Skip to content

GitLab

Commit 732e0731 authored by Bob Halley's avatar Bob Halley
Browse files

SIG support

parent e95d71d7
Expand all Hide whitespace changes
Inline Side-by-side
bin/named/query.c
View file @ 732e0731
......@@ -390,7 +390,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t type) {
*/
node = NULL;
result = dns_db_find(db, name, version, type, client->query.dboptions,
client->requesttime, &node, fname, rdataset);
client->requesttime, &node, fname, rdataset,
NULL);
switch (result) {
case DNS_R_SUCCESS:
case DNS_R_GLUE:
......@@ -409,7 +410,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t type) {
section++) {
mname = NULL;
result = dns_message_findname(client->message, section,
name, type, &mname, NULL);
name, type, 0, &mname, NULL);
if (result == ISC_R_SUCCESS) {
/*
* We've already got this RRset in the response.
......@@ -508,19 +509,23 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
static inline void
query_addrrset(ns_client_t *client, dns_name_t **namep,
dns_rdataset_t **rdatasetp, isc_dynbuffer_t *dbuf,
dns_section_t section)
dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
isc_dynbuffer_t *dbuf, dns_section_t section)
{
dns_name_t *name, *mname;
dns_rdataset_t *rdataset, *mrdataset;
dns_rdataset_t *rdataset, *mrdataset, *sigrdataset;
isc_result_t result;
name = *namep;
rdataset = *rdatasetp;
if (sigrdatasetp != NULL)
sigrdataset = *sigrdatasetp;
else
sigrdataset = NULL;
mname = NULL;
mrdataset = NULL;
result = dns_message_findname(client->message, section,
name, rdataset->type,
name, rdataset->type, rdataset->covers,
&mname, &mrdataset);
if (result == ISC_R_SUCCESS) {
/*
......@@ -540,8 +545,20 @@ query_addrrset(ns_client_t *client, dns_name_t **namep,
} else
RUNTIME_CHECK(result == DNS_R_NXRDATASET);
/*
* Note: we only add SIGs if we've added the type they cover, so
* we do not need to check if the SIG rdataset is already in the
* response.
*/
query_addrdataset(client, mname, rdataset);
*rdatasetp = NULL;
if (sigrdataset != NULL && sigrdataset->methods != NULL) {
/*
* We have a signature. Add it to the response.
*/
query_addrdataset(client, mname, sigrdataset);
*sigrdatasetp = NULL;
}
}
static inline isc_result_t
......@@ -550,7 +567,7 @@ query_addsoa(ns_client_t *client, dns_db_t *db) {
dns_dbnode_t *node;
isc_result_t result, eresult;
dns_fixedname_t foundname;
dns_rdataset_t *rdataset;
dns_rdataset_t *rdataset, *sigrdataset;
/*
* Initialization.
......@@ -571,7 +588,8 @@ query_addsoa(ns_client_t *client, dns_db_t *db) {
dns_name_init(name, NULL);
dns_name_clone(dns_db_origin(db), name);
rdataset = query_newrdataset(client);
if (rdataset == NULL) {
sigrdataset = query_newrdataset(client);
if (rdataset == NULL || sigrdataset == NULL) {
eresult = DNS_R_SERVFAIL;
goto cleanup;
}
......@@ -580,7 +598,7 @@ query_addsoa(ns_client_t *client, dns_db_t *db) {
* Find the SOA.
*/
result = dns_db_find(db, name, NULL, dns_rdatatype_soa, 0, 0, &node,
fname, rdataset);
fname, rdataset, sigrdataset);
if (result != ISC_R_SUCCESS) {
/*
* This is bad. We tried to get the SOA RR at the zone top
......@@ -589,11 +607,17 @@ query_addsoa(ns_client_t *client, dns_db_t *db) {
* The note above about temporary leakage applies here too.
