upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-04-27 09:06:51 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Clear dnssec-sign stats for removed keys

Browse source 
Clear the key slots for dnssec-sign statistics for keys that are
removed. This way, the number of slots will stabilize to the maximum
key usage in a zone and will not grow every time a key rollover is
triggered.

(cherry picked from commit de15e07800)
This commit is contained in:
Matthijs Mekking 2021-08-20 15:06:13 +02:00
parent 7e90ef8f8c
commit c499478321
4 changed files with 57 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/dns/include/dns/stats.h
View file

@ -698,8 +698,17 @@ void
dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
dnssecsignstats_type_t operation);
/*%<
* Increment the statistics counter for the DNSKEY 'id'. The 'operation'
* determines what counter is incremented.
* Increment the statistics counter for the DNSKEY 'id' with algorithm 'alg'.
* The 'operation' determines what counter is incremented.
*
* Requires:
*\li 'stats' is a valid dns_stats_t created by dns_dnssecsignstats_create().
*/
void
dns_dnssecsignstats_clear(dns_stats_t *stats, dns_keytag_t id, uint8_t alg);
/*%<
* Clear the statistics counter for the DNSKEY 'id' with algorithm 'alg'.
*
* Requires:
*\li 'stats' is a valid dns_stats_t created by dns_dnssecsignstats_create().

27
lib/dns/stats.c
View file

@ -406,6 +406,33 @@ dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
isc_stats_increment(stats->counters, (nidx + operation));
}
void
dns_dnssecsignstats_clear(dns_stats_t *stats, dns_keytag_t id, uint8_t alg) {
uint32_t kval;
int num_keys = isc_stats_ncounters(stats->counters) /
dnssecsign_block_size;
REQUIRE(DNS_STATS_VALID(stats) && stats->type == dns_statstype_dnssec);
/* Shift algorithm in front of key tag, which is 16 bits */
kval = (uint32_t)(alg << 16 | id);
/* Look up correct counter. */
for (int i = 0; i < num_keys; i++) {
int idx = i * dnssecsign_block_size;
uint32_t counter = isc_stats_get_counter(stats->counters, idx);
if (counter == kval) {
/* Match */
isc_stats_set(stats->counters, 0, idx);
isc_stats_set(stats->counters, 0,
(idx + dns_dnssecsignstats_sign));
isc_stats_set(stats->counters, 0,
(idx + dns_dnssecsignstats_refresh));
return;
}
}
}
/*%
* Dump methods
*/

1
lib/dns/win32/libdns.def.in
View file

@ -339,6 +339,7 @@ dns_dnssec_verify
dns_dnssec_verifymessage
dns_dnsseckey_create
dns_dnsseckey_destroy
dns_dnssecsignstats_clear
dns_dnssecsignstats_create
dns_dnssecsignstats_dump
dns_dnssecsignstats_increment

18
lib/dns/zone.c
View file

@ -21560,6 +21560,8 @@ zone_rekey(dns_zone_t *zone) {
if (commit) {
dns_difftuple_t *tuple;
dns_stats_t *dnssecsignstats =
dns_zone_getdnssecsignstats(zone);
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
@ -21580,6 +21582,22 @@ zone_rekey(dns_zone_t *zone) {
"%s",
dns_result_totext(result));
}
/* Clear DNSSEC sign statistics. */
if (dnssecsignstats != NULL) {
dns_dnssecsignstats_clear(
dnssecsignstats,
dst_key_id(key->key),
dst_key_alg(key->key));
/*
* Also clear the dnssec-sign
* statistics of the revoked key id.
*/
dns_dnssecsignstats_clear(
dnssecsignstats,
dst_key_rid(key->key),
dst_key_alg(key->key));
}
}
}