From: Libor Peltan Date: Wed, 19 Sep 2018 13:41:31 +0000 (+0200) Subject: Revert "offline KSK: feat - sending and signing also CDNSKEY and CDS" X-Git-Tag: v2.8.0~183^2~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b6079c1223de06f65e75735d30c8c7e19afe68fb;p=thirdparty%2Fknot-dns.git Revert "offline KSK: feat - sending and signing also CDNSKEY and CDS" This reverts commit 7faf3eafec6774d920e2e87853fc362ed21ada74. --- diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c index f618e68993..3e2095a292 100644 --- a/src/knot/dnssec/zone-sign.c +++ b/src/knot/dnssec/zone-sign.c @@ -279,18 +279,7 @@ static int remove_expired_rrsigs(const knot_rrset_t *covered, static bool can_have_offline_rrsig(const knot_rrset_t *rr, const knot_dname_t *zone_apex) { - if (knot_dname_cmp(rr->owner, zone_apex) != 0) { - return false; - } - - switch (rr->type) { - case KNOT_RRTYPE_DNSKEY: - case KNOT_RRTYPE_CDNSKEY: - case KNOT_RRTYPE_CDS: - return true; - default: - return false; - } + return (rr->type == KNOT_RRTYPE_DNSKEY && knot_dname_cmp(rr->owner, zone_apex) == 0); } static int load_offline_rrsig(const knot_rrset_t *covered, @@ -357,17 +346,13 @@ static int add_missing_rrsigs(const knot_rrset_t *covered, uint16_t at_offline; if (valid_signature_exists(covered, &offline_rrsigs, key->key, key->ctx, dnssec_ctx, &at_offline)) { - log_zone_info(dnssec_ctx->zone->dname, "DNSSEC, using offline %s RRSIG", - knot_get_rdata_descriptor(covered->type)->type_name); + log_zone_info(dnssec_ctx->zone->dname, "DNSSEC, using offline DNSKEY RRSIG"); knot_rdata_t *offline_rd = knot_rdataset_at(&offline_rrsigs.rrs, at_offline); result = knot_rrset_add_rdata(&to_add, offline_rd->data, offline_rd->len, NULL); if (result != KNOT_EOK) { break; } continue; - } else if (!knot_rrset_empty(&offline_rrsigs)) { - log_zone_warning(dnssec_ctx->zone->dname, "DNSSEC, loaded offline %s RRSIGs but not usable for signing by %hu", - knot_get_rdata_descriptor(covered->type)->type_name, dnssec_key_get_keytag(key->key)); } result = knot_sign_rrset(&to_add, covered, key->key, key->ctx, @@ -657,7 +642,7 @@ int rrset_add_zone_key(knot_rrset_t *rrset, zone_key_t *zone_key) return knot_rrset_add_rdata(rrset, dnskey_rdata.data, dnskey_rdata.size, NULL); } -int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key) +static int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key) { assert(rrset); assert(zone_key); diff --git a/src/knot/dnssec/zone-sign.h b/src/knot/dnssec/zone-sign.h index 6853046f1a..7f833daef2 100644 --- a/src/knot/dnssec/zone-sign.h +++ b/src/knot/dnssec/zone-sign.h @@ -23,7 +23,6 @@ #include "knot/dnssec/zone-keys.h" int rrset_add_zone_key(knot_rrset_t *rrset, zone_key_t *zone_key); -int rrset_add_zone_ds(knot_rrset_t *rrset, zone_key_t *zone_key); /*! * \brief Adds/removes DNSKEY (and CDNSKEY, CDS) records to zone according to zone keyset. diff --git a/src/utils/keymgr/offline_ksk.c b/src/utils/keymgr/offline_ksk.c index 525e112538..d9d0b1fc85 100644 --- a/src/utils/keymgr/offline_ksk.c +++ b/src/utils/keymgr/offline_ksk.c @@ -69,56 +69,40 @@ static void next_resign(knot_time_t *next, kdnssec_ctx_t *ctx) } // please free *_dnskey and keyset even if returned error -static int load_dnskey_rrset(kdnssec_ctx_t *ctx, knot_rrset_t **_dnskey, - knot_rrset_t **_cdnskey, knot_rrset_t **_cds, zone_keyset_t *keyset) +static int load_dnskey_rrset(kdnssec_ctx_t *ctx, knot_rrset_t **_dnskey, zone_keyset_t *keyset) { - keyptr_dynarray_t ckeys = { 0 }; - // prepare the DNSKEY rrset to be signed knot_rrset_t *dnskey = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_DNSKEY, KNOT_CLASS_IN, ctx->policy->dnskey_ttl, NULL); - *_dnskey = dnskey; if (dnskey == NULL) { return KNOT_ENOMEM; } - knot_rrset_t *cdnskey = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_CDNSKEY, KNOT_CLASS_IN, 0, NULL); - *_cdnskey = cdnskey; - if (cdnskey == NULL) { - return KNOT_ENOMEM; - } - knot_rrset_t *cds = knot_rrset_new(ctx->zone->dname, KNOT_RRTYPE_CDS, KNOT_CLASS_IN, 0, NULL); - *_cds = cds; - if (cds == NULL) { - return KNOT_ENOMEM; - } int ret = load_zone_keys(ctx, keyset, false); - - ckeys = knot_zone_sign_get_cdnskeys(ctx, keyset); - dynarray_foreach(keyptr, zone_key_t *, ksk_for_cds, ckeys) { - if (ret == KNOT_EOK) { - ret = rrset_add_zone_key(cdnskey, *ksk_for_cds); - } - if (ret == KNOT_EOK) { - ret = rrset_add_zone_ds(cds, *ksk_for_cds); - } + if (ret != KNOT_EOK) { + printf("load keys failed\n"); + return ret; } - for (int i = 0; i < keyset->count && ret == KNOT_EOK; i++) { + for (int i = 0; i < keyset->count; i++) { zone_key_t *key = &keyset->keys[i]; if (key->is_public) { ret = rrset_add_zone_key(dnskey, key); + if (ret != KNOT_EOK) { + printf("add zone key failed\n"); + return ret; + } } } - keyptr_dynarray_free(&ckeys); - return ret; + *_dnskey = dnskey; + return KNOT_EOK; } static int presign_once(kdnssec_ctx_t *ctx) { - knot_rrset_t *dnskey = NULL, *cdnskey = NULL, *cds = NULL, *rrsig = NULL; + knot_rrset_t *dnskey = NULL, *rrsig = NULL; zone_keyset_t keyset = { 0 }; - int ret = load_dnskey_rrset(ctx, &dnskey, &cdnskey, &cds, &keyset); + int ret = load_dnskey_rrset(ctx, &dnskey, &keyset); if (ret != KNOT_EOK) { goto done; } @@ -133,21 +117,13 @@ static int presign_once(kdnssec_ctx_t *ctx) for (int i = 0; i < keyset.count; i++) { zone_key_t *key = &keyset.keys[i]; if (key->is_active && key->is_ksk) { - if (ret == KNOT_EOK) { - ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL); - } - if (ret == KNOT_EOK && !knot_rrset_empty(cdnskey)) { - ret = knot_sign_rrset(rrsig, cdnskey, key->key, key->ctx, ctx, NULL); - } - if (ret == KNOT_EOK && !knot_rrset_empty(cds)) { - ret = knot_sign_rrset(rrsig, cds, key->key, key->ctx, ctx, NULL); + ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL); + if (ret != KNOT_EOK) { + printf("sign rrset failed\n"); + goto done; } } } - if (ret != KNOT_EOK) { - printf("sign rrset failed\n"); - goto done; - } // store it to KASP db assert(!knot_rrset_empty(rrsig)); @@ -159,8 +135,6 @@ static int presign_once(kdnssec_ctx_t *ctx) done: knot_rrset_free(dnskey, NULL); - knot_rrset_free(cdnskey, NULL); - knot_rrset_free(cds, NULL); knot_rrset_free(rrsig, NULL); free_zone_keys(&keyset); return ret; @@ -255,24 +229,16 @@ static void print_generated_message() static int ksr_once(kdnssec_ctx_t *ctx, char **buf, size_t *buf_size) { - knot_rrset_t *dnskey = NULL, *cdnskey = NULL, *cds = NULL; + knot_rrset_t *dnskey = NULL; zone_keyset_t keyset = { 0 }; - int ret = load_dnskey_rrset(ctx, &dnskey, &cdnskey, &cds, &keyset); + int ret = load_dnskey_rrset(ctx, &dnskey, &keyset); if (ret != KNOT_EOK) { goto done; } - ret = dump_rrset_to_buf(cdnskey, buf, buf_size); - if (ret >= 0) { - printf(";;KSR =================\n%s", *buf); - } - ret = dump_rrset_to_buf(cds, buf, buf_size); - if (ret >= 0) { - printf("%s", *buf); - } ret = dump_rrset_to_buf(dnskey, buf, buf_size); if (ret >= 0) { (*buf)[strlen(*buf) - 1] = '\0'; // remove trailing newline - printf("%s ; end KSR %lu\n", *buf, ctx->now); + printf(";;KSR %lu %hu %d\n%s ; end KSR %lu\n", ctx->now, dnskey->rrs.count, ret, *buf, ctx->now); ret = KNOT_EOK; } @@ -303,12 +269,10 @@ int keymgr_print_ksr(kdnssec_ctx_t *ctx, knot_time_t upto) typedef struct { knot_rrset_t *rr; - knot_rrset_t *cdnskey; - knot_rrset_t *cds; kdnssec_ctx_t *kctx; } ksr_sign_ctx_t; -static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey, knot_rrset_t *cdnskey, knot_rrset_t *cds) +static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey) { zone_keyset_t keyset = { 0 }; char *buf = NULL; @@ -323,22 +287,15 @@ static int ksr_sign_dnskey(kdnssec_ctx_t *ctx, knot_rrset_t *dnskey, knot_rrset_ goto done; } // no check if the KSK used for signing (in keyset) is contained in DNSKEY record being signed (in KSR) ! - for (int i = 0; i < keyset.count && ret == KNOT_EOK; i++) { + for (int i = 0; i < keyset.count; i++) { zone_key_t *key = &keyset.keys[i]; if (key->is_active && key->is_ksk) { ret = knot_sign_rrset(rrsig, dnskey, key->key, key->ctx, ctx, NULL); - if (ret == KNOT_EOK && !knot_rrset_empty(cdnskey)) { - ret = knot_sign_rrset(rrsig, cdnskey, key->key, key->ctx, ctx, NULL); - } - if (ret == KNOT_EOK && !knot_rrset_empty(cds)) { - ret = knot_sign_rrset(rrsig, cds, key->key, key->ctx, ctx, NULL); + if (ret != KNOT_EOK) { + goto done; } } } - if (ret != KNOT_EOK) { - goto done; - } - ret = dump_rrset_to_buf(rrsig, &buf, &buf_size); if (ret >= 0) { buf[strlen(buf) - 1] = '\0'; // remove trailing newline @@ -356,31 +313,14 @@ done: static void ksr_sign_once(zs_scanner_t *sc) { ksr_sign_ctx_t *ctx = sc->process.data; - knot_rrset_t *rr_add = NULL; - switch (sc->r_type) { - case KNOT_RRTYPE_DNSKEY: - rr_add = ctx->rr; - break; - case KNOT_RRTYPE_CDNSKEY: - rr_add = ctx->cdnskey; - break; - case KNOT_RRTYPE_CDS: - rr_add = ctx->cds; - break; - default: - sc->error.code = KNOT_ESEMCHECK; - return; - } - sc->error.code = knot_rrset_add_rdata(rr_add, sc->r_data, sc->r_data_length, NULL); + sc->error.code = knot_rrset_add_rdata(ctx->rr, sc->r_data, sc->r_data_length, NULL); ctx->rr->ttl = sc->r_ttl; if (sc->error.code == KNOT_EOK && sc->buffer_length > 9 && strncmp((const char *)sc->buffer, " end KSR ", 9) == 0) { ctx->kctx->now = atol((const char *)sc->buffer + 9); - sc->error.code = ksr_sign_dnskey(ctx->kctx, ctx->rr, ctx->cdnskey, ctx->cds); + sc->error.code = ksr_sign_dnskey(ctx->kctx, ctx->rr); knot_rdataset_clear(&ctx->rr->rrs, NULL); - knot_rdataset_clear(&ctx->cdnskey->rrs, NULL); - knot_rdataset_clear(&ctx->cds->rrs, NULL); } } @@ -412,12 +352,10 @@ static int read_ksr_skr(kdnssec_ctx_t *ctx, const char *infile, void (*cb)(zs_sc return KNOT_EFILE; } - knot_rrset_t rr = { 0 }, cdnskey = { 0 }, cds = { 0}; + knot_rrset_t rr = { 0 }; knot_rrset_init(&rr, ctx->zone->dname, rrtype, KNOT_CLASS_IN, ctx->policy->dnskey_ttl); - knot_rrset_init(&cdnskey, ctx->zone->dname, KNOT_RRTYPE_CDNSKEY, KNOT_CLASS_IN, 0); - knot_rrset_init(&cds, ctx->zone->dname, KNOT_RRTYPE_CDS, KNOT_CLASS_IN, 0); - ksr_sign_ctx_t pctx = { &rr, &cdnskey, &cds, ctx }; + ksr_sign_ctx_t pctx = { &rr, ctx }; ret = zs_set_processing(&sc, cb, NULL, &pctx); if (ret < 0) { zs_deinit(&sc); @@ -432,8 +370,6 @@ static int read_ksr_skr(kdnssec_ctx_t *ctx, const char *infile, void (*cb)(zs_sc ret = KNOT_EMALF; } knot_rdataset_clear(&rr.rrs, NULL); - knot_rdataset_clear(&cdnskey.rrs, NULL); - knot_rdataset_clear(&cds.rrs, NULL); zs_deinit(&sc); return ret; } diff --git a/tests-extra/tests/dnssec/offline_ksk2/test.py b/tests-extra/tests/dnssec/offline_ksk2/test.py index 335935abec..a03043bed2 100644 --- a/tests-extra/tests/dnssec/offline_ksk2/test.py +++ b/tests-extra/tests/dnssec/offline_ksk2/test.py @@ -94,6 +94,7 @@ knot.dnssec(zone).dnskey_ttl = 2 knot.dnssec(zone).zsk_lifetime = STARTUP + 6*TICK # see ksk1 lifetime knot.dnssec(zone).ksk_lifetime = 300 # this can be possibly left also infinity knot.dnssec(zone).propagation_delay = TICK-2 +knot.dnssec(zone).cds_publish = "none" knot.port = 1234 # dummy, will be overwritten knot.gen_confile()