*/
eresult = DNS_R_SERVFAIL;
} else
query_addrrset(client, &name, &rdataset, NULL,
} else {
query_addrrset(client, &name, &rdataset, &sigrdataset, NULL,
DNS_SECTION_AUTHORITY);
}
cleanup:
if (sigrdataset != NULL) {
if (sigrdataset->methods != NULL)
dns_rdataset_disassociate(sigrdataset);
ISC_LIST_APPEND(client->query.tmprdatasets, sigrdataset, link);
}
if (rdataset != NULL) {
if (rdataset->methods != NULL)
dns_rdataset_disassociate(rdataset);
......@@ -611,13 +635,10 @@ static inline isc_result_t
query_checktype(dns_rdatatype_t type) {
/*
* XXXRTH SIG is here only temporarily.
* OPT still needs to be added.
* XXXRTH OPT still needs to be added.
* Should get help with this from rdata.c
*/
switch (type) {
case dns_rdatatype_sig:
return (DNS_R_NOTIMP);
case dns_rdatatype_tkey:
return (DNS_R_NOTIMP);
case dns_rdatatype_tsig:
......@@ -649,6 +670,7 @@ query_find(ns_client_t *client) {
dns_rdatatype_t qtype, type;
dns_name_t *fname, *tname, *prefix;
dns_rdataset_t *rdataset, *qrdataset, *trdataset;
dns_rdataset_t *sigrdataset;
dns_rdata_t rdata;
dns_rdatasetiter_t *rdsiter;
isc_boolean_t use_cache, recursion_ok, want_restart;
......@@ -676,6 +698,7 @@ query_find(ns_client_t *client) {
recursion_ok = ISC_FALSE;
fname = NULL;
rdataset = NULL;
sigrdataset = NULL;
node = NULL;
db = NULL;
version = NULL;
......@@ -778,6 +801,12 @@ query_find(ns_client_t *client) {
goto cleanup;
}
/*
* If it's a SIG query, we'll iterate the node.
*/
if (qtype == dns_rdatatype_sig)
type = dns_rdatatype_any;
/*
* We'll need some resources...
*/
......@@ -788,7 +817,8 @@ query_find(ns_client_t *client) {
}
fname = query_newname(client, dbuf, &b);
rdataset = query_newrdataset(client);
if (fname == NULL || rdataset == NULL) {
sigrdataset = query_newrdataset(client);
if (fname == NULL || rdataset == NULL || sigrdataset == NULL) {
QUERY_ERROR(DNS_R_SERVFAIL);
goto cleanup;
}
......@@ -800,7 +830,8 @@ query_find(ns_client_t *client) {
* Now look for an answer in the database.
*/
result = dns_db_find(db, client->query.qname, version, type, 0,
client->requesttime, &node, fname, rdataset);
client->requesttime, &node, fname, rdataset,
sigrdataset);
switch (result) {
case DNS_R_SUCCESS:
case DNS_R_ZONECUT:
......@@ -818,7 +849,8 @@ query_find(ns_client_t *client) {
* We don't have a cache, so this is the best
* answer.
*/
query_addrrset(client, &fname, &rdataset, dbuf,
query_addrrset(client, &fname, &rdataset,
&sigrdataset, dbuf,
DNS_SECTION_AUTHORITY);
} else {
/*
......@@ -878,8 +910,8 @@ query_find(ns_client_t *client) {
* Add NXT record if we found one.
*/
if (dns_rdataset_isassociated(rdataset))
query_addrrset(client, &tname, &rdataset, NULL,
DNS_SECTION_AUTHORITY);
query_addrrset(client, &tname, &rdataset, &sigrdataset,
NULL, DNS_SECTION_AUTHORITY);
goto cleanup;
case DNS_R_NXDOMAIN:
if (restarts > 0) {
......@@ -922,8 +954,8 @@ query_find(ns_client_t *client) {
* Add NXT record if we found one.
*/
if (dns_rdataset_isassociated(rdataset))
query_addrrset(client, &tname, &rdataset, NULL,
DNS_SECTION_AUTHORITY);
query_addrrset(client, &tname, &rdataset, &sigrdataset,
NULL, DNS_SECTION_AUTHORITY);
/*
* Set message rcode.
