From: Wouter Wijngaards <wouter@nlnetlabs.nl>
Date: Tue, 28 Aug 2007 14:13:32 +0000 (+0000)
Subject: Small speedup.
X-Git-Tag: release-0.5~83
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d832f5dca563307a9c5c1ed51ec8c3883dddb0d;p=thirdparty%2Funbound.git

Small speedup.


git-svn-id: file:///svn/unbound/trunk@558 be551aaa-1e26-0410-a405-d3ace91eadb9
---

diff --git a/doc/Changelog b/doc/Changelog
index 1e4ce025b..3d0d1322b 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -14,6 +14,7 @@
 	  the same signature.
 	- if the rrset is too big (64k exactly + large owner name) the
 	  canonicalization routine will fail if it does not fit in buffer.
+	- faster verification for large sigsets.
 
 27 August 2007: Wouter
 	- do not garble the edns if a cache answer fails.
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index b28578b97..6682af780 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -423,6 +423,8 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
 	size_t i, num;
 	rbtree_t* sortree = NULL;
 	int buf_canon = 0;
+	uint16_t tag = dnskey_calc_keytag(dnskey, dnskey_idx);
+	int algo = dnskey_get_algo(dnskey, dnskey_idx);
 
 	num = rrset_get_sigcount(rrset);
 	if(num == 0) {
@@ -431,6 +433,10 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
 		return sec_status_bogus;
 	}
 	for(i=0; i<num; i++) {
+		/* see if sig matches keytag and algo */
+		if(algo != rrset_get_sig_algo(rrset, i) ||
+			tag != rrset_get_sig_keytag(rrset, i))
+			continue;
 		buf_canon = 0;
 		sec = dnskey_verify_rrset_sig(env->scratch, 
 			env->scratch_buffer, ve, rrset, dnskey, dnskey_idx, i,