← Back to branch summary

~kernevil/ubuntu/trusty/bind9/sdlz-hmac-keys

« back to all changes in this revision

Viewing changes to lib/dns/zone.c

  • Committer: Package Import Robot
  • Author(s): LaMont Jones, Matthew Grant, LaMont Jones
  • Date: 2012-10-29 08:37:49 UTC
  • mfrom: (1.9.2)
  • Revision ID: package-import@ubuntu.com-20121029083749-r9inpzl0yuj9xdlu
Tags: 1:9.8.4.dfsg-1
[Matthew Grant]

* Turn off dlopen as it was causing test compile failures.
* Add missing library .postrm files for debhelper

[LaMont Jones]

* New upstream version
* soname fixup
* Ack NMUs

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/dns/zone.c
1
1
/*
2
 
 * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 
2
 * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
3
3
 * Copyright (C) 1999-2003  Internet Software Consortium.
4
4
 *
5
5
 * Permission to use, copy, modify, and/or distribute this software for any
15
15
 * PERFORMANCE OF THIS SOFTWARE.
16
16
 */
17
17
 
18
 
/* $Id: zone.c,v 1.582.8.26 2011-08-09 02:34:24 marka Exp $ */
 
18
/* $Id$ */
19
19
 
20
20
/*! \file */
21
21
 
74
74
#include <dns/soa.h>
75
75
#include <dns/ssu.h>
76
76
#include <dns/stats.h>
 
77
#include <dns/time.h>
77
78
#include <dns/tsig.h>
78
79
#include <dns/xfrin.h>
79
80
#include <dns/zone.h>
136
137
typedef struct dns_stub dns_stub_t;
137
138
typedef struct dns_load dns_load_t;
138
139
typedef struct dns_forward dns_forward_t;
 
140
typedef ISC_LIST(dns_forward_t) dns_forwardlist_t;
139
141
typedef struct dns_io dns_io_t;
140
142
typedef ISC_LIST(dns_io_t) dns_iolist_t;
141
143
typedef struct dns_signing dns_signing_t;
336
338
         * whether a rpz radix was needed when last loaded
337
339
         */
338
340
        isc_boolean_t           rpz_zone;
 
341
 
 
342
        /*%
 
343
         * Outstanding forwarded UPDATE requests.
 
344
         */
 
345
        dns_forwardlist_t       forwards;
339
346
};
340
347
 
341
348
#define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
422
429
        isc_ratelimiter_t *     rl;
423
430
        isc_rwlock_t            rwlock;
424
431
        isc_mutex_t             iolock;
 
432
        isc_rwlock_t            urlock;
425
433
 
426
434
        /* Locked by rwlock. */
427
435
        dns_zonelist_t          zones;
439
447
        dns_iolist_t            high;
440
448
        dns_iolist_t            low;
441
449
 
442
 
        /* Locked by rwlock. */
 
450
        /* Locked by urlock. */
443
451
        /* LRU cache */
444
452
        struct dns_unreachable  unreachable[UNREACH_CHACHE_SIZE];
445
453
};
500
508
        isc_sockaddr_t          addr;
501
509
        dns_updatecallback_t    callback;
502
510
        void                    *callback_arg;
 
511
        ISC_LINK(dns_forward_t) link;
503
512
};
504
513
 
505
514
/*%
659
668
static void zone_maintenance(dns_zone_t *zone);
660
669
static void zone_notify(dns_zone_t *zone, isc_time_t *now);
661
670
static void dump_done(void *arg, isc_result_t result);
662
 
static isc_boolean_t dns_zonemgr_unreachable(dns_zonemgr_t *zmgr,
663
 
                                             isc_sockaddr_t *remote,
664
 
                                             isc_sockaddr_t *local,
665
 
                                             isc_time_t *now);
666
671
static isc_result_t zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm,
667
672
                                     isc_uint16_t keyid, isc_boolean_t delete);
668
673
static isc_result_t delete_nsec(dns_db_t *db, dns_dbversion_t *ver,
851
856
        zone->privatetype = (dns_rdatatype_t)0xffffU;
852
857
        zone->added = ISC_FALSE;
853
858
        zone->rpz_zone = ISC_FALSE;
 
859
        ISC_LIST_INIT(zone->forwards);
854
860
 
855
861
        zone->magic = ZONE_MAGIC;
856
862
 
1671
1677
 
1672
1678
        LOCK_ZONE(zone);
1673
1679
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
1674
 
        dns_db_currentversion(zone->db, &version);
1675
 
        result = dns_master_dumpinc2(zone->mctx, zone->db, version,
1676
 
                                     &dns_master_style_default,
1677
 
                                     zone->masterfile, zone->task, dump_done,
1678
 
                                     zone, &zone->dctx, zone->masterformat);
1679
 
        dns_db_closeversion(zone->db, &version, ISC_FALSE);
 
1680
        if (zone->db != NULL) {
 
1681
                dns_db_currentversion(zone->db, &version);
 
1682
                result = dns_master_dumpinc2(zone->mctx, zone->db, version,
 
1683
                                             &dns_master_style_default,
 
1684
                                             zone->masterfile, zone->task,
 
1685
                                             dump_done, zone, &zone->dctx,
 
1686
                                             zone->masterformat);
 
1687
                dns_db_closeversion(zone->db, &version, ISC_FALSE);
 
1688
        } else
 
1689
                result = ISC_R_CANCELED;
1680
1690
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
1681
1691
        UNLOCK_ZONE(zone);
1682
1692
        if (result != DNS_R_CONTINUE)
2690
2700
 */
2691
2701
static void
2692
2702
set_refreshkeytimer(dns_zone_t *zone, dns_rdata_keydata_t *key,
2693
 
                    isc_stdtime_t now) {
 
2703
                    isc_stdtime_t now)
 
2704
{
2694
2705
        const char me[] = "set_refreshkeytimer";
2695
2706
        isc_stdtime_t then;
2696
2707
        isc_time_t timenow, timethen;
3071
3082
                                          ISC_TRUE, &journal);
3072
3083
                if (result != ISC_R_SUCCESS) {
3073
3084
                        dns_zone_log(zone, ISC_LOG_ERROR,
3074
 
                                     "%s:dns_journal_open -> %s\n",
 
3085
                                     "%s:dns_journal_open -> %s",
3075
3086
                                     caller, dns_result_totext(result));
3076
3087
                        return (result);
3077
3088
                }
3080
3091
                dns_journal_destroy(&journal);
3081
3092
                if (result != ISC_R_SUCCESS) {
3082
3093
                        dns_zone_log(zone, ISC_LOG_ERROR,
3083
 
                                     "%s:dns_journal_write_transaction -> %s\n",
 
3094
                                     "%s:dns_journal_write_transaction -> %s",
3084
3095
                                     caller, dns_result_totext(result));
3085
3096
                        return (result);
3086
3097
                }
3105
3116
        result = dns_db_newversion(db, &ver);
3106
3117
        if (result != ISC_R_SUCCESS) {
3107
3118
                dns_zone_log(zone, ISC_LOG_ERROR,
3108
 
                             "add_soa:dns_db_newversion -> %s\n",
 
3119
                             "add_soa:dns_db_newversion -> %s",
3109
3120
                             dns_result_totext(result));
3110
3121
                goto failure;
3111
3122
        }
3115
3126
                                    0, 0, 0, 0, 0, buf, &rdata);
3116
3127
        if (result != ISC_R_SUCCESS) {
3117
3128
                dns_zone_log(zone, ISC_LOG_ERROR,
3118
 
                             "add_soa:dns_soa_buildrdata -> %s\n",
 
3129
                             "add_soa:dns_soa_buildrdata -> %s",
3119
3130
                             dns_result_totext(result));
3120
3131
                goto failure;
3121
3132
        }
3167
3178
        result = dns_db_newversion(db, &ver);
3168
3179
        if (result != ISC_R_SUCCESS) {
3169
3180
                dns_zone_log(zone, ISC_LOG_ERROR,
3170
 
                             "sync_keyzone:dns_db_newversion -> %s\n",
 
3181
                             "sync_keyzone:dns_db_newversion -> %s",
3171
3182
                             dns_result_totext(result));
3172
3183
                goto failure;
3173
3184
        }
3183
3194
        for (result = dns_rriterator_first(&rrit);
3184
3195
             result == ISC_R_SUCCESS;
3185
3196
             result = dns_rriterator_nextrrset(&rrit)) {
3186
 
                dns_rdataset_t *rdataset;
 
3197
                dns_rdataset_t *rdataset = NULL;
3187
3198
                dns_name_t *rrname = NULL;
3188
3199
                isc_uint32_t ttl;
3189
3200
 
3319
3330
                                             zone->masterfile,
3320
3331
                                             dns_result_totext(result));
3321
3332
                } else {
3322
 
                        dns_zone_log(zone, ISC_LOG_ERROR,
 
3333
                        int level = ISC_LOG_ERROR;
 
3334
                        if (zone->type == dns_zone_key &&
 
3335
                            result == ISC_R_FILENOTFOUND)
 
3336
                                level = ISC_LOG_DEBUG(1);
 
3337
                        dns_zone_log(zone, level,
3323
3338
                                     "loading from master file %s failed: %s",
3324
3339
                                     zone->masterfile,
3325
3340
                                     dns_result_totext(result));
3388
3403
                        needdump = ISC_TRUE;
3389
3404
        }
3390
3405
 
3391
 
        zone->loadtime = loadtime;
3392
 
 
3393
 
        dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
 
3406
        dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded; checking validity");
3394
3407
        /*
3395
3408
         * Obtain ns, soa and cname counts for top of zone.
3396
3409
         */
3635
3648
                dns_zone_log(zone, ISC_LOG_INFO, "loaded serial %u%s", serial,
3636
3649
                             dns_db_issecure(db) ? " (DNSSEC signed)" : "");
3637
3650
 
