#include <config.h>

#include <stdlib.h>

#include <time.h>

#include <isc/app.h>

#include <isc/base32.h>

#include <isc/commandline.h>

#include <isc/entropy.h>

#include <isc/event.h>

#include <isc/file.h>

#include <isc/hash.h>

#include <isc/hex.h>

#include <isc/mem.h>

#include <isc/mutex.h>

#include <isc/os.h>

#include <isc/print.h>

#include <isc/random.h>

#include <isc/rwlock.h>

#include <isc/serial.h>

#include <isc/stdio.h>

#include <isc/stdlib.h>

#include <isc/string.h>

#include <isc/task.h>

#include <isc/time.h>

#include <isc/util.h>

#include <dns/db.h>

#include <dns/dbiterator.h>

#include <dns/diff.h>

#include <dns/dnssec.h>

#include <dns/ds.h>

#include <dns/fixedname.h>

#include <dns/keyvalues.h>

#include <dns/log.h>

#include <dns/master.h>

#include <dns/masterdump.h>

#include <dns/nsec.h>

#include <dns/nsec3.h>

#include <dns/rdata.h>

#include <dns/rdatalist.h>

#include <dns/rdataset.h>

#include <dns/rdataclass.h>

#include <dns/rdatasetiter.h>

#include <dns/rdatastruct.h>

#include <dns/rdatatype.h>

#include <dns/result.h>

#include <dns/soa.h>

#include <dns/time.h>

#include <dst/dst.h>

#include "dnssectool.h"

#ifndef PATH_MAX

#define PATH_MAX 1024 /* AIX, WIN32, and others don't define this. */

#endif

const char *program = "dnssec-signzone";

int verbose;

typedef struct hashlist hashlist_t;

static int nsec_datatype = dns_rdatatype_nsec;

#define IS_NSEC3 (nsec_datatype == dns_rdatatype_nsec3)

#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)

#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)

#define BUFSIZE 2048

#define MAXDSKEYS 8

#define SIGNER_EVENTCLASS ISC_EVENTCLASS(0x4453)

#define SIGNER_EVENT_WRITE (SIGNER_EVENTCLASS + 0)

#define SIGNER_EVENT_WORK (SIGNER_EVENTCLASS + 1)

#define SOA_SERIAL_KEEP 0

#define SOA_SERIAL_INCREMENT 1

#define SOA_SERIAL_UNIXTIME 2

typedef struct signer_event sevent_t;

struct signer_event {

ISC_EVENT_COMMON(sevent_t);

dns_fixedname_t *fname;

dns_dbnode_t *node;

};

static dns_dnsseckeylist_t keylist;

static unsigned int keycount = 0;

isc_rwlock_t keylist_lock;

static isc_stdtime_t starttime = 0, endtime = 0, now;

static int cycle = -1;

static int jitter = 0;

static isc_boolean_t tryverify = ISC_FALSE;

static isc_boolean_t printstats = ISC_FALSE;

static isc_mem_t *mctx = NULL;

static isc_entropy_t *ectx = NULL;

static dns_ttl_t zone_soa_min_ttl;

static dns_ttl_t soa_ttl;

static FILE *fp;

static char *tempfile = NULL;

static const dns_master_style_t *masterstyle;

static dns_masterformat_t inputformat = dns_masterformat_text;

static dns_masterformat_t outputformat = dns_masterformat_text;

static unsigned int nsigned = 0, nretained = 0, ndropped = 0;

static unsigned int nverified = 0, nverifyfailed = 0;

static const char *directory = NULL, *dsdir = NULL;

static isc_mutex_t namelock, statslock;

static isc_taskmgr_t *taskmgr = NULL;

static dns_db_t *gdb; /* The database */

static dns_dbversion_t *gversion; /* The database version */

static dns_dbiterator_t *gdbiter; /* The database iterator */

static dns_rdataclass_t gclass; /* The class */

static dns_name_t *gorigin; /* The database origin */

static int nsec3flags = 0;

static dns_iterations_t nsec3iter = 10U;

static unsigned char saltbuf[255];

static unsigned char *salt = saltbuf;

static size_t salt_length = 0;

static isc_task_t *master = NULL;

static unsigned int ntasks = 0;

static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE;

static isc_boolean_t nokeys = ISC_FALSE;

static isc_boolean_t removefile = ISC_FALSE;

static isc_boolean_t generateds = ISC_FALSE;

static isc_boolean_t ignore_kskflag = ISC_FALSE;

static isc_boolean_t keyset_kskonly = ISC_FALSE;

static dns_name_t *dlv = NULL;

static dns_fixedname_t dlv_fixed;

static dns_master_style_t *dsstyle = NULL;

static unsigned int serialformat = SOA_SERIAL_KEEP;

static unsigned int hash_length = 0;

static isc_boolean_t unknownalg = ISC_FALSE;

static isc_boolean_t disable_zone_check = ISC_FALSE;

static isc_boolean_t update_chain = ISC_FALSE;

static isc_boolean_t set_keyttl = ISC_FALSE;

static dns_ttl_t keyttl;

#define INCSTAT(counter) \

if (printstats) { \

LOCK(&statslock); \

counter++; \

UNLOCK(&statslock); \

}

static void

sign(isc_task_t *task, isc_event_t *event);

#define check_dns_dbiterator_current(result) \

check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \

"dns_dbiterator_current()")

static void

dumpnode(dns_name_t *name, dns_dbnode_t *node) {

isc_result_t result;

if (outputformat != dns_masterformat_text)

return;

result = dns_master_dumpnodetostream(mctx, gdb, gversion, node, name,

masterstyle, fp);

check_result(result, "dns_master_dumpnodetostream");

}

static void

signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

dns_ttl_t ttl, dns_diff_t *add, const char *logmsg)

{

isc_result_t result;

isc_stdtime_t jendtime;

char keystr[DST_KEY_FORMATSIZE];

dns_rdata_t trdata = DNS_RDATA_INIT;

unsigned char array[BUFSIZE];

isc_buffer_t b;

dns_difftuple_t *tuple;

dst_key_format(key, keystr, sizeof(keystr));

vbprintf(1, "\t%s %s\n", logmsg, keystr);

jendtime = (jitter != 0) ? isc_random_jitter(endtime, jitter) : endtime;

isc_buffer_init(&b, array, sizeof(array));

result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime,

mctx, &b, &trdata);

isc_entropy_stopcallbacksources(ectx);

if (result != ISC_R_SUCCESS) {

char keystr[DST_KEY_FORMATSIZE];

dst_key_format(key, keystr, sizeof(keystr));

fatal("dnskey '%s' failed to sign data: %s",

keystr, isc_result_totext(result));

}

INCSTAT(nsigned);

if (tryverify) {

result = dns_dnssec_verify(name, rdataset, key,

ISC_TRUE, mctx, &trdata);

if (result == ISC_R_SUCCESS) {

vbprintf(3, "\tsignature verified\n");

INCSTAT(nverified);

} else {

vbprintf(3, "\tsignature failed to verify\n");

INCSTAT(nverifyfailed);

}

}

tuple = NULL;

result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name, ttl, &trdata,

&tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(add, &tuple);

}

static inline isc_boolean_t

issigningkey(dns_dnsseckey_t *key) {

return (key->force_sign || key->hint_sign);

}

static inline isc_boolean_t

iszonekey(dns_dnsseckey_t *key) {

return (ISC_TF(dns_name_equal(dst_key_name(key->key), gorigin) &&

dst_key_iszonekey(key->key)));

}

static inline isc_boolean_t

isksk(dns_dnsseckey_t *key) {

return (key->ksk);

}

static inline isc_boolean_t

iszsk(dns_dnsseckey_t *key) {

return (ignore_kskflag || !key->ksk);

}

static dns_dnsseckey_t *

keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {

dns_dnsseckey_t *key;

for (key = ISC_LIST_HEAD(keylist);

key != NULL;

key = ISC_LIST_NEXT(key, link)) {

if (rrsig->keyid == dst_key_id(key->key) &&

rrsig->algorithm == dst_key_alg(key->key) &&

dns_name_equal(&rrsig->signer, dst_key_name(key->key)))

return (key);

}

return (NULL);

}

static dns_dnsseckey_t *

keythatsigned(dns_rdata_rrsig_t *rrsig) {

isc_result_t result;

dst_key_t *pubkey = NULL, *privkey = NULL;

dns_dnsseckey_t *key = NULL;

isc_rwlock_lock(&keylist_lock, isc_rwlocktype_read);

key = keythatsigned_unlocked(rrsig);

isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_read);

if (key != NULL)

return (key);

/*

isc_rwlock_lock(&keylist_lock, isc_rwlocktype_write);

key = keythatsigned_unlocked(rrsig);

if (key != NULL) {

isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);

return (key);

