.91.2.5.8.10 2004/04/15 23:56:30 marka Exp */
+/* Id: validator.c,v 1.91.2.5.8.12 2004/06/11 01:17:36 marka Exp */
#include <config.h>
@@ -55,6 +55,7 @@
#define VALATTR_INSECURITY 0x0010
#define VALATTR_DLV 0x0020
#define VALATTR_DLVTRIED 0x0040
+#define VALATTR_DLVSEPTRIED 0x0080
#define VALATTR_NEEDNOQNAME 0x0100
#define VALATTR_NEEDNOWILDCARD 0x0200
@@ -70,6 +71,7 @@
#define NEEDNOWILDCARD(val) ((val->attributes & VALATTR_NEEDNOWILDCARD) != 0)
#define DLV(val) ((val->attributes & VALATTR_DLV) != 0)
#define DLVTRIED(val) ((val->attributes & VALATTR_DLVTRIED) != 0)
+#define DLVSEPTRIED(val) ((val->attributes & VALATTR_DLVSEPTRIED) != 0)
#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)
@@ -109,6 +111,9 @@ validator_logcreate(dns_validator_t *val,
static isc_result_t
dlv_validatezonekey(dns_validator_t *val);
+static isc_result_t
+finddlvsep(dns_validator_t *val, isc_boolean_t resume);
+
static void
validator_done(dns_validator_t *val, isc_result_t result) {
isc_task_t *task;
@@ -737,6 +742,16 @@ negauthvalidated(isc_task_t *task, isc_event_t *event) {
static inline isc_result_t
view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
+ dns_fixedname_t fixedname;
+ dns_name_t *foundname;
+ dns_rdata_nsec_t nsec;
+ dns_rdata_t rdata = DNS_RDATA_INIT;
+ isc_result_t result;
+ unsigned int options;
+ char buf1[DNS_NAME_FORMATSIZE];
+ char buf2[DNS_NAME_FORMATSIZE];
+ char buf3[DNS_NAME_FORMATSIZE];
+
if (dns_rdataset_isassociated(&val->frdataset))
dns_rdataset_disassociate(&val->frdataset);
if (dns_rdataset_isassociated(&val->fsigrdataset))
@@ -744,9 +759,106 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
if (val->view->zonetable == NULL)
return (ISC_R_CANCELED);
- return (dns_view_simplefind(val->view, name, type, 0,
- DNS_DBFIND_PENDINGOK, ISC_FALSE,
- &val->frdataset, &val->fsigrdataset));
+
+ options = DNS_DBFIND_PENDINGOK;
+ if (type == dns_rdatatype_dlv)
+ options |= DNS_DBFIND_COVERINGNSEC;
+ dns_fixedname_init(&fixedname);
+ foundname = dns_fixedname_name(&fixedname);
+ result = dns_view_find(val->view, name, type, 0, options,
+ ISC_FALSE, NULL, NULL, foundname,
+ &val->frdataset, &val->fsigrdataset);
+ if (result == DNS_R_NXDOMAIN) {
+ if (dns_rdataset_isassociated(&val->frdataset))
+ dns_rdataset_disassociate(&val->frdataset);
+ if (dns_rdataset_isassociated(&val->fsigrdataset))
+ dns_rdataset_disassociate(&val->fsigrdataset);
+ } else if (result == DNS_R_COVERINGNSEC) {
+ validator_log(val, ISC_LOG_DEBUG(3), "DNS_R_COVERINGNSEC");
+ /*
+ * Check if the returned NSEC covers the name.