 
3651
        zone->loadtime = loadtime;
3638
3652
        return (result);
3639
3653
 
3640
3654
 cleanup:
3988
4002
        UNLOCK_ZONE(source);
3989
4003
}
3990
4004
 
 
4005
isc_result_t
 
4006
dns_zone_synckeyzone(dns_zone_t *zone) {
 
4007
        isc_result_t result;
 
4008
        dns_db_t *db = NULL;
 
4009
 
 
4010
        if (zone->type != dns_zone_key)
 
4011
                return (DNS_R_BADZONE);
 
4012
 
 
4013
        CHECK(dns_zone_getdb(zone, &db));
 
4014
 
 
4015
        LOCK_ZONE(zone);
 
4016
        result = sync_keyzone(zone, db);
 
4017
        UNLOCK_ZONE(zone);
 
4018
 
 
4019
 failure:
 
4020
        if (db != NULL)
 
4021
                dns_db_detach(&db);
 
4022
        return (result);
 
4023
}
 
4024
 
3991
4025
static void
3992
4026
zone_iattach(dns_zone_t *source, dns_zone_t **target) {
3993
4027
 
4415
4449
        /*
4416
4450
         * Everything is ok so attach to the zone.
4417
4451
         */
 
4452
        zone->curmaster = 0;
4418
4453
        zone->masters = new;
4419
4454
        zone->mastersok = newok;
4420
4455
        zone->masterkeynames = newname;
4486
4521
        return (dumping);
4487
4522
}
4488
4523
 
4489
 
#define MAXZONEKEYS 10
4490
 
 
4491
4524
static isc_result_t
4492
4525
find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
4493
4526
               isc_mem_t *mctx, unsigned int maxkeys,
4604
4637
        isc_result_t result;
4605
4638
        dns_dbnode_t *node = NULL;
4606
4639
        dns_rdataset_t rdataset;
4607
 
        dns_rdata_t rdata = DNS_RDATA_INIT;
4608
4640
        unsigned int i;
4609
4641
        dns_rdata_rrsig_t rrsig;
4610
4642
        isc_boolean_t found, changed;
4611
 
        isc_stdtime_t warn = 0, maybe = 0;
 
4643
        isc_int64_t warn = 0, maybe = 0;
4612
4644
 
4613
4645
        dns_rdataset_init(&rdataset);
4614
4646
 
4637
4669
        for (result = dns_rdataset_first(&rdataset);
4638
4670
             result == ISC_R_SUCCESS;
4639
4671
             result = dns_rdataset_next(&rdataset)) {
 
4672
                dns_rdata_t rdata = DNS_RDATA_INIT;
 
4673
 
4640
4674
                dns_rdataset_current(&rdataset, &rdata);
4641
4675
                result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
4642
4676
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
4648
4682
                                               rdataset.ttl, &rdata);
4649
4683
                                if (incremental)
4650
4684
                                        changed = ISC_TRUE;
4651
 
                                dns_rdata_reset(&rdata);
4652
4685
                                if (result != ISC_R_SUCCESS)
4653
4686
                                        break;
4654
4687
                        } else {
4709
4742
                                 * iff there is a new offline signature.
4710
4743
                                 */
4711
4744
                                if (!dst_key_isprivate(keys[i])) {
4712
 
                                        if (warn != 0 &&
4713
 
                                            warn > rrsig.timeexpire)
4714
 
                                                warn = rrsig.timeexpire;
 
4745
                                        isc_int64_t timeexpire =
 
4746
                                           dns_time64_from32(rrsig.timeexpire);
 
4747
                                        if (warn != 0 && warn > timeexpire)
 
4748
                                                warn = timeexpire;
4715
4749
                                        if (rdata.flags & DNS_RDATA_OFFLINE) {
4716
4750
                                                if (maybe == 0 ||
4717
 
                                                    maybe > rrsig.timeexpire)
4718
 
                                                        maybe =
4719
 
                                                             rrsig.timeexpire;
 
4751
                                                    maybe > timeexpire)
 
4752
                                                        maybe = timeexpire;
4720
4753
                                                break;
4721
4754
                                        }
4722
4755
                                        if (warn == 0)
4723
4756
                                                warn = maybe;
4724
 
                                        if (warn == 0 ||
4725
 
                                            warn > rrsig.timeexpire)
4726
 
                                                warn = rrsig.timeexpire;
 
4757
                                        if (warn == 0 || warn > timeexpire)
 
4758
                                                warn = timeexpire;
4727
4759
                                        result = offline(db, ver, diff, name,
4728
4760
                                                         rdataset.ttl, &rdata);
4729
4761
                                        break;
4744
4776
                        result = update_one_rr(db, ver, diff,
4745
4777
                                               DNS_DIFFOP_DELRESIGN, name,
4746
4778
                                               rdataset.ttl, &rdata);
4747
 
                dns_rdata_reset(&rdata);
4748
4779
                if (result != ISC_R_SUCCESS)
4749
4780
                        break;
4750
4781
        }
4755
4786
        dns_rdataset_disassociate(&rdataset);
4756
4787
        if (result == ISC_R_NOMORE)
4757
4788
                result = ISC_R_SUCCESS;
4758
 
        if (warn != 0)
4759
 
                set_key_expiry_warning(zone, warn, now);
 
4789
        if (warn > 0) {
 
4790
#if defined(STDTIME_ON_32BITS)
 
4791
                isc_stdtime_t stdwarn = (isc_stdtime_t)warn;
 
4792
                if (warn == stdwarn)
 
4793
#endif
 
4794
                        set_key_expiry_warning(zone, (isc_stdtime_t)warn, now);
 
4795
#if defined(STDTIME_ON_32BITS)
 
4796
                else
 
4797
                        dns_zone_log(zone, ISC_LOG_ERROR,
 
4798
                                     "key expiry warning time out of range");
 
4799
#endif
 
4800
        }
4760
4801
 failure:
4761
4802
        if (node != NULL)
4762
4803
                dns_db_detachnode(db, &node);
4869
4910
        dns_name_t *name;
4870
4911
        dns_rdataset_t rdataset;
4871
4912
        dns_rdatatype_t covers;
4872
 
        dst_key_t *zone_keys[MAXZONEKEYS];
 
4913
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
4873
4914
        isc_boolean_t check_ksk, keyset_kskonly = ISC_FALSE;
4874
4915
        isc_result_t result;
4875
4916
        isc_stdtime_t now, inception, soaexpire, expire, stop;
4898
4939
        result = dns_db_newversion(db, &version);
4899
4940
        if (result != ISC_R_SUCCESS) {
4900
4941
                dns_zone_log(zone, ISC_LOG_ERROR,
4901
 
                             "zone_resigninc:dns_db_newversion -> %s\n",
 
4942
                             "zone_resigninc:dns_db_newversion -> %s",
4902
4943
                             dns_result_totext(result));
4903
4944
                goto failure;
4904
4945
        }
4905
4946
 
4906
 
        result = find_zone_keys(zone, db, version, zone->mctx, MAXZONEKEYS,
 
4947
        result = find_zone_keys(zone, db, version, zone->mctx, DNS_MAXZONEKEYS,
4907
4948
                                zone_keys, &nkeys);
4908
4949
        if (result != ISC_R_SUCCESS) {
4909
4950
                dns_zone_log(zone, ISC_LOG_ERROR,
4910
 
                             "zone_resigninc:find_zone_keys -> %s\n",
 
4951
                             "zone_resigninc:find_zone_keys -> %s",
4911
4952
                             dns_result_totext(result));
4912
4953
                goto failure;
4913
4954
        }
4931
4972
        result = dns_db_getsigningtime(db, &rdataset, name);
4932
4973
        if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
4933
4974
                dns_zone_log(zone, ISC_LOG_ERROR,
4934
 
                             "zone_resigninc:dns_db_getsigningtime -> %s\n",
 
4975
                             "zone_resigninc:dns_db_getsigningtime -> %s",
4935
4976
                             dns_result_totext(result));
4936
4977
        }
4937
4978
 
4955
4996
                                  zone_keys, nkeys, now, ISC_TRUE);
4956
4997
                if (result != ISC_R_SUCCESS) {
4957
4998
                        dns_zone_log(zone, ISC_LOG_ERROR,
4958
 
                                     "zone_resigninc:del_sigs -> %s\n",
 
4999
                                     "zone_resigninc:del_sigs -> %s",
4959
5000
                                     dns_result_totext(result));
4960
5001
                        break;
4961
5002
                }
4965
5006
                                  expire, check_ksk, keyset_kskonly);
4966
5007
                if (result != ISC_R_SUCCESS) {
4967
5008
                        dns_zone_log(zone, ISC_LOG_ERROR,
4968
 
                                     "zone_resigninc:add_sigs -> %s\n",
 
5009
                                     "zone_resigninc:add_sigs -> %s",
4969
5010
                                     dns_result_totext(result));
4970
5011
                        break;
4971
5012
                }
4977
5018
                }
4978
5019
                if (result != ISC_R_SUCCESS)
4979
5020
                        dns_zone_log(zone, ISC_LOG_ERROR,
4980
 
                             "zone_resigninc:dns_db_getsigningtime -> %s\n",
 
5021
                             "zone_resigninc:dns_db_getsigningtime -> %s",
4981
5022
                                     dns_result_totext(result));
4982
5023
        }
4983
5024
 
4988
5029
                          &sig_diff, zone_keys, nkeys, now, ISC_TRUE);
4989
5030
        if (result != ISC_R_SUCCESS) {
4990
5031
                dns_zone_log(zone, ISC_LOG_ERROR,
4991
 
