mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 21:47:59 +00:00
Code Issues Releases Wiki Activity

Do not call exit() upon check_bad_algorithms() errors

Browse Source 
Replace all fatal() and fprintf() calls inside check_bad_algorithms()
with zoneverify_print() calls and error handling code.  Enable
check_bad_algorithms() to signal errors to the caller using its return
value.

Modify the call site of check_bad_algorithms() so that its errors are
properly handled.
This commit is contained in:
Michał Kępień 2018-06-15 09:59:20 +02:00
parent 7c3f653112
commit 00ecbad2d0
1 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
lib/dns/zoneverify.c
View File

@ -1526,26 +1526,31 @@ verify_nodes(vctx_t *vctx, isc_result_t *vresult) {
dns_dbiterator_destroy(&dbiter); dns_dbiterator_destroy(&dbiter);
} }
static void static isc_result_t
check_bad_algorithms(const vctx_t *vctx) { check_bad_algorithms(const vctx_t *vctx) {
char algbuf[DNS_SECALG_FORMATSIZE]; char algbuf[DNS_SECALG_FORMATSIZE];
isc_boolean_t first = ISC_TRUE; isc_boolean_t first = ISC_TRUE;
int i; int i;
for (i = 0; i < 256; i++) { for (i = 0; i < 256; i++) {
if (vctx->bad_algorithms[i] != 0) { if (vctx->bad_algorithms[i] == 0) {
if (first) continue;
fprintf(stderr, "The zone is not fully signed "
"for the following algorithms:");
dns_secalg_format(i, algbuf, sizeof(algbuf));
fprintf(stderr, " %s", algbuf);
first = ISC_FALSE;
} }
if (first) {
zoneverify_print(vctx,
"The zone is not fully signed for "
"the following algorithms:");
}
dns_secalg_format(i, algbuf, sizeof(algbuf));
zoneverify_print(vctx, " %s", algbuf);
first = ISC_FALSE;
} }
if (!first) { if (!first) {
fprintf(stderr, ".\n"); zoneverify_print(vctx, ".\n");
fatal("DNSSEC completeness test failed.");
} }
return (first ? ISC_R_SUCCESS : ISC_R_FAILURE);
} }
static void static void
@ -1619,7 +1624,11 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
if (result != ISC_R_SUCCESS && vresult == ISC_R_SUCCESS) if (result != ISC_R_SUCCESS && vresult == ISC_R_SUCCESS)
vresult = result; vresult = result;
check_bad_algorithms(&vctx); result = check_bad_algorithms(&vctx);
if (result != ISC_R_SUCCESS) {
zoneverify_print(&vctx, "DNSSEC completeness test failed.\n");
goto done;
}
if (vresult != ISC_R_SUCCESS) if (vresult != ISC_R_SUCCESS)
fatal("DNSSEC completeness test failed (%s).", fatal("DNSSEC completeness test failed (%s).",