}

result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,

rrsig->algorithm, DST_TYPE_PUBLIC,

directory, mctx, &pubkey);

if (result != ISC_R_SUCCESS) {

isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);

return (NULL);

}

result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,

rrsig->algorithm,

DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,

directory, mctx, &privkey);

if (result == ISC_R_SUCCESS) {

dst_key_free(&pubkey);

dns_dnsseckey_create(mctx, &privkey, &key);

} else {

dns_dnsseckey_create(mctx, &pubkey, &key);

}

key->force_publish = ISC_TRUE;

key->force_sign = ISC_FALSE;

ISC_LIST_APPEND(keylist, key, link);

isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);

return (key);

}

static isc_boolean_t

expecttofindkey(dns_name_t *name) {

unsigned int options = DNS_DBFIND_NOWILD;

dns_fixedname_t fname;

isc_result_t result;

char namestr[DNS_NAME_FORMATSIZE];

dns_fixedname_init(&fname);

result = dns_db_find(gdb, name, gversion, dns_rdatatype_dnskey, options,

0, NULL, dns_fixedname_name(&fname), NULL, NULL);

switch (result) {

case ISC_R_SUCCESS:

case DNS_R_NXDOMAIN:

case DNS_R_NXRRSET:

return (ISC_TRUE);

case DNS_R_DELEGATION:

case DNS_R_CNAME:

case DNS_R_DNAME:

return (ISC_FALSE);

}

dns_name_format(name, namestr, sizeof(namestr));

fatal("failure looking for '%s DNSKEY' in database: %s",

namestr, isc_result_totext(result));

/* NOTREACHED */

return (ISC_FALSE); /* removes a warning */

}

static inline isc_boolean_t

setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,

dns_rdata_t *rrsig)

{

isc_result_t result;

result = dns_dnssec_verify(name, set, key, ISC_FALSE, mctx, rrsig);

if (result == ISC_R_SUCCESS) {

INCSTAT(nverified);

return (ISC_TRUE);

} else {

INCSTAT(nverifyfailed);

return (ISC_FALSE);

}

}

static void

signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,

dns_rdataset_t *set)

{

dns_rdataset_t sigset;

dns_rdata_t sigrdata = DNS_RDATA_INIT;

dns_rdata_rrsig_t rrsig;

dns_dnsseckey_t *key;

isc_result_t result;

isc_boolean_t nosigs = ISC_FALSE;

isc_boolean_t *wassignedby, *nowsignedby;

int arraysize;

dns_difftuple_t *tuple;

dns_ttl_t ttl;

int i;

char namestr[DNS_NAME_FORMATSIZE];

char typestr[TYPE_FORMATSIZE];

char sigstr[SIG_FORMATSIZE];

dns_name_format(name, namestr, sizeof(namestr));

type_format(set->type, typestr, sizeof(typestr));

ttl = ISC_MIN(set->ttl, endtime - starttime);

dns_rdataset_init(&sigset);

result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_rrsig,

set->type, 0, &sigset, NULL);

if (result == ISC_R_NOTFOUND) {

result = ISC_R_SUCCESS;

nosigs = ISC_TRUE;

}

if (result != ISC_R_SUCCESS)

fatal("failed while looking for '%s RRSIG %s': %s",

namestr, typestr, isc_result_totext(result));

vbprintf(1, "%s/%s:\n", namestr, typestr);

arraysize = keycount;

if (!nosigs)

arraysize += dns_rdataset_count(&sigset);

wassignedby = isc_mem_get(mctx, arraysize * sizeof(isc_boolean_t));

nowsignedby = isc_mem_get(mctx, arraysize * sizeof(isc_boolean_t));

if (wassignedby == NULL || nowsignedby == NULL)

fatal("out of memory");

for (i = 0; i < arraysize; i++)

wassignedby[i] = nowsignedby[i] = ISC_FALSE;

if (nosigs)

result = ISC_R_NOMORE;

else

result = dns_rdataset_first(&sigset);

while (result == ISC_R_SUCCESS) {

isc_boolean_t expired, future;

isc_boolean_t keep = ISC_FALSE, resign = ISC_FALSE;

dns_rdataset_current(&sigset, &sigrdata);

result = dns_rdata_tostruct(&sigrdata, &rrsig, NULL);

check_result(result, "dns_rdata_tostruct");

future = isc_serial_lt(now, rrsig.timesigned);

key = keythatsigned(&rrsig);

sig_format(&rrsig, sigstr, sizeof(sigstr));

if (key != NULL && issigningkey(key))

expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

else

expired = isc_serial_gt(now, rrsig.timeexpire);

if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {

/* rrsig is dropped and not replaced */

vbprintf(2, "\trrsig by %s dropped - "

"invalid validity period\n",

sigstr);

} else if (key == NULL && !future &&

expecttofindkey(&rrsig.signer)) {

/* rrsig is dropped and not replaced */

vbprintf(2, "\trrsig by %s dropped - "

"private dnskey not found\n",

sigstr);

} else if (key == NULL || future) {

vbprintf(2, "\trrsig by %s %s - dnskey not found\n",

expired ? "retained" : "dropped", sigstr);

if (!expired)

keep = ISC_TRUE;

} else if (issigningkey(key)) {

if (!expired && setverifies(name, set, key->key,

&sigrdata)) {

vbprintf(2, "\trrsig by %s retained\n", sigstr);

keep = ISC_TRUE;

wassignedby[key->index] = ISC_TRUE;

nowsignedby[key->index] = ISC_TRUE;

} else {

vbprintf(2, "\trrsig by %s dropped - %s\n",

sigstr,

expired ? "expired" :

"failed to verify");

wassignedby[key->index] = ISC_TRUE;

resign = ISC_TRUE;

}

} else if (iszonekey(key)) {

if (!expired && setverifies(name, set, key->key,

&sigrdata)) {

vbprintf(2, "\trrsig by %s retained\n", sigstr);

keep = ISC_TRUE;

wassignedby[key->index] = ISC_TRUE;

nowsignedby[key->index] = ISC_TRUE;

} else {

vbprintf(2, "\trrsig by %s dropped - %s\n",

sigstr,

expired ? "expired" :

"failed to verify");

wassignedby[key->index] = ISC_TRUE;

}

} else if (!expired) {

vbprintf(2, "\trrsig by %s retained\n", sigstr);

keep = ISC_TRUE;

} else {

vbprintf(2, "\trrsig by %s expired\n", sigstr);

}

if (keep) {

nowsignedby[key->index] = ISC_TRUE;

INCSTAT(nretained);

if (sigset.ttl != ttl) {

vbprintf(2, "\tfixing ttl %s\n", sigstr);

tuple = NULL;

result = dns_difftuple_create(mctx,

DNS_DIFFOP_DEL,

name, sigset.ttl,

&sigrdata,

&tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(del, &tuple);

result = dns_difftuple_create(mctx,

DNS_DIFFOP_ADD,

name, ttl,

&sigrdata,

&tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(add, &tuple);

}

} else {

tuple = NULL;

result = dns_difftuple_create(mctx, DNS_DIFFOP_DEL,

name, sigset.ttl,

&sigrdata, &tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(del, &tuple);

INCSTAT(ndropped);

}

if (resign) {

INSIST(!keep);

signwithkey(name, set, key->key, ttl, add,

"resigning with dnskey");

nowsignedby[key->index] = ISC_TRUE;

}

dns_rdata_reset(&sigrdata);

dns_rdata_freestruct(&rrsig);

result = dns_rdataset_next(&sigset);

}

if (result == ISC_R_NOMORE)

result = ISC_R_SUCCESS;

check_result(result, "dns_rdataset_first/next");

if (dns_rdataset_isassociated(&sigset))

dns_rdataset_disassociate(&sigset);

for (key = ISC_LIST_HEAD(keylist);

key != NULL;

key = ISC_LIST_NEXT(key, link))

{

if (nowsignedby[key->index])

continue;

if (!issigningkey(key))

continue;

if (set->type == dns_rdatatype_dnskey &&

dns_name_equal(name, gorigin)) {

isc_boolean_t have_ksk;

dns_dnsseckey_t *tmpkey;

have_ksk = isksk(key);

for (tmpkey = ISC_LIST_HEAD(keylist);

tmpkey != NULL;

tmpkey = ISC_LIST_NEXT(tmpkey, link)) {

if (dst_key_alg(key->key) !=

dst_key_alg(tmpkey->key))

continue;

if (REVOKE(tmpkey->key))

continue;

if (isksk(tmpkey))

have_ksk = ISC_TRUE;

}

if (isksk(key) || !have_ksk ||

(iszsk(key) && !keyset_kskonly))

signwithkey(name, set, key->key, ttl, add,

"signing with dnskey");

} else if (iszsk(key)) {

signwithkey(name, set, key->key, ttl, add,

"signing with dnskey");