                             "zone_resigninc:del_sigs -> %s\n",
 
5032
                             "zone_resigninc:del_sigs -> %s",
4992
5033
                             dns_result_totext(result));
4993
5034
                goto failure;
4994
5035
        }
5003
5044
        result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
5004
5045
        if (result != ISC_R_SUCCESS) {
5005
5046
                dns_zone_log(zone, ISC_LOG_ERROR,
5006
 
                             "zone_resigninc:increment_soa_serial -> %s\n",
 
5047
                             "zone_resigninc:increment_soa_serial -> %s",
5007
5048
                             dns_result_totext(result));
5008
5049
                goto failure;
5009
5050
        }
5017
5058
                          soaexpire, check_ksk, keyset_kskonly);
5018
5059
        if (result != ISC_R_SUCCESS) {
5019
5060
                dns_zone_log(zone, ISC_LOG_ERROR,
5020
 
                             "zone_resigninc:add_sigs -> %s\n",
 
5061
                             "zone_resigninc:add_sigs -> %s",
5021
5062
                             dns_result_totext(result));
5022
5063
                goto failure;
5023
5064
        }
5712
5753
                                  zone_keys, nkeys, now, ISC_FALSE);
5713
5754
                if (result != ISC_R_SUCCESS) {
5714
5755
                        dns_zone_log(zone, ISC_LOG_ERROR,
5715
 
                                     "update_sigs:del_sigs -> %s\n",
 
5756
                                     "update_sigs:del_sigs -> %s",
5716
5757
                                     dns_result_totext(result));
5717
5758
                        return (result);
5718
5759
                }
5722
5763
                                  expire, check_ksk, keyset_kskonly);
5723
5764
                if (result != ISC_R_SUCCESS) {
5724
5765
                        dns_zone_log(zone, ISC_LOG_ERROR,
5725
 
                                     "update_sigs:add_sigs -> %s\n",
 
5766
                                     "update_sigs:add_sigs -> %s",
5726
5767
                                     dns_result_totext(result));
5727
5768
                        return (result);
5728
5769
                }
5761
5802
        dns_rdataset_t rdataset;
5762
5803
        dns_nsec3chain_t *nsec3chain = NULL, *nextnsec3chain;
5763
5804
        dns_nsec3chainlist_t cleanup;
5764
 
        dst_key_t *zone_keys[MAXZONEKEYS];
 
5805
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
5765
5806
        isc_int32_t signatures;
5766
5807
        isc_boolean_t check_ksk, keyset_kskonly;
5767
5808
        isc_boolean_t delegation;
5807
5848
        result = dns_db_newversion(db, &version);
5808
5849
        if (result != ISC_R_SUCCESS) {
5809
5850
                dns_zone_log(zone, ISC_LOG_ERROR,
5810
 
                             "zone_nsec3chain:dns_db_newversion -> %s\n",
 
5851
                             "zone_nsec3chain:dns_db_newversion -> %s",
5811
5852
                             dns_result_totext(result));
5812
5853
                goto failure;
5813
5854
        }
5814
5855
 
5815
5856
        result = find_zone_keys(zone, db, version, zone->mctx,
5816
 
                                MAXZONEKEYS, zone_keys, &nkeys);
 
5857
                                DNS_MAXZONEKEYS, zone_keys, &nkeys);
5817
5858
        if (result != ISC_R_SUCCESS) {
5818
5859
                dns_zone_log(zone, ISC_LOG_ERROR,
5819
 
                             "zone_nsec3chain:find_zone_keys -> %s\n",
 
5860
                             "zone_nsec3chain:find_zone_keys -> %s",
5820
5861
                             dns_result_totext(result));
5821
5862
                goto failure;
5822
5863
        }
5962
6003
                                            &nsec3_diff);
5963
6004
                if (result != ISC_R_SUCCESS) {
5964
6005
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
5965
 
                                     "dns_nsec3_addnsec3 -> %s\n",
 
6006
                                     "dns_nsec3_addnsec3 -> %s",
5966
6007
                                     dns_result_totext(result));
5967
6008
                        goto failure;
5968
6009
                }
6020
6061
                        } else if (result != ISC_R_SUCCESS) {
6021
6062
                                dns_zone_log(zone, ISC_LOG_ERROR,
6022
6063
                                             "zone_nsec3chain:"
6023
 
                                             "dns_dbiterator_next -> %s\n",
 
6064
                                             "dns_dbiterator_next -> %s",
6024
6065
                                             dns_result_totext(result));
6025
6066
                                goto failure;
6026
6067
                        } else if (delegation) {
6078
6119
                        if (result != ISC_R_SUCCESS) {
6079
6120
                                dns_zone_log(zone, ISC_LOG_ERROR,
6080
6121
                                             "zone_nsec3chain:"
6081
 
                                             "need_nsec_chain -> %s\n",
 
6122
                                             "need_nsec_chain -> %s",
6082
6123
                                             dns_result_totext(result));
6083
6124
                                goto failure;
6084
6125
                        }
6103
6144
                                if (result != ISC_R_SUCCESS) {
6104
6145
                                        dns_zone_log(zone, ISC_LOG_ERROR,
6105
6146
                                                     "zone_nsec3chain:"
6106
 
                                                     "fixup_nsec3param -> %s\n",
 
6147
                                                     "fixup_nsec3param -> %s",
6107
6148
                                                     dns_result_totext(result));
6108
6149
                                        goto failure;
6109
6150
                                }
6118
6159
                        if (result != ISC_R_SUCCESS) {
6119
6160
                                dns_zone_log(zone, ISC_LOG_ERROR,
6120
6161
                                             "zone_nsec3chain:"
6121
 
                                             "deletematchingnsec3 -> %s\n",
 
6162
                                             "deletematchingnsec3 -> %s",
6122
6163
                                             dns_result_totext(result));
6123
6164
                                goto failure;
6124
6165
                        }
6219
6260
                                if (result != ISC_R_SUCCESS) {
6220
6261
                                        dns_zone_log(zone, ISC_LOG_ERROR,
6221
6262
                                                     "zone_nsec3chain:"
6222
 
                                                     "fixup_nsec3param -> %s\n",
 
6263
                                                     "fixup_nsec3param -> %s",
6223
6264
                                                     dns_result_totext(result));
6224
6265
                                        goto failure;
6225
6266
                                }
6227
6268
                        } else if (result != ISC_R_SUCCESS) {
6228
6269
                                dns_zone_log(zone, ISC_LOG_ERROR,
6229
6270
                                             "zone_nsec3chain:"
6230
 
                                             "dns_dbiterator_next -> %s\n",
 
6271
                                             "dns_dbiterator_next -> %s",
6231
6272
                                             dns_result_totext(result));
6232
6273
                                goto failure;
6233
6274
                        } else if (delegation) {
6264
6305
                result = dns_db_allrdatasets(db, node, version, 0, &iterator);
6265
6306
                if (result != ISC_R_SUCCESS) {
6266
6307
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6267
 
                                     "dns_db_allrdatasets -> %s\n",
 
6308
                                     "dns_db_allrdatasets -> %s",
6268
6309
                                     dns_result_totext(result));
6269
6310
                        goto failure;
6270
6311
                }
6290
6331
                        if (result != ISC_R_SUCCESS) {
6291
6332
                                dns_zone_log(zone, ISC_LOG_ERROR,
6292
6333
                                             "zone_nsec3chain:"
6293
 
                                             "updatesecure -> %s\n",
 
6334
                                             "updatesecure -> %s",
6294
6335
                                             dns_result_totext(result));
6295
6336
                                goto failure;
6296
6337
                        }
6303
6344
                        if (result != ISC_R_SUCCESS) {
6304
6345
                                dns_zone_log(zone, ISC_LOG_ERROR,
6305
6346
                                             "zone_nsec3chain:"
6306
 
                                             "dns_nsec3_addnsec3s -> %s\n",
 
6347
                                             "dns_nsec3_addnsec3s -> %s",
6307
6348
                                             dns_result_totext(result));
6308
6349
                                goto failure;
6309
6350
                        }
6318
6359
                             check_ksk, keyset_kskonly, &sig_diff);
6319
6360
        if (result != ISC_R_SUCCESS) {
6320
6361
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6321
 
                             "update_sigs -> %s\n", dns_result_totext(result));
 
6362
                             "update_sigs -> %s", dns_result_totext(result));
6322
6363
                goto failure;
6323
6364
        }
6324
6365
 
6331
6372
                             check_ksk, keyset_kskonly, &sig_diff);
6332
6373
        if (result != ISC_R_SUCCESS) {
6333
6374
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6334
 
                             "update_sigs -> %s\n", dns_result_totext(result));
 
6375
                             "update_sigs -> %s", dns_result_totext(result));
6335
6376
                goto failure;
6336
6377
        }
6337
6378
 
6342
6383
                                      zone->minimum, ISC_FALSE, &nsec_diff);
6343
6384
                if (result != ISC_R_SUCCESS) {
6344
6385
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6345
 
                                     "updatesecure -> %s\n",
 
6386
                                     "updatesecure -> %s",
6346
6387
                                     dns_result_totext(result));
6347
6388
                        goto failure;
6348
6389
                }
6353
6394
                             check_ksk, keyset_kskonly, &sig_diff);
6354
6395
        if (result != ISC_R_SUCCESS) {
6355
6396
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6356
 
                             "update_sigs -> %s\n", dns_result_totext(result));
 
6397
                             "update_sigs -> %s", dns_result_totext(result));
6357
6398
                goto failure;
6358
6399
        }
6359
6400
 
6368
6409
                          &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
6369
6410
        if (result != ISC_R_SUCCESS) {
6370
6411
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6371
 
                             "del_sigs -> %s\n", dns_result_totext(result));
 
6412
                             "del_sigs -> %s", dns_result_totext(result));
6372
6413
                goto failure;
6373
6414
        }
6374
6415
 
6375
6416
        result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
6376
6417
        if (result != ISC_R_SUCCESS) {
6377
6418
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6378
 
