Revert "offline KSK: feat - sending and signing also CDNSKEY and CDS"

This reverts commit 7faf3eafec6774d920e2e87853fc362ed21ada74.

diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index f618e68993fe7e7de6f18e202f67e6b1fbf1a1c1..3e2095a2929e8a15b0bd422771a5f13e5cf04532 100644 (file)
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -279,18 +279,7 @@ static int remove_expired_rrsigs(const knot_rrset_t *covered,
 
 static bool can_have_offline_rrsig(const knot_rrset_t *rr, const knot_dname_t *zone_apex)
 {
-       if (knot_dname_cmp(rr->owner, zone_apex) != 0) {
-               return false;
-       }
-
-       switch (rr->type) {
-       case KNOT_RRTYPE_DNSKEY:
-       case KNOT_RRTYPE_CDNSKEY:
-       case KNOT_RRTYPE_CDS:
-               return true;
-       default:
-               return false;
-       }
+       return (rr->type == KNOT_RRTYPE_DNSKEY && knot_dname_cmp(rr->owner, zone_apex) == 0);
 }
 
 static int load_offline_rrsig(const knot_rrset_t *covered,
@@ -357,17 +346,13 @@ static int add_missing_rrsigs(const knot_rrset_t *covered,
 
                uint16_t at_offline;
                if (valid_signature_exists(covered, &offline_rrsigs, key->key, key->ctx, dnssec_ctx, &at_offline)) {
-                       log_zone_info(dnssec_ctx->zone->dname, "DNSSEC, using offline %s RRSIG",
-                                     knot_get_rdata_descriptor(covered->type)->type_name);
+                       log_zone_info(dnssec_ctx->zone->dname, "DNSSEC, using offline DNSKEY RRSIG");
                        knot_rdata_t *offline_rd = knot_rdataset_at(&offline_rrsigs.rrs, at_offline);
                        result = knot_rrset_add_rdata(&to_add, offline_rd->data, offline_rd->len, NULL);
                        if (result != KNOT_EOK) {
                                break;
                        }
                        continue;
-               } else if (!knot_rrset_empty(&offline_rrsigs)) {
-                       log_zone_warning(dnssec_ctx->zone->dname, "DNSSEC, loaded offline %s RRSIGs but not usable for signing by %hu",
-                                        knot_get_rdata_descriptor(covered->type)->type_name, dnssec_key_get_keytag(key->key));
                }
 
                result = knot_sign_rrset(&to_add, covered, key->key, key->ctx,
@@ -657,7 +642,7 @@ int rrset_add_zone_key(knot_rrset_t *rrset, zone_key_t *zone_key)
        return knot_rrset_add_rdata(rrset, dnskey_rdata.data, dnskey_rdata.size, NULL);
 }
 
-int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key)
+static int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key)
 {
        assert(rrset);
        assert(zone_key);

diff --git a/src/knot/dnssec/zone-sign.h b/src/knot/dnssec/zone-sign.h
index 6853046f1a8d1c70529b347e8f85aa63686235dc..7f833daef26a074d67c878d5e96935b5ee18c811 100644 (file)
--- a/src/knot/dnssec/zone-sign.h
+++ b/src/knot/dnssec/zone-sign.h
@@ -23,7 +23,6 @@
 #include "knot/dnssec/zone-keys.h"
 
 int rrset_add_zone_key(knot_rrset_t *rrset, zone_key_t *zone_key);
-int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key);
 
 /*!
  * \brief Adds/removes DNSKEY (and CDNSKEY, CDS) records to zone according to zone keyset.

diff --git a/src/utils/keymgr/offline_ksk.c b/src/utils/keymgr/offline_ksk.c
index 525e112538d0e116f99f111ecf40bd7f4c0d868b..d9d0b1fc851c3665f772bf0eb47f47a08c57ddb4 100644 (file)
--- a/src/utils/keymgr/offline_ksk.c
+++ b/src/utils/keymgr/offline_ksk.c
@@ -69,56 +69,40 @@ static void next_resign(knot_time_t *next, kdnssec_ctx_t *ctx)
 }
 