+ */
+ INSIST(type == dns_rdatatype_dlv);
+ if (val->frdataset.trust != dns_trust_secure) {
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "covering nsec: trust %u",
+ val->frdataset.trust);
+ goto notfound;
+ }
+ result = dns_rdataset_first(&val->frdataset);
+ if (result != ISC_R_SUCCESS)
+ goto notfound;
+ dns_rdataset_current(&val->frdataset, &rdata);
+ if (dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&
+ !dns_nsec_typepresent(&rdata, dns_rdatatype_soa)) {
+ /* Parent NSEC record. */
+ if (dns_name_issubdomain(name, foundname)) {
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "covering nsec: for parent");
+ goto notfound;
+ }
+ }
+ result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+ if (result != ISC_R_SUCCESS)
+ goto notfound;
+ if (dns_name_compare(foundname, &nsec.next) >= 0) {
+ /* End of zone chain. */
+ if (!dns_name_issubdomain(name, &nsec.next)) {
+ /*
+ * XXXMPA We could look for a parent NSEC
+ * at nsec.next and if found retest with
+ * this NSEC.
+ */
+ dns_rdata_freestruct(&nsec);
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "covering nsec: not in zone");
+ goto notfound;
+ }
+ } else if (dns_name_compare(name, &nsec.next) >= 0) {
+ /*
+ * XXXMPA We could check if this NSEC is at a zone
+ * apex and if the qname is not below it and look for
+ * a parent NSEC with the same name. This requires
+ * that we can cache both NSEC records which we
+ * currently don't support.
+ */
+ dns_rdata_freestruct(&nsec);
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "covering nsec: not in range");
+ goto notfound;
+ }
+ if (isc_log_wouldlog(dns_lctx,ISC_LOG_DEBUG(3))) {
+ dns_name_format(name, buf1, sizeof buf1);
+ dns_name_format(foundname, buf2, sizeof buf2);
+ dns_name_format(&nsec.next, buf3, sizeof buf3);
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "covering nsec found: '%s' '%s' '%s'",
+ buf1, buf2, buf3);
+ }
+ if (dns_rdataset_isassociated(&val->frdataset))
+ dns_rdataset_disassociate(&val->frdataset);
+ if (dns_rdataset_isassociated(&val->fsigrdataset))
+ dns_rdataset_disassociate(&val->fsigrdataset);
+ dns_rdata_freestruct(&nsec);
+ result = DNS_R_NCACHENXDOMAIN;
+ } else if (result != ISC_R_SUCCESS &&
+ result != DNS_R_GLUE &&
+ result != DNS_R_HINT &&
+ result != DNS_R_NCACHENXDOMAIN &&
+ result != DNS_R_NCACHENXRRSET &&
+ result != DNS_R_NXRRSET &&
+ result != DNS_R_HINTNXRRSET &&
+ result != ISC_R_NOTFOUND) {
+ goto notfound;
+ }
+ return (result);
+
+ notfound:
+ if (dns_rdataset_isassociated(&val->frdataset))
+ dns_rdataset_disassociate(&val->frdataset);
+ if (dns_rdataset_isassociated(&val->fsigrdataset))
+ dns_rdataset_disassociate(&val->fsigrdataset);
+ return (ISC_R_NOTFOUND);
}
static inline isc_boolean_t
@@ -1483,7 +1595,7 @@ dlv_validatezonekey(dns_validator_t *val) {
}
if (result != ISC_R_SUCCESS) {
validator_log(val, ISC_LOG_DEBUG(3),
- "no KEY matching DLV");
+ "no DNSKEY matching DLV");
continue;
}
@@ -1518,7 +1630,8 @@ dlv_validatezonekey(dns_validator_t *val) {
dns_rdataset_disassociate(&trdataset);
if (result == ISC_R_SUCCESS)
break;
- validator_log(val, ISC_LOG_DEBUG(3), "no SIG matching DLV key");
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "no RRSIG matching DLV key");
}
if (result == ISC_R_SUCCESS) {
val->event->rdataset->trust = dns_trust_secure;
@@ -1767,7 +1880,7 @@ validatezonekey(dns_validator_t *val) {
}
if (result != ISC_R_SUCCESS) {
validator_log(val, ISC_LOG_DEBUG(3),
- "no KEY matching DS");
+ "no DNSKEY matching DS");
continue;
}
@@ -1802,7 +1915,8 @@ validatezonekey(dns_validator_t *val) {
dns_rdataset_disassociate(&trdataset);
if (result == ISC_R_SUCCESS)
break;
- validator_log(val, ISC_LOG_DEBUG(3), "no SIG matching DS key");
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "no RRSIG matching DS key");
}
if (result == ISC_R_SUCCESS) {
event->rdataset->trust = dns_trust_secure;
@@ -1982,8 +2096,8 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
* would lead to a query for the zone key, which
* would return a negative answer, which would contain
* an SOA and an NSEC signed by the missing key, which
- * would trigger another query for the KEY (since the
- * first one is still in progress), and go into an
+ * would trigger another query for the DNSKEY (since
+ * the first one is still in progress), and go into an
* infinite loop. Avoid that.
