diff options
| author | christos <christos@NetBSD.org> | 2004-11-06 23:53:21 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2004-11-06 23:53:21 +0000 |
| commit | dfd98c8a16d53dff0d1bdca29bcddc6571054129 (patch) | |
| tree | 24f3891f470a8e79f037a71c4b43266f23767859 /dist/bind/lib/dns | |
| parent | aefec4290d9fd9e83eaf8b2b4ada33ff37ecaedb (diff) | |
Import bind-9.3.0
Diffstat (limited to 'dist/bind/lib/dns')
28 files changed, 821 insertions, 284 deletions
diff --git a/dist/bind/lib/dns/Makefile.in b/dist/bind/lib/dns/Makefile.in index 15996afc583..eb1fd61f172 100644 --- a/dist/bind/lib/dns/Makefile.in +++ b/dist/bind/lib/dns/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# Id: Makefile.in,v 1.126.2.3.2.14 2004/04/15 00:34:52 marka Exp +# Id: Makefile.in,v 1.126.2.3.2.15 2004/07/20 07:01:57 marka Exp srcdir = @srcdir@ VPATH = @srcdir@ @@ -107,7 +107,7 @@ libdns.@SA@: ${OBJS} libdns.la: ${OBJS} ${LIBTOOL_MODE_LINK} \ - ${CC} ${ALL_CFLAGS} -o libdns.la -rpath ${libdir} \ + ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \ -version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \ ${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS} @@ -151,7 +151,7 @@ code.h: gen ./gen -s ${srcdir} > code.h gen: gen.c - ${CC} ${ALL_CFLAGS} -o $@ ${srcdir}/gen.c ${LIBS} + ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ${srcdir}/gen.c ${LIBS} rbtdb64.@O@: rbtdb.c diff --git a/dist/bind/lib/dns/adb.c b/dist/bind/lib/dns/adb.c index 0272a008f23..192e0c3f170 100644 --- a/dist/bind/lib/dns/adb.c +++ b/dist/bind/lib/dns/adb.c @@ -1,4 +1,4 @@ -/* $NetBSD: adb.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */ +/* $NetBSD: adb.c,v 1.1.1.2 2004/11/06 23:55:35 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: adb.c,v 1.181.2.11.2.17 2004/03/10 02:55:57 marka Exp */ +/* Id: adb.c,v 1.181.2.11.2.19 2004/09/01 05:19:57 marka Exp */ /* * Implementation notes @@ -1009,6 +1009,8 @@ set_target(dns_adb_t *adb, dns_name_t *name, dns_name_t *fname, dns_fixedname_init(&fixed2); new_target = dns_fixedname_name(&fixed2); dns_name_split(name, nlabels, prefix, NULL); + result = dns_name_concatenate(prefix, &dname.dname, new_target, + NULL); dns_rdata_freestruct(&dname); if (result != ISC_R_SUCCESS) return (result); @@ -1581,7 +1583,7 @@ find_name_and_lock(dns_adb_t *adb, dns_name_t *name, dns_adbname_t *adbname; int bucket; - bucket = dns_fullname_hash(name, ISC_FALSE) % NBUCKETS; + bucket = dns_name_fullhash(name, ISC_FALSE) % NBUCKETS; if (*bucketp == DNS_ADB_INVALIDBUCKET) { LOCK(&adb->namelocks[bucket]); diff --git a/dist/bind/lib/dns/api b/dist/bind/lib/dns/api index a8be9070823..444e0c5cd0c 100644 --- a/dist/bind/lib/dns/api +++ b/dist/bind/lib/dns/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 14 +LIBINTERFACE = 20 LIBREVISION = 0 LIBAGE = 0 diff --git a/dist/bind/lib/dns/byaddr.c b/dist/bind/lib/dns/byaddr.c index 1cfdc079098..f2183f852a0 100644 --- a/dist/bind/lib/dns/byaddr.c +++ b/dist/bind/lib/dns/byaddr.c @@ -1,4 +1,4 @@ -/* $NetBSD: byaddr.c,v 1.1.1.1 2004/05/17 23:44:48 christos Exp $ */ +/* $NetBSD: byaddr.c,v 1.1.1.2 2004/11/06 23:55:34 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,12 +17,13 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: byaddr.c,v 1.29.2.1.2.7 2004/03/09 05:21:08 marka Exp */ +/* Id: byaddr.c,v 1.29.2.1.2.8 2004/08/28 06:25:18 marka Exp */ #include <config.h> #include <isc/mem.h> #include <isc/netaddr.h> +#include <isc/print.h> #include <isc/string.h> /* Required for HP/UX (and others?) */ #include <isc/task.h> #include <isc/util.h> diff --git a/dist/bind/lib/dns/dispatch.c b/dist/bind/lib/dns/dispatch.c index e9d05054697..cd600f90bd3 100644 --- a/dist/bind/lib/dns/dispatch.c +++ b/dist/bind/lib/dns/dispatch.c @@ -1,4 +1,4 @@ -/* $NetBSD: dispatch.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */ +/* $NetBSD: dispatch.c,v 1.1.1.2 2004/11/06 23:55:36 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: dispatch.c,v 1.101.2.6.2.7 2004/04/15 02:10:39 marka Exp */ +/* Id: dispatch.c,v 1.101.2.6.2.10 2004/09/01 04:27:41 marka Exp */ #include <config.h> @@ -157,14 +157,14 @@ static isc_boolean_t destroy_disp_ok(dns_dispatch_t *); static void destroy_disp(isc_task_t *task, isc_event_t *event); static void udp_recv(isc_task_t *, isc_event_t *); static void tcp_recv(isc_task_t *, isc_event_t *); -static inline void startrecv(dns_dispatch_t *); +static void startrecv(dns_dispatch_t *); static dns_messageid_t dns_randomid(dns_qid_t *); static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t); static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len); static void *allocate_udp_buffer(dns_dispatch_t *disp); static inline void free_event(dns_dispatch_t *disp, dns_dispatchevent_t *ev); static inline dns_dispatchevent_t *allocate_event(dns_dispatch_t *disp); -static void do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp); +static void do_cancel(dns_dispatch_t *disp); static dns_dispentry_t *linear_first(dns_qid_t *disp); static dns_dispentry_t *linear_next(dns_qid_t *disp, dns_dispentry_t *resp); @@ -629,26 +629,25 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { /* query */ free_buffer(disp, ev->region.base, ev->region.length); goto restart; - } else { - /* response */ - bucket = dns_hash(qid, &ev->address, id); - LOCK(&qid->lock); - resp = bucket_search(qid, &ev->address, id, bucket); - UNLOCK(&qid->lock); - dispatch_log(disp, LVL(90), - "search for response in bucket %d: %s", - bucket, (resp == NULL ? "not found" : "found")); - - if (resp == NULL) { - free_buffer(disp, ev->region.base, ev->region.length); - goto restart; - } - queue_response = resp->item_out; - rev = allocate_event(resp->disp); - if (rev == NULL) { - free_buffer(disp, ev->region.base, ev->region.length); - goto restart; - } + } + + /* response */ + bucket = dns_hash(qid, &ev->address, id); + LOCK(&qid->lock); + resp = bucket_search(qid, &ev->address, id, bucket); + dispatch_log(disp, LVL(90), + "search for response in bucket %d: %s", + bucket, (resp == NULL ? "not found" : "found")); + + if (resp == NULL) { + free_buffer(disp, ev->region.base, ev->region.length); + goto unlock; + } + queue_response = resp->item_out; + rev = allocate_event(resp->disp); + if (rev == NULL) { + free_buffer(disp, ev->region.base, ev->region.length); + goto unlock; } /* @@ -676,6 +675,8 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) { resp->item_out = ISC_TRUE; isc_task_send(resp->task, ISC_EVENT_PTR(&rev)); } + unlock: + UNLOCK(&qid->lock); /* * Restart recv() to get the next packet. @@ -748,7 +749,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { case ISC_R_EOF: dispatch_log(disp, LVL(90), "shutting down on EOF"); - do_cancel(disp, NULL); + do_cancel(disp); break; case ISC_R_CONNECTIONRESET: @@ -762,7 +763,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { dispatch_log(disp, level, "shutting down due to TCP " "receive error: %s: %s", buf, isc_result_totext(tcpmsg->result)); - do_cancel(disp, NULL); + do_cancel(disp); break; } @@ -818,27 +819,26 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { * Query. */ goto restart; - } else { - /* - * Response. - */ - bucket = dns_hash(qid, &tcpmsg->address, id); - LOCK(&qid->lock); - resp = bucket_search(qid, &tcpmsg->address, id, bucket); - UNLOCK(&qid->lock); - dispatch_log(disp, LVL(90), - "search for response in bucket %d: %s", - bucket, (resp == NULL ? "not found" : "found")); - - if (resp == NULL) - goto restart; - queue_response = resp->item_out; - rev = allocate_event(disp); - if (rev == NULL) - goto restart; } /* + * Response. + */ + bucket = dns_hash(qid, &tcpmsg->address, id); + LOCK(&qid->lock); + resp = bucket_search(qid, &tcpmsg->address, id, bucket); + dispatch_log(disp, LVL(90), + "search for response in bucket %d: %s", + bucket, (resp == NULL ? "not found" : "found")); + + if (resp == NULL) + goto unlock; + queue_response = resp->item_out; + rev = allocate_event(disp); + if (rev == NULL) + goto unlock; + + /* * At this point, rev contains the event we want to fill in, and * resp contains the information on the place to send it to. * Send the event off. @@ -860,6 +860,8 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) { resp->item_out = ISC_TRUE; isc_task_send(resp->task, ISC_EVENT_PTR(&rev)); } + unlock: + UNLOCK(&qid->lock); /* * Restart recv() to get the next packet. @@ -907,7 +909,7 @@ startrecv(dns_dispatch_t *disp) { free_buffer(disp, region.base, region.length); disp->shutdown_why = res; disp->shutting_down = 1; - do_cancel(disp, NULL); + do_cancel(disp); return; } INSIST(disp->recv_pending == 0); @@ -920,7 +922,7 @@ startrecv(dns_dispatch_t *disp) { if (res != ISC_R_SUCCESS) { disp->shutdown_why = res; disp->shutting_down = 1; - do_cancel(disp, NULL); + do_cancel(disp); return; } INSIST(disp->recv_pending == 0); @@ -1296,7 +1298,7 @@ local_addr_match(dns_dispatch_t *disp, isc_sockaddr_t *addr) { if (result != ISC_R_SUCCESS) return (ISC_FALSE); - return (isc_sockaddr_equal(&disp->local, &sockaddr)); + return (isc_sockaddr_equal(&sockaddr, addr)); } /* @@ -2020,7 +2022,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, res->magic = 0; isc_mempool_put(disp->mgr->rpool, res); if (disp->shutting_down == 1) - do_cancel(disp, NULL); + do_cancel(disp); else startrecv(disp); @@ -2031,8 +2033,9 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp, } static void -do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) { +do_cancel(dns_dispatch_t *disp) { dns_dispatchevent_t *ev; + dns_dispentry_t *resp; dns_qid_t *qid; if (disp->shutdown_out == 1) @@ -2043,28 +2046,16 @@ do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) { /* * Search