lib/dnssec: refactor kr_dnssec_key_*

- The "ksk" and "zsk" in names were confusing,
  as they did NOT match the normal terms of KSK and ZSK.
- Add _usable() as a more useful function than _zsk() was.
- don't use 16-bit flag-sets; it's way easier to extract on byte level
- use inline for the simplified code

diff --git a/daemon/lua/kres-gen-30.lua b/daemon/lua/kres-gen-30.lua
index 48ea7a9045469bb7c74d340be7efa9f8314939bb..ae182a37a96ae1b2821f42209e576ecab3051f0a 100644 (file)
--- a/daemon/lua/kres-gen-30.lua
+++ b/daemon/lua/kres-gen-30.lua
@@ -486,7 +486,7 @@ knot_rrset_t *kr_ta_get(trie_t *, const knot_dname_t *);
 int kr_ta_add(trie_t *, const knot_dname_t *, uint16_t, uint32_t, const uint8_t *, uint16_t);
 int kr_ta_del(trie_t *, const knot_dname_t *);
 void kr_ta_clear(trie_t *);
-_Bool kr_dnssec_key_ksk(const uint8_t *);
+_Bool kr_dnssec_key_sep_flag(const uint8_t *);
 _Bool kr_dnssec_key_revoked(const uint8_t *);
 int kr_dnssec_key_tag(uint16_t, const uint8_t *, size_t);
 int kr_dnssec_key_match(const uint8_t *, size_t, const uint8_t *, size_t);

diff --git a/daemon/lua/kres-gen-31.lua b/daemon/lua/kres-gen-31.lua
index 0bc509312ffe5f32165fa653d82f19b8a0ed663c..1033e104ffbab62e6b96132273ff706cd4680288 100644 (file)
--- a/daemon/lua/kres-gen-31.lua
+++ b/daemon/lua/kres-gen-31.lua
@@ -486,7 +486,7 @@ knot_rrset_t *kr_ta_get(trie_t *, const knot_dname_t *);
 int kr_ta_add(trie_t *, const knot_dname_t *, uint16_t, uint32_t, const uint8_t *, uint16_t);
 int kr_ta_del(trie_t *, const knot_dname_t *);
 void kr_ta_clear(trie_t *);
-_Bool kr_dnssec_key_ksk(const uint8_t *);
+_Bool kr_dnssec_key_sep_flag(const uint8_t *);
 _Bool kr_dnssec_key_revoked(const uint8_t *);
 int kr_dnssec_key_tag(uint16_t, const uint8_t *, size_t);
 int kr_dnssec_key_match(const uint8_t *, size_t, const uint8_t *, size_t);

diff --git a/daemon/lua/kres-gen-32.lua b/daemon/lua/kres-gen-32.lua
index 88d9511ff82d3f5115fcd370d79e3dc1c3f08ab6..23a338f0965340825370cb3934bd9cc698bd22df 100644 (file)
--- a/daemon/lua/kres-gen-32.lua
+++ b/daemon/lua/kres-gen-32.lua
@@ -487,7 +487,7 @@ knot_rrset_t *kr_ta_get(trie_t *, const knot_dname_t *);
 int kr_ta_add(trie_t *, const knot_dname_t *, uint16_t, uint32_t, const uint8_t *, uint16_t);
 int kr_ta_del(trie_t *, const knot_dname_t *);
 void kr_ta_clear(trie_t *);
-_Bool kr_dnssec_key_ksk(const uint8_t *);
+_Bool kr_dnssec_key_sep_flag(const uint8_t *);
 _Bool kr_dnssec_key_revoked(const uint8_t *);
 int kr_dnssec_key_tag(uint16_t, const uint8_t *, size_t);
 int kr_dnssec_key_match(const uint8_t *, size_t, const uint8_t *, size_t);

diff --git a/daemon/lua/kres-gen.sh b/daemon/lua/kres-gen.sh
index cd9a52cfd43cf123151d5c7fe404f2bda814ad49..5939dc65ad8c56974a13311b36adb1a252a40042 100755 (executable)
--- a/daemon/lua/kres-gen.sh
+++ b/daemon/lua/kres-gen.sh
@@ -281,7 +281,7 @@ ${CDEFS} ${LIBKRES} functions <<-EOF
        kr_ta_del
        kr_ta_clear
 # DNSSEC
-       kr_dnssec_key_ksk
+       kr_dnssec_key_sep_flag
        kr_dnssec_key_revoked
        kr_dnssec_key_tag
        kr_dnssec_key_match