*/
......@@ -942,7 +974,7 @@ query_find(ns_client_t *client) {
/*
* Add the CNAME to the answer section.
*/
query_addrrset(client, &fname, &rdataset, dbuf,
query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
DNS_SECTION_ANSWER);
/*
* We set the PARTIALANSWER attribute so that if anything goes
......@@ -986,7 +1018,7 @@ query_find(ns_client_t *client) {
/*
* Add the DNAME to the answer section.
*/
query_addrrset(client, &fname, &rdataset, dbuf,
query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
DNS_SECTION_ANSWER);
/*
* We set the PARTIALANSWER attribute so that if anything goes
......@@ -1029,9 +1061,8 @@ query_find(ns_client_t *client) {
if (result != ISC_R_SUCCESS) {
if (result == ISC_R_NOSPACE) {
/*
* draft-ietf-dnsind-dname-03.txt, section
* 4.1, subsection 3c says we should
* return YXDOMAIN if the constructed
* RFC 2672, section 4.1, subsection 3c says
* we should return YXDOMAIN if the constructed
* name would be too long.
*/
client->message->rcode = dns_rcode_yxdomain;
......@@ -1058,7 +1089,7 @@ query_find(ns_client_t *client) {
*/
n = 0;
rdsiter = NULL;
result = dns_db_allrdatasets(db, node, NULL, 0, &rdsiter);
result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
if (result != ISC_R_SUCCESS) {
QUERY_ERROR(DNS_R_SERVFAIL);
goto cleanup;
......@@ -1066,34 +1097,72 @@ query_find(ns_client_t *client) {
result = dns_rdatasetiter_first(rdsiter);
while (result == ISC_R_SUCCESS) {
dns_rdatasetiter_current(rdsiter, rdataset);
tname = fname;
query_addrrset(client, &tname, &rdataset, dbuf,
DNS_SECTION_ANSWER);
n++;
if (qtype == dns_rdatatype_any ||
rdataset->type == qtype) {
tname = fname;
query_addrrset(client, &tname, &rdataset, NULL,
dbuf, DNS_SECTION_ANSWER);
n++;
/*
* We shouldn't ever fail to add 'rdataset'
* because it's already in the answer.
*/
INSIST(rdataset == NULL);
/*
* We set dbuf to NULL because we only want
* the query_keepname() call in
* query_addrrset() to be called once.
*/
dbuf = NULL;
rdataset = query_newrdataset(client);
if (rdataset == NULL)
break;
} else {
/*
* We're not interested in this rdataset.
*/
dns_rdataset_disassociate(rdataset);
}
result = dns_rdatasetiter_next(rdsiter);
}
if (n > 0) {
/*
* We shouldn't ever fail to add 'rdataset' because
* it's already in the answer.
* If we added at least one RRset, then we must clear
* fname, otherwise the cleanup code might cause it
* to be reused.
*/
INSIST(rdataset == NULL);
fname = NULL;
} else {
/*
* We set dbuf to NULL because we only want the
* query_keepname() call in query_addrrset() to be
* called once.
* We didn't match any rdatasets.
*/
dbuf = NULL;
result = dns_message_gettemprdataset(client->message,
&rdataset);
if (result == ISC_R_SUCCESS) {
dns_rdataset_init(rdataset);
result = dns_rdatasetiter_next(rdsiter);
if (qtype == dns_rdatatype_sig &&
result == DNS_R_NOMORE) {
/*
* XXXRTH If this is a secure zone and we
* didn't find any SIGs, we should generate
* an error unless we were searching for
* glue. Ugh.
*/
/*
* We were searching for SIG records in
* a nonsecure zone. Send a "no error,
* no data" response.
*
* First we must release fname.
*/
query_releasename(client, &fname);
/*
* Add SOA.
*/
result = query_addsoa(client, db);
} else {
/*
* Something went wrong.
*/
result = DNS_R_SERVFAIL;
}
}
/*
* If we added at least one RRset, then we must clear fname,
* otherwise the cleanup code might cause it to be reused.