*/
if (val->event->type == dns_rdatatype_dnskey &&
@@ -2099,9 +2213,127 @@ check_ds_algorithm(dns_validator_t *val, dns_name_t *name,
return (ISC_FALSE);
}
+static void
+dlv_fetched2(isc_task_t *task, isc_event_t *event) {
+ dns_fetchevent_t *devent;
+ dns_validator_t *val;
+ isc_boolean_t want_destroy;
+ isc_result_t eresult;
+ isc_result_t result;
+
+ UNUSED(task);
+ INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
+ devent = (dns_fetchevent_t *)event;
+ val = devent->ev_arg;
+ eresult = devent->result;
+
+ isc_event_free(&event);
+ dns_resolver_destroyfetch(&val->fetch);
+
+ INSIST(val->event != NULL);
+ validator_log(val, ISC_LOG_DEBUG(3), "in dlv_fetched2: %s",
+ dns_result_totext(eresult));
+
+ LOCK(&val->lock);
+ if (eresult == ISC_R_SUCCESS) {
+ val->havedlvsep = ISC_TRUE;
+ result = proveunsecure(val, ISC_FALSE);
+ if (result != DNS_R_WAIT)
+ validator_done(val, result);
+ } else if (eresult == DNS_R_NXRRSET ||
+ eresult == DNS_R_NXDOMAIN ||
+ eresult == DNS_R_NCACHENXRRSET ||
+ eresult == DNS_R_NCACHENXDOMAIN) {
+ result = finddlvsep(val, ISC_TRUE);
+ if (result == ISC_R_SUCCESS) {
+ result = proveunsecure(val, ISC_FALSE);
+ if (result != DNS_R_WAIT)
+ validator_done(val, result);
+ } else if (result == ISC_R_NOTFOUND) {
+ validator_done(val, ISC_R_SUCCESS);
+ } else if (result != DNS_R_WAIT)
+ validator_done(val, result);
+ }
+ want_destroy = exit_check(val);
+ UNLOCK(&val->lock);
+ if (want_destroy)
+ destroy(val);
+}
+
+static isc_result_t
+finddlvsep(dns_validator_t *val, isc_boolean_t resume) {
+ dns_fixedname_t dlvfixed;
+ dns_name_t *dlvname;
+ dns_name_t *dlvsep;
+ dns_name_t noroot;
+ isc_result_t result;
+ unsigned int labels;
+
+ if (!resume) {
+ dns_fixedname_init(&val->dlvsep);
+ dlvsep = dns_fixedname_name(&val->dlvsep);
+ dns_name_copy(val->event->name, dlvsep, NULL);
+ val->attributes |= VALATTR_DLVSEPTRIED;
+ } else {
+ dlvsep = dns_fixedname_name(&val->dlvsep);
+ labels = dns_name_countlabels(dlvsep);
+ dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep);
+ }
+ dns_name_init(&noroot, NULL);
+ dns_fixedname_init(&dlvfixed);
+ dlvname = dns_fixedname_name(&dlvfixed);
+ labels = dns_name_countlabels(dlvsep);
+ dns_name_getlabelsequence(dlvsep, 0, labels - 1, &noroot);
+ result = dns_name_concatenate(&noroot, val->view->dlv, dlvname, NULL);
+ while (result == ISC_R_NOSPACE) {
+ labels = dns_name_countlabels(dlvsep);
+ dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep);
+ dns_name_getlabelsequence(dlvsep, 0, labels - 2, &noroot);
+ result = dns_name_concatenate(&noroot, val->view->dlv,
+ dlvname, NULL);
+ }
+ if (result != ISC_R_SUCCESS) {
+ validator_log(val, ISC_LOG_DEBUG(2), "DLV concatenate failed");
+ return (DNS_R_NOVALIDSIG);
+ }
+
+ while (dns_name_countlabels(dlvname) >
+ dns_name_countlabels(val->view->dlv))
+ {
+ result = view_find(val, dlvname, dns_rdatatype_dlv);
+ if (result == ISC_R_SUCCESS) {
+ if (val->frdataset.trust < dns_trust_secure)
