From: Libor Peltan <libcha.p@gmail.com>
Date: Sun, 16 Sep 2018 06:20:48 +0000 (+0200)
Subject: dnssec: separated function for determining cdnskeys
X-Git-Tag: v2.8.0~183^2~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93a112a5ff5a6794eb2bb18cb836f39590a0fb0b;p=thirdparty%2Fknot-dns.git

dnssec: separated function for determining cdnskeys
---

diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index 4153407e36..4e17274145 100644
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -857,6 +857,39 @@ int knot_zone_sign(zone_update_t *update,
 	return result;
 }
 
+keyptr_dynarray_t knot_zone_sign_get_cdnskeys(const kdnssec_ctx_t *ctx,
+					      zone_keyset_t *zone_keys)
+{
+	keyptr_dynarray_t r = { 0 };
+	zone_key_t *ksk_for_cds = NULL;
+	unsigned crp = ctx->policy->child_records_publish;
+	int kfc_prio = (crp == CHILD_RECORDS_ALWAYS ? 0 : (crp == CHILD_RECORDS_ROLLOVER ? 1 : 2));
+
+	for (int i = 0; i < zone_keys->count; i++) {
+		zone_key_t *key = &zone_keys->keys[i];
+		// determine which key (if any) will be the one for CDS/CDNSKEY
+		if (key->is_ksk && key->cds_priority > kfc_prio) {
+			ksk_for_cds = key;
+			kfc_prio = key->cds_priority;
+		}
+	}
+
+	for (int i = 0; i < zone_keys->count; i++) {
+		zone_key_t *key = &zone_keys->keys[i];
+		// determine which key (if any) will be the one for CDS/CDNSKEY
+		if (key->is_ksk && key->cds_priority > kfc_prio) {
+			ksk_for_cds = key;
+			kfc_prio = key->cds_priority;
+		}
+	}
+
+	if (ksk_for_cds != NULL) {
+		keyptr_dynarray_add(&r, &ksk_for_cds);
+	}
+
+	return r;
+}
+
 int knot_zone_sign_update_dnskeys(zone_update_t *update,
                                   zone_keyset_t *zone_keys,
                                   const kdnssec_ctx_t *dnssec_ctx)
@@ -872,6 +905,7 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
 	knot_rrset_t *add_dnskeys = NULL;
 	knot_rrset_t *add_cdnskeys = NULL;
 	knot_rrset_t *add_cdss = NULL;
+	keyptr_dynarray_t kcdnskeys = { 0 };
 	uint32_t dnskey_ttl = dnssec_ctx->policy->dnskey_ttl;
 	knot_rrset_t soa = node_rrset(apex, KNOT_RRTYPE_SOA);
 	if (knot_rrset_empty(&soa)) {
@@ -905,31 +939,23 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
 		ret = KNOT_ENOMEM;
 		CHECK_RET;
 	}
-	zone_key_t *ksk_for_cds = NULL;
-	unsigned crp = dnssec_ctx->policy->child_records_publish;
-	int kfc_prio = (crp == CHILD_RECORDS_ALWAYS ? 0 : (crp == CHILD_RECORDS_ROLLOVER ? 1 : 2));
 	for (int i = 0; i < zone_keys->count; i++) {
 		zone_key_t *key = &zone_keys->keys[i];
 		if (key->is_public) {
 			ret = rrset_add_zone_key(add_dnskeys, key);
 			CHECK_RET;
 		}
-
-		// determine which key (if any) will be the one for CDS/CDNSKEY
-		if (key->is_ksk && key->cds_priority > kfc_prio) {
-			ksk_for_cds = key;
-			kfc_prio = key->cds_priority;
-		}
 	}
 
-	if (ksk_for_cds != NULL) {
-		ret = rrset_add_zone_key(add_cdnskeys, ksk_for_cds);
+	kcdnskeys = knot_zone_sign_get_cdnskeys(dnssec_ctx, zone_keys);
+	dynarray_foreach(keyptr, zone_key_t *, ksk_for_cds, kcdnskeys) {
+		ret = rrset_add_zone_key(add_cdnskeys, *ksk_for_cds);
 		CHECK_RET;
-		ret = rrset_add_zone_ds(add_cdss, ksk_for_cds);
+		ret = rrset_add_zone_ds(add_cdss, *ksk_for_cds);
 		CHECK_RET;
 	}
 
-	if (crp == CHILD_RECORDS_EMPTY) {
+	if (dnssec_ctx->policy->child_records_publish == CHILD_RECORDS_EMPTY) {
 		const uint8_t cdnskey_empty[5] = { 0, 0, 3, 0, 0 };
 		const uint8_t cds_empty[5] = { 0, 0, 0, 0, 0 };
 		ret = knot_rrset_add_rdata(add_cdnskeys, cdnskey_empty,
@@ -963,6 +989,7 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
 #undef CHECK_RET
 
 cleanup:
+	keyptr_dynarray_free(&kcdnskeys);
 	knot_rrset_free(add_dnskeys, NULL);
 	knot_rrset_free(add_cdnskeys, NULL);
 	knot_rrset_free(add_cdss, NULL);
diff --git a/src/knot/dnssec/zone-sign.h b/src/knot/dnssec/zone-sign.h
index 22b4e6482e..8796c4d537 100644
--- a/src/knot/dnssec/zone-sign.h
+++ b/src/knot/dnssec/zone-sign.h
@@ -45,6 +45,17 @@ int knot_zone_sign_update_dnskeys(zone_update_t *update,
  */
 bool knot_zone_sign_use_key(const zone_key_t *key, const knot_rrset_t *covered);
 
+/*!
+ * \brief Return those keys for whose the CDNSKEY/CDS records shall be created.
+ *
+ * \param ctx        DNSSEC context.
+ * \param zone_keys  Zone keyset, includeing ZSKs.
+ *
+ * \return Dynarray containing pointers on some KSKs in keyset.
+ */
+keyptr_dynarray_t knot_zone_sign_get_cdnskeys(const kdnssec_ctx_t *ctx,
+					      zone_keyset_t *zone_keys);
+
 /*!
  * \brief Update zone signatures and store performed changes in update.
  *