*/
if (n > 0)
fname = NULL;
dns_rdatasetiter_destroy(&rdsiter);
if (result != DNS_R_NOMORE) {
QUERY_ERROR(DNS_R_SERVFAIL);
......@@ -1104,7 +1173,7 @@ query_find(ns_client_t *client) {
* This is the "normal" case -- an ordinary question to which
* we know the answer.
*/
query_addrrset(client, &fname, &rdataset, dbuf,
query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
DNS_SECTION_ANSWER);
/*
* Remember that we've answered this question.
......@@ -1123,6 +1192,11 @@ query_find(ns_client_t *client) {
*/
cleanup:
if (sigrdataset != NULL) {
if (sigrdataset->methods != NULL)
dns_rdataset_disassociate(sigrdataset);
ISC_LIST_APPEND(client->query.tmprdatasets, sigrdataset, link);
}
if (rdataset != NULL) {
if (rdataset->methods != NULL)
dns_rdataset_disassociate(rdataset);
......
bin/named/update.c
View file @ 732e0731
......@@ -261,9 +261,9 @@ foreach_node_rr(dns_db_t *db,
/*
* For each of the RRs specified by 'db', 'ver', 'name', and 'type',
* (which can be dns_rdatatype_any to match any type), call 'action'
* with the RR and 'action_data' as arguments. If the name
* For each of the RRs specified by 'db', 'ver', 'name', 'type',
* (which can be dns_rdatatype_any to match any type), and 'covers', call
* 'action' with the RR and 'action_data' as arguments. If the name
* does not exist, or if no RRset of the given type exists at the name,
* do nothing.
*
......@@ -274,6 +274,7 @@ foreach_rr(dns_db_t *db,
dns_dbversion_t *ver,
dns_name_t *name,
dns_rdatatype_t type,
dns_rdatatype_t covers,
rr_func *rr_action,
void *rr_action_data)
{
......@@ -294,7 +295,7 @@ foreach_rr(dns_db_t *db,
return (result);
dns_rdataset_init(&rdataset);
result = dns_db_findrdataset(db, node, ver, type,
result = dns_db_findrdataset(db, node, ver, type, covers,
(isc_stdtime_t) 0, &rdataset);
if (result == DNS_R_NOTFOUND) {
result = DNS_R_SUCCESS;
......@@ -366,10 +367,11 @@ do { \
*/
static dns_result_t
rrset_exists(dns_db_t *db, dns_dbversion_t *ver,
dns_name_t *name, dns_rdatatype_t type, isc_boolean_t *exists)
dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers,
isc_boolean_t *exists)
{
dns_result_t result;
result = foreach_rr(db, ver, name, type,
result = foreach_rr(db, ver, name, type, covers,
rrset_exists_action, NULL);
RETURN_EXISTENCE_FLAG;
}
......@@ -429,10 +431,10 @@ count_rr_action(void *data, rr_t *rr) /*ARGSUSED*/ {
*/
static dns_result_t
rr_count(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dns_rdatatype_t type, int *countp)
dns_rdatatype_t type, dns_rdatatype_t covers, int *countp)
{
*countp = 0;
return (foreach_rr(db, ver, name, type,
return (foreach_rr(db, ver, name, type, covers,
count_rr_action, countp));
}
......@@ -468,6 +470,7 @@ matching_rr_exists(rr_predicate *predicate,
dns_dbversion_t *ver,
dns_name_t *name,
dns_rdatatype_t type,
dns_rdatatype_t covers,
dns_rdata_t *update_rr,
isc_boolean_t *exists)
{
......@@ -478,7 +481,7 @@ matching_rr_exists(rr_predicate *predicate,
ctx.ver = ver;
ctx.name = name;
ctx.update_rr = update_rr;
result = foreach_rr(db, ver, name, type,
result = foreach_rr(db, ver, name, type, covers,
matching_rr_exists_action, &ctx);
RETURN_EXISTENCE_FLAG;
}
......@@ -637,7 +640,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
/* A new unique type begins here. */
while (t != NULL && dns_name_equal(&t->name, name)) {
dns_rdatatype_t type;
dns_rdatatype_t type, covers;
dns_rdataset_t rdataset;
dns_diff_t d_rrs; /* Database RRs with
this name and type */
......@@ -645,6 +648,10 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
this name and type */
type = t->rdata.type;
if (type == dns_rdatatype_sig)
covers = dns_rdata_covers(&t->rdata);
else
covers = 0;
/*