                             "increment_soa_serial -> %s\n",
 
6419
                             "increment_soa_serial -> %s",
6379
6420
                             dns_result_totext(result));
6380
6421
                goto failure;
6381
6422
        }
6385
6426
                          soaexpire, check_ksk, keyset_kskonly);
6386
6427
        if (result != ISC_R_SUCCESS) {
6387
6428
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
6388
 
                             "add_sigs -> %s\n", dns_result_totext(result));
 
6429
                             "add_sigs -> %s", dns_result_totext(result));
6389
6430
                goto failure;
6390
6431
        }
6391
6432
 
6429
6470
 
6430
6471
 failure:
6431
6472
        if (result != ISC_R_SUCCESS)
6432
 
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain: %s\n",
 
6473
                dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain: %s",
6433
6474
                             dns_result_totext(result));
6434
6475
        /*
6435
6476
         * On error roll back the current nsec3chain.
6592
6633
        dns_rdataset_t rdataset;
6593
6634
        dns_signing_t *signing, *nextsigning;
6594
6635
        dns_signinglist_t cleanup;
6595
 
        dst_key_t *zone_keys[MAXZONEKEYS];
 
6636
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
6596
6637
        isc_int32_t signatures;
6597
6638
        isc_boolean_t check_ksk, keyset_kskonly, is_ksk;
6598
6639
        isc_boolean_t commit = ISC_FALSE;
6632
6673
        result = dns_db_newversion(db, &version);
6633
6674
        if (result != ISC_R_SUCCESS) {
6634
6675
                dns_zone_log(zone, ISC_LOG_ERROR,
6635
 
                             "zone_sign:dns_db_newversion -> %s\n",
 
6676
                             "zone_sign:dns_db_newversion -> %s",
6636
6677
                             dns_result_totext(result));
6637
6678
                goto failure;
6638
6679
        }
6639
6680
 
6640
6681
        result = find_zone_keys(zone, db, version, zone->mctx,
6641
 
                                MAXZONEKEYS, zone_keys, &nkeys);
 
6682
                                DNS_MAXZONEKEYS, zone_keys, &nkeys);
6642
6683
        if (result != ISC_R_SUCCESS) {
6643
6684
                dns_zone_log(zone, ISC_LOG_ERROR,
6644
 
                             "zone_sign:find_zone_keys -> %s\n",
 
6685
                             "zone_sign:find_zone_keys -> %s",
6645
6686
                             dns_result_totext(result));
6646
6687
                goto failure;
6647
6688
        }
6862
6903
                                        if (result != ISC_R_SUCCESS) {
6863
6904
                                                dns_zone_log(zone,
6864
6905
                                                             ISC_LOG_ERROR,
6865
 
                                                    "updatesecure -> %s\n",
 
6906
                                                    "updatesecure -> %s",
6866
6907
                                                    dns_result_totext(result));
6867
6908
                                                goto failure;
6868
6909
                                        }
6874
6915
                                                           &post_diff);
6875
6916
                                if (result != ISC_R_SUCCESS) {
6876
6917
                                        dns_zone_log(zone, ISC_LOG_ERROR,
6877
 
                                                     "updatesignwithkey "
6878
 
                                                     "-> %s\n",
 
6918
                                                     "updatesignwithkey -> %s",
6879
6919
                                                     dns_result_totext(result));
6880
6920
                                        goto failure;
6881
6921
                                }
6883
6923
                                goto next_signing;
6884
6924
                        } else if (result != ISC_R_SUCCESS) {
6885
6925
                                dns_zone_log(zone, ISC_LOG_ERROR,
6886
 
                                        "zone_sign:dns_dbiterator_next -> %s\n",
 
6926
                                        "zone_sign:dns_dbiterator_next -> %s",
6887
6927
                                             dns_result_totext(result));
6888
6928
                                goto failure;
6889
6929
                        } else if (delegation) {
6909
6949
                                     check_ksk, keyset_kskonly, &sig_diff);
6910
6950
                if (result != ISC_R_SUCCESS) {
6911
6951
                        dns_zone_log(zone, ISC_LOG_ERROR, "zone_sign:"
6912
 
                                     "update_sigs -> %s\n",
 
6952
                                     "update_sigs -> %s",
6913
6953
                                     dns_result_totext(result));
6914
6954
                        goto failure;
6915
6955
                }
6929
6969
                          &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
6930
6970
        if (result != ISC_R_SUCCESS) {
6931
6971
                dns_zone_log(zone, ISC_LOG_ERROR,
6932
 
                             "zone_sign:del_sigs -> %s\n",
 
6972
                             "zone_sign:del_sigs -> %s",
6933
6973
                             dns_result_totext(result));
6934
6974
                goto failure;
6935
6975
        }
6937
6977
        result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
6938
6978
        if (result != ISC_R_SUCCESS) {
6939
6979
                dns_zone_log(zone, ISC_LOG_ERROR,
6940
 
                             "zone_sign:increment_soa_serial -> %s\n",
 
6980
                             "zone_sign:increment_soa_serial -> %s",
6941
6981
                             dns_result_totext(result));
6942
6982
                goto failure;
6943
6983
        }
6951
6991
                          soaexpire, check_ksk, keyset_kskonly);
6952
6992
        if (result != ISC_R_SUCCESS) {
6953
6993
                dns_zone_log(zone, ISC_LOG_ERROR,
6954
 
                             "zone_sign:add_sigs -> %s\n",
 
6994
                             "zone_sign:add_sigs -> %s",
6955
6995
                             dns_result_totext(result));
6956
6996
                goto failure;
6957
6997
        }
7272
7312
 
7273
7313
                if (dst_key_alg(dstkey) == sig.algorithm &&
7274
7314
                    (dst_key_id(dstkey) == sig.keyid ||
7275
 
                     (sig.algorithm != 1 && sig.keyid ==
7276
 
                       ((dst_key_id(dstkey) + 128) & 0xffff)))) {
 
7315
                     dst_key_rid(dstkey) == sig.keyid)) {
7277
7316
                        result = dns_dnssec_verify2(keyname,
7278
7317
                                            &kfetch->dnskeyset,
7279
7318
                                            dstkey, ISC_FALSE, mctx, &sigrr,
7771
7810
        dns_rdata_keydata_t kd;
7772
7811
        isc_stdtime_t now;
7773
7812
        isc_boolean_t commit = ISC_FALSE;
 
7813
        isc_boolean_t fetching = ISC_FALSE, fetch_err = ISC_FALSE;
7774
7814
 
7775
7815
        ENTER;
7776
7816
        REQUIRE(zone->db != NULL);
7799
7839
             result == ISC_R_SUCCESS;
7800
7840
             result = dns_rriterator_nextrrset(&rrit)) {
7801
7841
                isc_stdtime_t timer = 0xffffffff;
 
7842
                dns_name_t *name = NULL, *kname = NULL;
 
7843
                dns_rdataset_t *kdset = NULL;
7802
7844
                dns_keyfetch_t *kfetch;
7803
 
                dns_rdataset_t *kdset;
7804
 
                dns_name_t *name = NULL;
7805
7845
                isc_uint32_t ttl;
7806
7846
 
7807
7847
                dns_rriterator_current(&rrit, &name, &ttl, &kdset, NULL);
7808
 
                if (!dns_rdataset_isassociated(kdset))
7809
 
                        continue;
7810
 
 
7811
 
                if (kdset->type != dns_rdatatype_keydata)
 
7848
                if (kdset == NULL || kdset->type != dns_rdatatype_keydata ||
 
7849
                    !dns_rdataset_isassociated(kdset))
7812
7850
                        continue;
7813
7851
 
7814
7852
                /*
7843
7881
                if (timer > now)
7844
7882
                        continue;
7845
7883
 
 
7884
                kfetch = isc_mem_get(zone->mctx, sizeof(dns_keyfetch_t));
 
7885
                if (kfetch == NULL) {
 
7886
                        fetch_err = ISC_TRUE;
 
7887
                        goto failure;
 
7888
                }
 
7889
 
7846
7890
                zone->refreshkeycount++;
7847
 
 
7848
 
                kfetch = isc_mem_get(zone->mctx, sizeof(dns_keyfetch_t));
7849
7891
                kfetch->zone = zone;
7850
7892
                zone->irefs++;
7851
7893
                INSIST(zone->irefs != 0);
7852
7894
                dns_fixedname_init(&kfetch->name);
7853
 
                dns_name_dup(name, zone->mctx,
7854
 
                             dns_fixedname_name(&kfetch->name));
 
7895
                kname = dns_fixedname_name(&kfetch->name);
 
7896
                dns_name_dup(name, zone->mctx, kname);
7855
7897
                dns_rdataset_init(&kfetch->dnskeyset);
7856
7898
                dns_rdataset_init(&kfetch->dnskeysigset);
7857
7899
                dns_rdataset_init(&kfetch->keydataset);
7860
7902
                dns_db_attach(db, &kfetch->db);
7861
7903
                kfetch->fetch = NULL;
7862
7904
 
7863
 
                dns_resolver_createfetch(zone->view->resolver,
7864
 
                                         dns_fixedname_name(&kfetch->name),
7865
 
                                         dns_rdatatype_dnskey,
7866
 
                                         NULL, NULL, NULL,
7867
 
                                         DNS_FETCHOPT_NOVALIDATE,
7868
 
                                         zone->task, keyfetch_done, kfetch,
7869
 
                                         &kfetch->dnskeyset,
7870
 
                                         &kfetch->dnskeysigset,
7871
 
                                         &kfetch->fetch);
 
7905
                result = dns_resolver_createfetch(zone->view->resolver,
 
7906
                                                  kname, dns_rdatatype_dnskey,
 