}

}

isc_mem_put(mctx, wassignedby, arraysize * sizeof(isc_boolean_t));

isc_mem_put(mctx, nowsignedby, arraysize * sizeof(isc_boolean_t));

}

struct hashlist {

unsigned char *hashbuf;

size_t entries;

size_t size;

size_t length;

};

static void

hashlist_init(hashlist_t *l, unsigned int nodes, unsigned int length) {

l->entries = 0;

l->length = length + 1;

if (nodes != 0) {

l->size = nodes;

l->hashbuf = malloc(l->size * l->length);

if (l->hashbuf == NULL)

l->size = 0;

} else {

l->size = 0;

l->hashbuf = NULL;

}

}

static void

hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)

{

REQUIRE(len <= l->length);

if (l->entries == l->size) {

l->size = l->size * 2 + 100;

l->hashbuf = realloc(l->hashbuf, l->size * l->length);

}

memset(l->hashbuf + l->entries * l->length, 0, l->length);

memcpy(l->hashbuf + l->entries * l->length, hash, len);

l->entries++;

}

static void

hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,

unsigned int hashalg, unsigned int iterations,

const unsigned char *salt, size_t salt_length,

isc_boolean_t speculative)

{

char nametext[DNS_NAME_FORMATSIZE];

unsigned char hash[NSEC3_MAX_HASH_LENGTH + 1];

unsigned int len;

size_t i;

len = isc_iterated_hash(hash, hashalg, iterations, salt, salt_length,

name->ndata, name->length);

if (verbose) {

dns_name_format(name, nametext, sizeof nametext);

for (i = 0 ; i < len; i++)

fprintf(stderr, "%02x", hash[i]);

fprintf(stderr, " %s\n", nametext);

}

hash[len++] = speculative ? 1 : 0;

hashlist_add(l, hash, len);

}

static int

hashlist_comp(const void *a, const void *b) {

return (memcmp(a, b, hash_length + 1));

}

static void

hashlist_sort(hashlist_t *l) {

qsort(l->hashbuf, l->entries, l->length, hashlist_comp);

}

static isc_boolean_t

hashlist_hasdup(hashlist_t *l) {

unsigned char *current;

unsigned char *next = l->hashbuf;

size_t entries = l->entries;

/*

while (entries > 0U && next[l->length-1] != 0U) {

next += l->length;

entries--;

}

current = next;

while (entries-- > 1U) {

next += l->length;

if (next[l->length-1] != 0)

continue;

if (memcmp(current, next, l->length - 1) == 0)

return (ISC_TRUE);

current = next;

}

return (ISC_FALSE);

}

static const unsigned char *

hashlist_findnext(const hashlist_t *l,

const unsigned char hash[NSEC3_MAX_HASH_LENGTH])

{

unsigned int entries = l->entries;

const unsigned char *next = bsearch(hash, l->hashbuf, l->entries,

l->length, hashlist_comp);

INSIST(next != NULL);

do {

if (next < l->hashbuf + (l->entries - 1) * l->length)

next += l->length;

else

next = l->hashbuf;

if (next[l->length - 1] == 0)

break;

} while (entries-- > 1);

INSIST(entries != 0);

return (next);

}

static isc_boolean_t

hashlist_exists(const hashlist_t *l,

const unsigned char hash[NSEC3_MAX_HASH_LENGTH])

{

if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp))

return (ISC_TRUE);

else

return (ISC_FALSE);

}

static void

addnowildcardhash(hashlist_t *l, /*const*/ dns_name_t *name,

unsigned int hashalg, unsigned int iterations,

const unsigned char *salt, size_t salt_length)

{

dns_fixedname_t fixed;

dns_name_t *wild;

dns_dbnode_t *node = NULL;

isc_result_t result;

char namestr[DNS_NAME_FORMATSIZE];

dns_fixedname_init(&fixed);

wild = dns_fixedname_name(&fixed);

result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);

if (result == ISC_R_NOSPACE)

return;

check_result(result,"addnowildcardhash: dns_name_concatenate()");

result = dns_db_findnode(gdb, wild, ISC_FALSE, &node);

if (result == ISC_R_SUCCESS) {

dns_db_detachnode(gdb, &node);

return;

}

if (verbose) {

dns_name_format(wild, namestr, sizeof(namestr));

fprintf(stderr, "adding no-wildcardhash for %s\n", namestr);

}

hashlist_add_dns_name(l, wild, hashalg, iterations, salt, salt_length,

ISC_TRUE);

}

static void

opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,

dns_db_t **dbp)

{

char filename[PATH_MAX];

isc_buffer_t b;

isc_result_t result;

isc_buffer_init(&b, filename, sizeof(filename));

if (dsdir != NULL) {

/* allow room for a trailing slash */

if (strlen(dsdir) >= isc_buffer_availablelength(&b))

fatal("path '%s' is too long", dsdir);

isc_buffer_putstr(&b, dsdir);

if (dsdir[strlen(dsdir) - 1] != '/')

isc_buffer_putstr(&b, "/");

}

if (strlen(prefix) > isc_buffer_availablelength(&b))

fatal("path '%s' is too long", dsdir);

isc_buffer_putstr(&b, prefix);

result = dns_name_tofilenametext(name, ISC_FALSE, &b);

check_result(result, "dns_name_tofilenametext()");

if (isc_buffer_availablelength(&b) == 0) {

char namestr[DNS_NAME_FORMATSIZE];

dns_name_format(name, namestr, sizeof(namestr));

fatal("name '%s' is too long", namestr);

}

isc_buffer_putuint8(&b, 0);

result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,

rdclass, 0, NULL, dbp);

check_result(result, "dns_db_create()");

result = dns_db_load3(*dbp, filename, inputformat, DNS_MASTER_HINT);

if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)

dns_db_detach(dbp);

}

static isc_result_t

loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) {

dns_db_t *db = NULL;

dns_dbversion_t *ver = NULL;

dns_dbnode_t *node = NULL;

isc_result_t result;

dns_rdataset_t keyset;

dns_rdata_t key, ds;

unsigned char dsbuf[DNS_DS_BUFFERSIZE];

dns_diff_t diff;

dns_difftuple_t *tuple = NULL;

opendb("dsset-", name, gclass, &db);

if (db != NULL) {

result = dns_db_findnode(db, name, ISC_FALSE, &node);

if (result == ISC_R_SUCCESS) {

dns_rdataset_init(dsset);

result = dns_db_findrdataset(db, node, NULL,

dns_rdatatype_ds, 0, 0,

dsset, NULL);

dns_db_detachnode(db, &node);

if (result == ISC_R_SUCCESS) {

vbprintf(2, "found DS records\n");

dsset->ttl = ttl;

dns_db_detach(&db);

return (result);

}

}

dns_db_detach(&db);

}

/* No DS records found; try again, looking for DNSKEY records */

opendb("keyset-", name, gclass, &db);

if (db == NULL) {

return (ISC_R_NOTFOUND);

}

result = dns_db_findnode(db, name, ISC_FALSE, &node);

if (result != ISC_R_SUCCESS) {

dns_db_detach(&db);

return (result);

}

dns_rdataset_init(&keyset);

result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 0, 0,

&keyset, NULL);

if (result != ISC_R_SUCCESS) {

dns_db_detachnode(db, &node);

dns_db_detach(&db);

return (result);

}

vbprintf(2, "found DNSKEY records\n");

result = dns_db_newversion(db, &ver);

check_result(result, "dns_db_newversion");

dns_diff_init(mctx, &diff);

for (result = dns_rdataset_first(&keyset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&keyset))

{

dns_rdata_init(&key);

dns_rdata_init(&ds);

dns_rdataset_current(&keyset, &key);

result = dns_ds_buildrdata(name, &key, DNS_DSDIGEST_SHA1,

dsbuf, &ds);

check_result(result, "dns_ds_buildrdata");

result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name,

ttl, &ds, &tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(&diff, &tuple);

dns_rdata_reset(&ds);

result = dns_ds_buildrdata(name, &key, DNS_DSDIGEST_SHA256,

dsbuf, &ds);

check_result(result, "dns_ds_buildrdata");

result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name,

ttl, &ds, &tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(&diff, &tuple);

}

result = dns_diff_apply(&diff, db, ver);

check_result(result, "dns_diff_apply");

dns_diff_clear(&diff);

dns_db_closeversion(db, &ver, ISC_TRUE);

result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0, 0,

dsset, NULL);

check_result(result, "dns_db_findrdataset");

dns_rdataset_disassociate(&keyset);

dns_db_detachnode(db, &node);

dns_db_detach(&db);

return (result);

}

static isc_boolean_t

delegation(dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp) {

dns_rdataset_t nsset;

isc_result_t result;

if (dns_name_equal(name, gorigin))

return (ISC_FALSE);

dns_rdataset_init(&nsset);

result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_ns,

0, 0, &nsset, NULL);

if (dns_rdataset_isassociated(&nsset)) {

if (ttlp != NULL)