for the first response handler without packets outstanding. */ - if (resp == NULL) { - LOCK(&qid->lock); - resp = linear_first(qid); - if (resp == NULL) { - /* no first item? */ - UNLOCK(&qid->lock); - return; - } - do { - if (resp->item_out == ISC_FALSE) - break; - - resp = linear_next(qid, resp); - } while (resp != NULL); - UNLOCK(&qid->lock); - } - + LOCK(&qid->lock); + for (resp = linear_first(qid); + resp != NULL && resp->item_out != ISC_FALSE; + /* Empty. */) + resp = linear_next(qid, resp); /* * No one to send the cancel event to, so nothing to do. */ if (resp == NULL) - return; + goto unlock; /* * Send the shutdown failsafe event to this resp. @@ -2081,6 +2072,8 @@ do_cancel(dns_dispatch_t *disp, dns_dispentry_t *resp) { ev, resp->task); resp->item_out = ISC_TRUE; isc_task_send(resp->task, ISC_EVENT_PTR(&ev)); + unlock: + UNLOCK(&qid->lock); } isc_socket_t * @@ -2116,7 +2109,7 @@ dns_dispatch_cancel(dns_dispatch_t *disp) { disp->shutdown_why = ISC_R_CANCELED; disp->shutting_down = 1; - do_cancel(disp, NULL); + do_cancel(disp); UNLOCK(&disp->lock); diff --git a/dist/bind/lib/dns/dnssec.c b/dist/bind/lib/dns/dnssec.c index 51f85529fe8..4787f308974 100644 --- a/dist/bind/lib/dns/dnssec.c +++ b/dist/bind/lib/dns/dnssec.c @@ -1,4 +1,4 @@ -/* $NetBSD: dnssec.c,v 1.1.1.1 2004/05/17 23:44:50 christos Exp $ */ +/* $NetBSD: dnssec.c,v 1.1.1.2 2004/11/06 23:55:36 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -18,7 +18,7 @@ */ /* - * Id: dnssec.c,v 1.69.2.5.2.6 2004/03/08 21:06:26 marka Exp + * Id: dnssec.c,v 1.69.2.5.2.7 2004/06/11 00:30:54 marka Exp */ @@ -136,6 +136,8 @@ dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx, INSIST(mctx != NULL); INSIST(key != NULL); INSIST(*key == NULL); + REQUIRE(rdata->type == dns_rdatatype_key || + rdata->type == dns_rdatatype_dnskey); dns_rdata_toregion(rdata, &r); isc_buffer_init(&b, r.base, r.length); diff --git a/dist/bind/lib/dns/include/dns/db.h b/dist/bind/lib/dns/include/dns/db.h index 58e78ffb09c..c2ca6510acb 100644 --- a/dist/bind/lib/dns/include/dns/db.h +++ b/dist/bind/lib/dns/include/dns/db.h @@ -1,4 +1,4 @@ -/* $NetBSD: db.h,v 1.1.1.1 2004/05/17 23:44:57 christos Exp $ */ +/* $NetBSD: db.h,v 1.1.1.2 2004/11/06 23:55:44 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: db.h,v 1.67.12.7 2004/03/08 09:04:35 marka Exp */ +/* Id: db.h,v 1.67.12.8 2004/05/14 05:06:41 marka Exp */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -190,6 +190,7 @@ struct dns_db { #define DNS_DBFIND_PENDINGOK 0x08 #define DNS_DBFIND_NOEXACT 0x10 #define DNS_DBFIND_FORCENSEC 0x20 +#define DNS_DBFIND_COVERINGNSEC 0x40 /* * Options that can be specified for dns_db_addrdataset(). @@ -649,6 +650,12 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * is only necessary when querying a database that was not secure * when created. * + * If the DNS_DBFIND_COVERINGNSEC option is set, then look for a + * NSEC record that potentially covers 'name' if a answer cannot + * be found. Note the returned NSEC needs to be checked to ensure + * that it is correct. This only affects answers returned from the + * cache. + * * To respond to a query for SIG records, the caller should create a * rdataset iterator and extract the signatures from each rdataset. * @@ -772,6 +779,9 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * DNS_R_EMPTYNAME The name exists but there is * no data at the name. * + * DNS_R_COVERINGNSEC The returned data is a NSEC + * that potentially covers 'name'. + * * Error results: * * ISC_R_NOMEMORY diff --git a/dist/bind/lib/dns/include/dns/name.h b/dist/bind/lib/dns/include/dns/name.h index a3aa4e93b69..7370f151227 100644 --- a/dist/bind/lib/dns/include/dns/name.h +++ b/dist/bind/lib/dns/include/dns/name.h @@ -1,4 +1,4 @@ -/* $NetBSD: name.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */ +/* $NetBSD: name.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: name.h,v 1.95.2.3.2.8 2004/03/16 12:57:17 marka Exp */ +/* Id: name.h,v 1.95.2.3.2.11 2004/09/01 05:19:59 marka Exp */ #ifndef DNS_NAME_H #define DNS_NAME_H 1 @@ -314,7 +314,7 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive); */ unsigned int -dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive); +dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive); /* * Provide a hash value for 'name'. Unlike dns_name_hash(), this function * always takes into account of the entire name to calculate the hash value. @@ -575,6 +575,9 @@ dns_name_getlabelsequence(const dns_name_t *source, unsigned int first, * Notes: * Numbering starts at 0. * + * Given "rc.vix.com.", the label 0 is "rc", and label 3 is the + * root label. + * * 'target' refers to the same memory as 'source', so 'source' * must not be changed while 'target' is still in use. * @@ -1216,7 +1219,7 @@ do { \ do { \ (r)->base = (n)->ndata; \ (r)->length = (n)->length; \ -} while (0); +} while (0) #define DNS_NAME_SPLIT(n, l, p, s) \ do { \ @@ -1228,7 +1231,7 @@ do { \ dns_name_getlabelsequence(_n, 0, _n->labels - _l, _p); \ if (_s != NULL) \ dns_name_getlabelsequence(_n, _n->labels - _l, _l, _s); \ -} while (0); +} while (0) #ifdef DNS_NAME_USEINLINE diff --git a/dist/bind/lib/dns/include/dns/result.h b/dist/bind/lib/dns/include/dns/result.h index d2fc5c76b58..bf98b76e610 100644 --- a/dist/bind/lib/dns/include/dns/result.h +++ b/dist/bind/lib/dns/include/dns/result.h @@ -1,4 +1,4 @@ -/* $NetBSD: result.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */ +/* $NetBSD: result.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: result.h,v 1.81.2.7.2.12 2004/04/15 23:56:32 marka Exp */ +/* Id: result.h,v 1.81.2.7.2.13 2004/05/14 05:06:41 marka Exp */ #ifndef DNS_RESULT_H #define DNS_RESULT_H 1 @@ -144,8 +144,9 @@ #define DNS_R_DYNAMIC (ISC_RESULTCLASS_DNS + 98) #define DNS_R_UNKNOWNCOMMAND (ISC_RESULTCLASS_DNS + 99) #define DNS_R_MUSTBESECURE (ISC_RESULTCLASS_DNS + 100) +#define DNS_R_COVERINGNSEC (ISC_RESULTCLASS_DNS + 101) -#define DNS_R_NRESULTS 101 /* Number of results */ +#define DNS_R_NRESULTS 102 /* Number of results */ /* * DNS wire format rcodes. diff --git a/dist/bind/lib/dns/include/dns/validator.h b/dist/bind/lib/dns/include/dns/validator.h index 578222d3cbe..98ca73586c8 100644 --- a/dist/bind/lib/dns/include/dns/validator.h +++ b/dist/bind/lib/dns/include/dns/validator.h @@ -1,4 +1,4 @@ -/* $NetBSD: validator.h,v 1.1.1.1 2004/05/17 23:44:58 christos Exp $ */ +/* $NetBSD: validator.h,v 1.1.1.2 2004/11/06 23:55:45 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: validator.h,v 1.18.12.6 2004/04/15 23:56:33 marka Exp */ +/* Id: validator.h,v 1.18.12.7 2004/05/14 05:06:41 marka Exp */ #ifndef DNS_VALIDATOR_H #define DNS_VALIDATOR_H 1 @@ -123,6 +123,8 @@ struct dns_validator { dns_fixedname_t wild; ISC_LINK(dns_validator_t) link; dns_rdataset_t * dlv; + dns_fixedname_t dlvsep; + isc_boolean_t havedlvsep; isc_boolean_t mustbesecure; }; diff --git a/dist/bind/lib/dns/journal.c b/dist/bind/lib/dns/journal.c index 42a331c07c7..7433e39e7f1 100644 --- a/dist/bind/lib/dns/journal.c +++ b/dist/bind/lib/dns/journal.c @@ -1,4 +1,4 @@ -/* $NetBSD: journal.c,v 1.1.1.1 2004/05/17 23:44:50 christos Exp $ */ +/* $NetBSD: journal.c,v 1.1.1.2 2004/11/06 23:55:37 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: journal.c,v 1.77.2.1.10.6 2004/03/08 09:04:30 marka Exp */ +/* Id: journal.c,v 1.77.2.1.10.8 2004/05/14 05:27:47 marka Exp */ #include <config.h> @@ -1824,10 +1824,16 @@ dns_db_diff(isc_mem_t *mctx, dns_fixedname_init(&fixname[0]); dns_fixedname_init(&fixname[1]); - CHECK(dns_journal_open(mctx, journal_filename, ISC_TRUE, &journal)); + result = dns_journal_open(mctx, journal_filename, ISC_TRUE, &journal); + if (result != ISC_R_SUCCESS) + return (result); - CHECK(dns_db_createiterator(db[0], ISC_FALSE, &dbit[0])); - CHECK(dns_db_createiterator(db[1], ISC_FALSE, &dbit[1])); + result = dns_db_createiterator(db[0], ISC_FALSE, &dbit[0]); + if (result != ISC_R_SUCCESS) + goto cleanup_journal; + result = dns_db_createiterator(db[1], ISC_FALSE, &dbit[1]); + if (result != ISC_R_SUCCESS) + goto cleanup_interator0; itresult[0] = dns_dbiterator_first(dbit[0]); itresult[1] = dns_dbiterator_first(dbit[1]); @@ -1900,8 +1906,10 @@ dns_db_diff(isc_mem_t *mctx, failure: dns_diff_clear(&resultdiff); - dns_dbiterator_destroy(&dbit[0]); dns_dbiterator_destroy(&dbit[1]); + cleanup_interator0: + dns_dbiterator_destroy(&dbit[0]); + cleanup_journal: dns_journal_destroy(&journal); return (result); } @@ -2117,6 +2125,7 @@ index_to_disk(dns_journal_t *j) { } INSIST(p == j->rawindex + rawbytes); + CHECK(journal_seek(j, sizeof(journal_rawheader_t))); CHECK(journal_write(j, j->rawindex, rawbytes)); } failure: diff --git a/dist/bind/lib/dns/master.c b/dist/bind/lib/dns/master.c index 50b796512c5..43a6d2f64ec 100644 --- a/dist/bind/lib/dns/master.c +++ b/dist/bind/lib/dns/master.c @@ -1,4 +1,4 @@ -/* $NetBSD: master.