+ return (DNS_R_NOVALIDSIG);
+ val->havedlvsep = ISC_TRUE;
+ return (ISC_R_SUCCESS);
+ }
+ if (result == ISC_R_NOTFOUND) {
+ result = create_fetch(val, dlvname, dns_rdatatype_dlv,
+ dlv_fetched2, "finddlvsep");
+ if (result != ISC_R_SUCCESS)
+ return (result);
+ return (DNS_R_WAIT);
+ }
+ if (result != DNS_R_NXRRSET &&
+ result != DNS_R_NXDOMAIN &&
+ result != DNS_R_NCACHENXRRSET &&
+ result != DNS_R_NCACHENXDOMAIN)
+ return (result);
+ /*
+ * Strip first labels from both dlvsep and dlvname.
+ */
+ labels = dns_name_countlabels(dlvsep);
+ dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep);
+ labels = dns_name_countlabels(dlvname);
+ dns_name_getlabelsequence(dlvname, 1, labels - 1, dlvname);
+ }
+ return (ISC_R_NOTFOUND);
+}
+
static isc_result_t
proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
isc_result_t result;
+ isc_result_t tresult;
dns_fixedname_t secroot;
dns_name_t *tname;
@@ -2112,11 +2344,30 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
/*
* If the name is not under a security root, it must be insecure.
*/
- if (result == ISC_R_NOTFOUND)
- return (ISC_R_SUCCESS);
+ if (val->view->dlv != NULL && !DLVSEPTRIED(val) &&
+ !dns_name_issubdomain(val->event->name, val->view->dlv)) {
+ tresult = finddlvsep(val, ISC_FALSE);
+ if (tresult != ISC_R_NOTFOUND && tresult != ISC_R_SUCCESS) {
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "finddlvsep returned: %s",
+ dns_result_totext(tresult));
+ return (tresult);
+ }
+ }
- else if (result != ISC_R_SUCCESS)
+ if (result == ISC_R_NOTFOUND) {
+ if (!val->havedlvsep)
+ return (ISC_R_SUCCESS);
+ dns_name_copy(dns_fixedname_name(&val->dlvsep),
+ dns_fixedname_name(&secroot), NULL);
+ } else if (result != ISC_R_SUCCESS)
return (result);
+ else if (val->havedlvsep &&
+ dns_name_issubdomain(dns_fixedname_name(&val->dlvsep),
+ dns_fixedname_name(&secroot))) {
+ dns_name_copy(dns_fixedname_name(&val->dlvsep),
+ dns_fixedname_name(&secroot), NULL);
+ }
if (!resume) {
val->labels =
@@ -2429,6 +2680,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
val->nsecset = NULL;
val->soaname = NULL;
val->seensig = ISC_FALSE;
+ val->havedlvsep = ISC_FALSE;
val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name);
dns_rdataset_init(&val->frdataset);
dns_rdataset_init(&val->fsigrdataset);
diff --git a/dist/bind/lib/dns/zone.c b/dist/bind/lib/dns/zone.c
index 9c94dc4ce9c..9e18270455b 100644
--- a/dist/bind/lib/dns/zone.c
+++ b/dist/bind/lib/dns/zone.c
@@ -1,4 +1,4 @@
-/* $NetBSD: zone.c,v 1.1.1.1 2004/05/17 23:44:56 christos Exp $ */
+/* $NetBSD: zone.c,v 1.1.1.2 2004/11/06 23:55:43 christos Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: zone.c,v 1.333.2.23.2.45 2004/04/29 01:45:23 marka Exp */
+/* Id: zone.c,v 1.333.2.23.2.50 2004/08/28 05:53:37 marka Exp */
#include <config.h>
@@ -2351,8 +2351,10 @@ dump_done(void *arg, isc_result_t result) {
tresult = dns_db_getsoaserial(db, version, &serial);