*ttlp = nsset.ttl;

dns_rdataset_disassociate(&nsset);

}

return (ISC_TF(result == ISC_R_SUCCESS));

}

static isc_boolean_t

secure(dns_name_t *name, dns_dbnode_t *node) {

dns_rdataset_t dsset;

isc_result_t result;

if (dns_name_equal(name, gorigin))

return (ISC_FALSE);

dns_rdataset_init(&dsset);

result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_ds,

0, 0, &dsset, NULL);

if (dns_rdataset_isassociated(&dsset))

dns_rdataset_disassociate(&dsset);

return (ISC_TF(result == ISC_R_SUCCESS));

}

static void

signname(dns_dbnode_t *node, dns_name_t *name) {

isc_result_t result;

dns_rdataset_t rdataset;

dns_rdatasetiter_t *rdsiter;

isc_boolean_t isdelegation = ISC_FALSE;

dns_diff_t del, add;

char namestr[DNS_NAME_FORMATSIZE];

dns_rdataset_init(&rdataset);

dns_name_format(name, namestr, sizeof(namestr));

/*

if (delegation(name, node, NULL))

isdelegation = ISC_TRUE;

/*

dns_diff_init(mctx, &del);

dns_diff_init(mctx, &add);

rdsiter = NULL;

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &rdataset);

/* If this is a RRSIG set, skip it. */

if (rdataset.type == dns_rdatatype_rrsig)

goto skip;

/*

if (isdelegation) {

if (rdataset.type != nsec_datatype &&

rdataset.type != dns_rdatatype_ds)

goto skip;

} else if (rdataset.type == dns_rdatatype_ds) {

char namebuf[DNS_NAME_FORMATSIZE];

dns_name_format(name, namebuf, sizeof(namebuf));

fatal("'%s': found DS RRset without NS RRset\n",

namebuf);

}

signset(&del, &add, node, name, &rdataset);

skip:

dns_rdataset_disassociate(&rdataset);

result = dns_rdatasetiter_next(rdsiter);

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration for name '%s' failed: %s",

namestr, isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter);

result = dns_diff_applysilently(&del, gdb, gversion);

if (result != ISC_R_SUCCESS)

fatal("failed to delete SIGs at node '%s': %s",

namestr, isc_result_totext(result));

result = dns_diff_applysilently(&add, gdb, gversion);

if (result != ISC_R_SUCCESS)

fatal("failed to add SIGs at node '%s': %s",

namestr, isc_result_totext(result));

dns_diff_clear(&del);

dns_diff_clear(&add);

}

static inline isc_boolean_t

active_node(dns_dbnode_t *node) {

dns_rdatasetiter_t *rdsiter = NULL;

dns_rdatasetiter_t *rdsiter2 = NULL;

isc_boolean_t active = ISC_FALSE;

isc_result_t result;

dns_rdataset_t rdataset;

dns_rdatatype_t type;

dns_rdatatype_t covers;

isc_boolean_t found;

dns_rdataset_init(&rdataset);

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &rdataset);

if (rdataset.type != dns_rdatatype_nsec &&

rdataset.type != dns_rdatatype_nsec3 &&

rdataset.type != dns_rdatatype_rrsig)

active = ISC_TRUE;

dns_rdataset_disassociate(&rdataset);

if (!active)

result = dns_rdatasetiter_next(rdsiter);

else

result = ISC_R_NOMORE;

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

if (!active && nsec_datatype == dns_rdatatype_nsec) {

/*%

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &rdataset);

result = dns_db_deleterdataset(gdb, node, gversion,

rdataset.type,

rdataset.covers);

check_result(result, "dns_db_deleterdataset()");

dns_rdataset_disassociate(&rdataset);

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

} else {

/*

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);

check_result(result, "dns_db_allrdatasets()");

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &rdataset);

type = rdataset.type;

covers = rdataset.covers;

dns_rdataset_disassociate(&rdataset);

/*

if (nsec_datatype == dns_rdatatype_nsec3 &&

(type == dns_rdatatype_nsec ||

covers == dns_rdatatype_nsec)) {

result = dns_db_deleterdataset(gdb, node,

gversion, type,

covers);

check_result(result,

"dns_db_deleterdataset(nsec/rrsig)");

continue;

}

if (type != dns_rdatatype_rrsig)

continue;

found = ISC_FALSE;

for (result = dns_rdatasetiter_first(rdsiter2);

!found && result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter2)) {

dns_rdatasetiter_current(rdsiter2, &rdataset);

if (rdataset.type == covers)

found = ISC_TRUE;

dns_rdataset_disassociate(&rdataset);

}

if (!found) {

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

result = dns_db_deleterdataset(gdb, node,

gversion, type,

covers);

check_result(result,

"dns_db_deleterdataset(rrsig)");

} else if (result != ISC_R_NOMORE &&

result != ISC_R_SUCCESS)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter2);

}

dns_rdatasetiter_destroy(&rdsiter);

return (active);

}

static void

get_soa_ttls(void) {

dns_rdataset_t soaset;

dns_fixedname_t fname;

dns_name_t *name;

isc_result_t result;

dns_rdata_t rdata = DNS_RDATA_INIT;

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_rdataset_init(&soaset);

result = dns_db_find(gdb, gorigin, gversion, dns_rdatatype_soa,

0, 0, NULL, name, &soaset, NULL);

if (result != ISC_R_SUCCESS)

fatal("failed to find an SOA at the zone apex: %s",

isc_result_totext(result));

result = dns_rdataset_first(&soaset);

check_result(result, "dns_rdataset_first");

dns_rdataset_current(&soaset, &rdata);

zone_soa_min_ttl = dns_soa_getminimum(&rdata);

soa_ttl = soaset.ttl;

dns_rdataset_disassociate(&soaset);

}

static isc_result_t

setsoaserial(isc_uint32_t serial) {

isc_result_t result;

dns_dbnode_t *node = NULL;

dns_rdataset_t rdataset;

dns_rdata_t rdata = DNS_RDATA_INIT;

isc_uint32_t old_serial, new_serial;

result = dns_db_getoriginnode(gdb, &node);

if (result != ISC_R_SUCCESS)

return result;

dns_rdataset_init(&rdataset);

result = dns_db_findrdataset(gdb, node, gversion,

dns_rdatatype_soa, 0,

0, &rdataset, NULL);

if (result != ISC_R_SUCCESS)

goto cleanup;

result = dns_rdataset_first(&rdataset);

RUNTIME_CHECK(result == ISC_R_SUCCESS);

dns_rdataset_current(&rdataset, &rdata);

old_serial = dns_soa_getserial(&rdata);

if (serial) {

/* Set SOA serial to the value provided. */

new_serial = serial;

} else {

/* Increment SOA serial using RFC 1982 arithmetics */

new_serial = (old_serial + 1) & 0xFFFFFFFF;

if (new_serial == 0)

new_serial = 1;

}

/* If the new serial is not likely to cause a zone transfer

if (new_serial == old_serial ||

(new_serial - old_serial) > 0x7fffffffU)

fprintf(stderr, "%s: warning: Serial number not advanced, "

"zone may not transfer\n", program);

dns_soa_setserial(new_serial, &rdata);

result = dns_db_deleterdataset(gdb, node, gversion,

dns_rdatatype_soa, 0);

check_result(result, "dns_db_deleterdataset");

if (result != ISC_R_SUCCESS)

goto cleanup;

result = dns_db_addrdataset(gdb, node, gversion,

0, &rdataset, 0, NULL);

check_result(result, "dns_db_addrdataset");

if (result != ISC_R_SUCCESS)

goto cleanup;

cleanup:

dns_rdataset_disassociate(&rdataset);

if (node != NULL)

dns_db_detachnode(gdb, &node);

dns_rdata_reset(&rdata);

return (result);

}

static void

cleannode(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {

dns_rdatasetiter_t *rdsiter = NULL;

dns_rdataset_t set;

isc_result_t result, dresult;

if (outputformat != dns_masterformat_text || !disable_zone_check)

return;

dns_rdataset_init(&set);

result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

isc_boolean_t destroy = ISC_FALSE;

dns_rdatatype_t covers = 0;

dns_rdatasetiter_current(rdsiter, &set);

if (set.type == dns_rdatatype_rrsig) {

covers = set.covers;

destroy = ISC_TRUE;

}

dns_rdataset_disassociate(&set);

result = dns_rdatasetiter_next(rdsiter);

if (destroy) {

dresult = dns_db_deleterdataset(db, node, version,

dns_rdatatype_rrsig,

covers);

check_result(dresult, "dns_db_deleterdataset");

}

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter);