* Collect all database RRs for this name and type
......@@ -652,7 +659,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
*/
dns_rdataset_init(&rdataset);
result = dns_db_findrdataset(db, node, ver, type,
(isc_stdtime_t) 0,
covers, (isc_stdtime_t) 0,
&rdataset);
if (result != DNS_R_SUCCESS) {
dns_db_detachnode(db, &node);
......@@ -837,6 +844,7 @@ delete_if(rr_predicate *predicate,
dns_dbversion_t *ver,
dns_name_t *name,
dns_rdatatype_t type,
dns_rdatatype_t covers,
dns_rdata_t *update_rr,
dns_diff_t *diff)
{
......@@ -847,7 +855,7 @@ delete_if(rr_predicate *predicate,
ctx.diff = diff;
ctx.name = name;
ctx.update_rr = update_rr;
return (foreach_rr(db, ver, name, type,
return (foreach_rr(db, ver, name, type, covers,
delete_if_action, &ctx));
}
......@@ -866,7 +874,8 @@ delete_if(rr_predicate *predicate,
static void
get_current_rr(dns_message_t *msg, dns_section_t section,
dns_rdataclass_t zoneclass,
dns_name_t **name, dns_rdata_t *rdata, dns_ttl_t *ttl,
dns_name_t **name, dns_rdata_t *rdata, dns_rdatatype_t *covers,
dns_ttl_t *ttl,
dns_rdataclass_t *update_class)
{
dns_rdataset_t *rdataset;
......@@ -875,6 +884,7 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
rdataset = ISC_LIST_HEAD((*name)->list);
INSIST(rdataset != NULL);
INSIST(ISC_LIST_NEXT(rdataset, link) == NULL);
*covers = rdataset->covers;
*ttl = rdataset->ttl;
result = dns_rdataset_first(rdataset);
INSIST(result == DNS_R_SUCCESS);
......@@ -991,6 +1001,7 @@ ns_req_update(ns_client_t *client,
unsigned int response_rcode = dns_rcode_noerror;
isc_boolean_t soa_serial_changed = ISC_FALSE;
isc_mem_t *mctx = client->mctx;
dns_rdatatype_t covers;
dns_diff_init(mctx, &diff);
dns_diff_init(mctx, &temp);
......@@ -1065,7 +1076,7 @@ ns_req_update(ns_client_t *client,
isc_boolean_t flag;
get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
&name, &rdata, &ttl, &update_class);
&name, &rdata, &covers, &ttl, &update_class);
if (ttl != 0)
FAILMSG(DNS_R_FORMERR, "prereq TTL != 0");
......@@ -1087,7 +1098,7 @@ ns_req_update(ns_client_t *client,
}
} else {
CHECK(rrset_exists(db, ver, name,
rdata.type, &flag));
rdata.type, covers, &flag));
if (! flag) {
/* RRset does not exist. */
FAILMSG(DNS_R_NXRRSET,
......@@ -1108,7 +1119,7 @@ ns_req_update(ns_client_t *client,
}
} else {
CHECK(rrset_exists(db, ver, name,
rdata.type, &flag));
rdata.type, covers, &flag));
if (flag) {
/* RRset exists. */
FAILMSG(DNS_R_YXRRSET,
......@@ -1156,7 +1167,7 @@ ns_req_update(ns_client_t *client,
dns_ttl_t ttl;
dns_rdataclass_t update_class;
get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
&name, &rdata, &ttl, &update_class);
&name, &rdata, &covers, &ttl, &update_class);
if (! dns_name_issubdomain(name, zonename))
FAILMSG(DNS_R_NOTZONE,
......@@ -1206,7 +1217,7 @@ ns_req_update(ns_client_t *client,
isc_boolean_t flag;
get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
&name, &rdata, &ttl, &update_class);
&name, &rdata, &covers, &ttl, &update_class);
if (update_class == zoneclass) {
if (rdata.type == dns_rdatatype_cname) {
......@@ -1221,7 +1232,7 @@ ns_req_update(ns_client_t *client,
}
} else {
CHECK(rrset_exists(db, ver, name,
dns_rdatatype_cname,
dns_rdatatype_cname, 0,
&flag));
if (flag && ! is_dnssec_type(rdata.type)) {
printf("attempt to add non-cname "
......@@ -1232,7 +1243,8 @@ ns_req_update(ns_client_t *client,
if (rdata.type == dns_rdatatype_soa) {
isc_boolean_t changed, ok;
CHECK(rrset_exists(db, ver, name,
dns_rdatatype_soa, &flag));
dns_rdatatype_soa, 0,
&flag));
if (! flag) {
printf("attempt to create extra SOA "
"ignored\n");
......@@ -1254,11 +1266,13 @@ ns_req_update(ns_client_t *client,
* CNAME, SOA, or WKS exists, remove it first.