7907
                                                  NULL, NULL, NULL,
 
7908
                                                  DNS_FETCHOPT_NOVALIDATE,
 
7909
                                                  zone->task,
 
7910
                                                  keyfetch_done, kfetch,
 
7911
                                                  &kfetch->dnskeyset,
 
7912
                                                  &kfetch->dnskeysigset,
 
7913
                                                  &kfetch->fetch);
 
7914
                if (result == ISC_R_SUCCESS)
 
7915
                        fetching = ISC_TRUE;
 
7916
                else {
 
7917
                        zone->refreshkeycount--;
 
7918
                        zone->irefs--;
 
7919
                        dns_db_detach(&kfetch->db);
 
7920
                        dns_rdataset_disassociate(&kfetch->keydataset);
 
7921
                        dns_name_free(kname, zone->mctx);
 
7922
                        isc_mem_put(zone->mctx, kfetch, sizeof(dns_keyfetch_t));
 
7923
                        dns_zone_log(zone, ISC_LOG_WARNING,
 
7924
                                     "Failed to create fetch for "
 
7925
                                     "DNSKEY update");
 
7926
                        fetch_err = ISC_TRUE;
 
7927
                }
7872
7928
        }
7873
7929
        if (!ISC_LIST_EMPTY(diff.tuples)) {
7874
7930
                CHECK(increment_soa_serial(db, ver, &diff, zone->mctx));
7875
 
                CHECK(zone_journal(zone, &diff, "sync_keyzone"));
 
7931
                CHECK(zone_journal(zone, &diff, "zone_refreshkeys"));
7876
7932
                commit = ISC_TRUE;
7877
7933
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
7878
7934
                zone_needdump(zone, 30);
7879
7935
        }
7880
7936
 
7881
7937
  failure:
 
7938
        if (fetch_err) {
 
7939
                /*
 
7940
                 * Error during a key fetch; retry in an hour.
 
7941
                 */
 
7942
                isc_time_t timenow, timethen;
 
7943
                char timebuf[80];
 
7944
 
 
7945
                TIME_NOW(&timenow);
 
7946
                DNS_ZONE_TIME_ADD(&timenow, HOUR, &timethen);
 
7947
                zone->refreshkeytime = timethen;
 
7948
                zone_settimer(zone, &timenow);
 
7949
 
 
7950
                isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
 
7951
                dns_zone_log(zone, ISC_LOG_DEBUG(1), "retry key refresh: %s",
 
7952
                             timebuf);
 
7953
 
 
7954
                if (!fetching)
 
7955
                        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESHING);
 
7956
        }
 
7957
 
7882
7958
        UNLOCK_ZONE(zone);
7883
7959
 
7884
7960
        dns_diff_clear(&diff);
7903
7979
         * Configuring the view of this zone may have
7904
7980
         * failed, for example because the config file
7905
7981
         * had a syntax error.  In that case, the view
7906
 
         * adb or resolver, and we had better not try
 
7982
         * db or resolver will be NULL, and we had better not try
7907
7983
         * to do maintenance on it.
7908
7984
         */
7909
7985
        if (zone->view == NULL || zone->view->adb == NULL)
7950
8026
        case dns_zone_master:
7951
8027
        case dns_zone_slave:
7952
8028
        case dns_zone_key:
 
8029
        case dns_zone_stub:
7953
8030
                LOCK_ZONE(zone);
7954
8031
                if (zone->masterfile != NULL &&
7955
8032
                    isc_time_compare(&now, &zone->dumptime) >= 0 &&
8309
8386
                goto fail;
8310
8387
        }
8311
8388
 
8312
 
        if (compact) {
 
8389
        if (compact && zone->type != dns_zone_stub) {
8313
8390
                dns_zone_t *dummy = NULL;
8314
8391
                LOCK_ZONE(zone);
8315
8392
                zone_iattach(zone, &dummy);
8435
8512
}
8436
8513
 
8437
8514
static void
 
8515
forward_cancel(dns_zone_t *zone) {
 
8516
        dns_forward_t *forward;
 
8517
 
 
8518
        /*
 
8519
         * 'zone' locked by caller.
 
8520
         */
 
8521
 
 
8522
        REQUIRE(LOCKED_ZONE(zone));
 
8523
 
 
8524
        for (forward = ISC_LIST_HEAD(zone->forwards);
 
8525
             forward != NULL;
 
8526
             forward = ISC_LIST_NEXT(forward, link)) {
 
8527
                if (forward->request != NULL)
 
8528
                        dns_request_cancel(forward->request);
 
8529
        }
 
8530
}
 
8531
 
 
8532
static void
8438
8533
zone_unload(dns_zone_t *zone) {
8439
8534
 
8440
8535
        /*
8443
8538
 
8444
8539
        REQUIRE(LOCKED_ZONE(zone));
8445
8540
 
 
8541
        if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FLUSH) ||
 
8542
            !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) {
 
8543
                if (zone->writeio != NULL)
 
8544
                        zonemgr_cancelio(zone->writeio);
 
8545
 
 
8546
                if (zone->dctx != NULL)
 
8547
                        dns_dumpctx_cancel(zone->dctx);
 
8548
        }
8446
8549
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
8447
8550
        zone_detachdb(zone);
8448
8551
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
9139
9242
        dns_zone_t *zone = NULL;
9140
9243
        char master[ISC_SOCKADDR_FORMATSIZE];
9141
9244
        char source[ISC_SOCKADDR_FORMATSIZE];
9142
 
        isc_uint32_t nscnt, cnamecnt;
 
9245
        isc_uint32_t nscnt, cnamecnt, refresh, retry, expire;
9143
9246
        isc_result_t result;
9144
9247
        isc_time_t now;
9145
9248
        isc_boolean_t exiting = ISC_FALSE;
9157
9260
 
9158
9261
        TIME_NOW(&now);
9159
9262
 
 
9263
        LOCK_ZONE(zone);
 
9264
 
9160
9265
        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
9161
9266
                zone_debuglog(zone, me, 1, "exiting");
9162
9267
                exiting = ISC_TRUE;
9169
9274
        if (revent->result != ISC_R_SUCCESS) {
9170
9275
                if (revent->result == ISC_R_TIMEDOUT &&
9171
9276
                    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
9172
 
                        LOCK_ZONE(zone);
9173
9277
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
9174
 
                        UNLOCK_ZONE(zone);
9175
9278
                        dns_zone_log(zone, ISC_LOG_DEBUG(1),
9176
9279
                                     "refreshing stub: timeout retrying "
9177
9280
                                     " without EDNS master %s (source %s)",
9213
9316
                                     "refreshing stub: rcode (%.*s) retrying "
9214
9317
                                     "without EDNS master %s (source %s)",
9215
9318
                                     (int)rb.used, rcode, master, source);
9216
 
                        LOCK_ZONE(zone);
9217
9319
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
9218
 
                        UNLOCK_ZONE(zone);
9219
9320
                        goto same_master;
9220
9321
                }
9221
9322
 
9237
9338
                                     master, source);
9238
9339
                        goto next_master;
9239
9340
                }
9240
 
                LOCK_ZONE(zone);
9241
9341
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEVC);
9242
 
                UNLOCK_ZONE(zone);
9243
9342
                goto same_master;
9244
9343
        }
9245
9344
 
9291
9390
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
9292
9391
        if (zone->db == NULL)
9293
9392
                zone_attachdb(zone, stub->db);
 
9393
        result = zone_get_from_db(zone, zone->db, NULL, NULL, NULL, &refresh,
 
9394
                                  &retry, &expire, NULL, NULL);
 
9395
        if (result == ISC_R_SUCCESS) {
 
9396
                zone->refresh = RANGE(refresh, zone->minrefresh,
 
9397
                                      zone->maxrefresh);
 
9398
                zone->retry = RANGE(retry, zone->minretry, zone->maxretry);
 
9399
                zone->expire = RANGE(expire, zone->refresh + zone->retry,
 
9400
                                     DNS_MAX_EXPIRE);
 
9401
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
 
9402
        }
9294
9403
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
9295
9404
        dns_db_detach(&stub->db);
9296
9405
 
9297
 
        if (zone->masterfile != NULL) {
9298
 
                dns_zone_dump(zone);
9299
 
                TIME_NOW(&zone->loadtime);
9300
 
        }
9301
 
 
9302
9406
        dns_message_destroy(&msg);
9303
9407
        isc_event_free(&event);
9304
 
        LOCK_ZONE(zone);
9305
9408
        dns_request_destroy(&zone->request);
 
9409
 
9306
9410
        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
 
9411
        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
9307
9412
        DNS_ZONE_JITTER_ADD(&now, zone->refresh, &zone->refreshtime);
9308
9413
        isc_interval_set(&i, zone->expire, 0);
9309
9414
        DNS_ZONE_TIME_ADD(&now, zone->expire, &zone->expiretime);
 
9415
 
 
9416
        if (zone->masterfile != NULL)
 
9417
                zone_needdump(zone, 0);
 
9418
 
9310
9419
        zone_settimer(zone, &now);
9311
 
        UNLOCK_ZONE(zone);
9312
9420
        goto free_stub;
9313
9421
 
9314
9422
 next_master:
9319
9427
        if (msg != NULL)
9320
9428
                dns_message_destroy(&msg);
9321
9429
        isc_event_free(&event);
9322
 
        LOCK_ZONE(zone);
9323
9430
        dns_request_destroy(&zone->request);
9324
9431
        /*
9325
9432
         * Skip to next failed / untried master.
9357
9464
                        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
9358
9465
 
9359
9466
                        zone_settimer(zone, &now);
9360
 
                        UNLOCK_ZONE(zone);
9361
9467
                        goto free_stub;
9362
9468
                }
9363
9469
        }
9364
9470
        queue_soa_query(zone);
9365
 