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */ +/* $NetBSD: master.c,v 1.1.1.2 2004/11/06 23:55:37 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: master.c,v 1.122.2.8.2.13 2004/03/08 02:07:53 marka Exp */ +/* Id: master.c,v 1.122.2.8.2.14 2004/05/05 01:32:16 marka Exp */ #include <config.h> @@ -1647,7 +1647,8 @@ load(dns_loadctx_t *lctx) { } - if (type == dns_rdatatype_rrsig) + if (type == dns_rdatatype_rrsig || + type == dns_rdatatype_sig) covers = dns_rdata_covers(&rdata[rdcount]); else covers = 0; diff --git a/dist/bind/lib/dns/masterdump.c b/dist/bind/lib/dns/masterdump.c index ab3cf3d2e28..f3457bbda06 100644 --- a/dist/bind/lib/dns/masterdump.c +++ b/dist/bind/lib/dns/masterdump.c @@ -1,4 +1,4 @@ -/* $NetBSD: masterdump.c,v 1.1.1.1 2004/05/17 23:44:49 christos Exp $ */ +/* $NetBSD: masterdump.c,v 1.1.1.2 2004/11/06 23:55:35 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: masterdump.c,v 1.56.2.5.2.10 2004/03/08 09:04:30 marka Exp */ +/* Id: masterdump.c,v 1.56.2.5.2.12 2004/08/28 06:25:19 marka Exp */ #include <config.h> @@ -27,6 +27,7 @@ #include <isc/file.h> #include <isc/magic.h> #include <isc/mem.h> +#include <isc/print.h> #include <isc/stdio.h> #include <isc/string.h> #include <isc/task.h> @@ -981,6 +982,7 @@ closeandrename(FILE *f, isc_result_t result, const char *temp, const char *file) static void dump_quantum(isc_task_t *task, isc_event_t *event) { isc_result_t result; + isc_result_t tresult; dns_dumpctx_t *dctx; REQUIRE(event != NULL); @@ -996,11 +998,12 @@ dump_quantum(isc_task_t *task, isc_event_t *event) { return; } - if (dctx->file != NULL) - result = closeandrename(dctx->f, result, - dctx->tmpfile, dctx->file); - if (dctx->version != NULL) - dns_db_closeversion(dctx->db, &dctx->version, ISC_FALSE); + if (dctx->file != NULL) { + tresult = closeandrename(dctx->f, result, + dctx->tmpfile, dctx->file); + if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS) + result = tresult; + } (dctx->done)(dctx->done_arg, result); isc_event_free(&event); dns_dumpctx_detach(&dctx); diff --git a/dist/bind/lib/dns/message.c b/dist/bind/lib/dns/message.c index 693930d1863..30be78789fe 100644 --- a/dist/bind/lib/dns/message.c +++ b/dist/bind/lib/dns/message.c @@ -1,4 +1,4 @@ -/* $NetBSD: message.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */ +/* $NetBSD: message.c,v 1.1.1.2 2004/11/06 23:55:38 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: message.c,v 1.194.2.10.2.16 2004/03/10 00:48:49 marka Exp */ +/* Id: message.c,v 1.194.2.10.2.17 2004/05/05 01:32:16 marka Exp */ /*** *** Imports @@ -1290,18 +1290,16 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, if (result != ISC_R_SUCCESS) goto cleanup; rdata->rdclass = rdclass; + issigzero = ISC_FALSE; if (rdtype == dns_rdatatype_rrsig && rdata->flags == 0) { covers = dns_rdata_covers(rdata); if (covers == 0) DO_FORMERR; - } else - covers = 0; - - issigzero = ISC_FALSE; - if (rdtype == dns_rdatatype_sig /* SIG(0) */ && - rdata->flags == 0) { - if (dns_rdata_covers(rdata) == 0) { + } else if (rdtype == dns_rdatatype_sig /* SIG(0) */ && + rdata->flags == 0) { + covers = dns_rdata_covers(rdata); + if (covers == 0) { if (sectionid != DNS_SECTION_ADDITIONAL || count != msg->counts[sectionid] - 1) DO_FORMERR; @@ -1310,7 +1308,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, skip_type_search = ISC_TRUE; issigzero = ISC_TRUE; } - } + } else + covers = 0; /* * If we are doing a dynamic update or this is a meta-type, diff --git a/dist/bind/lib/dns/name.c b/dist/bind/lib/dns/name.c index 8f6261e96f1..dac5874e8f4 100644 --- a/dist/bind/lib/dns/name.c +++ b/dist/bind/lib/dns/name.c @@ -1,4 +1,4 @@ -/* $NetBSD: name.c,v 1.1.1.1 2004/05/17 23:44:51 christos Exp $ */ +/* $NetBSD: name.c,v 1.1.1.2 2004/11/06 23:55:38 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: name.c,v 1.127.2.7.2.10 2004/04/19 21:55:38 marka Exp */ +/* Id: name.c,v 1.127.2.7.2.11 2004/09/01 05:19:59 marka Exp */ #include <config.h> @@ -181,6 +181,9 @@ static dns_name_t wild = /* XXXDCL make const? */ LIBDNS_EXTERNAL_DATA dns_name_t *dns_wildcardname = &wild; +unsigned int +dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive); + static void set_offsets(const dns_name_t *name, unsigned char *offsets, dns_name_t *set_name); @@ -432,7 +435,7 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) { } unsigned int -dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) { +dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive) { /* * Provide a hash value for 'name'. */ @@ -446,6 +449,18 @@ dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) { } unsigned int +dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) { + /* + * This function was deprecated due to the breakage of the name space + * convention. We only keep this internally to provide binary backward + * compatibility. + */ + REQUIRE(VALID_NAME(name)); + + return (dns_name_fullhash(name, case_sensitive)); +} + +unsigned int dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive) { unsigned char *offsets; dns_offsets_t odata; diff --git a/dist/bind/lib/dns/rbtdb.c b/dist/bind/lib/dns/rbtdb.c index 87e9f72f227..181af9195c7 100644 --- a/dist/bind/lib/dns/rbtdb.c +++ b/dist/bind/lib/dns/rbtdb.c @@ -1,4 +1,4 @@ -/* $NetBSD: rbtdb.c,v 1.1.1.1 2004/05/17 23:44:52 christos Exp $ */ +/* $NetBSD: rbtdb.c,v 1.1.1.2 2004/11/06 23:55:39 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: rbtdb.c,v 1.168.2.11.2.12 2004/03/08 02:07:55 marka Exp */ +/* Id: rbtdb.c,v 1.168.2.11.2.16 2004/05/23 11:07:23 marka Exp */ /* * Principal Author: Bob Halley @@ -844,8 +844,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, /* * If this is a NONEXISTENT rdataset, we can delete it. */ - if ((current->attributes & RDATASET_ATTR_NONEXISTENT) - != 0) { + if (NONEXISTENT(current)) { if (top_prev != NULL) top_prev->next = current->next; else @@ -1064,9 +1063,13 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) { * isn't being used by anyone, we can clean * it up. */ - if (rbtdb->current_version->references == 0) + if (rbtdb->current_version->references == 0) { cleanup_version = rbtdb->current_version; + APPENDLIST(version->changed_list, + cleanup_version->changed_list, + link); + } /* * Become the current version. */ @@ -1079,6 +1082,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) { * We're rolling back this transaction. */ cleanup_list = version->changed_list; + ISC_LIST_INIT(version->changed_list); rollback = ISC_TRUE; cleanup_version = version; rbtdb->future_version = NULL; @@ -1099,6 +1103,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) { if (least_greater == NULL) least_greater = rbtdb->current_version; + INSIST(version->serial < least_greater->serial); /* * Is this the least open version? */ @@ -1119,16 +1124,19 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) { version->changed_list, link); } - } + } else if (version->serial == rbtdb->least_serial) + INSIST(EMPTY(version->changed_list)); UNLINK(rbtdb->open_versions, version, link); } } least_serial = rbtdb->least_serial; UNLOCK(&rbtdb->lock); - if (cleanup_version != NULL) + if (cleanup_version != NULL) { + INSIST(EMPTY(cleanup_version->changed_list)); isc_mem_put(rbtdb->common.mctx, cleanup_version, sizeof(*cleanup_version)); + } if (!EMPTY(cleanup_list)) { for (changed = HEAD(cleanup_list); @@ -1933,8 +1941,7 @@ find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep, * Is this a "this rdataset doesn't * exist" record? */ - if ((header->attributes & - RDATASET_ATTR_NONEXISTENT) != 0) + if (NONEXISTENT(header)) header = NULL; break; } else @@ -2206,8 +2213,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, * Is this a "this rdataset doesn't * exist" record? */ - if ((header->attributes & - RDATASET_ATTR_NONEXISTENT) != 0) + if (NONEXISTENT(header)) header = NULL; break; } else @@ -2660,8 +2666,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node, node->dirty = 1; header_prev = header; } - } else if ((header->attributes & - RDATASET_ATTR_NONEXISTENT) == 0) { + } else if (EXISTS(header)) { /* * We've found an extant rdataset. See if * we're interested in it. @@ -2738,6 +2743,104 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node, } static isc_result_t +find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, + isc_stdtime_t now, dns_name_t *foundname, + dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) +{ + dns_rbtnode_t *node; + rdatasetheader_t *header, *header_next, *header_prev; + rdatasetheader_t *found, *foundsig; + isc_boolean_t empty_node; + isc_result_t result; + dns_fixedname_t fname, forigin; + dns_name_t *name, *origin; + rbtdb_rdatatype_t matchtype, sigmatchtype, nsectype; + + matchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_nsec, 0); + nsectype = RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_nsec); + sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, + dns_rdatatype_nsec); + + do { + node = NULL; + dns_fixedname_init(&fname); + name = dns_fixedname_name(&fname); + dns_fixedname_init(&forigin); + origin = dns_fixedname_name(&forigin); + result = dns_rbtnodechain_current(&search->chain, name, + origin, &node); + if (result != ISC_R_SUCCESS) + return (result); + LOCK(&(search->rbtdb->node_locks[node->locknum].lock)); + found = NULL; + foundsig = NULL; + empty_node = ISC_TRUE; + header_prev = NULL; + for (header = node->data; + header != NULL; + header = header_next) { + header_next = header->next; + if (header->ttl <= now) { + /* + * This rdataset is stale. If no one else is + * using the node, we can clean it up right + * now, otherwise we mark it as stale, and the + * node as dirty, so it will get cleaned up + * later. + */ + if (node->references == 0) { + INSIST(header->down == NULL); + if (header_prev != NULL) + header_prev->next = + header->next; + else + node->data = header->next; + free_rdataset(search->rbtdb->common.mctx, + header); + } else { + header->attributes |= + RDATASET_ATTR_STALE; + node->dirty = 1; + header_prev = header; + } + continue; + } + if (NONEXISTENT(header) || NXDOMAIN(header)) { + header_prev = header; + continue; + } + empty_node = ISC_FALSE; + if (header->type == matchtype) + found = header; + else if (header->type == sigmatchtype) + foundsig = header; + header_prev = header; + } + if (found != NULL) { + result = dns_name_concatenate(name, origin, + foundname, NULL); + if (result != ISC_R_SUCCESS) + goto