nsec3: cleanup code before re-designing it

diff --git a/src/knot/dnssec/nsec3-chain.c b/src/knot/dnssec/nsec3-chain.c
index 0e0063384781a87a489be81c57a72df48b29ef01..700bc710f94e293b90ad6eaba8870b18bd8354aa 100644 (file)
--- a/src/knot/dnssec/nsec3-chain.c
+++ b/src/knot/dnssec/nsec3-chain.c
@@ -441,10 +441,6 @@ static int connect_nsec3_nodes2(zone_node_t *a, zone_node_t *b,
 
        // check if the NSEC3 rrset has not been updated in changeset
        knot_rrset_t aorig = node_rrset(a, KNOT_RRTYPE_NSEC3);
-       const zone_node_t *ch_a = zone_contents_find_nsec3_node(data->changeset->add, a->owner);
-       if (node_rrtype_exists(ch_a, KNOT_RRTYPE_NSEC3)) {
-               aorig = node_rrset(ch_a, KNOT_RRTYPE_NSEC3);
-       }
 
        // prepare a copy of NSEC3 rrsets in question
        knot_rrset_t *acopy = knot_rrset_copy(&aorig, NULL);
@@ -460,9 +456,7 @@ static int connect_nsec3_nodes2(zone_node_t *a, zone_node_t *b,
        }
 
        // add the removed original and the updated copy to changeset
-       if (node_rrtype_exists(ch_a, KNOT_RRTYPE_NSEC3)) {
-               ret = changeset_remove_addition(data->changeset, &aorig);
-       } else {
+       if (1) {
                ret = changeset_add_removal(data->changeset, &aorig, 0);
        }
        if (ret == KNOT_EOK) {
@@ -553,7 +547,7 @@ static int create_nsec3_nodes(const zone_contents_t *zone,
  * \return KNOT_EOK, KNOT_E* if any error.
  */
 static int fix_nsec3_for_node(zone_update_t *update, const dnssec_nsec3_params_t *params,
-                              uint32_t ttl, bool opt_out, changeset_t *chgset, const knot_dname_t *for_node)
+                              uint32_t ttl, bool opt_out, const knot_dname_t *for_node)
 {
        // check if we need to do something
        const zone_node_t *old_n = zone_contents_find_node(update->zone->contents, for_node);
@@ -588,16 +582,11 @@ static int fix_nsec3_for_node(zone_update_t *update, const dnssec_nsec3_params_t
                knot_rrset_t rem_nsec3 = node_rrset(old_nsec3_n, KNOT_RRTYPE_NSEC3);
                if (!knot_rrset_empty(&rem_nsec3)) {
                        knot_rrset_t rem_rrsig = node_rrset(old_nsec3_n, KNOT_RRTYPE_RRSIG);
-                       if (!add_nsec3) {
+                       if (1) {
                                ret = zone_update_remove(update, &rem_nsec3);
                                if (ret == KNOT_EOK && !knot_rrset_empty(&rem_rrsig)) {
                                        ret = zone_update_remove(update, &rem_rrsig);
                                }
-                       } else {
-                               ret = changeset_add_removal(chgset, &rem_nsec3, CHANGESET_CHECK | CHANGESET_CHECK_CANCELOUT);
-                               if (ret == KNOT_EOK && !knot_rrset_empty(&rem_rrsig)) {
-                                       ret = changeset_add_removal(chgset, &rem_rrsig, 0);
-                               }
                        }
                        next_hash = (uint8_t *)knot_nsec3_next(rem_nsec3.rrs.rdata);
                        next_length = knot_nsec3_next_len(rem_nsec3.rrs.rdata);
@@ -625,10 +614,8 @@ static int fix_nsec3_for_node(zone_update_t *update, const dnssec_nsec3_params_t
                        }
                }
                if (ret == KNOT_EOK) {
-                       if (next_hash == NULL) {
+                       if (1) {
                                ret = zone_update_add(update, &nsec3);
-                       } else {
-                               ret = changeset_add_addition(chgset, &nsec3, CHANGESET_CHECK | CHANGESET_CHECK_CANCELOUT);
                        }
                }
                binode_unify(new_nsec3_n, false, NULL);
@@ -640,7 +627,7 @@ static int fix_nsec3_for_node(zone_update_t *update, const dnssec_nsec3_params_t
 }
 
 static int fix_nsec3_nodes(zone_update_t *update, const dnssec_nsec3_params_t *params,
-                           uint32_t ttl, bool opt_out, changeset_t *chgset)
+                           uint32_t ttl, bool opt_out)
 {
        assert(update);
 
@@ -649,7 +636,7 @@ static int fix_nsec3_nodes(zone_update_t *update, const dnssec_nsec3_params_t *p
 
        while (!zone_tree_it_finished(&it) && ret == KNOT_EOK) {
                zone_node_t *n = zone_tree_it_val(&it);
-               ret = fix_nsec3_for_node(update, params, ttl, opt_out, chgset, n->owner);
+               ret = fix_nsec3_for_node(update, params, ttl, opt_out, n->owner);
                zone_tree_it_next(&it);
        }
 