if (tresult == ISC_R_SUCCESS) {
- tresult = dns_journal_compact(zone->mctx, zone->journal,
- serial, zone->journalsize);
+ tresult = dns_journal_compact(zone->mctx,
+ zone->journal,
+ serial,
+ zone->journalsize);
switch (tresult) {
case ISC_R_SUCCESS:
case ISC_R_NOSPACE:
@@ -3620,7 +3622,12 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
dns_message_destroy(&msg);
} else if (isc_serial_eq(soa.serial, zone->serial)) {
if (zone->masterfile != NULL) {
- result = isc_file_settime(zone->masterfile, &now);
+ result = ISC_R_FAILURE;
+ if (zone->journal != NULL)
+ result = isc_file_settime(zone->journal, &now);
+ if (result != ISC_R_SUCCESS)
+ result = isc_file_settime(zone->masterfile,
+ &now);
/* Someone removed the file from underneath us! */
if (result == ISC_R_FILENOTFOUND) {
LOCK_ZONE(zone);
@@ -3988,6 +3995,8 @@ soa_query(isc_task_t *task, isc_event_t *event) {
return;
skip_master:
+ if (key != NULL)
+ dns_tsigkey_detach(&key);
zone->curmaster++;
if (zone->curmaster < zone->masterscnt)
goto again;
@@ -4251,14 +4260,17 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
if (zone->readio != NULL)
zonemgr_cancelio(zone->readio);
- if (zone->writeio != NULL)
- zonemgr_cancelio(zone->writeio);
-
if (zone->lctx != NULL)
dns_loadctx_cancel(zone->lctx);
- if (zone->dctx != NULL)
- dns_dumpctx_cancel(zone->dctx);
+ if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FLUSH) ||
+ !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) {
+ if (zone->writeio != NULL)
+ zonemgr_cancelio(zone->writeio);
+
+ if (zone->dctx != NULL)
+ dns_dumpctx_cancel(zone->dctx);
+ }
notify_cancel(zone);
@@ -5166,9 +5178,8 @@ notify_done(isc_task_t *task, isc_event_t *event) {
* the soa if we see a formerr and had sent a SOA.
*/
isc_event_free(&event);
- if ((result == ISC_R_TIMEDOUT ||
- (message != NULL && message->rcode == dns_rcode_formerr &&
- (notify->flags & DNS_NOTIFY_NOSOA) == 0))) {
+ if (message != NULL && message->rcode == dns_rcode_formerr &&
+ (notify->flags & DNS_NOTIFY_NOSOA) == 0) {
notify->flags |= DNS_NOTIFY_NOSOA;
dns_request_destroy(&notify->request);
result = notify_send_queue(notify);
@@ -5226,6 +5237,31 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
goto fail;
if (dump)
zone_needdump(zone, DNS_DUMP_DELAY);
+ else if (zone->journalsize != -1) {
+ isc_uint32_t serial;
+
+ result = dns_db_getsoaserial(db, ver, &serial);
+ if (result == ISC_R_SUCCESS) {
+ result = dns_journal_compact(zone->mctx,
+ zone->journal,
+ serial,
+ zone->journalsize);
+ switch (result) {
+ case ISC_R_SUCCESS:
+ case ISC_R_NOSPACE:
+ case ISC_R_NOTFOUND:
+ dns_zone_log(zone, ISC_LOG_DEBUG(3),
+ "dns_journal_compact: %s",
+ dns_result_totext(result));
+ break;
+ default:
+ dns_zone_log(zone, ISC_LOG_ERROR,
+ "dns_journal_compact failed: %s",
+ dns_result_totext(result));
+ break;
+ }
+ }
+ }
} else {
if (dump && zone->masterfile != NULL) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,