unlock_node; + bind_rdataset(search->rbtdb, node, found, + now, rdataset); + if (foundsig != NULL) + bind_rdataset(search->rbtdb, node, foundsig, + now, sigrdataset); + new_reference(search->rbtdb, node); + *nodep = node; + result = DNS_R_COVERINGNSEC; + } else if (!empty_node) { + result = ISC_R_NOTFOUND; + }else + result = dns_rbtnodechain_prev(&search->chain, NULL, + NULL); + unlock_node: + UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock)); + } while (empty_node && result == ISC_R_SUCCESS); + return (result); +} + +static isc_result_t cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, dns_rdatatype_t type, unsigned int options, isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname, @@ -2752,7 +2855,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, rdatasetheader_t *header, *header_prev, *header_next; rdatasetheader_t *found, *nsheader; rdatasetheader_t *foundsig, *nssig, *cnamesig; - rbtdb_rdatatype_t sigtype, nsecype; + rbtdb_rdatatype_t sigtype, nsectype; UNUSED(version); @@ -2787,6 +2890,13 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, cache_zonecut_callback, &search); if (result == DNS_R_PARTIALMATCH) { + if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0) { + result = find_coveringnsec(&search, nodep, now, + foundname, rdataset, + sigrdataset); + if (result == DNS_R_COVERINGNSEC) + goto tree_exit; + } if (search.zonecut != NULL) { result = setup_delegation(&search, nodep, foundname, rdataset, sigrdataset); @@ -2820,7 +2930,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, found = NULL; foundsig = NULL; sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); - nsecype = RBTDB_RDATATYPE_VALUE(0, type); + nsectype = RBTDB_RDATATYPE_VALUE(0, type); nsheader = NULL; nssig = NULL; cnamesig = NULL; @@ -2848,8 +2958,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, node->dirty = 1; header_prev = header; } - } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT) - == 0) { + } else if (EXISTS(header)) { /* * We now know that there is at least one active * non-stale rdataset at this node. @@ -2891,7 +3000,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, */ foundsig = header; } else if (header->type == RBTDB_RDATATYPE_NCACHEANY || - header->type == nsecype) { + header->type == nsectype) { /* * We've found a negative cache entry. */ @@ -3116,8 +3225,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options, node->dirty = 1; header_prev = header; } - } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT) - == 0) { + } else if (EXISTS(header)) { /* * If we found a type we were looking for, remember * it. @@ -3180,6 +3288,7 @@ attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) { dns_rbtnode_t *node = (dns_rbtnode_t *)source; REQUIRE(VALID_RBTDB(rbtdb)); + REQUIRE(targetp != NULL && *targetp == NULL); LOCK(&rbtdb->node_locks[node->locknum].lock); INSIST(node->references > 0); @@ -3450,8 +3559,7 @@ zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, * Is this a "this rdataset doesn't * exist" record? */ - if ((header->attributes & - RDATASET_ATTR_NONEXISTENT) != 0) + if (NONEXISTENT(header)) header = NULL; break; } else @@ -3501,7 +3609,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db; dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node; rdatasetheader_t *header, *header_next, *found, *foundsig; - rbtdb_rdatatype_t matchtype, sigmatchtype, nsecype; + rbtdb_rdatatype_t matchtype, sigmatchtype, nsectype; isc_result_t result; REQUIRE(VALID_RBTDB(rbtdb)); @@ -3519,7 +3627,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, found = NULL; foundsig = NULL; matchtype = RBTDB_RDATATYPE_VALUE(type, covers); - nsecype = RBTDB_RDATATYPE_VALUE(0, type); + nsectype = RBTDB_RDATATYPE_VALUE(0, type); if (covers == 0) sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type); else @@ -3536,12 +3644,11 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, */ header->attributes |= RDATASET_ATTR_STALE; rbtnode->dirty = 1; - } else if ((header->attributes & RDATASET_ATTR_NONEXISTENT) == - 0) { + } else if (EXISTS(header)) { if (header->type == matchtype) found = header; else if (header->type == RBTDB_RDATATYPE_NCACHEANY || - header->type == nsecype) + header->type == nsectype) found = header; else if (header->type == sigmatchtype) foundsig = header; @@ -3671,10 +3778,13 @@ cname_and_other_data(dns_rbtnode_t *node, rbtdb_serial_t serial) { * or RRSIG CNAME. */ rdtype = RBTDB_RDATATYPE_BASE(header->type); - if (rdtype == dns_rdatatype_rrsig) + if (rdtype == dns_rdatatype_rrsig || + rdtype == dns_rdatatype_sig) rdtype = RBTDB_RDATATYPE_EXT(header->type); if (rdtype != dns_rdatatype_nsec && rdtype != dns_rdatatype_dnskey && + rdtype != dns_rdatatype_nxt && + rdtype != dns_rdatatype_key && rdtype != dns_rdatatype_cname) { /* * We've found a type that isn't @@ -3718,7 +3828,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, isc_boolean_t header_nx; isc_boolean_t newheader_nx; isc_boolean_t merge; - dns_rdatatype_t nsecype, rdtype, covers; + dns_rdatatype_t nsectype, rdtype, covers; dns_trust_t trust; /* @@ -3756,7 +3866,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, newheader_nx = NONEXISTENT(newheader) ? ISC_TRUE : ISC_FALSE; topheader_prev = NULL; - nsecype = 0; + nsectype = 0; if (rbtversion == NULL && !newheader_nx) { rdtype = RBTDB_RDATATYPE_BASE(newheader->type); if (rdtype == 0) { @@ -3783,7 +3893,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, rbtnode->dirty = 1; goto find_header; } - nsecype = RBTDB_RDATATYPE_VALUE(covers, 0); + nsectype = RBTDB_RDATATYPE_VALUE(covers, 0); } else { /* * We're adding something that isn't a @@ -3823,7 +3933,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, topheader = NULL; goto find_header; } - nsecype = RBTDB_RDATATYPE_VALUE(0, rdtype); + nsectype = RBTDB_RDATATYPE_VALUE(0, rdtype); } } @@ -3831,7 +3941,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, topheader != NULL; topheader = topheader->next) { if (topheader->type == newheader->type || - topheader->type == nsecype) + topheader->type == nsectype) break; topheader_prev = topheader; } @@ -4092,8 +4202,10 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader, RUNTIME_CHECK(result == ISC_R_SUCCESS); noqname = isc_mem_get(mctx, sizeof(*noqname)); - if (noqname == NULL) - return (ISC_R_NOMEMORY); + if (noqname == NULL) { + result = ISC_R_NOMEMORY; + goto cleanup; + } dns_name_init(&noqname->name, NULL); noqname->nsec = NULL; noqname->nsecsig = NULL; @@ -4114,6 +4226,8 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader, return (ISC_R_SUCCESS); cleanup: + dns_rdataset_disassociate(&nsec); + dns_rdataset_disassociate(&nsecsig); free_noqname(mctx, &noqname); return(result); } @@ -4956,7 +5070,7 @@ static void rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) { dns_db_t *db = source->private1; dns_dbnode_t *node = source->private2; - dns_dbnode_t *cloned_node; + dns_dbnode_t *cloned_node = NULL; attachnode(db, node, &cloned_node); *target = *source; @@ -4987,9 +5101,8 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *cloned_node; struct noqname *noqname = rdataset->private6; + cloned_node = NULL; attachnode(db, node, &cloned_node); - attachnode(db, node, &cloned_node); - nsec->methods = &rdataset_methods; nsec->rdclass = db->rdclass; nsec->type = dns_rdatatype_nsec; @@ -5003,6 +5116,8 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name, nsec->private5 = NULL; nsec->private6 = NULL; + cloned_node = NULL; + attachnode(db, node, &cloned_node); nsecsig->methods = &rdataset_methods; nsecsig->rdclass = db->rdclass; nsecsig->type = dns_rdatatype_rrsig; @@ -5021,7 +5136,6 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name, return (ISC_R_SUCCESS); } - /* * Rdataset Iterator Methods */ diff --git a/dist/bind/lib/dns/rdata/generic/rrsig_46.c b/dist/bind/lib/dns/rdata/generic/rrsig_46.c index 3089a64f38b..887bec85d5a 100644 --- a/dist/bind/lib/dns/rdata/generic/rrsig_46.c +++ b/dist/bind/lib/dns/rdata/generic/rrsig_46.c @@ -1,4 +1,4 @@ -/* $NetBSD: rrsig_46.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */ +/* $NetBSD: rrsig_46.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: rrsig_46.c,v 1.4.2.2 2004/03/16 12:38:14 marka Exp */ +/* Id: rrsig_46.c,v 1.4.2.3 2004/06/24 00:58:06 marka Exp */ /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */ @@ -156,8 +156,8 @@ totext_rrsig(ARGS_TOTEXT) { if (dns_rdatatype_isknown(covered) && covered != 0) { RETERR(dns_rdatatype_totext(covered, target)); } else { - char buf[sizeof("65535")]; - sprintf(buf, "%u", covered); + char buf[sizeof("TYPE65535")]; + sprintf(buf, "TYPE%u", covered); RETERR(str_totext(buf, target)); } RETERR(str_totext(" ", target)); diff --git a/dist/bind/lib/dns/resolver.c b/dist/bind/lib/dns/resolver.c index 4b953db42f1..ee58adf8d24 100644 --- a/dist/bind/lib/dns/resolver.c +++ b/dist/bind/lib/dns/resolver.c @@ -1,4 +1,4 @@ -/* $NetBSD: resolver.