 // please free *_dnskey and keyset even if returned error
-static int load_dnskey_rrset(kdnssec_ctx_t *ctx, knot_rrset_t **_dnskey,
-                            knot_rrset_t **_cdnskey, knot_rrset_t **_cds, zone_keyset_t *keyset)
+static int load_dnskey_rrset(kdnssec_ctx_t *ctx, knot_rrset_t **_dnskey, zone_keyset_t *keyset)
 {
-       keyptr_dynarray_t ckeys = { 0 };
-
        // prepare the DNSKEY rrset to be signed
        knot_rrset_t *dnskey = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_DNSKEY, KNOT_CLASS_IN, ctx->policy->dnskey_ttl, NULL);
-       *_dnskey = dnskey;
        if (dnskey == NULL) {
                return KNOT_ENOMEM;
        }
-       knot_rrset_t *cdnskey = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_CDNSKEY, KNOT_CLASS_IN, 0, NULL);
-       *_cdnskey = cdnskey;
-       if (cdnskey == NULL) {
-               return KNOT_ENOMEM;
-       }
-       knot_rrset_t *cds = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_CDS, KNOT_CLASS_IN, 0, NULL);
-       *_cds = cds;
-       if (cds == NULL) {
-               return KNOT_ENOMEM;
-       }
 
        int ret = load_zone_keys(ctx, keyset, false);
-
-       ckeys = knot_zone_sign_get_cdnskeys(ctx, keyset);
-       dynarray_foreach(keyptr, zone_key_t *, ksk_for_cds, ckeys) {
-               if (ret == KNOT_EOK) {
-                       ret = rrset_add_zone_key(cdnskey, *ksk_for_cds);
-               }
-               if (ret == KNOT_EOK) {
-                       ret = rrset_add_zone_ds(cds, *ksk_for_cds);
-               }
+       if (ret != KNOT_EOK) {
+               printf("load keys failed\n");
+               return ret;
        }
 
-       for (int i = 0; i < keyset->count && ret == KNOT_EOK; i++) {
+       for (int i = 0; i < keyset->count; i++) {
                zone_key_t *key = &keyset->keys[i];
                if (key->is_public) {
                        ret = rrset_add_zone_key(dnskey, key);
+                       if (ret != KNOT_EOK) {
+                               printf("add zone key failed\n");
+                               return ret;
+                       }
                }
        }
 
-       keyptr_dynarray_free(&ckeys);
-       return ret;
+       *_dnskey = dnskey;
+       return KNOT_EOK;
 }
 
 static int presign_once(kdnssec_ctx_t *ctx)
 {
-       knot_rrset_t *dnskey = NULL, *cdnskey = NULL, *cds = NULL, *rrsig = NULL;
+       knot_rrset_t *dnskey = NULL, *rrsig = NULL;
        zone_keyset_t keyset = { 0 };
-       int ret = load_dnskey_rrset(ctx, &dnskey, &cdnskey, &cds, &keyset);
+       int ret = load_dnskey_rrset(ctx, &dnskey, &keyset);
        if (ret != KNOT_EOK) {
                goto done;
        }
@@ -133,21 +117,13 @@ static int presign_once(kdnssec_ctx_t *ctx)
        for (int i = 0; i < keyset.count; i++) {
                zone_key_t *key = &keyset.keys[i];
                if (key->is_active && key->is_ksk) {
-                       if (ret == KNOT_EOK) {
-                               ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL);
-                       }
-                       if (ret == KNOT_EOK && !knot_rrset_empty(cdnskey)) {
-                               ret = knot_sign_rrset(rrsig, cdnskey, key->key, key->ctx, ctx, NULL);
-                       }
-                       if (ret == KNOT_EOK && !knot_rrset_empty(cds)) {
-                               ret = knot_sign_rrset(rrsig, cds, key->key, key->ctx, ctx, NULL);
+                       ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL);
+                       if (ret != KNOT_EOK) {
+                               printf("sign rrset failed\n");
+                               goto done;
                        }
                }
        }
-       if (ret != KNOT_EOK) {
-               printf("sign rrset failed\n");
-               goto done;
-       }
 
