Commit 01de125806 for bind
commit 01de125806fe5a5a7d4181fd24e7aff7a35d72bc
Author: Martin Basti <mbasti@isc.org>
Date: Tue Oct 13 09:25:57 2026 +0000
Use %hu for key tags in format strings
dns_keytag_t is a uint16_t, but key tags were printed with %d almost
everywhere. Integer promotion makes that work, so it is not a bug.
The one site printing a uint32_t revoked key ID now uses %u.
Assisted-by: Claude:claude-fable-5-1
diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index d994dd42eb..75f0e0fecc 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -479,7 +479,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
if (result != ISC_R_SUCCESS) {
vbprintf(3,
"dns_ds_buildrdata("
- "keytag=%d, algo=%d, digest=%d): %s\n",
+ "keytag=%hu, algo=%d, digest=%d): %s\n",
ds.key_tag, ds.algorithm, ds.digest_type,
isc_result_totext(result));
continue;
@@ -488,13 +488,13 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
c = dsrdata.type != dns_rdatatype_ds;
dsrdata.type = dns_rdatatype_ds;
if (dns_rdata_compare(&dsrdata, &newdsrdata) == 0) {
- vbprintf(1, "found matching %s %d %d %d\n",
+ vbprintf(1, "found matching %s %hu %d %d\n",
c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
ds.digest_type);
return true;
} else if (strictness == TIGHT) {
vbprintf(0,
- "key does not match %s %d %d %d "
+ "key does not match %s %hu %d %d "
"when it looks like it should\n",
c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
ds.digest_type);
@@ -502,7 +502,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
}
}
- vbprintf(1, "no matching %s for %s %d %d\n",
+ vbprintf(1, "no matching %s for %s %hu %d\n",
dsset->type == dns_rdatatype_cds ? "CDS" : "DS",
ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
ki->tag, ki->algo);
@@ -555,7 +555,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
if (result != ISC_R_SUCCESS) {
vbprintf(3,
"dns_dnssec_keyfromrdata("
- "keytag=%d, algo=%d): %s\n",
+ "keytag=%hu, algo=%d): %s\n",
ki->tag, ki->algo, isc_result_totext(result));
}
ki++;
@@ -614,7 +614,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
* Replay attack protection: check against current age limit
*/
if (isc_serial_lt(sig.timesigned, notbefore)) {
- vbprintf(1, "skip RRSIG by key %d: too old\n",
+ vbprintf(1, "skip RRSIG by key %hu: too old\n",
sig.keyid);
continue;
}
@@ -628,7 +628,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
}
if (ki->dst == NULL) {
vbprintf(1,
- "skip RRSIG by key %d:"
+ "skip RRSIG by key %hu:"
" no matching (C)DS\n",
sig.keyid);
continue;
@@ -642,13 +642,13 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
result != DNS_R_FROMWILDCARD)
{
vbprintf(1,
- "skip RRSIG by key %d:"
+ "skip RRSIG by key %hu:"
" verification failed: %s\n",
sig.keyid, isc_result_totext(result));
continue;
}
- vbprintf(1, "found RRSIG by key %d\n", ki->tag);
+ vbprintf(1, "found RRSIG by key %hu\n", ki->tag);
algo[i] = sig.algorithm;
/*
@@ -715,7 +715,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
if (!ds_ok) {
vbprintf(0,
"missing signature for algorithm %d "
- "(key %d)\n",
+ "(key %hu)\n",
ds.algorithm, ds.key_tag);
all_ok = false;
}
@@ -1234,7 +1234,8 @@ main(int argc, char *argv[]) {
dns_rdatatype_format(oldestsig.covered, type, sizeof(type));
verbose_time(1, "child signature inception time",
oldestsig.timesigned);
- vbprintf(2, "from RRSIG %s by key %d\n", type, oldestsig.keyid);
+ vbprintf(2, "from RRSIG %s by key %hu\n", type,
+ oldestsig.keyid);
}
/*
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 3c8f902985..1d58b780e3 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -128,7 +128,7 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