diff --git a/lib/dnssec.c b/lib/dnssec.c
index 262570c44f73f0ee99a0f2241ddec143874176f1..6d809abf797f99f483fc991a9b43742024d68dec 100644 (file)
--- a/lib/dnssec.c
+++ b/lib/dnssec.c
@@ -225,7 +225,7 @@ struct kr_svldr_ctx * kr_svldr_new_ctx(const knot_rrset_t *ds, knot_rrset_t *dns
        array_reserve(ctx->keys, dnskey->rrs.count);
        knot_rdata_t *krr = dnskey->rrs.rdata;
        for (int i = 0; i < dnskey->rrs.count; ++i, krr = knot_rdataset_next(krr)) {
-               if (!kr_dnssec_key_zsk(krr->data) || kr_dnssec_key_revoked(krr->data))
+               if (!kr_dnssec_key_usable(krr->data))
                        continue; // key not usable for this
                kr_svldr_key_t key;
                if (unlikely(svldr_key_new(krr, NULL/*seems OK here*/, &key) != 0))
@@ -448,6 +448,12 @@ bool kr_ds_algo_support(const knot_rrset_t *ta)
        return false;
 }
 
+// Now we instantiate these two as non-inline externally linkable code here (for lua).
+KR_EXPORT extern inline KR_PURE
+bool kr_dnssec_key_sep_flag(const uint8_t *dnskey_rdata);
+KR_EXPORT extern inline KR_PURE
+bool kr_dnssec_key_revoked(const uint8_t *dnskey_rdata);
+
 int kr_dnskeys_trusted(kr_rrset_validation_ctx_t *vctx, const knot_rdataset_t *sigs,
                        const knot_rrset_t *ta)
 {
@@ -464,8 +470,8 @@ int kr_dnskeys_trusted(kr_rrset_validation_ctx_t *vctx, const knot_rdataset_t *s
         */
        knot_rdata_t *krr = keys->rrs.rdata;
        for (int i = 0; i < keys->rrs.count; ++i, krr = knot_rdataset_next(krr)) {
-               /* RFC4035 5.3.1, bullet 8 */ /* ZSK */
-               if (!kr_dnssec_key_zsk(krr->data) || kr_dnssec_key_revoked(krr->data))
+               /* RFC4035 5.3.1, bullet 8 requires the Zone Flag bit */
+               if (!kr_dnssec_key_usable(krr->data))
                        continue;
 
                kr_svldr_key_t key;
@@ -487,22 +493,6 @@ int kr_dnskeys_trusted(kr_rrset_validation_ctx_t *vctx, const knot_rdataset_t *s
        return vctx->result;
 }
 
-bool kr_dnssec_key_zsk(const uint8_t *dnskey_rdata)
-{
-       return knot_wire_read_u16(dnskey_rdata) & 0x0100;
-}
-
-bool kr_dnssec_key_ksk(const uint8_t *dnskey_rdata)
-{
-       return knot_wire_read_u16(dnskey_rdata) & 0x0001;
-}
-
-/** Return true if the DNSKEY is revoked. */
-bool kr_dnssec_key_revoked(const uint8_t *dnskey_rdata)
-{
-       return knot_wire_read_u16(dnskey_rdata) & 0x0080;
-}
-
 int kr_dnssec_key_tag(uint16_t rrtype, const uint8_t *rdata, size_t rdlen)
 {
        if (!rdata || rdlen == 0 || (rrtype != KNOT_RRTYPE_DS && rrtype != KNOT_RRTYPE_DNSKEY)) {

diff --git a/lib/dnssec.h b/lib/dnssec.h
index ca737cfe126915f48e36e947945a4373aad3a2d7..52465042bc9858e73a017c63c61e88b9e1a6b61b 100644 (file)
--- a/lib/dnssec.h
+++ b/lib/dnssec.h
@@ -94,17 +94,29 @@ bool kr_ds_algo_support(const knot_rrset_t *ta);
 int kr_dnskeys_trusted(kr_rrset_validation_ctx_t *vctx, const knot_rdataset_t *sigs,
                        const knot_rrset_t *ta);
 