}

static void

presign(void) {

isc_result_t result;

gdbiter = NULL;

result = dns_db_createiterator(gdb, 0, &gdbiter);

check_result(result, "dns_db_createiterator()");

}

static void

postsign(void) {

dns_dbiterator_destroy(&gdbiter);

}

static isc_boolean_t

goodsig(dns_rdata_t *sigrdata, dns_name_t *name, dns_rdataset_t *keyrdataset,

dns_rdataset_t *rdataset)

{

dns_rdata_dnskey_t key;

dns_rdata_rrsig_t sig;

dst_key_t *dstkey = NULL;

isc_result_t result;

dns_rdata_tostruct(sigrdata, &sig, NULL);

for (result = dns_rdataset_first(keyrdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(keyrdataset)) {

dns_rdata_t rdata = DNS_RDATA_INIT;

dns_rdataset_current(keyrdataset, &rdata);

dns_rdata_tostruct(&rdata, &key, NULL);

result = dns_dnssec_keyfromrdata(gorigin, &rdata, mctx,

&dstkey);

if (result != ISC_R_SUCCESS)

return (ISC_FALSE);

if (sig.algorithm != key.algorithm ||

sig.keyid != dst_key_id(dstkey) ||

!dns_name_equal(&sig.signer, gorigin)) {

dst_key_free(&dstkey);

continue;

}

result = dns_dnssec_verify(name, rdataset, dstkey, ISC_FALSE,

mctx, sigrdata);

dst_key_free(&dstkey);

if (result == ISC_R_SUCCESS)

return(ISC_TRUE);

}

return (ISC_FALSE);

}

static void

verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node,

dns_rdataset_t *keyrdataset, unsigned char *ksk_algorithms,

unsigned char *bad_algorithms)

{

unsigned char set_algorithms[256];

char namebuf[DNS_NAME_FORMATSIZE];

char algbuf[80];

char typebuf[80];

dns_rdataset_t sigrdataset;

dns_rdatasetiter_t *rdsiter = NULL;

isc_result_t result;

int i;

dns_rdataset_init(&sigrdataset);

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &sigrdataset);

if (sigrdataset.type == dns_rdatatype_rrsig &&

sigrdataset.covers == rdataset->type)

break;

dns_rdataset_disassociate(&sigrdataset);

}

if (result != ISC_R_SUCCESS) {

dns_name_format(name, namebuf, sizeof(namebuf));

type_format(rdataset->type, typebuf, sizeof(typebuf));

fprintf(stderr, "no signatures for %s/%s\n", namebuf, typebuf);

for (i = 0; i < 256; i++)

if (ksk_algorithms[i] != 0)

bad_algorithms[i] = 1;

return;

}

memset(set_algorithms, 0, sizeof(set_algorithms));

for (result = dns_rdataset_first(&sigrdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&sigrdataset)) {

dns_rdata_t rdata = DNS_RDATA_INIT;

dns_rdata_rrsig_t sig;

dns_rdataset_current(&sigrdataset, &rdata);

dns_rdata_tostruct(&rdata, &sig, NULL);

if ((set_algorithms[sig.algorithm] != 0) ||

(ksk_algorithms[sig.algorithm] == 0))

continue;

if (goodsig(&rdata, name, keyrdataset, rdataset))

set_algorithms[sig.algorithm] = 1;

}

dns_rdatasetiter_destroy(&rdsiter);

if (memcmp(set_algorithms, ksk_algorithms, sizeof(set_algorithms))) {

dns_name_format(name, namebuf, sizeof(namebuf));

type_format(rdataset->type, typebuf, sizeof(typebuf));

for (i = 0; i < 256; i++)

if ((ksk_algorithms[i] != 0) &&

(set_algorithms[i] == 0)) {

dns_secalg_format(i, algbuf, sizeof(algbuf));

fprintf(stderr, "Missing %s signature for "

"%s %s\n", algbuf, namebuf, typebuf);

bad_algorithms[i] = 1;

}

}

dns_rdataset_disassociate(&sigrdataset);

}

static void

verifynode(dns_name_t *name, dns_dbnode_t *node, isc_boolean_t delegation,

dns_rdataset_t *keyrdataset, unsigned char *ksk_algorithms,

unsigned char *bad_algorithms)

{

dns_rdataset_t rdataset;

dns_rdatasetiter_t *rdsiter = NULL;

isc_result_t result;

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

result = dns_rdatasetiter_first(rdsiter);

dns_rdataset_init(&rdataset);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &rdataset);

if (rdataset.type != dns_rdatatype_rrsig &&

rdataset.type != dns_rdatatype_dnskey &&

(!delegation || rdataset.type == dns_rdatatype_ds ||

rdataset.type == dns_rdatatype_nsec)) {

verifyset(&rdataset, name, node, keyrdataset,

ksk_algorithms, bad_algorithms);

}

dns_rdataset_disassociate(&rdataset);

result = dns_rdatasetiter_next(rdsiter);

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter);

}

static void

verifyzone(void) {

char algbuf[80];

dns_dbiterator_t *dbiter = NULL;

dns_dbnode_t *node = NULL, *nextnode = NULL;

dns_fixedname_t fname, fnextname, fzonecut;

dns_name_t *name, *nextname, *zonecut;

dns_rdata_dnskey_t dnskey;

dns_rdata_t rdata = DNS_RDATA_INIT;

dns_rdataset_t rdataset;

dns_rdataset_t sigrdataset;

int i;

isc_boolean_t done = ISC_FALSE;

isc_boolean_t first = ISC_TRUE;

isc_boolean_t goodksk = ISC_FALSE;

isc_boolean_t goodzsk = ISC_FALSE;

isc_result_t result;

unsigned char revoked_ksk[256];

unsigned char revoked_zsk[256];

unsigned char standby_ksk[256];

unsigned char standby_zsk[256];

unsigned char ksk_algorithms[256];

unsigned char zsk_algorithms[256];

unsigned char bad_algorithms[256];

#ifdef ALLOW_KSKLESS_ZONES

isc_boolean_t allzsksigned = ISC_TRUE;

unsigned char self_algorithms[256];

#endif

if (disable_zone_check)

return;

result = dns_db_findnode(gdb, gorigin, ISC_FALSE, &node);

if (result != ISC_R_SUCCESS)

fatal("failed to find the zone's origin: %s",

isc_result_totext(result));

dns_rdataset_init(&rdataset);

dns_rdataset_init(&sigrdataset);

result = dns_db_findrdataset(gdb, node, gversion,

dns_rdatatype_dnskey,

0, 0, &rdataset, &sigrdataset);

dns_db_detachnode(gdb, &node);

if (result != ISC_R_SUCCESS)

fatal("cannot find DNSKEY rrset\n");

if (!dns_rdataset_isassociated(&sigrdataset))

fatal("cannot find DNSKEY RRSIGs\n");

memset(revoked_ksk, 0, sizeof(revoked_ksk));

memset(revoked_zsk, 0, sizeof(revoked_zsk));

memset(standby_ksk, 0, sizeof(standby_ksk));

memset(standby_zsk, 0, sizeof(standby_zsk));

memset(ksk_algorithms, 0, sizeof(ksk_algorithms));

memset(zsk_algorithms, 0, sizeof(zsk_algorithms));

memset(bad_algorithms, 0, sizeof(bad_algorithms));

#ifdef ALLOW_KSKLESS_ZONES

memset(self_algorithms, 0, sizeof(self_algorithms));

#endif

/*

for (result = dns_rdataset_first(&rdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&rdataset)) {

dns_rdataset_current(&rdataset, &rdata);

result = dns_rdata_tostruct(&rdata, &dnskey, NULL);

check_result(result, "dns_rdata_tostruct");

if ((dnskey.flags & DNS_KEYOWNER_ZONE) == 0)

;

else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {

if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&

!dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,

&sigrdataset, ISC_FALSE,

mctx)) {

char namebuf[DNS_NAME_FORMATSIZE];

char buffer[1024];

isc_buffer_t buf;

dns_name_format(gorigin, namebuf,

sizeof(namebuf));

isc_buffer_init(&buf, buffer, sizeof(buffer));

result = dns_rdata_totext(&rdata, NULL, &buf);

check_result(result, "dns_rdata_totext");

fatal("revoked KSK is not self signed:\n"

"%s DNSKEY %.*s", namebuf,

(int)isc_buffer_usedlength(&buf), buffer);

}

if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&

revoked_ksk[dnskey.algorithm] != 255)

revoked_ksk[dnskey.algorithm]++;

else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 &&

revoked_zsk[dnskey.algorithm] != 255)

revoked_zsk[dnskey.algorithm]++;

} else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {

if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,

&sigrdataset, ISC_FALSE, mctx)) {

if (ksk_algorithms[dnskey.algorithm] != 255)

ksk_algorithms[dnskey.algorithm]++;

goodksk = ISC_TRUE;