@@ -660,9 +647,7 @@ static int fix_nsec3_nodes(zone_update_t *update, const dnssec_nsec3_params_t *p
 
        while (!zone_tree_it_finished(&it) && ret == KNOT_EOK) {
                zone_node_t *n = zone_tree_it_val(&it);
-               if (zone_tree_get(update->change.remove->nodes, n->owner) == NULL) {
-                       ret = fix_nsec3_for_node(update, params, ttl, opt_out, chgset, n->owner);
-               }
+               ret = fix_nsec3_for_node(update, params, ttl, opt_out, n->owner);
                zone_tree_it_next(&it);
        }
        zone_tree_it_free(&it);
@@ -811,7 +796,7 @@ int knot_nsec3_fix_chain(zone_update_t *update,
                          changeset_t *changeset)
 {
 
-       int ret = fix_nsec3_nodes(update, params, ttl, opt_out, changeset);
+       int ret = fix_nsec3_nodes(update, params, ttl, opt_out);
        if (ret != KNOT_EOK) {
                return ret;
        }

diff --git a/src/knot/dnssec/zone-nsec.c b/src/knot/dnssec/zone-nsec.c
index 47a681f78da74507b50a90051249070f089bfd6b..2c7212d6c4f3303c750a493fd114fc930ae3acb4 100644 (file)
--- a/src/knot/dnssec/zone-nsec.c
+++ b/src/knot/dnssec/zone-nsec.c
@@ -374,8 +374,7 @@ int knot_zone_fix_nsec_chain(zone_update_t *update,
                goto cleanup;
        }
 
-       ret = knot_zone_sign_nsecs_in_changeset(zone_keys, ctx, &ch);
-       if (ret == KNOT_EOK) {
+       if (1) {
                // Disable strict changeset application momentarily for the NSEC chain fix.
                // This is important for NSEC3, since some nodes are removed from contents
                // when fixing individual NSEC3 nodes and then the NSEC3 records from these nodes
@@ -385,6 +384,17 @@ int knot_zone_fix_nsec_chain(zone_update_t *update,
                ret = zone_update_apply_changeset(update, &ch);
                update->a_ctx->flags |= APPLY_STRICT;
        }
+       if (ret == KNOT_EOK) {
+               changeset_t ch2;
+               ret = changeset_init(&ch2, update->new_cont->apex->owner);
+               if (ret == KNOT_EOK) {
+                       ret = knot_zone_sign_nsecs_in_changeset(zone_keys, ctx, &update->change, &ch2);
+               }
+               if (ret == KNOT_EOK) {
+                       ret = zone_update_apply_changeset(update, &ch2);
+               }
+               changeset_clear(&ch2);
+       }
 
 cleanup:
        changeset_clear(&ch);

diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index 371562598cef05935841bbc00a9b0a25ba3a50a9..453f7e53693130bf7902afd5676d859a3019a1f5 100644 (file)
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -1018,7 +1018,7 @@ static int sign_changeset(const zone_contents_t *zone,
 
 int knot_zone_sign_nsecs_in_changeset(const zone_keyset_t *zone_keys,
                                       const kdnssec_ctx_t *dnssec_ctx,
-                                      changeset_t *changeset)
+                                      changeset_t *changeset, changeset_t *ch_out)
 {
        if (zone_keys == NULL || dnssec_ctx == NULL || changeset == NULL) {
                return KNOT_EINVAL;
@@ -1038,7 +1038,7 @@ int knot_zone_sign_nsecs_in_changeset(const zone_keyset_t *zone_keys,
                    rr.type == KNOT_RRTYPE_NSEC3 ||
                    rr.type == KNOT_RRTYPE_NSEC3PARAM) {
                        int ret =  add_missing_rrsigs(&rr, NULL, sign_ctx,
-                                                     changeset, NULL);
+                                                     ch_out, NULL);
                        if (ret != KNOT_EOK) {
                                changeset_iter_clear(&itt);
                                return ret;

diff --git a/src/knot/dnssec/zone-sign.h b/src/knot/dnssec/zone-sign.h
index 08d94443fb2050168178a93dca7339409358317b..470b4c250a2ce32ee7caa06186443e1412b18225 100644 (file)
--- a/src/knot/dnssec/zone-sign.h
+++ b/src/knot/dnssec/zone-sign.h
@@ -112,7 +112,7 @@ bool knot_zone_sign_soa_expired(const zone_contents_t *zone,
  */
 int knot_zone_sign_nsecs_in_changeset(const zone_keyset_t *zone_keys,
                                       const kdnssec_ctx_t *dnssec_ctx,
-                                      changeset_t *changeset);
+                                      changeset_t *changeset, changeset_t *ch_out);
 
 /*!
  * \brief Checks whether RRSet in a node has to be signed. Will not return