dns_name_format(&sig->signer, namestr, sizeof(namestr));
dst_algorithm_format(algorithm, algstr, sizeof(algstr));
- snprintf(cp, size, "%s/%s/%d", namestr, algstr, sig->keyid);
+ snprintf(cp, size, "%s/%s/%hu", namestr, algstr, sig->keyid);
}
void
@@ -474,13 +474,13 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
if (min != max) {
if (id < min || id > max) {
- fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
+ fprintf(stderr, "Key ID %hu outside of [%u..%u]\n", id,
min, max);
return true;
}
if (rid < min || rid > max) {
fprintf(stderr,
- "Revoked Key ID %d (for tag %d) outside of "
+ "Revoked Key ID %u (for tag %hu) outside of "
"[%u..%u]\n",
rid, id, min, max);
return true;
@@ -515,14 +515,14 @@ again:
if (id != oldid) {
if (verbose > 1) {
fprintf(stderr,
- "Key ID %d could "
- "collide with %d\n",
+ "Key ID %hu could "
+ "collide with %hu\n",
id, oldid);
}
} else {
SET_IF_NOT_NULL(exact, true);
if (verbose > 1) {
- fprintf(stderr, "Key ID %d exists\n",
+ fprintf(stderr, "Key ID %hu exists\n",
id);
}
}
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 9fa095eab7..4117145bf5 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1698,7 +1698,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, dns_kasp_t *kasp,
dst_algorithm_format(dst_key_alg(dnskey),
algbuf, sizeof(algbuf));
snprintf(filename, sizeof(filename) - 1,
- "key file for %s/%s/%d", namebuf,
+ "key file for %s/%s/%hu", namebuf,
algbuf, dst_key_id(dnskey));
}
@@ -1844,7 +1844,7 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
dst_algorithm_format(dst_key_alg(key->key), alg, sizeof(alg));
dns_name_format(dst_key_name(key->key), namebuf, sizeof(namebuf));
- report("Removing %s key %s/%d/%s from DNSKEY RRset.", reason, namebuf,
+ report("Removing %s key %s/%hu/%s from DNSKEY RRset.", reason, namebuf,
dst_key_id(key->key), alg);
CHECK(dns_dnssec_make_dnskey(key->key, buf, sizeof(buf), &dnskey));
@@ -2385,7 +2385,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
DNS_LOGCATEGORY_DNSSEC,
DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
"DNSKEY %s (%s) is now revoked; "
- "new ID is %05d",
+ "new ID is %05hu",
keystr2,
key2->ksk ? (key2->zsk ? "CSK" : "KSK")
: "ZSK",
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index a8487685fe..5cf64bc7e8 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -1336,7 +1336,7 @@ dst_key_format(const dst_key_t *key, char *cp, unsigned int size) {
dns_name_format(dst_key_name(key), namestr, sizeof(namestr));
dst_algorithm_format(algorithm, algstr, sizeof(algstr));
- snprintf(cp, size, "%s/%s/%d", namestr, algstr, dst_key_id(key));
+ snprintf(cp, size, "%s/%s/%hu", namestr, algstr, dst_key_id(key));
}
isc_result_t
@@ -1879,7 +1879,8 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
/* Write key state */
if ((type & DST_TYPE_KEY) == 0) {
- fprintf(fp, "; This is the state of key %d, for ", key->key_id);
+ fprintf(fp, "; This is the state of key %hu, for ",
+ key->key_id);
result = dns_name_print(key->key_name, fp);
if (result != ISC_R_SUCCESS) {
return dst_key_cleanup(tmpname, fp);
@@ -1988,7 +1989,7 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
/* Write key information in comments */
if ((type & DST_TYPE_KEY) == 0) {
- fprintf(fp, "; This is a %s%s-signing key, keyid %d, for ",
+ fprintf(fp, "; This is a %s%s-signing key, keyid %hu, for ",
(key->key_flags & DNS_KEYFLAG_REVOKE) != 0 ? "revoked "
: "",
(key->key_flags & DNS_KEYFLAG_KSK) != 0 ? "key"
@@ -2078,7 +2079,7 @@ buildfilename(dns_name_t *name, dns_keytag_t id, unsigned int alg,
isc_buffer_putstr(out, "K");
RETERR(dns_name_tofilenametext(name, false, out));
- return isc_buffer_printf(out, "+%03d+%05d%s", alg, id, suffix);