} else {

if (standby_ksk[dnskey.algorithm] != 255)

standby_ksk[dnskey.algorithm]++;

}

} else if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,

&sigrdataset, ISC_FALSE,

mctx)) {

#ifdef ALLOW_KSKLESS_ZONES

if (self_algorithms[dnskey.algorithm] != 255)

self_algorithms[dnskey.algorithm]++;

#endif

if (zsk_algorithms[dnskey.algorithm] != 255)

zsk_algorithms[dnskey.algorithm]++;

goodzsk = ISC_TRUE;

} else {

if (standby_zsk[dnskey.algorithm] != 255)

standby_zsk[dnskey.algorithm]++;

#ifdef ALLOW_KSKLESS_ZONES

allzsksigned = ISC_FALSE;

#endif

}

dns_rdata_freestruct(&dnskey);

dns_rdata_reset(&rdata);

}

dns_rdataset_disassociate(&sigrdataset);

#ifdef ALLOW_KSKLESS_ZONES

if (!goodksk) {

if (!ignore_kskflag)

fprintf(stderr, "No self signing KSK found. Using "

"self signed ZSK's for active "

"algorithm list.\n");

memcpy(ksk_algorithms, self_algorithms, sizeof(ksk_algorithms));

if (!allzsksigned)

fprintf(stderr, "warning: not all ZSK's are self "

"signed.\n");

}

#else

if (!goodksk) {

fatal("no self signed KSK's found");

}

#endif

fprintf(stderr, "Verifying the zone using the following algorithms:");

for (i = 0; i < 256; i++) {

#ifdef ALLOW_KSKLESS_ZONES

if (ksk_algorithms[i] != 0 || zsk_algorithms[i] != 0)

#else

if (ksk_algorithms[i] != 0)

#endif

{

dns_secalg_format(i, algbuf, sizeof(algbuf));

fprintf(stderr, " %s", algbuf);

}

}

fprintf(stderr, ".\n");

if (!ignore_kskflag && !keyset_kskonly) {

for (i = 0; i < 256; i++) {

/*

if ((ksk_algorithms[i] != 0) ==

(zsk_algorithms[i] != 0))

continue;

dns_secalg_format(i, algbuf, sizeof(algbuf));

fprintf(stderr, "Missing %s for algorithm %s\n",

(ksk_algorithms[i] != 0)

? "ZSK"

: "self signing KSK",

algbuf);

bad_algorithms[i] = 1;

}

}

/*

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_fixedname_init(&fnextname);

nextname = dns_fixedname_name(&fnextname);

dns_fixedname_init(&fzonecut);

zonecut = NULL;

result = dns_db_createiterator(gdb, DNS_DB_NONSEC3, &dbiter);

check_result(result, "dns_db_createiterator()");

result = dns_dbiterator_first(dbiter);

check_result(result, "dns_dbiterator_first()");

while (!done) {

isc_boolean_t isdelegation = ISC_FALSE;

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

if (delegation(name, node, NULL)) {

zonecut = dns_fixedname_name(&fzonecut);

dns_name_copy(name, zonecut, NULL);

isdelegation = ISC_TRUE;

}

verifynode(name, node, isdelegation, &rdataset,

ksk_algorithms, bad_algorithms);

result = dns_dbiterator_next(dbiter);

nextnode = NULL;

while (result == ISC_R_SUCCESS) {

result = dns_dbiterator_current(dbiter, &nextnode,

nextname);

check_dns_dbiterator_current(result);

if (!dns_name_issubdomain(nextname, gorigin) ||

(zonecut != NULL &&

dns_name_issubdomain(nextname, zonecut)))

{

dns_db_detachnode(gdb, &nextnode);

result = dns_dbiterator_next(dbiter);

continue;

}

dns_db_detachnode(gdb, &nextnode);

break;

}

if (result == ISC_R_NOMORE) {

done = ISC_TRUE;

} else if (result != ISC_R_SUCCESS)

fatal("iterating through the database failed: %s",

isc_result_totext(result));

dns_db_detachnode(gdb, &node);

}

dns_dbiterator_destroy(&dbiter);

result = dns_db_createiterator(gdb, DNS_DB_NSEC3ONLY, &dbiter);

check_result(result, "dns_db_createiterator()");

for (result = dns_dbiterator_first(dbiter);

result == ISC_R_SUCCESS;

result = dns_dbiterator_next(dbiter) ) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

verifynode(name, node, ISC_FALSE, &rdataset,

ksk_algorithms, bad_algorithms);

dns_db_detachnode(gdb, &node);

}

dns_dbiterator_destroy(&dbiter);

dns_rdataset_disassociate(&rdataset);

/*

for (i = 0; i < 256; i++) {

if (bad_algorithms[i] != 0) {

if (first)

fprintf(stderr, "The zone is not fully signed "

"for the following algorithms:");

dns_secalg_format(i, algbuf, sizeof(algbuf));

fprintf(stderr, " %s", algbuf);

first = ISC_FALSE;

}

}

if (!first) {

fprintf(stderr, ".\n");

fatal("DNSSEC completeness test failed.");

}

if (goodksk || ignore_kskflag) {

/*

fprintf(stderr, "Zone signing complete:\n");

for (i = 0; i < 256; i++) {

if ((ksk_algorithms[i] != 0) ||

(standby_ksk[i] != 0) ||

(revoked_zsk[i] != 0) ||

(zsk_algorithms[i] != 0) ||

(standby_zsk[i] != 0) ||

(revoked_zsk[i] != 0)) {

dns_secalg_format(i, algbuf, sizeof(algbuf));

fprintf(stderr, "Algorithm: %s: KSKs: "

"%u active, %u stand-by, %u revoked\n",

algbuf, ksk_algorithms[i],

standby_ksk[i], revoked_ksk[i]);

fprintf(stderr, "%*sZSKs: "

"%u active, %u %s, %u revoked\n",

(int) strlen(algbuf) + 13, "",

zsk_algorithms[i],

standby_zsk[i],

keyset_kskonly ? "present" : "stand-by",

revoked_zsk[i]);

}

}

}

}

static void

signapex(void) {

dns_dbnode_t *node = NULL;

dns_fixedname_t fixed;

dns_name_t *name;

isc_result_t result;

dns_fixedname_init(&fixed);

name = dns_fixedname_name(&fixed);

result = dns_dbiterator_seek(gdbiter, gorigin);

check_result(result, "dns_dbiterator_seek()");

result = dns_dbiterator_current(gdbiter, &node, name);

check_dns_dbiterator_current(result);

signname(node, name);

dumpnode(name, node);

cleannode(gdb, gversion, node);

dns_db_detachnode(gdb, &node);

result = dns_dbiterator_first(gdbiter);

if (result == ISC_R_NOMORE)

finished = ISC_TRUE;

else if (result != ISC_R_SUCCESS)

fatal("failure iterating database: %s",

isc_result_totext(result));

}

static void

assignwork(isc_task_t *task, isc_task_t *worker) {

dns_fixedname_t *fname;

dns_name_t *name;

dns_dbnode_t *node;

sevent_t *sevent;

dns_rdataset_t nsec;

isc_boolean_t found;

isc_result_t result;

static dns_name_t *zonecut = NULL; /* Protected by namelock. */

static dns_fixedname_t fzonecut; /* Protected by namelock. */

static unsigned int ended = 0; /* Protected by namelock. */

if (shuttingdown)

return;

LOCK(&namelock);

if (finished) {

ended++;

if (ended == ntasks) {

isc_task_detach(&task);

isc_app_shutdown();

}

goto unlock;

}

fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));

if (fname == NULL)

fatal("out of memory");

dns_fixedname_init(fname);

name = dns_fixedname_name(fname);

node = NULL;

found = ISC_FALSE;

while (!found) {

result = dns_dbiterator_current(gdbiter, &node, name);

check_dns_dbiterator_current(result);

/*

if (dns_name_equal(name, gorigin)) {

dns_db_detachnode(gdb, &node);

goto next;

}

/*

dns_rdataset_init(&nsec);

result = dns_db_findrdataset(gdb, node, gversion,

nsec_datatype, 0, 0,

&nsec, NULL);

if (dns_rdataset_isassociated(&nsec))

dns_rdataset_disassociate(&nsec);

if (result == ISC_R_SUCCESS) {

found = ISC_TRUE;

} else if (nsec_datatype == dns_rdatatype_nsec3) {

if (dns_name_issubdomain(name, gorigin) &&

(zonecut == NULL ||

!dns_name_issubdomain(name, zonecut))) {

if (delegation(name, node, NULL)) {

dns_fixedname_init(&fzonecut);

zonecut = dns_fixedname_name(&fzonecut);

dns_name_copy(name, zonecut, NULL);

if (!OPTOUT(nsec3flags) ||

secure(name, node))

found = ISC_TRUE;

