From: Libor Peltan <libor.peltan@nic.cz>
Date: Wed, 22 May 2019 11:51:15 +0000 (+0200)
Subject: update/dnssec: cancel-out in update's changeset while signing update
X-Git-Tag: v2.9.0~265^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=845ac32ffcd7df281606125ff93ebeab2c8418bd;p=thirdparty%2Fknot-dns.git

update/dnssec: cancel-out in update's changeset while signing update
---

diff --git a/src/knot/dnssec/zone-events.c b/src/knot/dnssec/zone-events.c
index 8f47d14a21..93a6705c1e 100644
--- a/src/knot/dnssec/zone-events.c
+++ b/src/knot/dnssec/zone-events.c
@@ -242,6 +242,8 @@ int knot_dnssec_sign_update(zone_update_t *update, zone_sign_reschedule_t *resch
 	kdnssec_ctx_t ctx = { 0 };
 	zone_keyset_t keyset = { 0 };
 
+	update->flags |= UPDATE_CANCELOUT;
+
 	// signing pipeline
 
 	result = sign_init(update->new_cont, 0, 0, update->zone->kaspdb, &ctx, reschedule);
diff --git a/src/knot/updates/zone-update.c b/src/knot/updates/zone-update.c
index 35cee77fe8..c9545393de 100644
--- a/src/knot/updates/zone-update.c
+++ b/src/knot/updates/zone-update.c
@@ -350,6 +350,15 @@ void zone_update_clear(zone_update_t *update)
 	memset(update, 0, sizeof(*update));
 }
 
+static changeset_flag_t changeset_flags(const zone_update_t *update)
+{
+	if ((update->flags & UPDATE_CANCELOUT)) {
+		return CHANGESET_CHECK | CHANGESET_CHECK_CANCELOUT;
+	} else {
+		return CHANGESET_CHECK;
+	}
+}
+
 int zone_update_add(zone_update_t *update, const knot_rrset_t *rrset)
 {
 	if (update == NULL || rrset == NULL) {
@@ -357,7 +366,7 @@ int zone_update_add(zone_update_t *update, const knot_rrset_t *rrset)
 	}
 
 	if (update->flags & UPDATE_INCREMENTAL) {
-		int ret = changeset_add_addition(&update->change, rrset, CHANGESET_CHECK);
+		int ret = changeset_add_addition(&update->change, rrset, changeset_flags(update));
 		if (ret != KNOT_EOK) {
 			return ret;
 		}
@@ -413,7 +422,7 @@ int zone_update_remove(zone_update_t *update, const knot_rrset_t *rrset)
 	}
 
 	if (update->flags & UPDATE_INCREMENTAL) {
-		int ret = changeset_add_removal(&update->change, rrset, CHANGESET_CHECK);
+		int ret = changeset_add_removal(&update->change, rrset, changeset_flags(update));
 		if (ret != KNOT_EOK) {
 			return ret;
 		}
@@ -456,7 +465,7 @@ int zone_update_remove_rrset(zone_update_t *update, knot_dname_t *owner, uint16_
 				return KNOT_ENOENT;
 			}
 			int ret = changeset_add_removal(&update->change, &rrset,
-			                                CHANGESET_CHECK);
+			                                changeset_flags(update));
 			if (ret != KNOT_EOK) {
 				return ret;
 			}
@@ -504,7 +513,7 @@ int zone_update_remove_node(zone_update_t *update, const knot_dname_t *owner)
 			for (int i = 0; i < rrset_count; ++i) {
 				knot_rrset_t rrset = node_rrset_at(node, rrset_count - 1 - i);
 				int ret = changeset_add_removal(&update->change, &rrset,
-				                                CHANGESET_CHECK);
+				                                changeset_flags(update));
 				if (ret != KNOT_EOK) {
 					return ret;
 				}
diff --git a/src/knot/updates/zone-update.h b/src/knot/updates/zone-update.h
index a22e98959b..9f68011992 100644
--- a/src/knot/updates/zone-update.h
+++ b/src/knot/updates/zone-update.h
@@ -47,6 +47,7 @@ typedef enum {
 	UPDATE_SIGN           = 1 << 2, /*!< Sign the resulting zone. */
 	UPDATE_JOURNAL        = 1 << 3, /*!< Using zone-in-journal for a diff update. */
 	UPDATE_STRICT         = 1 << 4, /*!< Apply changes strictly, i.e. fail when removing nonexistent RR. */
+	UPDATE_CANCELOUT      = 1 << 5, /*!< When adding to changeset, cancel-out what has been both added and removed. */
 } zone_update_flags_t;
 
 /*!