+ return isc_buffer_printf(out, "+%03d+%05hu%s", alg, id, suffix);
}
static isc_result_t
diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 59fd99a755..db4631d314 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -543,7 +543,7 @@ keymgr_createkey(dns_kasp_key_t *kkey, const dns_name_t *origin,
/* Try again. */
isc_log_write(DNS_LOGCATEGORY_DNSSEC,
DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
- "keymgr: key collision id %d",
+ "keymgr: key collision id %hu",
dst_key_id(newkey));
dst_key_free(&newkey);
}
@@ -2743,8 +2743,9 @@ rollover_status(dns_dnsseckey_t *dkey, dns_kasp_t *kasp,
" ! Once the DS is in "
"the parent, run 'rndc "
"dnssec -checkds -key "
- "%d published' to mark "
- "it as published.\n",
+ "%hu published' to "
+ "mark it as "
+ "published.\n",
dst_key_id(key)));
}
} else {
@@ -2793,8 +2794,9 @@ rollover_status(dns_dnsseckey_t *dkey, dns_kasp_t *kasp,
"removed from the "
"parent, run 'rndc "
"dnssec -checkds -key "
- "%d withdrawn' to mark "
- "it as withdrawn.\n",
+ "%hu withdrawn' to "
+ "mark it as "
+ "withdrawn.\n",
dst_key_id(key)));
}
} else {
@@ -2886,7 +2888,7 @@ dns_keymgr_status(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
// key data
dst_algorithm_format(dst_key_alg(dkey->key), algstr,
sizeof(algstr));
- CHECK(isc_buffer_printf(buf, "\n%s %d (%s):\n",
+ CHECK(isc_buffer_printf(buf, "\n%s %hu (%s):\n",
keymgr_keyrole(dkey->key),
dst_key_id(dkey->key), algstr));
diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c
index f405e31c7c..6868f08998 100644
--- a/lib/dns/keytable.c
+++ b/lib/dns/keytable.c
@@ -619,7 +619,7 @@ keynode_dslist_totext(dns_keynode_t *keynode, isc_buffer_t *text) {
dns_secalg_format(ds.algorithm, algbuf, sizeof(algbuf));
RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
- snprintf(obuf, sizeof(obuf), "%s/%s/%d ; %s%s\n", namebuf,
+ snprintf(obuf, sizeof(obuf), "%s/%s/%hu ; %s%s\n", namebuf,
algbuf, ds.key_tag,
keynode->initial ? "initializing " : "",
keynode->managed ? "managed" : "static");
diff --git a/lib/dns/private.c b/lib/dns/private.c
index 11ebea16d4..28f877adef 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -374,7 +374,7 @@ dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) {
}
dst_algorithm_format(alg, algbuf, sizeof(algbuf));
- snprintf(keybuf, sizeof(keybuf), "key %d/%s", keyid, algbuf);
+ snprintf(keybuf, sizeof(keybuf), "key %hu/%s", keyid, algbuf);
isc_buffer_putstr(buf, keybuf);
} else {
return ISC_R_NOTFOUND;
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 93db1198b8..15ffc0241c 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -5139,7 +5139,7 @@ findzonekeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
dst_algorithm_format(dst_key_alg(pubkey),
algbuf, sizeof(algbuf));
snprintf(filename, sizeof(filename) - 1,
- "key file for %s/%s/%d", namebuf,
+ "key file for %s/%s/%hu", namebuf,
algbuf, dst_key_id(pubkey));
}
@@ -5577,7 +5577,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dst_algorithm_format(algorithm, algbuf,
sizeof(algbuf));
dns_zone_log(zone, ISC_LOG_WARNING,
- "Key %s/%s/%d "
+ "Key %s/%s/%hu "
"missing or inactive "
"and has no replacement: "
"retaining signatures.",
@@ -9143,7 +9143,7 @@ keyfetch_done(dns_zonefetch_t *fetch, isc_result_t eresult) {
dnssec_log(zone, ISC_LOG_DEBUG(3),
"Verifying DNSKEY set for zone "
- "'%s' using DS %d/%d: %s",
+ "'%s' using DS %hu/%d: %s",
namebuf, sig.keyid, sig.algorithm,
isc_result_totext(result));
@@ -9233,7 +9233,7 @@ anchors_done:
deletekey = true;
} else if (keydata.addhd > now) {
dnssec_log(zone, ISC_LOG_INFO,
- "Pending key %d for zone %s "
+ "Pending key %hu for zone %s "