*/
CHECK(matching_rr_exists(rr_equal_p, db, ver, name,
rdata.type, &rdata, &flag));
rdata.type, covers, &rdata,
&flag));
if (! flag) {
printf("add an RR\n");
CHECK(delete_if(replaces_p, db, ver, name,
rdata.type, &rdata, &diff));
rdata.type, covers, &rdata,
&diff));
result = update_one_rr(db, ver, &diff,
DNS_DIFFOP_ADD,
name, ttl, &rdata);
......@@ -1273,11 +1287,11 @@ ns_req_update(ns_client_t *client,
if (dns_name_equal(name, zonename)) {
CHECK(delete_if(type_not_soa_nor_ns_p,
db, ver, name,
dns_rdatatype_any,
dns_rdatatype_any, 0,
&rdata, &diff));
} else {
CHECK(delete_if(true_p, db, ver, name,
dns_rdatatype_any,
dns_rdatatype_any, 0,
&rdata, &diff));
}
} else if (dns_name_equal(name, zonename) &&
......@@ -1289,7 +1303,8 @@ ns_req_update(ns_client_t *client,
} else {
printf("delete an rrset\n");
CHECK(delete_if(true_p, db, ver, name,
rdata.type, &rdata, &diff));
rdata.type, covers, &rdata,
&diff));
}
} else if (update_class == dns_rdataclass_none) {
if (rdata.type == dns_rdatatype_soa) {
......@@ -1299,7 +1314,7 @@ ns_req_update(ns_client_t *client,
if (rdata.type == dns_rdatatype_ns) {
int count;
CHECK(rr_count(db, ver, name,
dns_rdatatype_ns, &count));
dns_rdatatype_ns, 0, &count));
if (count == 1) {
printf("attempt to delete last "
"NS ignored\n");
......@@ -1308,7 +1323,7 @@ ns_req_update(ns_client_t *client,
}
printf("delete an RR\n");
CHECK(delete_if(rr_equal_p, db, ver, name,
rdata.type, &rdata, &diff));
rdata.type, covers, &rdata, &diff));
}
}
if (result != DNS_R_NOMORE)
......
bin/tests/db/t_db.c
View file @ 732e0731
......@@ -211,7 +211,7 @@ t_dns_db_load(char **av) {
0,
&nodep,
dns_fixedname_name(&dns_foundname),
&rdataset);
&rdataset, NULL);
if (dns_result != exp_find_result) {
t_info("dns_db_findnode returned %s, expected %s\n",
......@@ -757,7 +757,7 @@ t_dns_db_currentversion(char **av) {
0,
&nodep,
dns_fixedname_name(&dns_foundname),
&rdataset);
&rdataset, NULL);
if (dns_result != DNS_R_SUCCESS) {
t_info("unable to find %s using current version\n", findname);
......@@ -817,7 +817,7 @@ t_dns_db_currentversion(char **av) {
0,
&nodep,
dns_fixedname_name(&dns_foundname),
<