        // store it to KASP db
        assert(!knot_rrset_empty(rrsig));
@@ -159,8 +135,6 @@ static int presign_once(kdnssec_ctx_t *ctx)
 
 done:
        knot_rrset_free(dnskey, NULL);
-       knot_rrset_free(cdnskey, NULL);
-       knot_rrset_free(cds, NULL);
        knot_rrset_free(rrsig, NULL);
        free_zone_keys(&keyset);
        return ret;
@@ -255,24 +229,16 @@ static void print_generated_message()
 
 static int ksr_once(kdnssec_ctx_t *ctx, char **buf, size_t *buf_size)
 {
-       knot_rrset_t *dnskey = NULL, *cdnskey = NULL, *cds = NULL;
+       knot_rrset_t *dnskey = NULL;
        zone_keyset_t keyset = { 0 };
-       int ret = load_dnskey_rrset(ctx, &dnskey, &cdnskey, &cds, &keyset);
+       int ret = load_dnskey_rrset(ctx, &dnskey, &keyset);
        if (ret != KNOT_EOK) {
                goto done;
        }
-       ret = dump_rrset_to_buf(cdnskey, buf, buf_size);
-       if (ret >= 0) {
-               printf(";;KSR =================\n%s", *buf);
-       }
-       ret = dump_rrset_to_buf(cds, buf, buf_size);
-       if (ret >= 0) {
-               printf("%s", *buf);
-       }
        ret = dump_rrset_to_buf(dnskey, buf, buf_size);
        if (ret >= 0) {
                (*buf)[strlen(*buf) - 1] = '\0'; // remove trailing newline
-               printf("%s ; end KSR %lu\n", *buf, ctx->now);
+               printf(";;KSR %lu %hu %d\n%s ; end KSR %lu\n", ctx->now, dnskey->rrs.count, ret, *buf, ctx->now);
                ret = KNOT_EOK;
        }
 
@@ -303,12 +269,10 @@ int keymgr_print_ksr(kdnssec_ctx_t *ctx, knot_time_t upto)
 
 typedef struct {
        knot_rrset_t *rr;
-       knot_rrset_t *cdnskey;
-       knot_rrset_t *cds;
        kdnssec_ctx_t *kctx;
 } ksr_sign_ctx_t;
 
-static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey, knot_rrset_t *cdnskey, knot_rrset_t *cds)
+static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey)
 {
        zone_keyset_t keyset = { 0 };
        char *buf = NULL;
@@ -323,22 +287,15 @@ static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey, knot_rrset_
                goto done;
        }
        // no check if the KSK used for signing (in keyset) is contained in DNSKEY record being signed (in KSR) !
-       for (int i = 0; i < keyset.count && ret == KNOT_EOK; i++) {
+       for (int i = 0; i < keyset.count; i++) {
                zone_key_t *key = &keyset.keys[i];
                if (key->is_active && key->is_ksk) {
                        ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL);
-                       if (ret == KNOT_EOK && !knot_rrset_empty(cdnskey)) {
-                               ret = knot_sign_rrset(rrsig, cdnskey, key->key, key->ctx, ctx, NULL);
-                       }
-                       if (ret == KNOT_EOK && !knot_rrset_empty(cds)) {
-                               ret = knot_sign_rrset(rrsig, cds, key->key, key->ctx, ctx, NULL);
+                       if (ret != KNOT_EOK) {
+                               goto done;
                        }
                }
        }
-       if (ret != KNOT_EOK) {
-               goto done;
-       }
-
        ret = dump_rrset_to_buf(rrsig, &buf, &buf_size);
        if (ret >= 0) {
                buf[strlen(buf) - 1] = '\0'; // remove trailing newline
@@ -356,31 +313,14 @@ done:
 static void ksr_sign_once(zs_scanner_t *sc)
 {
        ksr_sign_ctx_t *ctx = sc->process.data;
-       knot_rrset_t *rr_add = NULL;
-       switch (sc->r_type) {
-       case KNOT_RRTYPE_DNSKEY:
-               rr_add = ctx->rr;
-               break;
-       case KNOT_RRTYPE_CDNSKEY:
-               rr_add = ctx->cdnskey;
-               break;
-       case KNOT_RRTYPE_CDS:
-               rr_add = ctx->cds;
-               break;
-       default:
-               sc->error.code = KNOT_ESEMCHECK;
-               return;
-       }
 
