dnssec: separated function for determining cdnskeys

diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index 4153407e368804c95c709477228f9a6abeb28e73..4e17274145234085784bc5bda186bb17af2dedd3 100644 (file)
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -857,6 +857,39 @@ int knot_zone_sign(zone_update_t *update,
        return result;
 }
 
+keyptr_dynarray_t knot_zone_sign_get_cdnskeys(const kdnssec_ctx_t *ctx,
+                                             zone_keyset_t *zone_keys)
+{
+       keyptr_dynarray_t r = { 0 };
+       zone_key_t *ksk_for_cds = NULL;
+       unsigned crp = ctx->policy->child_records_publish;
+       int kfc_prio = (crp == CHILD_RECORDS_ALWAYS ? 0 : (crp == CHILD_RECORDS_ROLLOVER ? 1 : 2));
+
+       for (int i = 0; i < zone_keys->count; i++) {
+               zone_key_t *key = &zone_keys->keys[i];
+               // determine which key (if any) will be the one for CDS/CDNSKEY
+               if (key->is_ksk && key->cds_priority > kfc_prio) {
+                       ksk_for_cds = key;
+                       kfc_prio = key->cds_priority;
+               }
+       }
+
+       for (int i = 0; i < zone_keys->count; i++) {
+               zone_key_t *key = &zone_keys->keys[i];
+               // determine which key (if any) will be the one for CDS/CDNSKEY
+               if (key->is_ksk && key->cds_priority > kfc_prio) {
+                       ksk_for_cds = key;
+                       kfc_prio = key->cds_priority;
+               }
+       }
+
+       if (ksk_for_cds != NULL) {
+               keyptr_dynarray_add(&r, &ksk_for_cds);
+       }
+
+       return r;
+}
+
 int knot_zone_sign_update_dnskeys(zone_update_t *update,
                                   zone_keyset_t *zone_keys,
                                   const kdnssec_ctx_t *dnssec_ctx)
@@ -872,6 +905,7 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
        knot_rrset_t *add_dnskeys = NULL;
        knot_rrset_t *add_cdnskeys = NULL;
        knot_rrset_t *add_cdss = NULL;
+       keyptr_dynarray_t kcdnskeys = { 0 };
        uint32_t dnskey_ttl = dnssec_ctx->policy->dnskey_ttl;
        knot_rrset_t soa = node_rrset(apex, KNOT_RRTYPE_SOA);
        if (knot_rrset_empty(&soa)) {
@@ -905,31 +939,23 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
                ret = KNOT_ENOMEM;
                CHECK_RET;
        }
-       zone_key_t *ksk_for_cds = NULL;
-       unsigned crp = dnssec_ctx->policy->child_records_publish;
-       int kfc_prio = (crp == CHILD_RECORDS_ALWAYS ? 0 : (crp == CHILD_RECORDS_ROLLOVER ? 1 : 2));
        for (int i = 0; i < zone_keys->count; i++) {
                zone_key_t *key = &zone_keys->keys[i];
                if (key->is_public) {
                        ret = rrset_add_zone_key(add_dnskeys, key);
                        CHECK_RET;
                }
-
-               // determine which key (if any) will be the one for CDS/CDNSKEY
-               if (key->is_ksk && key->cds_priority > kfc_prio) {
-                       ksk_for_cds = key;
-                       kfc_prio = key->cds_priority;
-               }
        }
 
-       if (ksk_for_cds != NULL) {
-               ret = rrset_add_zone_key(add_cdnskeys, ksk_for_cds);
+       kcdnskeys = knot_zone_sign_get_cdnskeys(dnssec_ctx, zone_keys);
+       dynarray_foreach(keyptr, zone_key_t *, ksk_for_cds, kcdnskeys) {
+               ret = rrset_add_zone_key(add_cdnskeys, *ksk_for_cds);
                CHECK_RET;
-               ret = rrset_add_zone_ds(add_cdss, ksk_for_cds);
+               ret = rrset_add_zone_ds(add_cdss, *ksk_for_cds);
                CHECK_RET;
        }
 
-       if (crp == CHILD_RECORDS_EMPTY) {
+       if (dnssec_ctx->policy->child_records_publish == CHILD_RECORDS_EMPTY) {
                const uint8_t cdnskey_empty[5] = { 0, 0, 3, 0, 0 };
                const uint8_t cds_empty[5] = { 0, 0, 0, 0, 0 };
                ret = knot_rrset_add_rdata(add_cdnskeys, cdnskey_empty,
@@ -963,6 +989,7 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
 #undef CHECK_RET
 
 cleanup:
+       keyptr_dynarray_free(&kcdnskeys);
        knot_rrset_free(add_dnskeys, NULL);
        knot_rrset_free(add_cdnskeys, NULL);
        knot_rrset_free(add_cdss, NULL);

diff --git a/src/knot/dnssec/zone-sign.h b/src/knot/dnssec/zone-sign.h
index 22b4e6482ede38a32d8e8b3411e77bbafdf54655..8796c4d5373f79cc67d23219922623928fba28df 100644 (file)
--- a/src/knot/dnssec/zone-sign.h
+++ b/src/knot/dnssec/zone-sign.h
@@ -45,6 +45,17 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
  */
 bool knot_zone_sign_use_key(const zone_key_t *key, const knot_rrset_t *covered);
 
+/*!
+ * \brief Return those keys for whose the CDNSKEY/CDS records shall be created.
+ *
+ * \param ctx        DNSSEC context.
+ * \param zone_keys  Zone keyset, includeing ZSKs.
+ *
+ * \return Dynarray containing pointers on some KSKs in keyset.
+ */
+keyptr_dynarray_t knot_zone_sign_get_cdnskeys(const kdnssec_ctx_t *ctx,
+                                             zone_keyset_t *zone_keys);
+
 /*!
  * \brief Update zone signatures and store performed changes in update.
  *