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */ +/* $NetBSD: resolver.c,v 1.1.1.2 2004/11/06 23:55:41 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,10 +17,11 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: resolver.c,v 1.218.2.18.4.36 2004/04/19 23:41:33 marka Exp */ +/* Id: resolver.c,v 1.218.2.18.4.43 2004/08/28 06:25:19 marka Exp */ #include <config.h> +#include <isc/print.h> #include <isc/string.h> #include <isc/task.h> #include <isc/timer.h> @@ -67,25 +68,28 @@ DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, \ ISC_LOG_DEBUG(3), \ - "fctx %p: %s", fctx, (m)) + "fctx %p(%s'): %s", fctx, fctx->info, (m)) #define FCTXTRACE2(m1, m2) \ isc_log_write(dns_lctx, \ DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, \ ISC_LOG_DEBUG(3), \ - "fctx %p: %s %s", fctx, (m1), (m2)) + "fctx %p(%s): %s %s", \ + fctx, fctx->info, (m1), (m2)) #define FTRACE(m) isc_log_write(dns_lctx, \ DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, \ ISC_LOG_DEBUG(3), \ - "fetch %p (fctx %p): %s", \ - fetch, fetch->private, (m)) + "fetch %p (fctx %p(%s)): %s", \ + fetch, fetch->private, \ + fetch->private->info, (m)) #define QTRACE(m) isc_log_write(dns_lctx, \ DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, \ ISC_LOG_DEBUG(3), \ - "resquery %p (fctx %p): %s", \ - query, query->fctx, (m)) + "resquery %p (fctx %p(%s)): %s", \ + query, query->fctx, \ + query->fctx->info, (m)) #else #define RTRACE(m) #define RRTRACE(r, m) @@ -154,6 +158,7 @@ struct fetchctx { dns_rdatatype_t type; unsigned int options; unsigned int bucketnum; + char * info; /* Locked by appropriate bucket lock. */ fetchstate state; isc_boolean_t want_shutdown; @@ -1123,6 +1128,8 @@ resquery_send(resquery_t *query) { &secure_domain); if (result != ISC_R_SUCCESS) secure_domain = ISC_FALSE; + if (res->view->dlv != NULL) + secure_domain = ISC_TRUE; if (secure_domain) fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD; } else @@ -1817,8 +1824,23 @@ fctx_getaddresses(fetchctx_t *fctx) { sa = ISC_LIST_HEAD(fctx->forwarders); if (sa == NULL) { dns_forwarders_t *forwarders = NULL; - result = dns_fwdtable_find(fctx->res->view->fwdtable, - &fctx->name, &forwarders); + dns_name_t *name = &fctx->name; + dns_name_t suffix; + unsigned int labels; + + /* + * DS records are found in the parent server. + * Strip label to get the correct forwarder (if any). + */ + if (fctx->type == dns_rdatatype_ds && + dns_name_countlabels(name) > 1) { + dns_name_init(&suffix, NULL); + labels = dns_name_countlabels(name); + dns_name_getlabelsequence(name, 1, labels - 1, &suffix); + name = &suffix; + } + result = dns_fwdtable_find(fctx->res->view->fwdtable, name, + &forwarders); if (result == ISC_R_SUCCESS) { sa = ISC_LIST_HEAD(forwarders->addrs); fctx->fwdpolicy = forwarders->fwdpolicy; @@ -2055,7 +2077,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) static inline dns_adbaddrinfo_t * fctx_nextaddress(fetchctx_t *fctx) { - dns_adbfind_t *find; + dns_adbfind_t *find, *start; dns_adbaddrinfo_t *addrinfo; dns_adbaddrinfo_t *faddrinfo; @@ -2098,23 +2120,26 @@ fctx_nextaddress(fetchctx_t *fctx) { * Find the first unmarked addrinfo. */ addrinfo = NULL; - while (find != fctx->find) { - for (addrinfo = ISC_LIST_HEAD(find->list); - addrinfo != NULL; - addrinfo = ISC_LIST_NEXT(addrinfo, publink)) { - if (!UNMARKED(addrinfo)) - continue; - possibly_mark(fctx, addrinfo); - if (UNMARKED(addrinfo)) { - addrinfo->flags |= FCTX_ADDRINFO_MARK; - break; + if (find != NULL) { + start = find; + do { + for (addrinfo = ISC_LIST_HEAD(find->list); + addrinfo != NULL; + addrinfo = ISC_LIST_NEXT(addrinfo, publink)) { + if (!UNMARKED(addrinfo)) + continue; + possibly_mark(fctx, addrinfo); + if (UNMARKED(addrinfo)) { + addrinfo->flags |= FCTX_ADDRINFO_MARK; + break; + } } - } - if (addrinfo != NULL) - break; - find = ISC_LIST_NEXT(find, publink); - if (find != fctx->find && find == NULL) - find = ISC_LIST_HEAD(fctx->finds); + if (addrinfo != NULL) + break; + find = ISC_LIST_NEXT(find, publink); + if (find == NULL) + find = ISC_LIST_HEAD(fctx->finds); + } while (find != start); } fctx->find = find; @@ -2140,23 +2165,26 @@ fctx_nextaddress(fetchctx_t *fctx) { * Find the first unmarked addrinfo. */ addrinfo = NULL; - while (find != fctx->altfind) { - for (addrinfo = ISC_LIST_HEAD(find->list); - addrinfo != NULL; - addrinfo = ISC_LIST_NEXT(addrinfo, publink)) { - if (!UNMARKED(addrinfo)) - continue; - possibly_mark(fctx, addrinfo); - if (UNMARKED(addrinfo)) { - addrinfo->flags |= FCTX_ADDRINFO_MARK; - break; + if (find != NULL) { + start = find; + do { + for (addrinfo = ISC_LIST_HEAD(find->list); + addrinfo != NULL; + addrinfo = ISC_LIST_NEXT(addrinfo, publink)) { + if (!UNMARKED(addrinfo)) + continue; + possibly_mark(fctx, addrinfo); + if (UNMARKED(addrinfo)) { + addrinfo->flags |= FCTX_ADDRINFO_MARK; + break; + } } - } - if (addrinfo != NULL) - break; - find = ISC_LIST_NEXT(find, publink); - if (find != fctx->altfind && find == NULL) - find = ISC_LIST_HEAD(fctx->altfinds); + if (addrinfo != NULL) + break; + find = ISC_LIST_NEXT(find, publink); + if (find == NULL) + find = ISC_LIST_HEAD(fctx->altfinds); + } while (find != start); } faddrinfo = addrinfo; @@ -2289,6 +2317,7 @@ fctx_destroy(fetchctx_t *fctx) { dns_name_free(&fctx->name, res->mctx); dns_db_detach(&fctx->cache); dns_adb_detach(&fctx->adb); + isc_mem_free(res->mctx, fctx->info); isc_mem_put(res->mctx, fctx, sizeof(*fctx)); LOCK(&res->nlock); @@ -2577,6 +2606,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, isc_interval_t interval; dns_fixedname_t qdomain; unsigned int findoptions = 0; + char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE]; + char typebuf[DNS_RDATATYPE_FORMATSIZE]; + dns_name_t suffix; /* * Caller must be holding the lock for bucket number 'bucketnum'. @@ -2586,11 +2618,18 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, fctx = isc_mem_get(res->mctx, sizeof(*fctx)); if (fctx == NULL) return (ISC_R_NOMEMORY); + dns_name_format(name, buf, sizeof(buf)); + dns_rdatatype_format(type, typebuf, sizeof(typebuf)); + strcat(buf, "/"); /* checked */ + strcat(buf, typebuf); /* checked */ + fctx->info = isc_mem_strdup(res->mctx, buf); + if (fctx->info == NULL) + goto cleanup_fetch; FCTXTRACE("create"); dns_name_init(&fctx->name, NULL); result = dns_name_dup(name, res->mctx, &fctx->name); if (result != ISC_R_SUCCESS) - goto cleanup_fetch; + goto cleanup_info; dns_name_init(&fctx->domain, NULL); dns_rdataset_init(&fctx->nameservers); @@ -2629,8 +2668,21 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, if (domain == NULL) { dns_forwarders_t *forwarders = NULL; - result = dns_fwdtable_find(fctx->res->view->fwdtable, - &fctx->name, &forwarders); + unsigned int labels; + + /* + * DS records are found in the parent server. + * Strip label to get the correct forwarder (if any). + */ + if (fctx->type == dns_rdatatype_ds && + dns_name_countlabels(name) > 1) { + dns_name_init(&suffix, NULL); + labels = dns_name_countlabels(name); + dns_name_getlabelsequence(name, 1, labels - 1, &suffix); + name = &suffix; + } + result = dns_fwdtable_find(fctx->res->view->fwdtable, name, + &forwarders); if (result == ISC_R_SUCCESS) fctx->fwdpolicy = forwarders->fwdpolicy; @@ -2763,6 +2815,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, cleanup_name: dns_name_free(&fctx->name, res->mctx); + cleanup_info: + isc_mem_free(res->mctx, fctx->info); + cleanup_fetch: isc_mem_put(res->mctx, fctx, sizeof(*fctx)); @@ -3093,7 +3148,6 @@ validated(isc_task_t *task, isc_event_t *event) { ardataset, &eresult); if (result != ISC_R_SUCCESS) goto noanswer_response; - goto answer_response; } @@ -3154,8 +3208,9 @@ validated(isc_task_t *task, isc_event_t *event) { goto cleanup_event; } + answer_response: /* - * Cache any NS records that happened to be validate. + * Cache any NS/NSEC records that happened to be validated. */ result = dns_message_firstname(fctx->rmessage, DNS_SECTION_AUTHORITY); while (result == ISC_R_SUCCESS) { @@ -3165,14 +3220,15 @@ validated(isc_task_t *task, isc_event_t *event) { for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link)) { - if (rdataset->type != dns_rdatatype_ns || + if ((rdataset->type != dns_rdatatype_ns && + rdataset->type != dns_rdatatype_nsec) || rdataset->trust != dns_trust_secure) continue; for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL; sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) { if (sigrdataset->type != dns_rdatatype_rrsig || - sigrdataset->covers != dns_rdatatype_ns) + sigrdataset->covers != rdataset->type) continue; break; } @@ -3199,7 +3255,6 @@ validated(isc_task_t *task, isc_event_t *event) { result = ISC_R_SUCCESS; - answer_response: /* * Respond with an answer, positive or negative, * as opposed to an error. 'node' must be non-NULL. @@ -3264,6 +3319,9 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { if (result != ISC_R_SUCCESS) return (result); + if (res->view->dlv != NULL) + secure_domain = ISC_TRUE; + if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) need_validation = ISC_FALSE; else @@ -3688,6 +3746,9 @@ ncache_message(fetchctx_t *fctx, dns_rdatatype_t covers, isc_stdtime_t now) { if (result != ISC_R_SUCCESS) return (result); + if (res->view->dlv != NULL) + secure_domain = ISC_TRUE; + if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) need_validation = ISC_FALSE; else @@ -4693,6 +4754,9 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) { isc_boolean_t bucket_empty = ISC_FALSE; isc_boolean_t locked = ISC_FALSE; unsigned int bucketnum; + dns_rdataset_t nameservers; + dns_fixedname_t fixed; + dns_name_t *domain; REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE); fevent = (dns_fetchevent_t *)event; @@ -4708,15 +4772,17 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) { if (fevent->db != NULL) dns_db_detach(&fevent->db); - dns_resolver_destroyfetch(&fctx->nsfetch); + dns_rdataset_init(&nameservers); bucketnum = fctx->bucketnum; - if (fevent->result == ISC_R_CANCELED) + if (fevent->result == ISC_R_CANCELED) { + dns_resolver_destroyfetch(&fctx->nsfetch); fctx_done(fctx, ISC_R_CANCELED); - else if (fevent->result == ISC_R_SUCCESS) { + } else if (fevent->result == ISC_R_SUCCESS) { FCTXTRACE("resuming DS lookup"); + dns_resolver_destroyfetch(&fctx->nsfetch); if (dns_rdataset_isassociated(&fctx->nameservers)) dns_rdataset_disassociate(&fctx->nameservers); dns_rdataset_clone(fevent->rdataset, &fctx->nameservers); @@ -4735,22 +4801,29 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) { } else { unsigned int n; + /* + * Retrieve state from fctx->nsfetch before we destroy it. + */ + dns_fixedname_init(&fixed); + domain = dns_fixedname_name(&fixed); + dns_name_copy(&fctx->nsfetch->private->domain, domain, NULL); + dns_rdataset_clone(&fctx->nsfetch->private->nameservers, + &nameservers); + dns_resolver_destroyfetch(&fctx->nsfetch); + if (dns_name_equal(&fctx->nsname, domain)) { + fctx_done(fctx, DNS_R_SERVFAIL); + goto cleanup; + } n = dns_name_countlabels(&fctx->nsname); dns_name_getlabelsequence(&fctx->nsname, 1, n - 1, &fctx->nsname); - if (dns_name_equal(&fctx->nsname, &fctx->domain)) { - fctx_done(fctx, DNS_R_SERVFAIL); - goto cleanup; - } if (dns_rdataset_isassociated(fevent->rdataset)) dns_rdataset_disassociate(fevent->rdataset); FCTXTRACE("continuing to look for parent's NS records"); result = dns_resolver_createfetch(fctx->res, &fctx->nsname, - dns_rdatatype_ns, - &fctx->domain, - &fctx->nameservers, NULL, - 0, task, + dns_rdatatype_ns, domain, + &nameservers, NULL, 0, task, resume_dslookup, fctx, &fctx->nsrrset, NULL, &fctx->nsfetch); @@ -4764,6 +4837,8 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) { } cleanup: + if (dns_rdataset_isassociated(&nameservers)) + dns_rdataset_disassociate(&nameservers); if (dns_rdataset_isassociated(fevent->rdataset)) dns_rdataset_disassociate(fevent->rdataset); INSIST(fevent->sigrdataset == NULL); diff --git a/dist/bind/lib/dns/result.c b/dist/bind/lib/dns/result.c index 09163c77492..f4b2ecdb8e9 100644 --- a/dist/bind/lib/dns/result.c +++ b/dist/bind/lib/dns/result.c @@ -1,4 +1,4 @@ -/* $NetBSD: result.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */ +/* $NetBSD: result.c,v 1.1.1.2 2004/11/06 23:55:41 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: result.c,v 1.90.2.9.2.12 2004/04/15 23:56:30 marka Exp */ +/* Id: result.c,v 1.90.2.9.2.13 2004/05/14 05:06:39 marka Exp */ #include <config.h> @@ -152,7 +152,8 @@ static const char *text[DNS_R_NRESULTS] = { "dynamic zone", /* 98 DNS_R_DYNAMIC */ "unknown command", /* 99 DNS_R_UNKNOWNCOMMAND */ - "must-be-secure" /* 100 DNS_R_MUSTBESECURE */ + "must-be-secure", /* 100 DNS_R_MUSTBESECURE */ + "covering NSEC record returned" /* 101 DNS_R_COVERINGNSEC */ }; static const char *rcode_text[DNS_R_NRCODERESULTS] = { diff --git a/dist/bind/lib/dns/sdb.c b/dist/bind/lib/dns/sdb.c index 97a429bcfde..34c04ba8cba 100644 --- a/dist/bind/lib/dns/sdb.c +++ b/dist/bind/lib/dns/sdb.c @@ -1,4 +1,4 @@ -/* $NetBSD: sdb.c,v 1.1.1.1 2004/05/17 23:44:54 christos Exp $ */ +/* $NetBSD: sdb.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: sdb.c,v 1.35.12.7 2004/03/08 21:06:27 marka Exp */ +/* Id: sdb.c,v 1.35.12.8 2004/07/22 04:01:58 marka Exp */ #include <config.h> @@ -631,10 +631,10 @@ attachversion(dns_db_t *db, dns_dbversion_t *source, dns_dbversion_t **targetp) { REQUIRE(source != NULL && source == (void *) &dummy); + REQUIRE(targetp != NULL && *targetp == NULL); UNUSED(db); - UNUSED(source); - UNUSED(targetp); + *targetp = source; return; } diff --git a/dist/bind/lib/dns/sec/dst/dst_api.c b/dist/bind/lib/dns/sec/dst/dst_api.c index d8f11f5c9d2..9321870a205 100644 --- a/dist/bind/lib/dns/sec/dst/dst_api.c +++ b/dist/bind/lib/dns/sec/dst/dst_api.c @@ -1,4 +1,4 @@ -/* $NetBSD: dst_api.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */ +/* $NetBSD: dst_api.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */ /* * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -20,7 +20,7 @@ /* * Principal Author: Brian Wellington - * Id: dst_api.c,v 1.88.2.3.2.12 2004/03/16 05:50:22 marka Exp + * Id: dst_api.c,v 1.88.2.3.2.15 2004/06/16 01:05:01 marka Exp */ #include <config.h> @@ -72,6 +72,7 @@ static dst_key_t * get_key_struct(dns_name_t *name, dns_rdataclass_t rdclass, isc_mem_t *mctx); static isc_result_t read_public_key(const char *filename, + int type, isc_mem_t *mctx, dst_key_t **keyp); static isc_result_t write_public_key(const dst_key_t *key, int type, @@ -147,9 +148,11 @@ dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) { RETERR(dst__openssl_init()); RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5])); RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1])); +#ifdef HAVE_OPENSSL_DSA RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA])); - RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH])); #endif + RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH])); +#endif /* OPENSSL */ #ifdef GSSAPI RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI])); #endif @@ -391,7 +394,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx, REQUIRE(mctx != NULL); REQUIRE(keyp != NULL && *keyp == NULL); - result = read_public_key(filename, mctx, &pubkey); + result = read_public_key(filename, type, mctx, &pubkey); if (result != ISC_R_SUCCESS) return (result); @@ -825,7 +828,9 @@ get_key_struct(dns_name_t *name, unsigned int alg, * Reads a public key from disk */ static isc_result_t -read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) { +read_public_key(const char *filename, int type, + isc_mem_t *mctx, dst_key_t **keyp) +{ u_char rdatabuf[DST_KEY_MAXSIZE]; isc_buffer_t b; dns_fixedname_t name; @@ -840,7 +845,7 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) { isc_lexspecials_t specials; isc_uint32_t ttl; isc_result_t result; - dns_rdatatype_t type; + dns_rdatatype_t keytype; newfilenamelen = strlen(filename) + 5; newfilename = isc_mem_get(mctx, newfilenamelen); @@ -913,14 +918,20 @@ read_public_key(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) { BADTOKEN(); if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0) - type = dns_rdatatype_dnskey; + keytype = dns_rdatatype_dnskey; else if (strcasecmp(DST_AS_STR(token), "KEY") == 0) - type = dns_rdatatype_key; /* SIG(0) */ + keytype = dns_rdatatype_key; /* SIG(0), TKEY */ else BADTOKEN(); + if (((type & DST_TYPE_KEY) != 0 && keytype != dns_rdatatype_key) || + ((type & DST_TYPE_KEY) == 0 && keytype != dns_rdatatype_dnskey)) { + ret = DST_R_BADKEYTYPE; + goto cleanup; + } + isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf)); - ret = dns_rdata_fromtext(&rdata, rdclass, type, lex, NULL, + ret = dns_rdata_fromtext(&rdata, rdclass, keytype, lex, NULL, ISC_FALSE, mctx, &b, NULL); if (ret != ISC_R_SUCCESS) goto cleanup; @@ -1138,10 +1149,12 @@ algorithm_status(unsigned int alg) { if (dst_algorithm_supported(alg)) return (ISC_R_SUCCESS); +#ifndef OPENSSL if (alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 || alg == DST_ALG_DSA || alg == DST_ALG_DH || alg == DST_ALG_HMACMD5) return (DST_R_NOCRYPTO); +#endif return (DST_R_UNSUPPORTEDALG); } diff --git a/dist/bind/lib/dns/sec/dst/dst_result.c b/dist/bind/lib/dns/sec/dst/dst_result.c index 18a8fd21efe..27a1460215a 100644 --- a/dist/bind/lib/dns/sec/dst/dst_result.c +++ b/dist/bind/lib/dns/sec/dst/dst_result.c @@ -1,4 +1,4 @@ -/* $NetBSD: dst_result.c,v 1.1.1.1 2004/05/17 23:45:00 christos Exp $ */ +/* $NetBSD: dst_result.c,v 1.1.1.2 2004/11/06 23:55:47 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -19,7 +19,7 @@ /* * Principal Author: Brian Wellington - * Id: dst_result.c,v 1.18.2.1.8.1 2004/03/06 08:14:21 marka Exp + * Id: dst_result.c,v 1.18.2.1.8.2 2004/06/11 00:30:55 marka Exp */ #include <config.h> @@ -51,6 +51,7 @@ static const char *text[DST_R_NRESULTS] = { "not a key that can compute a secret", /* 17 */ "failure computing a shared secret", /* 18 */ "no randomness available", /* 19 */ + "bad key type" /* 20 */ }; #define DST_RESULT_RESULTSET 2 diff --git a/dist/bind/lib/dns/sec/dst/include/dst/dst.h b/dist/bind/lib/dns/sec/dst/include/dst/dst.h index 7c4cc965da3..87392da810b 100644 --- a/dist/bind/lib/dns/sec/dst/include/dst/dst.h +++ b/dist/bind/lib/dns/sec/dst/include/dst/dst.h @@ -1,4 +1,4 @@ -/* $NetBSD: dst.h,v 1.1.1.1 2004/05/17 23:45:01 christos Exp $ */ +/* $NetBSD: dst.h,v 1.1.1.2 2004/11/06 23:55:48 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: dst.h,v 1.42.2.1.8.5 2004/03/10 02:55:59 marka Exp */ +/* Id: dst.h,v 1.42.2.1.8.6 2004/06/11 00:31:01 marka Exp */ #ifndef DST_DST_H #define DST_DST_H 1 @@ -220,6 +220,7 @@ dst_key_fromfile(dns_name_t *name, dns_keytag_t id, unsigned int alg, int type, * "id" is a valid key tag identifier. * "alg" is a supported key algorithm. * "type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union. + * DST_TYPE_KEY look for a KEY record otherwise DNSKEY * "mctx" is a valid memory context. * "keyp" is not NULL and "*keyp" is NULL. * @@ -242,6 +243,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx, * Requires: * "filename" is not NULL * "type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union + * DST_TYPE_KEY look for a KEY record otherwise DNSKEY * "mctx" is a valid memory context * "keyp" is not NULL and "*keyp" is NULL. * diff --git a/dist/bind/lib/dns/sec/dst/include/dst/result.h b/dist/bind/lib/dns/sec/dst/include/dst/result.h index 36bd3cd9f96..73d5d1d9e49 100644 --- a/dist/bind/lib/dns/sec/dst/include/dst/result.h +++ b/dist/bind/lib/dns/sec/dst/include/dst/result.h @@ -1,4 +1,4 @@ -/* $NetBSD: result.h,v 1.1.1.1 2004/05/17 23:45:01 christos Exp $ */ +/* $NetBSD: result.h,v 1.1.1.2 2004/11/06 23:55:48 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: result.h,v 1.20.206.1 2004/03/06 08:14:25 marka Exp */ +/* Id: result.h,v 1.20.206.2 2004/06/11 00:31:01 marka Exp */ #ifndef DST_RESULT_H #define DST_RESULT_H 1 @@ -53,8 +53,9 @@ #define DST_R_KEYCANNOTCOMPUTESECRET (ISC_RESULTCLASS_DST + 17) #define DST_R_COMPUTESECRETFAILURE (ISC_RESULTCLASS_DST + 18) #define DST_R_NORANDOMNESS (ISC_RESULTCLASS_DST + 19) +#define DST_R_BADKEYTYPE (ISC_RESULTCLASS_DST + 20) -#define DST_R_NRESULTS 20 /* Number of results */ +#define DST_R_NRESULTS 21 /* Number of results */ ISC_LANG_BEGINDECLS diff --git a/dist/bind/lib/dns/time.c b/dist/bind/lib/dns/time.c index 7e1d13f343d..e216aeb41d9 100644 --- a/dist/bind/lib/dns/time.c +++ b/dist/bind/lib/dns/time.c @@ -1,4 +1,4 @@ -/* $NetBSD: time.c,v 1.1.1.1 2004/05/17 23:44:55 christos Exp $ */ +/* $NetBSD: time.