} else

found = ISC_TRUE;

}

}

if (!found) {

dumpnode(name, node);

dns_db_detachnode(gdb, &node);

}

next:

result = dns_dbiterator_next(gdbiter);

if (result == ISC_R_NOMORE) {

finished = ISC_TRUE;

break;

} else if (result != ISC_R_SUCCESS)

fatal("failure iterating database: %s",

isc_result_totext(result));

}

if (!found) {

ended++;

if (ended == ntasks) {

isc_task_detach(&task);

isc_app_shutdown();

}

isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));

goto unlock;

}

sevent = (sevent_t *)

isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,

sign, NULL, sizeof(sevent_t));

if (sevent == NULL)

fatal("failed to allocate event\n");

sevent->node = node;

sevent->fname = fname;

isc_task_send(worker, ISC_EVENT_PTR(&sevent));

unlock:

UNLOCK(&namelock);

}

static void

startworker(isc_task_t *task, isc_event_t *event) {

isc_task_t *worker;

worker = (isc_task_t *)event->ev_arg;

assignwork(task, worker);

isc_event_free(&event);

}

static void

writenode(isc_task_t *task, isc_event_t *event) {

isc_task_t *worker;

sevent_t *sevent = (sevent_t *)event;

worker = (isc_task_t *)event->ev_sender;

dumpnode(dns_fixedname_name(sevent->fname), sevent->node);

cleannode(gdb, gversion, sevent->node);

dns_db_detachnode(gdb, &sevent->node);

isc_mem_put(mctx, sevent->fname, sizeof(dns_fixedname_t));

assignwork(task, worker);

isc_event_free(&event);

}

static void

sign(isc_task_t *task, isc_event_t *event) {

dns_fixedname_t *fname;

dns_dbnode_t *node;

sevent_t *sevent, *wevent;

sevent = (sevent_t *)event;

node = sevent->node;

fname = sevent->fname;

isc_event_free(&event);

signname(node, dns_fixedname_name(fname));

wevent = (sevent_t *)

isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,

writenode, NULL, sizeof(sevent_t));

if (wevent == NULL)

fatal("failed to allocate event\n");

wevent->node = node;

wevent->fname = fname;

isc_task_send(master, ISC_EVENT_PTR(&wevent));

}

static void

add_ds(dns_name_t *name, dns_dbnode_t *node, isc_uint32_t nsttl) {

dns_rdataset_t dsset;

dns_rdataset_t sigdsset;

isc_result_t result;

dns_rdataset_init(&dsset);

dns_rdataset_init(&sigdsset);

result = dns_db_findrdataset(gdb, node, gversion,

dns_rdatatype_ds,

0, 0, &dsset, &sigdsset);

if (result == ISC_R_SUCCESS) {

dns_rdataset_disassociate(&dsset);

result = dns_db_deleterdataset(gdb, node, gversion,

dns_rdatatype_ds, 0);

check_result(result, "dns_db_deleterdataset");

}

result = loadds(name, nsttl, &dsset);

if (result == ISC_R_SUCCESS) {

result = dns_db_addrdataset(gdb, node, gversion, 0,

&dsset, 0, NULL);

check_result(result, "dns_db_addrdataset");

dns_rdataset_disassociate(&dsset);

if (dns_rdataset_isassociated(&sigdsset))

dns_rdataset_disassociate(&sigdsset);

} else if (dns_rdataset_isassociated(&sigdsset)) {

result = dns_db_deleterdataset(gdb, node, gversion,

dns_rdatatype_rrsig,

dns_rdatatype_ds);

check_result(result, "dns_db_deleterdataset");

dns_rdataset_disassociate(&sigdsset);

}

}

static void

nsecify(void) {

dns_dbiterator_t *dbiter = NULL;

dns_dbnode_t *node = NULL, *nextnode = NULL;

dns_fixedname_t fname, fnextname, fzonecut;

dns_name_t *name, *nextname, *zonecut;

dns_rdataset_t rdataset;

dns_rdatasetiter_t *rdsiter = NULL;

dns_rdatatype_t type, covers;

isc_boolean_t done = ISC_FALSE;

isc_result_t result;

isc_uint32_t nsttl = 0;

dns_rdataset_init(&rdataset);

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_fixedname_init(&fnextname);

nextname = dns_fixedname_name(&fnextname);

dns_fixedname_init(&fzonecut);

zonecut = NULL;

/*

result = dns_db_createiterator(gdb, DNS_DB_NSEC3ONLY, &dbiter);

check_result(result, "dns_db_createiterator()");

for (result = dns_dbiterator_first(dbiter);

result == ISC_R_SUCCESS;

result = dns_dbiterator_next(dbiter)) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &rdataset);

type = rdataset.type;

covers = rdataset.covers;

dns_rdataset_disassociate(&rdataset);

result = dns_db_deleterdataset(gdb, node, gversion,

type, covers);

check_result(result,

"dns_db_deleterdataset(nsec3param/rrsig)");

}

dns_rdatasetiter_destroy(&rdsiter);

dns_db_detachnode(gdb, &node);

}

dns_dbiterator_destroy(&dbiter);

result = dns_db_createiterator(gdb, DNS_DB_NONSEC3, &dbiter);

check_result(result, "dns_db_createiterator()");

result = dns_dbiterator_first(dbiter);

check_result(result, "dns_dbiterator_first()");

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

/*

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &rdataset);

type = rdataset.type;

covers = rdataset.covers;

dns_rdataset_disassociate(&rdataset);

if (type == dns_rdatatype_nsec3param ||

covers == dns_rdatatype_nsec3param) {

result = dns_db_deleterdataset(gdb, node, gversion,

type, covers);

check_result(result,

"dns_db_deleterdataset(nsec3param/rrsig)");

continue;

}

}

dns_rdatasetiter_destroy(&rdsiter);

dns_db_detachnode(gdb, &node);

while (!done) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

if (delegation(name, node, &nsttl)) {

zonecut = dns_fixedname_name(&fzonecut);

dns_name_copy(name, zonecut, NULL);

if (generateds)

add_ds(name, node, nsttl);

}

result = dns_dbiterator_next(dbiter);

nextnode = NULL;

while (result == ISC_R_SUCCESS) {

isc_boolean_t active = ISC_FALSE;

result = dns_dbiterator_current(dbiter, &nextnode,

nextname);

check_dns_dbiterator_current(result);

active = active_node(nextnode);

if (!active) {

dns_db_detachnode(gdb, &nextnode);

result = dns_dbiterator_next(dbiter);

continue;

}

if (!dns_name_issubdomain(nextname, gorigin) ||

(zonecut != NULL &&

dns_name_issubdomain(nextname, zonecut)))

{

dns_db_detachnode(gdb, &nextnode);

result = dns_dbiterator_next(dbiter);

continue;

}

dns_db_detachnode(gdb, &nextnode);

break;

}

if (result == ISC_R_NOMORE) {

dns_name_clone(gorigin, nextname);

done = ISC_TRUE;

} else if (result != ISC_R_SUCCESS)

fatal("iterating through the database failed: %s",

isc_result_totext(result));

dns_dbiterator_pause(dbiter);

result = dns_nsec_build(gdb, gversion, node, nextname,

zone_soa_min_ttl);

check_result(result, "dns_nsec_build()");

dns_db_detachnode(gdb, &node);

}

dns_dbiterator_destroy(&dbiter);

}

static void

addnsec3param(const unsigned char *salt, size_t salt_length,

unsigned int iterations)

{

dns_dbnode_t *node = NULL;

dns_rdata_nsec3param_t nsec3param;

unsigned char nsec3parambuf[5 + 255];

dns_rdatalist_t rdatalist;

dns_rdataset_t rdataset;

dns_rdata_t rdata = DNS_RDATA_INIT;

isc_buffer_t b;

isc_result_t result;

dns_rdataset_init(&rdataset);

nsec3param.common.rdclass = gclass;

nsec3param.common.rdtype = dns_rdatatype_nsec3param;

ISC_LINK_INIT(&nsec3param.common, link);

nsec3param.mctx = NULL;

nsec3param.flags = 0;

nsec3param.hash = unknownalg ? DNS_NSEC3_UNKNOWNALG : dns_hash_sha1;

nsec3param.iterations = iterations;

nsec3param.salt_length = salt_length;

DE_CONST(salt, nsec3param.salt);

isc_buffer_init(&b, nsec3parambuf, sizeof(nsec3parambuf));

result = dns_rdata_fromstruct(&rdata, gclass,

dns_rdatatype_nsec3param,

&nsec3param, &b);

rdatalist.rdclass = rdata.rdclass;

rdatalist.type = rdata.type;

rdatalist.covers = 0;

rdatalist.ttl = 0;

ISC_LIST_INIT(rdatalist.rdata);

ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);

result = dns_rdatalist_tordataset(&rdatalist, &rdataset);

check_result(result, "dns_rdatalist_tordataset()");

result = dns_db_findnode(gdb, gorigin, ISC_TRUE, &node);

check_result(result, "dns_db_find(gorigin)");

/*

result = dns_db_deleterdataset(gdb, node, gversion,

dns_rdatatype_nsec3param, 0);

if (result == DNS_R_UNCHANGED)

result = ISC_R_SUCCESS;

check_result(result, "dddnsec3param: dns_db_deleterdataset()");

result = dns_db_addrdataset(gdb, node, gversion, 0, &rdataset,

DNS_DBADD_MERGE, NULL);

if (result == DNS_R_UNCHANGED)

result = ISC_R_SUCCESS;

check_result(result, "addnsec3param: dns_db_addrdataset()");

dns_db_detachnode(gdb, &node);

}

static void

addnsec3(dns_name_t *name, dns_dbnode_t *node,

const unsigned char *salt, size_t salt_length,

unsigned int iterations, hashlist_t *hashlist,

dns_ttl_t ttl)

{

unsigned char hash[NSEC3_MAX_HASH_LENGTH];

const unsigned char *nexthash;

unsigned char nsec3buffer[DNS_NSEC3_BUFFERSIZE];

dns_fixedname_t hashname;

dns_rdatalist_t rdatalist;

dns_rdataset_t rdataset;

dns_rdata_t rdata = DNS_RDATA_INIT;

isc_result_t result;

dns_dbnode_t *nsec3node = NULL;

char namebuf[DNS_NAME_FORMATSIZE];

size_t hash_length;

dns_name_format(name, namebuf, sizeof(namebuf));

dns_fixedname_init(&hashname);

dns_rdataset_init(&rdataset);

dns_name_downcase(name, name, NULL);

result = dns_nsec3_hashname(&hashname, hash, &hash_length,

name, gorigin, dns_hash_sha1, iterations,

salt, salt_length);

check_result(result, "addnsec3: dns_nsec3_hashname()");

nexthash = hashlist_findnext(hashlist, hash);

result = dns_nsec3_buildrdata(gdb, gversion, node,

unknownalg ?

DNS_NSEC3_UNKNOWNALG : dns_hash_sha1,

nsec3flags, iterations,

salt, salt_length,

nexthash, ISC_SHA1_DIGESTLENGTH,

nsec3buffer, &rdata);

check_result(result, "addnsec3: dns_nsec3_buildrdata()");

rdatalist.rdclass = rdata.rdclass;

rdatalist.type = rdata.type;

rdatalist.covers = 0;

rdatalist.ttl = ttl;

ISC_LIST_INIT(rdatalist.rdata);

ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);

result = dns_rdatalist_tordataset(&rdatalist, &rdataset);

check_result(result, "dns_rdatalist_tordataset()");

result = dns_db_findnsec3node(gdb, dns_fixedname_name(&hashname),

ISC_TRUE, &nsec3node);

check_result(result, "addnsec3: dns_db_findnode()");

result = dns_db_addrdataset(gdb, nsec3node, gversion, 0, &rdataset,

0, NULL);

if (result == DNS_R_UNCHANGED)

result = ISC_R_SUCCESS;

check_result(result, "addnsec3: dns_db_addrdataset()");

dns_db_detachnode(gdb, &nsec3node);

}

static void

nsec3clean(dns_name_t *name, dns_dbnode_t *node,

unsigned int hashalg, unsigned int iterations,

const unsigned char *salt, size_t salt_length, hashlist_t *hashlist)

{

dns_label_t label;

dns_rdata_nsec3_t nsec3;

dns_rdata_t rdata, delrdata;

dns_rdatalist_t rdatalist;

dns_rdataset_t rdataset, delrdataset;

isc_boolean_t delete_rrsigs = ISC_FALSE;

isc_buffer_t target;

isc_result_t result;

unsigned char hash[NSEC3_MAX_HASH_LENGTH + 1];

isc_boolean_t exists;

/*

dns_name_getlabel(name, 0, &label);

/*

isc_region_consume(&label, 1);

/*

isc_buffer_init(&target, hash, sizeof(hash) - 1);

result = isc_base32hex_decoderegion(&label, &target);

if (result != ISC_R_SUCCESS)

return;

hash[isc_buffer_usedlength(&target)] = 0;

exists = hashlist_exists(hashlist, hash);

/*

dns_rdataset_init(&rdataset);

dns_rdataset_init(&delrdataset);

result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_nsec3,

0, 0, &rdataset, NULL);

if (result != ISC_R_SUCCESS)

return;

/*

for (result = dns_rdataset_first(&rdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&rdataset)) {

dns_rdata_init(&rdata);

dns_rdataset_current(&rdataset, &rdata);

result = dns_rdata_tostruct(&rdata, &nsec3, NULL);

check_result(result, "dns_rdata_tostruct");

if (exists && nsec3.hash == hashalg &&

nsec3.iterations == iterations &&

nsec3.salt_length == salt_length &&

!memcmp(nsec3.salt, salt, salt_length))

continue;

rdatalist.rdclass = rdata.rdclass;

rdatalist.type = rdata.type;

rdatalist.covers = 0;

rdatalist.ttl = rdataset.ttl;

ISC_LIST_INIT(rdatalist.rdata);

dns_rdata_init(&delrdata);

dns_rdata_clone(&rdata, &delrdata);

ISC_LIST_APPEND(rdatalist.rdata, &delrdata, link);

result = dns_rdatalist_tordataset(&rdatalist, &delrdataset);

check_result(result, "dns_rdatalist_tordataset()");

result = dns_db_subtractrdataset(gdb, node, gversion,

&delrdataset, 0, NULL);

dns_rdataset_disassociate(&delrdataset);

if (result != ISC_R_SUCCESS && result != DNS_R_NXRRSET)

check_result(result, "dns_db_subtractrdataset(NSEC3)");

delete_rrsigs = ISC_TRUE;

}

dns_rdataset_disassociate(&rdataset);

if (result != ISC_R_NOMORE)

check_result(result, "dns_rdataset_first/next");

if (!delete_rrsigs)

return;

/*

result = dns_db_deleterdataset(gdb, node, gversion,

dns_rdatatype_rrsig,

dns_rdatatype_nsec3);

if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED)

check_result(result, "dns_db_deleterdataset(RRSIG(NSEC3))");

}

static void

rrset_remove_duplicates(dns_name_t *name, dns_rdataset_t *rdataset,

dns_diff_t *diff)

{

dns_difftuple_t *tuple = NULL;

isc_result_t result;

unsigned int count1 = 0;

dns_rdataset_t tmprdataset;

dns_rdataset_init(&tmprdataset);

for (result = dns_rdataset_first(rdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(rdataset)) {

dns_rdata_t rdata1 = DNS_RDATA_INIT;

unsigned int count2 = 0;

count1++;

dns_rdataset_current(rdataset, &rdata1);

dns_rdataset_clone(rdataset, &tmprdataset);

for (result = dns_rdataset_first(&tmprdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&tmprdataset)) {

dns_rdata_t rdata2 = DNS_RDATA_INIT;

count2++;

if (count1 >= count2)

continue;

dns_rdataset_current(&tmprdataset, &rdata2);

if (dns_rdata_casecompare(&rdata1, &rdata2) == 0) {

result = dns_difftuple_create(mctx,

DNS_DIFFOP_DEL,

name,

rdataset->ttl,

&rdata2, &tuple);

check_result(result, "dns_difftuple_create");

dns_diff_append(diff, &tuple);

}

}

dns_rdataset_disassociate(&tmprdataset);

}

}

static void

remove_duplicates(void) {

isc_result_t result;

dns_dbiterator_t *dbiter = NULL;

dns_rdatasetiter_t *rdsiter = NULL;

dns_diff_t diff;

dns_dbnode_t *node = NULL;

dns_rdataset_t rdataset;

dns_fixedname_t fname;

dns_name_t *name;

dns_diff_init(mctx, &diff);

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_rdataset_init(&rdataset);

result = dns_db_createiterator(gdb, 0, &dbiter);

check_result(result, "dns_db_createiterator()");

for (result = dns_dbiterator_first(dbiter);

result == ISC_R_SUCCESS;

result = dns_dbiterator_next(dbiter)) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

for (result = dns_rdatasetiter_first(rdsiter);

result == ISC_R_SUCCESS;

result = dns_rdatasetiter_next(rdsiter)) {

dns_rdatasetiter_current(rdsiter, &rdataset);

rrset_remove_duplicates(name, &rdataset, &diff);

dns_rdataset_disassociate(&rdataset);

}

if (result != ISC_R_NOMORE)

fatal("rdatasets iteration failed.");

dns_rdatasetiter_destroy(&rdsiter);

dns_db_detachnode(gdb, &node);

}

if (result != ISC_R_NOMORE)