-       sc->error.code = knot_rrset_add_rdata(rr_add, sc->r_data, sc->r_data_length, NULL);
+       sc->error.code = knot_rrset_add_rdata(ctx->rr, sc->r_data, sc->r_data_length, NULL);
        ctx->rr->ttl = sc->r_ttl;
 
        if (sc->error.code == KNOT_EOK && sc->buffer_length > 9 && strncmp((const char *)sc->buffer, " end KSR ", 9) == 0) {
                ctx->kctx->now = atol((const char *)sc->buffer + 9);
-               sc->error.code = ksr_sign_dnskey(ctx->kctx, ctx->rr, ctx->cdnskey, ctx->cds);
+               sc->error.code = ksr_sign_dnskey(ctx->kctx, ctx->rr);
                knot_rdataset_clear(&ctx->rr->rrs, NULL);
-               knot_rdataset_clear(&ctx->cdnskey->rrs, NULL);
-               knot_rdataset_clear(&ctx->cds->rrs, NULL);
        }
 }
 
@@ -412,12 +352,10 @@ static int read_ksr_skr(kdnssec_ctx_t *ctx, const char *infile, void (*cb)(zs_sc
                return KNOT_EFILE;
        }
 
-       knot_rrset_t rr = { 0 }, cdnskey = { 0 }, cds = { 0};
+       knot_rrset_t rr = { 0 };
        knot_rrset_init(&rr, ctx->zone->dname, rrtype, KNOT_CLASS_IN, ctx->policy->dnskey_ttl);
-       knot_rrset_init(&cdnskey, ctx->zone->dname, KNOT_RRTYPE_CDNSKEY, KNOT_CLASS_IN, 0);
-       knot_rrset_init(&cds, ctx->zone->dname, KNOT_RRTYPE_CDS, KNOT_CLASS_IN, 0);
 
-       ksr_sign_ctx_t pctx = { &rr, &cdnskey, &cds, ctx };
+       ksr_sign_ctx_t pctx = { &rr, ctx };
        ret = zs_set_processing(&sc, cb, NULL, &pctx);
        if (ret < 0) {
                zs_deinit(&sc);
@@ -432,8 +370,6 @@ static int read_ksr_skr(kdnssec_ctx_t *ctx, const char *infile, void (*cb)(zs_sc
                ret = KNOT_EMALF;
        }
        knot_rdataset_clear(&rr.rrs, NULL);
-       knot_rdataset_clear(&cdnskey.rrs, NULL);
-       knot_rdataset_clear(&cds.rrs, NULL);
        zs_deinit(&sc);
        return ret;
 }

diff --git a/tests-extra/tests/dnssec/offline_ksk2/test.py b/tests-extra/tests/dnssec/offline_ksk2/test.py
index 335935abecaae621bc0b2281292b136a1b6a797d..a03043bed2c26d69043a06b496dec8eb5a44d166 100644 (file)
--- a/tests-extra/tests/dnssec/offline_ksk2/test.py
+++ b/tests-extra/tests/dnssec/offline_ksk2/test.py
@@ -94,6 +94,7 @@ knot.dnssec(zone).dnskey_ttl = 2
 knot.dnssec(zone).zsk_lifetime = STARTUP + 6*TICK # see ksk1 lifetime
 knot.dnssec(zone).ksk_lifetime = 300 # this can be possibly left also infinity
 knot.dnssec(zone).propagation_delay = TICK-2
+knot.dnssec(zone).cds_publish = "none"
 knot.port = 1234 # dummy, will be overwritten
 knot.gen_confile()