Changeset 1937 for trunk/pdns/pdns/backends/bind/bindbackend2.cc

Timestamp:

01/30/11 21:43:58 (2 years ago)

Author:

ahu

Message:

when operating in front-signing mode, make sure we set the auth & hash fields correctly on the first load too.

Files:

• trunk/pdns/pdns/backends/bind/bindbackend2.cc (modified) (6 diffs)

trunk/pdns/pdns/backends/bind/bindbackend2.cc

@@ -211 +211 @@
 }
 
+bool Bind2Backend::updateDNSSECOrderAndAuthAbsolute(uint32_t domain_id, const std::string& qname, const std::string& ordername, bool auth)
+{
+  #if 0
+  const shared_ptr<State> state = getState();
+  BB2DomainInfo& bbd = state->id_zone_map[domain_id];
+
+  string sqname;
+
+  if(bbd.d_name.empty())
+    sqname=qname;
+  else if(strcasecmp(qname.c_str(), bbd.d_name.c_str()))
+    sqname=qname.substr(0,qname.size() - bbd.d_name.length()-1); // strip domain name
+
+  sqname = labelReverse(sqname);
+  
+  if(!auth)
+    d_authDelayed[sqname] = auth;
+  
+  #endif
+  return false;
+}
+
 bool Bind2Backend::feedRecord(const DNSResourceRecord &r)
 {
@@ -241 +263 @@
     break;
   }
-
   return true;
 }
@@ -527 +548 @@
 }
 #endif 
+
+void Bind2Backend::fixupAuth(shared_ptr<recordstorage_t> records)
+{
+  pair<recordstorage_t::const_iterator, recordstorage_t::const_iterator> range;
+            string sqname;
+  
+  BOOST_FOREACH(const Bind2DNSRecord& bdr, *records) {
+    bdr.auth=true;
+    if(bdr.qtype == QType::DS) // as are delegation signer records
+      continue;
+
+    sqname = labelReverse(bdr.qname);
+    
+    do {
+      if(sqname.empty()) // this is auth of course!
+        continue; 
+    
+      range=equal_range(records->begin(), records->end(), sqname); // XXX why isn't this wrong? should be records->equal_range, right?
+      if(range.first != range.second) {
+        for(recordstorage_t::const_iterator iter = range.first ; iter != range.second; ++iter) {
+          if(iter->qtype == QType::NS) {
+            //                cerr<<"Have an NS hit for '"<<labelReverse(bdr.qname)<<"' on '"<<iter->qname<<"'"<<endl;
+            bdr.auth=false;
+          }
+        }
+      }
+    } while(chopOff(sqname));
+  }
+}
+
 void Bind2Backend::loadConfig(string* status)
 {
@@ -634 +685 @@
             shared_ptr<recordstorage_t > records=staging->id_zone_map[bbd->d_id].d_records;
           
-            pair<recordstorage_t::const_iterator, recordstorage_t::const_iterator> range;
-            string sqname;
             
-            BOOST_FOREACH(const Bind2DNSRecord& bdr, *records) {
-              bdr.auth=true;
-              if(bdr.qtype == QType::DS) // as are delegation signer records
-                continue;
-    
-              sqname = labelReverse(bdr.qname);
-              
-              do {
-                if(sqname.empty()) // this is auth of course!
-                  continue; 
-              
-                range=equal_range(records->begin(), records->end(), sqname);
-                if(range.first != range.second) {
-                  for(recordstorage_t::const_iterator iter = range.first ; iter != range.second; ++iter) {
-                    if(iter->qtype == QType::NS) {
-                      //                      cerr<<"Have an NS hit for '"<<labelReverse(bdr.qname)<<"' on '"<<iter->qname<<"'"<<endl;
-                      bdr.auth=false;
-                    }
-                  }
-                }
-              } while(chopOff(sqname));
-            }
+            fixupAuth(records);
             
             staging->id_zone_map[bbd->d_id].setCtime();
@@ -769 +797 @@
     ZoneParserTNG zpt(bbd->d_filename, bbd->d_name, s_binddirectory);
     DNSResourceRecord rr;
+    string hashed;
+    DNSSECKeeper dk;
+    NSEC3PARAMRecordContent ns3pr;
+    bool nsec3zone=dk.getNSEC3PARAM(bbd->d_name, &ns3pr);
     while(zpt.get(rr)) {
-      insert(staging, bbd->d_id, rr.qname, rr.qtype, rr.content, rr.ttl, rr.priority);
+      if(nsec3zone)
+        hashed=toLower(toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname)));
+      insert(staging, bbd->d_id, rr.qname, rr.qtype, rr.content, rr.ttl, rr.priority, hashed);
     }
     // cerr<<"Start sort of "<<staging->id_zone_map[bbd->d_id].d_records->size()<<" records"<<endl;        
     // sort(staging->id_zone_map[bbd->d_id].d_records->begin(), staging->id_zone_map[bbd->d_id].d_records->end());
     // cerr<<"Sorting done"<<endl;
+    
+    fixupAuth(staging->id_zone_map[bbd->d_id].d_records);
     staging->id_zone_map[bbd->d_id].setCtime();
 
@@ -925 +961 @@
     ;
 
-
   if(iditer==state->name_id_map.end()) {
     if(mustlog)