        UNLOCK_ZONE(zone);
9366
9471
        goto free_stub;
9367
9472
 
9368
9473
 same_master:
9369
9474
        if (msg != NULL)
9370
9475
                dns_message_destroy(&msg);
9371
9476
        isc_event_free(&event);
9372
 
        LOCK_ZONE(zone);
9373
9477
        dns_request_destroy(&zone->request);
9374
 
        UNLOCK_ZONE(zone);
9375
9478
        ns_query(zone, NULL, stub);
 
9479
        UNLOCK_ZONE(zone);
9376
9480
        goto done;
9377
9481
 
9378
9482
 free_stub:
 
9483
        UNLOCK_ZONE(zone);
9379
9484
        stub->magic = 0;
9380
9485
        dns_zone_idetach(&stub->zone);
9381
9486
        INSIST(stub->db == NULL);
9404
9509
        dns_rdata_t rdata = DNS_RDATA_INIT;
9405
9510
        dns_rdata_soa_t soa;
9406
9511
        isc_result_t result;
9407
 
        isc_uint32_t serial, oldserial;
 
9512
        isc_uint32_t serial, oldserial = 0;
9408
9513
        unsigned int j;
 
9514
        isc_boolean_t do_queue_xfrin = ISC_FALSE;
9409
9515
 
9410
9516
        zone = revent->ev_arg;
9411
9517
        INSIST(DNS_ZONE_VALID(zone));
9414
9520
 
9415
9521
        ENTER;
9416
9522
 
 
9523
        TIME_NOW(&now);
 
9524
 
 
9525
        LOCK_ZONE(zone);
 
9526
 
9417
9527
        /*
9418
9528
         * if timeout log and next master;
9419
9529
         */
9421
9531
        isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
9422
9532
        isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
9423
9533
 
9424
 
        TIME_NOW(&now);
9425
 
 
9426
9534
        if (revent->result != ISC_R_SUCCESS) {
9427
9535
                if (revent->result == ISC_R_TIMEDOUT &&
9428
9536
                    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
9429
 
                        LOCK_ZONE(zone);
9430
9537
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
9431
 
                        UNLOCK_ZONE(zone);
9432
9538
                        dns_zone_log(zone, ISC_LOG_DEBUG(1),
9433
9539
                                     "refresh: timeout retrying without EDNS "
9434
9540
                                     "master %s (source %s)", master, source);
9446
9552
                                if (!dns_zonemgr_unreachable(zone->zmgr,
9447
9553
                                                             &zone->masteraddr,
9448
9554
                                                             &zone->sourceaddr,
9449
 
                                                             &now)) {
9450
 
                                        LOCK_ZONE(zone);
 
9555
                                                             &now))
 
9556
                                {
9451
9557
                                        DNS_ZONE_SETFLAG(zone,
9452
9558
                                                     DNS_ZONEFLG_SOABEFOREAXFR);
9453
 
                                        UNLOCK_ZONE(zone);
9454
9559
                                        goto tcp_transfer;
9455
9560
                                }
9456
9561
                                dns_zone_log(zone, ISC_LOG_DEBUG(1),
9497
9602
                                     "refresh: rcode (%.*s) retrying without "
9498
9603
                                     "EDNS master %s (source %s)",
9499
9604
                                     (int)rb.used, rcode, master, source);
9500
 
                        LOCK_ZONE(zone);
9501
9605
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
9502
 
                        UNLOCK_ZONE(zone);
9503
9606
                        goto same_master;
9504
9607
                }
9505
9608
                dns_zone_log(zone, ISC_LOG_INFO,
9525
9628
                                     "initiating TCP zone xfer "
9526
9629
                                     "for master %s (source %s)",
9527
9630
                                     master, source);
9528
 
                        LOCK_ZONE(zone);
9529
9631
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR);
9530
 
                        UNLOCK_ZONE(zone);
9531
9632
                        goto tcp_transfer;
9532
9633
                } else {
9533
9634
                        INSIST(zone->type == dns_zone_stub);
9538
9639
                                             master, source);
9539
9640
                                goto next_master;
9540
9641
                        }
9541
 
                        LOCK_ZONE(zone);
9542
9642
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEVC);
9543
 
                        UNLOCK_ZONE(zone);
9544
9643
                        goto same_master;
9545
9644
                }
9546
9645
        }
9601
9700
                             soacnt, master, source);
9602
9701
                goto next_master;
9603
9702
        }
 
9703
 
9604
9704
        /*
9605
9705
         * Extract serial
9606
9706
         */
9628
9728
 
9629
9729
        serial = soa.serial;
9630
9730
        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
9631
 
                result = dns_zone_getserial2(zone, &oldserial);
 
9731
                result = zone_get_from_db(zone, zone->db, NULL, NULL,
 
9732
                                          &oldserial, NULL, NULL, NULL, NULL,
 
9733
                                          NULL);
9632
9734
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
9633
9735
                zone_debuglog(zone, me, 1, "serial: new %u, old %u",
9634
9736
                              serial, oldserial);
9640
9742
            DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER) ||
9641
9743
            isc_serial_gt(serial, oldserial)) {
9642
9744
                if (dns_zonemgr_unreachable(zone->zmgr, &zone->masteraddr,
9643
 
                                            &zone->sourceaddr, &now)) {
 
9745
                                            &zone->sourceaddr, &now))
 
9746
                {
9644
9747
                        dns_zone_log(zone, ISC_LOG_INFO,
9645
9748
                                     "refresh: skipping %s as master %s "
9646
9749
                                     "(source %s) is unreachable (cached)",
9651
9754
                }
9652
9755
 tcp_transfer:
9653
9756
                isc_event_free(&event);
9654
 
                LOCK_ZONE(zone);
9655
9757
                dns_request_destroy(&zone->request);
9656
 
                UNLOCK_ZONE(zone);
9657
9758
                if (zone->type == dns_zone_slave) {
9658
 
                        queue_xfrin(zone);
 
9759
                        do_queue_xfrin = ISC_TRUE;
9659
9760
                } else {
9660
9761
                        INSIST(zone->type == dns_zone_stub);
9661
9762
                        ns_query(zone, rdataset, NULL);
9677
9778
                                                          &now);
9678
9779
                        /* Someone removed the file from underneath us! */
9679
9780
                        if (result == ISC_R_FILENOTFOUND) {
9680
 
                                LOCK_ZONE(zone);
9681
9781
                                zone_needdump(zone, DNS_DUMP_DELAY);
9682
 
                                UNLOCK_ZONE(zone);
9683
9782
                        } else if (result != ISC_R_SUCCESS)
9684
9783
                                dns_zone_log(zone, ISC_LOG_ERROR,
9685
9784
                                             "refresh: could not set file "
9709
9808
        if (msg != NULL)
9710
9809
                dns_message_destroy(&msg);
9711
9810
        isc_event_free(&event);
9712
 
        LOCK_ZONE(zone);
9713
9811
        dns_request_destroy(&zone->request);
9714
9812
        /*
9715
9813
         * Skip to next failed / untried master.
9751
9849
                }
9752
9850
                DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_USEALTXFRSRC);
9753
9851
                zone_settimer(zone, &now);
9754
 
                UNLOCK_ZONE(zone);
9755
9852
                goto detach;
9756
9853
        }
9757
9854
 
9758
9855
 requeue:
9759
9856
        queue_soa_query(zone);
9760
 
        UNLOCK_ZONE(zone);
9761
9857
        goto detach;
9762
9858
 
9763
9859
 same_master:
9764
9860
        if (msg != NULL)
9765
9861
                dns_message_destroy(&msg);
9766
9862
        isc_event_free(&event);
9767
 
        LOCK_ZONE(zone);
9768
9863
        dns_request_destroy(&zone->request);
9769
9864
        queue_soa_query(zone);
9770
 
        UNLOCK_ZONE(zone);
9771
9865
 
9772
9866
 detach:
 
9867
        UNLOCK_ZONE(zone);
 
9868
        if (do_queue_xfrin)
 
9869
                queue_xfrin(zone);
9773
9870
        dns_zone_idetach(&zone);
9774
9871
        return;
9775
9872
}
10127
10224
        isc_uint16_t udpsize = SEND_BUFFER_SIZE;
10128
10225
 
10129
10226
        REQUIRE(DNS_ZONE_VALID(zone));
 
10227
        REQUIRE(LOCKED_ZONE(zone));
10130
10228
        REQUIRE((soardataset != NULL && stub == NULL) ||
10131
10229
                (soardataset == NULL && stub != NULL));
10132
10230
        REQUIRE(stub == NULL || DNS_STUB_VALID(stub));
10133
10231
 
10134
10232
        ENTER;
10135
10233
 
10136
 
        LOCK_ZONE(zone);
10137
10234
        if (stub == NULL) {
10138
10235
                stub = isc_mem_get(zone->mctx, sizeof(*stub));
10139
10236
                if (stub == NULL)
10324
10421
        }
10325
10422
        if (message != NULL)
10326
10423
                dns_message_destroy(&message);
10327
 
  unlock:
 
10424
 unlock:
10328
10425
        if (key != NULL)
10329
10426
                dns_tsigkey_detach(&key);
10330
 
        UNLOCK_ZONE(zone);
10331
10427
        return;
10332
10428
}
10333
10429
 
10344
10440
        REQUIRE(DNS_ZONE_VALID(zone));
10345
10441
        INSIST(event->ev_type == DNS_EVENT_ZONECONTROL);
10346
10442
        INSIST(isc_refcount_current(&zone->erefs) == 0);
 
10443
 
10347
10444
        zone_debuglog(zone, "zone_shutdown", 3, "shutting down");
10348
10445
 
10349
10446
        /*
10402
10499
 
10403
10500
        notify_cancel(zone);
10404
10501
 
 
10502
        forward_cancel(zone);
 