-/** Return true if the DNSKEY can be used as a ZSK.  */
-KR_EXPORT KR_PURE
-bool kr_dnssec_key_zsk(const uint8_t *dnskey_rdata);
+// flags: https://www.iana.org/assignments/dnskey-flags/dnskey-flags.xhtml
+//        https://datatracker.ietf.org/doc/html/rfc4034#section-2.1
 
-/** Return true if the DNSKEY indicates being KSK (=> has SEP).  */
-KR_EXPORT KR_PURE
-bool kr_dnssec_key_ksk(const uint8_t *dnskey_rdata);
+/** Return true if the DNSKEY has the SEP flag (normally ignored). */
+KR_EXPORT inline KR_PURE
+bool kr_dnssec_key_sep_flag(const uint8_t *dnskey_rdata)
+{
+       return dnskey_rdata[1] & 0x01;
+}
 
 /** Return true if the DNSKEY is revoked. */
-KR_EXPORT KR_PURE
-bool kr_dnssec_key_revoked(const uint8_t *dnskey_rdata);
+KR_EXPORT inline KR_PURE
+bool kr_dnssec_key_revoked(const uint8_t *dnskey_rdata)
+{
+       return dnskey_rdata[1] & 0x80;
+}
+
+/** Return true if the DNSKEY could be used to validate zone records. */
+static inline KR_PURE
+bool kr_dnssec_key_usable(const uint8_t *dnskey_rdata)
+{
+       return (dnskey_rdata[0] & 0x01) && !kr_dnssec_key_revoked(dnskey_rdata);
+}
 
 /** Return DNSKEY tag.
   * @param rrtype RR type (either DS or DNSKEY are supported)

diff --git a/lib/dnssec/ta.c b/lib/dnssec/ta.c
index becf7d8108ba8e3c429ea48b53efbf9a51a4f8fc..67f0a2069b3c79ddee1a9920b9e52c1eebbeac1f 100644 (file)
--- a/lib/dnssec/ta.c
+++ b/lib/dnssec/ta.c
@@ -56,14 +56,13 @@ static int dnskey2ds(dnssec_binary_t *dst, const knot_dname_t *owner, const uint
        /* Accept only keys with Zone and SEP flags that aren't revoked,
         * as a precaution.  RFC 5011 also utilizes these flags.
         * TODO: kr_dnssec_key_* names are confusing. */
-       const bool flags_ok = kr_dnssec_key_zsk(rdata) && !kr_dnssec_key_revoked(rdata);
-       if (!flags_ok) {
+       if (!kr_dnssec_key_usable(rdata)) {
                auto_free char *owner_str = kr_dname_text(owner);
                kr_log_error(TA, "refusing to trust %s DNSKEY because of flags %d\n",
                        owner_str, dnssec_key_get_flags(key));
                ret = kr_error(EILSEQ);
                goto cleanup;
-       } else if (!kr_dnssec_key_ksk(rdata)) {
+       } else if (!kr_dnssec_key_sep_flag(rdata)) {
                auto_free char *owner_str = kr_dname_text(owner);
                int flags = dnssec_key_get_flags(key);
                kr_log_warning(TA, "warning: %s DNSKEY is missing the SEP bit; "

diff --git a/modules/ta_update/ta_update.lua b/modules/ta_update/ta_update.lua
index 2361e16726317e3d89ea89cd9eff47b3aba243e9..3c059f85e144e60a7ebf809120069fcba2fc5566 100644 (file)
--- a/modules/ta_update/ta_update.lua
+++ b/modules/ta_update/ta_update.lua
@@ -58,7 +58,7 @@ end
 
 -- Evaluate TA status of a RR according to RFC5011.  The time is in seconds.
 local function ta_present(keyset, rr, hold_down_time)
-       if rr.type == kres.type.DNSKEY and not C.kr_dnssec_key_ksk(rr.rdata) then
+       if rr.type == kres.type.DNSKEY and not C.kr_dnssec_key_sep_flag(rr.rdata) then
                return false -- Ignore
        end
        -- Attempt to extract key_tag
@@ -212,7 +212,7 @@ local function check_upstream(keyset, new_keys)
                local ta = ta_find(keyset, rr)
                table.insert(process_keys, ta)
 
-               if rr.type == kres.type.DNSKEY and not C.kr_dnssec_key_ksk(rr.rdata) then
+               if rr.type == kres.type.DNSKEY and not C.kr_dnssec_key_sep_flag(rr.rdata) then
                        goto continue -- Ignore
                end