"unexpectedly missing from DNSKEY "
"RRset: restarting 30-day "
"acceptance timer",
@@ -9245,7 +9245,7 @@ anchors_done:
keydata.refresh = refresh_time(fetch, false);
} else if (keydata.removehd == 0) {
dnssec_log(zone, ISC_LOG_INFO,
- "Active key %d for zone %s "
+ "Active key %hu for zone %s "
"unexpectedly missing from DNSKEY "
"RRset",
keytag, namebuf);
@@ -9254,7 +9254,7 @@ anchors_done:
deletekey = true;
dnssec_log(
zone, ISC_LOG_INFO,
- "Revoked key %d for zone %s no longer "
+ "Revoked key %hu for zone %s no longer "
"present in DNSKEY RRset: deleting "
"from managed keys database",
keytag, namebuf);
@@ -9281,7 +9281,7 @@ anchors_done:
if (result != ISC_R_SUCCESS) {
dnssec_log(zone, ISC_LOG_WARNING,
"dns_rdata_fromstruct failed: "
- "KEYDATA %d: %s",
+ "KEYDATA %hu: %s",
keytag, isc_result_totext(result));
continue;
}
@@ -9373,7 +9373,7 @@ anchors_done:
*/
deletekey = true;
dnssec_log(zone, ISC_LOG_INFO,
- "Pending key %d for "
+ "Pending key %hu for "
"zone %s is now revoked: "
"deleting from the "
"managed keys database",
@@ -9397,7 +9397,7 @@ anchors_done:
}
dnssec_log(zone, ISC_LOG_INFO,
- "Trusted key %d for "
+ "Trusted key %hu for "
"zone %s is now revoked",
keytag, namebuf);
} else if (keydata.removehd < now) {
@@ -9405,7 +9405,7 @@ anchors_done:
deletekey = true;
dnssec_log(zone, ISC_LOG_INFO,
- "Revoked key %d for "
+ "Revoked key %hu for "
"zone %s removal timer "
"complete: deleting from "
"the managed keys database",
@@ -9413,7 +9413,7 @@ anchors_done:
}
} else if (revoked && keydata.removehd == 0) {
dnssec_log(zone, ISC_LOG_WARNING,
- "Active key %d for zone "
+ "Active key %hu for zone "
"%s is revoked but "
"did not self-sign; "
"ignoring",
@@ -9435,7 +9435,7 @@ anchors_done:
dns_zone_mkey_month;
dnssec_log(zone, ISC_LOG_INFO,
- "Revoked key %d for "
+ "Revoked key %hu for "
"zone %s has returned: "
"starting 30-day "
"acceptance timer",
@@ -9449,7 +9449,7 @@ anchors_done:
if (keydata.addhd <= now) {
trustkey = true;
dnssec_log(zone, ISC_LOG_INFO,
- "Key %d for zone %s "
+ "Key %hu for zone %s "
"is now trusted (%s)",
keytag, namebuf,
initial ? "initializing key "
@@ -9465,7 +9465,7 @@ anchors_done:
pending++;
keydata.addhd = now + dns_zone_mkey_month;
dnssec_log(zone, ISC_LOG_INFO,
- "Pending key %d "
+ "Pending key %hu "
"for zone %s was "
"not validated: restarting "
"30-day acceptance timer",
@@ -9491,14 +9491,14 @@ anchors_done:
dnssec_log(zone, ISC_LOG_WARNING,
"Initializing automatic trust "
"anchor management for zone '%s'; "
- "DNSKEY ID %d is now trusted, "
+ "DNSKEY ID %hu is now trusted, "
"waiving the normal 30-day "
"waiting period.",
namebuf, keytag);
trustkey = true;
} else {
dnssec_log(zone, ISC_LOG_INFO,
- "New key %d observed "
+ "New key %hu observed "
"for zone '%s': "
"starting 30-day "
"acceptance timer",
@@ -9530,7 +9530,7 @@ anchors_done:
if (result != ISC_R_SUCCESS) {
dnssec_log(zone, ISC_LOG_WARNING,
"dns_rdata_fromstruct failed: "
- "KEYDATA %d: %s",
+ "KEYDATA %hu: %s",
keytag, isc_result_totext(result));
continue;
}
@@ -13872,7 +13872,7 @@ cds_inuse(dns_zone_t *zone, dns_rdata_t *rdata, dns_dnsseckeylist_t *keylist,
sizeof(cdsbuf), &cdsrdata);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
- "dns_ds_buildrdata(keytag=%d, algo=%d, "
+ "dns_ds_buildrdata(keytag=%hu, algo=%d, "
"digest=%d) failed: %s",
cds.key_tag, cds.algorithm,
cds.digest_type,
@@ -19297,7 +19297,7 @@ zone_rekey(dns_zone_t *zone) {
dst_algorithm_format(dst_key_alg(key->key), algbuf,
sizeof(algbuf));
dnssec_log(zone, ISC_LOG_DEBUG(3),
- "zone_rekey done: key %d/%s",
+ "zone_rekey done: key %hu/%s",
dst_key_id(key->key), algbuf);
}
ISC_LIST_UNLINK(dnskeys, key, link);