10503
 
10405
10504
        if (zone->timer != NULL) {
10406
10505
                isc_timer_detach(&zone->timer);
10407
10506
                INSIST(zone->irefs > 0);
10744
10843
        char fromtext[ISC_SOCKADDR_FORMATSIZE];
10745
10844
        int match = 0;
10746
10845
        isc_netaddr_t netaddr;
 
10846
        isc_sockaddr_t local, remote;
10747
10847
 
10748
10848
        REQUIRE(DNS_ZONE_VALID(zone));
10749
10849
 
10894
10994
                return (ISC_R_SUCCESS);
10895
10995
        }
10896
10996
        zone->notifyfrom = *from;
 
10997
        local = zone->masteraddr;
 
10998
        remote = zone->sourceaddr;
10897
10999
        UNLOCK_ZONE(zone);
 
11000
        dns_zonemgr_unreachabledel(zone->zmgr, &local, &remote);
10898
11001
        dns_zone_refresh(zone);
10899
11002
        return (ISC_R_SUCCESS);
10900
11003
}
11916
12019
         * This transfer finishing freed up a transfer quota slot.
11917
12020
         * Let any other zones waiting for quota have it.
11918
12021
         */
 
12022
        UNLOCK_ZONE(zone);
11919
12023
        RWLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
11920
12024
        ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone, statelink);
11921
12025
        zone->statelist = NULL;
11922
12026
        zmgr_resume_xfrs(zone->zmgr, ISC_FALSE);
11923
12027
        RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
 
12028
        LOCK_ZONE(zone);
11924
12029
 
11925
12030
        /*
11926
12031
         * Retry with a different server if necessary.
12087
12192
 
12088
12193
        isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
12089
12194
        if (dns_zonemgr_unreachable(zone->zmgr, &zone->masteraddr,
12090
 
                                    &zone->sourceaddr, &now)) {
 
12195
                                    &zone->sourceaddr, &now))
 
12196
        {
12091
12197
                isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
12092
12198
                dns_zone_log(zone, ISC_LOG_INFO,
12093
12199
                             "got_transfer_quota: skipping zone transfer as "
12227
12333
                dns_request_destroy(&forward->request);
12228
12334
        if (forward->msgbuf != NULL)
12229
12335
                isc_buffer_free(&forward->msgbuf);
12230
 
        if (forward->zone != NULL)
 
12336
        if (forward->zone != NULL) {
 
12337
                LOCK(&forward->zone->lock);
 
12338
                if (ISC_LINK_LINKED(forward, link))
 
12339
                        ISC_LIST_UNLINK(forward->zone->forwards, forward, link);
 
12340
                UNLOCK(&forward->zone->lock);
12231
12341
                dns_zone_idetach(&forward->zone);
 
12342
        }
12232
12343
        isc_mem_putanddetach(&forward->mctx, forward, sizeof(*forward));
12233
12344
}
12234
12345
 
12238
12349
        isc_sockaddr_t src;
12239
12350
 
12240
12351
        LOCK_ZONE(forward->zone);
 
12352
 
 
12353
        if (DNS_ZONE_FLAG(forward->zone, DNS_ZONEFLG_EXITING)) {
 
12354
                UNLOCK_ZONE(forward->zone);
 
12355
                return (ISC_R_CANCELED);
 
12356
        }
 
12357
 
12241
12358
        if (forward->which >= forward->zone->masterscnt) {
12242
12359
                UNLOCK_ZONE(forward->zone);
12243
12360
                return (ISC_R_NOMORE);
12268
12385
                                       forward->zone->task,
12269
12386
                                       forward_callback, forward,
12270
12387
                                       &forward->request);
 
12388
        if (result == ISC_R_SUCCESS) {
 
12389
                if (!ISC_LINK_LINKED(forward, link))
 
12390
                        ISC_LIST_APPEND(forward->zone->forwards, forward, link);
 
12391
        }
 
12392
 
12271
12393
 unlock:
12272
12394
        UNLOCK_ZONE(forward->zone);
12273
12395
        return (result);
12394
12516
        forward->mctx = 0;
12395
12517
        forward->callback = callback;
12396
12518
        forward->callback_arg = callback_arg;
 
12519
        ISC_LINK_INIT(forward, link);
12397
12520
        forward->magic = FORWARD_MAGIC;
12398
12521
 
12399
12522
        mr = dns_message_getrawmessage(msg);
12480
12603
        zmgr->transfersin = 10;
12481
12604
        zmgr->transfersperns = 2;
12482
12605
 
 
12606
        /* Unreachable lock. */
 
12607
        result = isc_rwlock_init(&zmgr->urlock, 0, 0);
 
12608
        if (result != ISC_R_SUCCESS)
 
12609
                goto free_rwlock;
 
12610
 
12483
12611
        /* Create a single task for queueing of SOA queries. */
12484
12612
        result = isc_task_create(taskmgr, 1, &zmgr->task);
12485
12613
        if (result != ISC_R_SUCCESS)
12486
 
                goto free_rwlock;
 
12614
                goto free_urlock;
 
12615
 
12487
12616
        isc_task_setname(zmgr->task, "zmgr", zmgr);
12488
12617
        result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
12489
12618
                                        &zmgr->rl);
12490
12619
        if (result != ISC_R_SUCCESS)
12491
12620
                goto free_task;
 
12621
 
12492
12622
        /* default to 20 refresh queries / notifies per second. */
12493
12623
        isc_interval_set(&interval, 0, 1000000000/2);
12494
12624
        result = isc_ratelimiter_setinterval(zmgr->rl, &interval);
12517
12647
        isc_ratelimiter_detach(&zmgr->rl);
12518
12648
 free_task:
12519
12649
        isc_task_detach(&zmgr->task);
 
12650
 free_urlock:
 
12651
        isc_rwlock_destroy(&zmgr->urlock);
12520
12652
 free_rwlock:
12521
12653
        isc_rwlock_destroy(&zmgr->rwlock);
12522
12654
 free_mem:
12676
12808
 
12677
12809
void
12678
12810
dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) {
 
12811
        dns_zone_t *zone;
 
12812
 
12679
12813
        REQUIRE(DNS_ZONEMGR_VALID(zmgr));
12680
12814
 
12681
12815
        isc_ratelimiter_shutdown(zmgr->rl);
12684
12818
                isc_task_destroy(&zmgr->task);
12685
12819
        if (zmgr->zonetasks != NULL)
12686
12820
                isc_taskpool_destroy(&zmgr->zonetasks);
 
12821
 
 
12822
        RWLOCK(&zmgr->rwlock, isc_rwlocktype_read);
 
12823
        for (zone = ISC_LIST_HEAD(zmgr->zones);
 
12824
             zone != NULL;
 
12825
             zone = ISC_LIST_NEXT(zone, link))
 
12826
        {
 
12827
                LOCK_ZONE(zone);
 
12828
                forward_cancel(zone);
 
12829
                UNLOCK_ZONE(zone);
 
12830
        }
 
12831
        RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
12687
12832
}
12688
12833
 
12689
12834
isc_result_t
12727
12872
        DESTROYLOCK(&zmgr->iolock);
12728
12873
        isc_ratelimiter_detach(&zmgr->rl);
12729
12874
 
 
12875
        isc_rwlock_destroy(&zmgr->urlock);
12730
12876
        isc_rwlock_destroy(&zmgr->rwlock);
12731
12877
        mctx = zmgr->mctx;
12732
12878
        isc_mem_put(zmgr->mctx, zmgr, sizeof(*zmgr));
12827
12973
        isc_event_t *e;
12828
12974
 
12829
12975
        /*
 
12976
         * If we are exiting just pretend we got quota so the zone will
 
12977
         * be cleaned up in the zone's task context.
 
12978
         */
 
12979
        LOCK_ZONE(zone);
 
12980
        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
 
12981
                UNLOCK_ZONE(zone);
 
12982
                goto gotquota;
 
12983
        }
 
12984
 
 
12985
        /*
12830
12986
         * Find any configured information about the server we'd
12831
12987
         * like to transfer this zone from.
12832
12988
         */
12833
12989
        isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
12834
 
        (void)dns_peerlist_peerbyaddr(zone->view->peers,
12835
 
                                      &masterip, &peer);
 
12990
        (void)dns_peerlist_peerbyaddr(zone->view->peers, &masterip, &peer);
 
12991
        UNLOCK_ZONE(zone);
12836
12992
 
12837
12993
        /*
12838
12994
         * Determine the total maximum number of simultaneous
12856
13012
             x = ISC_LIST_NEXT(x, statelink))
12857
13013
        {
12858
13014
                isc_netaddr_t xip;
 
13015
 
 
13016
                LOCK_ZONE(x);
12859
13017
                isc_netaddr_fromsockaddr(&xip, &x->masteraddr);
 
13018
                UNLOCK_ZONE(x);
 
13019
 
12860
13020
                nxfrsin++;
12861
13021
                if (isc_netaddr_equal(&xip, &masterip))
12862
13022
                        nxfrsperns++;
12869
13029
        if (nxfrsperns >= maxtransfersperns)
12870
13030
                return (ISC_R_QUOTA);
12871
13031
 
 
13032
 gotquota:
12872
13033
        /*
12873
13034
         * We have sufficient quota.  Move the zone to the "xfrin_in_progress"
12874
13035
         * list and send it an event to let it start the actual transfer in the
12875
13036
         * context of its own task.
12876
13037
         */
12877
 
        e = isc_event_allocate(zmgr->mctx, zmgr,
12878
 
                               DNS_EVENT_ZONESTARTXFRIN,
12879
 
                               got_transfer_quota, zone,
12880
 
                               sizeof(isc_event_t));
 
13038
        e = isc_event_allocate(zmgr->mctx, zmgr, DNS_EVENT_ZONESTARTXFRIN,
 
13039
                               got_transfer_quota, zone, sizeof(isc_event_t));
12881
13040
        if (e == NULL)
12882
13041
                return (ISC_R_NOMEMORY);
12883
13042
 