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: time.c,v 1.18.2.4.2.7 2004/03/11 04:23:00 marka Exp */ +/* Id: time.c,v 1.18.2.4.2.8 2004/08/28 06:25:20 marka Exp */ #include <config.h> @@ -25,6 +25,7 @@ #include <isc/string.h> /* Required for HP/UX (and others?) */ #include <time.h> +#include <isc/print.h> #include <isc/region.h> #include <isc/stdtime.h> #include <isc/util.h> diff --git a/dist/bind/lib/dns/tkey.c b/dist/bind/lib/dns/tkey.c index d03b2fa5338..4648741e1ac 100644 --- a/dist/bind/lib/dns/tkey.c +++ b/dist/bind/lib/dns/tkey.c @@ -1,4 +1,4 @@ -/* $NetBSD: tkey.c,v 1.1.1.1 2004/05/17 23:44:55 christos Exp $ */ +/* $NetBSD: tkey.c,v 1.1.1.2 2004/11/06 23:55:42 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -18,7 +18,7 @@ */ /* - * Id: tkey.c,v 1.71.2.1.10.4 2004/03/08 02:07:58 marka Exp + * Id: tkey.c,v 1.71.2.1.10.5 2004/06/11 00:30:54 marka Exp */ #include <config.h> @@ -287,7 +287,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name, keyname = NULL; dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname); keyset = NULL; - result = dns_message_findtype(keyname, dns_rdatatype_dnskey, 0, + result = dns_message_findtype(keyname, dns_rdatatype_key, 0, &keyset); if (result != ISC_R_SUCCESS) continue; @@ -335,7 +335,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name, RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf)); isc_buffer_usedregion(&ourkeybuf, &ourkeyr); dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any, - dns_rdatatype_dnskey, &ourkeyr); + dns_rdatatype_key, &ourkeyr); dns_name_init(&ourname, NULL); dns_name_clone(dst_key_name(tctx->dhkey), &ourname); @@ -879,7 +879,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name, RETERR(dst_key_todns(key, dynbuf)); isc_buffer_usedregion(dynbuf, &r); dns_rdata_fromregion(rdata, dns_rdataclass_any, - dns_rdatatype_dnskey, &r); + dns_rdatatype_key, &r); dns_message_takebuffer(msg, &dynbuf); dns_name_init(&keyname, NULL); @@ -1051,7 +1051,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg, ourkeyname = NULL; ourkeyset = NULL; RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname, - dns_rdatatype_dnskey, 0, &ourkeyname, + dns_rdatatype_key, 0, &ourkeyname, &ourkeyset)); result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER); @@ -1062,7 +1062,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg, if (dns_name_equal(theirkeyname, ourkeyname)) goto next; theirkeyset = NULL; - result = dns_message_findtype(theirkeyname, dns_rdatatype_dnskey, + result = dns_message_findtype(theirkeyname, dns_rdatatype_key, 0, &theirkeyset); if (result == ISC_R_SUCCESS) { RETERR(dns_rdataset_first(theirkeyset)); diff --git a/dist/bind/lib/dns/validator.c b/dist/bind/lib/dns/validator.c index f5ae6f87430..cbba995a3c9 100644 --- a/dist/bind/lib/dns/validator.c +++ b/dist/bind/lib/dns/validator.c @@ -1,4 +1,4 @@ -/* $NetBSD: validator.c,v 1.1.1.1 2004/05/17 23:44:53 christos Exp $ */ +/* $NetBSD: validator.c,v 1.1.1.2 2004/11/06 23:55:40 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: validator.c,v 1.91.2.5.8.10 2004/04/15 23:56:30 marka Exp */ +/* Id: validator.c,v 1.91.2.5.8.12 2004/06/11 01:17:36 marka Exp */ #include <config.h> @@ -55,6 +55,7 @@ #define VALATTR_INSECURITY 0x0010 #define VALATTR_DLV 0x0020 #define VALATTR_DLVTRIED 0x0040 +#define VALATTR_DLVSEPTRIED 0x0080 #define VALATTR_NEEDNOQNAME 0x0100 #define VALATTR_NEEDNOWILDCARD 0x0200 @@ -70,6 +71,7 @@ #define NEEDNOWILDCARD(val) ((val->attributes & VALATTR_NEEDNOWILDCARD) != 0) #define DLV(val) ((val->attributes & VALATTR_DLV) != 0) #define DLVTRIED(val) ((val->attributes & VALATTR_DLVTRIED) != 0) +#define DLVSEPTRIED(val) ((val->attributes & VALATTR_DLVSEPTRIED) != 0) #define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0) @@ -109,6 +111,9 @@ validator_logcreate(dns_validator_t *val, static isc_result_t dlv_validatezonekey(dns_validator_t *val); +static isc_result_t +finddlvsep(dns_validator_t *val, isc_boolean_t resume); + static void validator_done(dns_validator_t *val, isc_result_t result) { isc_task_t *task; @@ -737,6 +742,16 @@ negauthvalidated(isc_task_t *task, isc_event_t *event) { static inline isc_result_t view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) { + dns_fixedname_t fixedname; + dns_name_t *foundname; + dns_rdata_nsec_t nsec; + dns_rdata_t rdata = DNS_RDATA_INIT; + isc_result_t result; + unsigned int options; + char buf1[DNS_NAME_FORMATSIZE]; + char buf2[DNS_NAME_FORMATSIZE]; + char buf3[DNS_NAME_FORMATSIZE]; + if (dns_rdataset_isassociated(&val->frdataset)) dns_rdataset_disassociate(&val->frdataset); if (dns_rdataset_isassociated(&val->fsigrdataset)) @@ -744,9 +759,106 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) { if (val->view->zonetable == NULL) return (ISC_R_CANCELED); - return (dns_view_simplefind(val->view, name, type, 0, - DNS_DBFIND_PENDINGOK, ISC_FALSE, - &val->frdataset, &val->fsigrdataset)); + + options = DNS_DBFIND_PENDINGOK; + if (type == dns_rdatatype_dlv) + options |= DNS_DBFIND_COVERINGNSEC; + dns_fixedname_init(&fixedname); + foundname = dns_fixedname_name(&fixedname); + result = dns_view_find(val->view, name, type, 0, options, + ISC_FALSE, NULL, NULL, foundname, + &val->frdataset, &val->fsigrdataset); + if (result == DNS_R_NXDOMAIN) { + if (dns_rdataset_isassociated(&val->frdataset)) + dns_rdataset_disassociate(&val->frdataset); + if (dns_rdataset_isassociated(&val->fsigrdataset)) + dns_rdataset_disassociate(&val->fsigrdataset); + } else if (result == DNS_R_COVERINGNSEC) { + validator_log(val, ISC_LOG_DEBUG(3), "DNS_R_COVERINGNSEC"); + /* + * Check if the returned NSEC covers the name. + */ + INSIST(type == dns_rdatatype_dlv); + if (val->frdataset.trust != dns_trust_secure) { + validator_log(val, ISC_LOG_DEBUG(3), + "covering nsec: trust %u", + val->frdataset.trust); + goto notfound; + } + result = dns_rdataset_first(&val->frdataset); + if (result != ISC_R_SUCCESS) + goto notfound; + dns_rdataset_current(&val->frdataset, &rdata); + if (dns_nsec_typepresent(&rdata, dns_rdatatype_ns) && + !dns_nsec_typepresent(&rdata, dns_rdatatype_soa)) { + /* Parent NSEC record. */ + if (dns_name_issubdomain(name, foundname)) { + validator_log(val, ISC_LOG_DEBUG(3), + "covering nsec: for parent"); + goto notfound; + } + } + result = dns_rdata_tostruct(&rdata, &nsec, NULL); + if (result != ISC_R_SUCCESS) + goto notfound; + if (dns_name_compare(foundname, &nsec.next) >= 0) { + /* End of zone chain. */ + if (!dns_name_issubdomain(name, &nsec.next)) { + /* + * XXXMPA We could look for a parent NSEC + * at nsec.next and if found retest with + * this NSEC. + */ + dns_rdata_freestruct(&nsec); + validator_log(val, ISC_LOG_DEBUG(3), + "covering nsec: not in zone"); + goto notfound; + } + } else if (dns_name_compare(name, &nsec.next) >= 0) { + /* + * XXXMPA We could check if this NSEC is at a zone + * apex and if the qname is not below it and look for + * a parent NSEC with the same name. This requires + * that we can cache both NSEC records which we + * currently don't support. + */ + dns_rdata_freestruct(&nsec); + validator_log(val, ISC_LOG_DEBUG(3), + "covering nsec: not in range"); + goto notfound; + } + if (isc_log_wouldlog(dns_lctx,ISC_LOG_DEBUG(3))) { + dns_name_format(name, buf1, sizeof buf1); + dns_name_format(foundname, buf2, sizeof buf2); + dns_name_format(&nsec.next, buf3, sizeof buf3); + validator_log(val, ISC_LOG_DEBUG(3), + "covering nsec found: '%s' '%s' '%s'", + buf1, buf2, buf3); + } + if (dns_rdataset_isassociated(&val->frdataset)) + dns_rdataset_disassociate(&val->frdataset); + if (dns_rdataset_isassociated(&val->fsigrdataset)) + dns_rdataset_disassociate(&val->fsigrdataset); + dns_rdata_freestruct(&nsec); + result = DNS_R_NCACHENXDOMAIN; + } else if (result != ISC_R_SUCCESS && + result != DNS_R_GLUE && + result != DNS_R_HINT && + result != DNS_R_NCACHENXDOMAIN && + result != DNS_R_NCACHENXRRSET && + result != DNS_R_NXRRSET && + result != DNS_R_HINTNXRRSET && + result != ISC_R_NOTFOUND) { + goto notfound; + } + return (result); + + notfound: + if (dns_rdataset_isassociated(&val->frdataset)) + dns_rdataset_disassociate(&val->frdataset); + if (dns_rdataset_isassociated(&val->fsigrdataset)) + dns_rdataset_disassociate(&val->fsigrdataset); + return (ISC_R_NOTFOUND); } static inline isc_boolean_t @@ -1483,7 +1595,7 @@ dlv_validatezonekey(dns_validator_t *val) { } if (result != ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "no KEY matching DLV"); + "no DNSKEY matching DLV"); continue; } @@ -1518,7 +1630,8 @@ dlv_validatezonekey(dns_validator_t *val) { dns_rdataset_disassociate(&trdataset); if (result == ISC_R_SUCCESS) break; - validator_log(val, ISC_LOG_DEBUG(3), "no SIG matching DLV key"); + validator_log(val, ISC_LOG_DEBUG(3), + "no RRSIG matching DLV key"); } if (result == ISC_R_SUCCESS) { val->event->rdataset->trust = dns_trust_secure; @@ -1767,7 +1880,7 @@ validatezonekey(dns_validator_t *val) { } if (result != ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "no KEY matching DS"); + "no DNSKEY matching DS"); continue; } @@ -1802,7 +1915,8 @@ validatezonekey(dns_validator_t *val) { dns_rdataset_disassociate(&trdataset); if (result == ISC_R_SUCCESS) break; - validator_log(val, ISC_LOG_DEBUG(3), "no SIG matching DS key"); + validator_log(val, ISC_LOG_DEBUG(3), + "no RRSIG matching DS key"); } if (result == ISC_R_SUCCESS) { event->rdataset->trust = dns_trust_secure; @@ -1982,8 +2096,8 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) { * would lead to a query for the zone key, which * would return a negative answer, which would contain * an SOA and an NSEC signed by the missing key, which - * would trigger another query for the KEY (since the - * first one is still in progress), and go into an + * would trigger another query for the DNSKEY (since + * the first one is still in progress), and go into an * infinite loop. Avoid that. */ if (val->event->type == dns_rdatatype_dnskey && @@ -2099,9 +2213,127 @@ check_ds_algorithm(dns_validator_t *val, dns_name_t *name, return (ISC_FALSE); } +static void +dlv_fetched2(isc_task_t *task, isc_event_t *event) { + dns_fetchevent_t *devent; + dns_validator_t *val; + isc_boolean_t want_destroy; + isc_result_t eresult; + isc_result_t result; + + UNUSED(task); + INSIST(event->ev_type == DNS_EVENT_FETCHDONE); + devent = (dns_fetchevent_t *)event; + val = devent->ev_arg; + eresult = devent->result; + + isc_event_free(&event); + dns_resolver_destroyfetch(&val->fetch); + + INSIST(val->event != NULL); + validator_log(val, ISC_LOG_DEBUG(3), "in dlv_fetched2: %s", + dns_result_totext(eresult)); + + LOCK(&val->lock); + if (eresult == ISC_R_SUCCESS) { + val->havedlvsep = ISC_TRUE; + result = proveunsecure(val, ISC_FALSE); + if (result != DNS_R_WAIT) + validator_done(val, result); + } else if (eresult == DNS_R_NXRRSET || + eresult == DNS_R_NXDOMAIN || + eresult == DNS_R_NCACHENXRRSET || + eresult == DNS_R_NCACHENXDOMAIN) { + result = finddlvsep(val, ISC_TRUE); + if (result == ISC_R_SUCCESS) { + result = proveunsecure(val, ISC_FALSE); + if (result != DNS_R_WAIT) + validator_done(val, result); + } else if (result == ISC_R_NOTFOUND) { + validator_done(val, ISC_R_SUCCESS); + } else if (result != DNS_R_WAIT) + validator_done(val, result); + } + want_destroy = exit_check(val); + UNLOCK(&val->lock); + if (want_destroy) + destroy(val); +} + +static isc_result_t +finddlvsep(dns_validator_t *val, isc_boolean_t resume) { + dns_fixedname_t dlvfixed; + dns_name_t *dlvname; + dns_name_t *dlvsep; + dns_name_t noroot; + isc_result_t result; + unsigned int labels; + + if (!resume) { + dns_fixedname_init(&val->dlvsep); + dlvsep = dns_fixedname_name(&val->dlvsep); + dns_name_copy(val->event->name, dlvsep, NULL); + val->attributes |= VALATTR_DLVSEPTRIED; + } else { + dlvsep = dns_fixedname_name(&val->dlvsep); + labels = dns_name_countlabels(dlvsep); + dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep); + } + dns_name_init(&noroot, NULL); + dns_fixedname_init(&dlvfixed); + dlvname = dns_fixedname_name(&dlvfixed); + labels = dns_name_countlabels(dlvsep); + dns_name_getlabelsequence(dlvsep, 0, labels - 1, &noroot); + result = dns_name_concatenate(&noroot, val->view->dlv, dlvname, NULL); + while (result == ISC_R_NOSPACE) { + labels = dns_name_countlabels(dlvsep); + dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep); + dns_name_getlabelsequence(dlvsep, 0, labels - 2, &noroot); + result = dns_name_concatenate(&noroot, val->view->dlv, + dlvname, NULL); + } + if (result != ISC_R_SUCCESS) { + validator_log(val, ISC_LOG_DEBUG(2), "DLV concatenate failed"); + return (DNS_R_NOVALIDSIG); + } + + while (dns_name_countlabels(dlvname) > + dns_name_countlabels(val->view->dlv)) + { + result = view_find(val, dlvname, dns_rdatatype_dlv); + if (result == ISC_R_SUCCESS) { + if (val->frdataset.trust < dns_trust_secure) + return (DNS_R_NOVALIDSIG); + val->havedlvsep = ISC_TRUE; + return (ISC_R_SUCCESS); + } + if (result == ISC_R_NOTFOUND) { + result = create_fetch(val, dlvname, dns_rdatatype_dlv, + dlv_fetched2, "finddlvsep"); + if (result != ISC_R_SUCCESS) + return (result); + return (DNS_R_WAIT); + } + if (result != DNS_R_NXRRSET && + result != DNS_R_NXDOMAIN && + result != DNS_R_NCACHENXRRSET && + result != DNS_R_NCACHENXDOMAIN) + return (result); + /* + * Strip first labels from both dlvsep and dlvname. + */ + labels = dns_name_countlabels(dlvsep); + dns_name_getlabelsequence(dlvsep, 1, labels - 1, dlvsep); + labels = dns_name_countlabels(dlvname); + dns_name_getlabelsequence(dlvname, 1, labels - 1, dlvname); + } + return (ISC_R_NOTFOUND); +} + static isc_result_t proveunsecure(dns_validator_t *val, isc_boolean_t resume) { isc_result_t result; + isc_result_t tresult; dns_fixedname_t secroot; dns_name_t *tname; @@ -2112,11 +2344,30 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) { /* * If the name is not under a security root, it must be insecure. */ - if (result == ISC_R_NOTFOUND) - return (ISC_R_SUCCESS); + if (val->view->dlv != NULL && !DLVSEPTRIED(val) && + !dns_name_issubdomain(val->event->name, val->view->dlv)) { + tresult = finddlvsep(val, ISC_FALSE); + if (tresult != ISC_R_NOTFOUND && tresult != ISC_R_SUCCESS) { + validator_log(val, ISC_LOG_DEBUG(3), + "finddlvsep returned: %s", + dns_result_totext(tresult)); + return (tresult); + } + } - else if (result != ISC_R_SUCCESS) + if (result == ISC_R_NOTFOUND) { + if (!val->havedlvsep) + return (ISC_R_SUCCESS); + dns_name_copy(dns_fixedname_name(&val->dlvsep), + dns_fixedname_name(&secroot), NULL); + } else if (result != ISC_R_SUCCESS) return (result); + else if (val->havedlvsep && + dns_name_issubdomain(dns_fixedname_name(&val->dlvsep), + dns_fixedname_name(&secroot))) { + dns_name_copy(dns_fixedname_name(&val->dlvsep), + dns_fixedname_name(&secroot), NULL); + } if (!resume) { val->labels = @@ -2429,6 +2680,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, val->nsecset = NULL; val->soaname = NULL; val->seensig = ISC_FALSE; + val->havedlvsep = ISC_FALSE; val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name); dns_rdataset_init(&val->frdataset); dns_rdataset_init(&val->fsigrdataset); diff --git a/dist/bind/lib/dns/zone.c b/dist/bind/lib/dns/zone.c index 9c94dc4ce9c..9e18270455b 100644 --- a/dist/bind/lib/dns/zone.c +++ b/dist/bind/lib/dns/zone.c @@ -1,4 +1,4 @@ -/* $NetBSD: zone.c,v 1.1.1.1 2004/05/17 23:44:56 christos Exp $ */ +/* $NetBSD: zone.c,v 1.1.1.2 2004/11/06 23:55:43 christos Exp $ */ /* * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") @@ -17,7 +17,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* Id: zone.c,v 1.333.2.23.2.45 2004/04/29 01:45:23 marka Exp */ +/* Id: zone.c,v 1.333.2.23.2.50 2004/08/28 05:53:37 marka Exp */ #include <config.h> @@ -2351,8 +2351,10 @@ dump_done(void *arg, isc_result_t result) { tresult = dns_db_getsoaserial(db, version, &serial); if (tresult == ISC_R_SUCCESS) { - tresult = dns_journal_compact(zone->mctx, zone->journal, - serial, zone->journalsize); + tresult = dns_journal_compact(zone->mctx, + zone->journal, + serial, + zone->journalsize); switch (tresult) { case ISC_R_SUCCESS: case ISC_R_NOSPACE: @@ -3620,7 +3622,12 @@ refresh_callback(isc_task_t *task, isc_event_t *event) { dns_message_destroy(&msg); } else if (isc_serial_eq(soa.serial, zone->serial)) { if (zone->masterfile != NULL) { - result = isc_file_settime(zone->masterfile, &now); + result = ISC_R_FAILURE; + if (zone->journal != NULL) + result = isc_file_settime(zone->journal, &now); + if (result != ISC_R_SUCCESS) + result = isc_file_settime(zone->masterfile, + &now); /* Someone removed the file from underneath us! */ if (result == ISC_R_FILENOTFOUND) { LOCK_ZONE(zone); @@ -3988,6 +3995,8 @@ soa_query(isc_task_t *task, isc_event_t *event) { return; skip_master: + if (key != NULL) + dns_tsigkey_detach(&key); zone->curmaster++; if (zone->curmaster < zone->masterscnt) goto again; @@ -4251,14 +4260,17 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) { if (zone->readio != NULL) zonemgr_cancelio(zone->readio); - if (zone->writeio != NULL) - zonemgr_cancelio(zone->writeio); - if (zone->lctx != NULL) dns_loadctx_cancel(zone->lctx); - if (zone->dctx != NULL) - dns_dumpctx_cancel(zone->dctx); + if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FLUSH) || + !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) { + if (zone->writeio != NULL) + zonemgr_cancelio(zone->writeio); + + if (zone->dctx != NULL) + dns_dumpctx_cancel(zone->dctx); + } notify_cancel(zone); @@ -5166,9 +5178,8 @@ notify_done(isc_task_t *task, isc_event_t *event) { * the soa if we see a formerr and had sent a SOA. */ isc_event_free(&event); - if ((result == ISC_R_TIMEDOUT || - (message != NULL && message->rcode == dns_rcode_formerr && - (notify->flags & DNS_NOTIFY_NOSOA) == 0))) { + if (message != NULL && message->rcode == dns_rcode_formerr && + (notify->flags & DNS_NOTIFY_NOSOA) == 0) { notify->flags |= DNS_NOTIFY_NOSOA; dns_request_destroy(¬ify->request); result = notify_send_queue(notify); @@ -5226,6 +5237,31 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) { goto fail; if (dump) zone_needdump(zone, DNS_DUMP_DELAY); + else if (zone->journalsize != -1) { + isc_uint32_t serial; + + result = dns_db_getsoaserial(db, ver, &serial); + if (result == ISC_R_SUCCESS) { + result = dns_journal_compact(zone->mctx, + zone->journal, + serial, + zone->journalsize); + switch (result) { + case ISC_R_SUCCESS: + case ISC_R_NOSPACE: + case ISC_R_NOTFOUND: + dns_zone_log(zone, ISC_LOG_DEBUG(3), + "dns_journal_compact: %s", + dns_result_totext(result)); + break; + default: + dns_zone_log(zone, ISC_LOG_ERROR, + "dns_journal_compact failed: %s", + dns_result_totext(result)); + break; + } + } + } } else { if (dump && zone->masterfile != NULL) { isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, |