13049
13208
        if (result != ISC_R_SUCCESS)
13050
13209
                goto cleanup;
13051
13210
 
13052
 
        dns_zone_log(zone, ISC_LOG_WARNING, "saved '%s' as '%s'",
13053
 
                     path, buf);
 
13211
        dns_zone_log(zone, ISC_LOG_WARNING, "unable to load from '%s'; "
 
13212
                     "renaming file to '%s' for failure analysis and "
 
13213
                     "retransferring.", path, buf);
13054
13214
 
13055
13215
 cleanup:
13056
13216
        isc_mem_put(zone->mctx, buf, buflen);
13113
13273
        return (zmgr->serialqueryrate);
13114
13274
}
13115
13275
 
13116
 
static isc_boolean_t
 
13276
isc_boolean_t
13117
13277
dns_zonemgr_unreachable(dns_zonemgr_t *zmgr, isc_sockaddr_t *remote,
13118
13278
                        isc_sockaddr_t *local, isc_time_t *now)
13119
13279
{
13125
13285
        REQUIRE(DNS_ZONEMGR_VALID(zmgr));
13126
13286
 
13127
13287
        locktype = isc_rwlocktype_read;
13128
 
        RWLOCK(&zmgr->rwlock, locktype);
 
13288
        RWLOCK(&zmgr->urlock, locktype);
13129
13289
        for (i = 0; i < UNREACH_CHACHE_SIZE; i++) {
13130
13290
                if (zmgr->unreachable[i].expire >= seconds &&
13131
13291
                    isc_sockaddr_equal(&zmgr->unreachable[i].remote, remote) &&
13132
13292
                    isc_sockaddr_equal(&zmgr->unreachable[i].local, local)) {
13133
 
                        result = isc_rwlock_tryupgrade(&zmgr->rwlock);
 
13293
                        result = isc_rwlock_tryupgrade(&zmgr->urlock);
13134
13294
                        if (result == ISC_R_SUCCESS) {
13135
13295
                                locktype = isc_rwlocktype_write;
13136
13296
                                zmgr->unreachable[i].last = seconds;
13138
13298
                        break;
13139
13299
                }
13140
13300
        }
13141
 
        RWUNLOCK(&zmgr->rwlock, locktype);
 
13301
        RWUNLOCK(&zmgr->urlock, locktype);
13142
13302
        return (ISC_TF(i < UNREACH_CHACHE_SIZE));
13143
13303
}
13144
13304
 
13145
13305
void
 
13306
dns_zonemgr_unreachabledel(dns_zonemgr_t *zmgr, isc_sockaddr_t *remote,
 
13307
                           isc_sockaddr_t *local)
 
13308
{
 
13309
        unsigned int i;
 
13310
        isc_rwlocktype_t locktype;
 
13311
        isc_result_t result;
 
13312
 
 
13313
        char master[ISC_SOCKADDR_FORMATSIZE];
 
13314
        char source[ISC_SOCKADDR_FORMATSIZE];
 
13315
 
 
13316
        isc_sockaddr_format(remote, master, sizeof(master));
 
13317
        isc_sockaddr_format(local, source, sizeof(source));
 
13318
 
 
13319
        REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 
13320
 
 
13321
        locktype = isc_rwlocktype_read;
 
13322
        RWLOCK(&zmgr->urlock, locktype);
 
13323
        for (i = 0; i < UNREACH_CHACHE_SIZE; i++) {
 
13324
                if (isc_sockaddr_equal(&zmgr->unreachable[i].remote, remote) &&
 
13325
                    isc_sockaddr_equal(&zmgr->unreachable[i].local, local)) {
 
13326
                        result = isc_rwlock_tryupgrade(&zmgr->urlock);
 
13327
                        if (result == ISC_R_SUCCESS) {
 
13328
                                locktype = isc_rwlocktype_write;
 
13329
                                zmgr->unreachable[i].expire = 0;
 
13330
                                isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 
13331
                                              DNS_LOGMODULE_ZONE, ISC_LOG_INFO,
 
13332
                                              "master %s (source %s) deleted "
 
13333
                                              "from unreachable cache",
 
13334
                                              master, source);
 
13335
                        }
 
13336
                        break;
 
13337
                }
 
13338
        }
 
13339
        RWUNLOCK(&zmgr->urlock, locktype);
 
13340
}
 
13341
 
 
13342
void
13146
13343
dns_zonemgr_unreachableadd(dns_zonemgr_t *zmgr, isc_sockaddr_t *remote,
13147
13344
                           isc_sockaddr_t *local, isc_time_t *now)
13148
13345
{
13152
13349
 
13153
13350
        REQUIRE(DNS_ZONEMGR_VALID(zmgr));
13154
13351
 
13155
 
        RWLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 
13352
        RWLOCK(&zmgr->urlock, isc_rwlocktype_write);
13156
13353
        for (i = 0; i < UNREACH_CHACHE_SIZE; i++) {
13157
13354
                /* Existing entry? */
13158
13355
                if (isc_sockaddr_equal(&zmgr->unreachable[i].remote, remote) &&
13191
13388
                zmgr->unreachable[oldest].remote = *remote;
13192
13389
                zmgr->unreachable[oldest].local = *local;
13193
13390
        }
13194
 
        RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 
13391
        RWUNLOCK(&zmgr->urlock, isc_rwlocktype_write);
13195
13392
}
13196
13393
 
13197
13394
void
13802
13999
        isc_result_t result;
13803
14000
        isc_stdtime_t now, inception, soaexpire;
13804
14001
        isc_boolean_t check_ksk, keyset_kskonly;
13805
 
        dst_key_t *zone_keys[MAXZONEKEYS];
 
14002
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
13806
14003
        unsigned int nkeys = 0, i;
13807
14004
        dns_difftuple_t *tuple;
13808
14005
 
13809
 
        result = find_zone_keys(zone, db, ver, zone->mctx, MAXZONEKEYS,
 
14006
        result = find_zone_keys(zone, db, ver, zone->mctx, DNS_MAXZONEKEYS,
13810
14007
                                zone_keys, &nkeys);
13811
14008
        if (result != ISC_R_SUCCESS) {
13812
14009
                dns_zone_log(zone, ISC_LOG_ERROR,
13813
 
                             "sign_apex:find_zone_keys -> %s\n",
 
14010
                             "sign_apex:find_zone_keys -> %s",
13814
14011
                             dns_result_totext(result));
13815
14012
                return (result);
13816
14013
        }
13841
14038
                                  zone_keys, nkeys, now, ISC_FALSE);
13842
14039
                if (result != ISC_R_SUCCESS) {
13843
14040
                        dns_zone_log(zone, ISC_LOG_ERROR,
13844
 
                                     "sign_apex:del_sigs -> %s\n",
 
14041
                                     "sign_apex:del_sigs -> %s",
13845
14042
                                     dns_result_totext(result));
13846
14043
                        goto failure;
13847
14044
                }
13851
14048
                                  keyset_kskonly);
13852
14049
                if (result != ISC_R_SUCCESS) {
13853
14050
                        dns_zone_log(zone, ISC_LOG_ERROR,
13854
 
                                     "sign_apex:add_sigs -> %s\n",
 
14051
                                     "sign_apex:add_sigs -> %s",
13855
14052
                                     dns_result_totext(result));
13856
14053
                        goto failure;
13857
14054
                }
13863
14060
 
13864
14061
        if (result != ISC_R_SUCCESS) {
13865
14062
                dns_zone_log(zone, ISC_LOG_ERROR,
13866
 
                             "sign_apex:update_sigs -> %s\n",
 
14063
                             "sign_apex:update_sigs -> %s",
13867
14064
                             dns_result_totext(result));
13868
14065
                goto failure;
13869
14066
        }
14043
14240
        CHECK(dns_db_newversion(db, &ver));
14044
14241
        CHECK(dns_db_getoriginnode(db, &node));
14045
14242
 
 
14243
        TIME_NOW(&timenow);
 
14244
        now = isc_time_seconds(&timenow);
 
14245
 
14046
14246
        dns_zone_log(zone, ISC_LOG_INFO, "reconfiguring zone keys");
14047
14247
 
14048
14248
        /* Get the SOA record's TTL */
14092
14292
                        goto trylater;
14093
14293
                }
14094
14294
 
14095
 
                /* See if any pre-existing keys have newly become active;
 
14295
                /*
 
14296
                 * See if any pre-existing keys have newly become active;
14096
14297
                 * also, see if any new key is for a new algorithm, as in that
14097
14298
                 * event, we need to sign the zone fully.  (If there's a new
14098
14299
                 * key, but it's for an already-existing algorithm, then
14142
14343
        dns_db_closeversion(db, &ver, commit);
14143
14344
 
14144
14345
        if (commit) {
14145
 
                isc_time_t timenow;
14146
14346
                dns_difftuple_t *tuple;
14147
14347
 
14148
14348
                LOCK_ZONE(zone);
14150
14350
 
14151
14351
                zone_needdump(zone, DNS_DUMP_DELAY);
14152
14352
 
14153
 
                TIME_NOW(&timenow);
14154
14353
                zone_settimer(zone, &timenow);
14155
14354
 
14156
14355
                /* Remove any signatures from removed keys.  */
14260
14459
                UNLOCK_ZONE(zone);
14261
14460
        }
14262
14461
 
14263
 
        /*
14264
 
         * If we are doing automatic key maintenance and the key metadata
14265
 
         * indicates there is a key change event scheduled in the future,
14266
 
         * set the key refresh timer.
14267
 
         */
14268
 
        isc_stdtime_get(&now);
14269
 
        TIME_NOW(&timenow);
14270
14462
        isc_time_settoepoch(&zone->refreshkeytime);
14271
14463
 
14272
14464
        /*