Tiny refactor revoked key check

This makes the code flow a bit more readable.

diff --git a/lib/dns/update.c b/lib/dns/update.c
index 6063a50199da1b6b29344b30137a37aa96a7d6cc..6d7e563c0f52ceac740b639b60a27d35c72b9cb5 100644 (file)
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1160,17 +1160,6 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        continue;
                }
 
-               if (!REVOKE(keys[i])) {
-                       /*
-                        * Don't consider inactive keys, however the KSK may be
-                        * temporary offline, so do consider KSKs which private
-                        * key files are unavailable.
-                        */
-                       both = dst_key_have_ksk_and_zsk(
-                               keys, nkeys, i, false, KSK(keys[i]),
-                               !KSK(keys[i]), NULL, NULL);
-               }
-
                if (use_kasp) {
                        /*
                         * A dnssec-policy is found. Check what RRsets this
@@ -1216,26 +1205,34 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                                 */
                                continue;
                        }
-
-                       /*
-                        * If this key is revoked, it may only sign the
-                        * DNSKEY RRset.
-                        */
-                       if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
-                               continue;
-                       }
-               } else if (both) {
+               } else if (!REVOKE(keys[i])) {
                        /*
-                        * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
+                        * Don't consider inactive keys, however the KSK may be
+                        * temporary offline, so do consider KSKs which private
+                        * key files are unavailable.
                         */
-                       if (dns_rdatatype_iskeymaterial(type)) {
-                               if (!KSK(keys[i])) {
+                       both = dst_key_have_ksk_and_zsk(
+                               keys, nkeys, i, false, KSK(keys[i]),
+                               !KSK(keys[i]), NULL, NULL);
+                       if (both) {
+                               /*
+                                * CDS and CDNSKEY are signed with KSK (RFC
+                                * 7344, 4.1).
+                                */
+                               if (dns_rdatatype_iskeymaterial(type)) {
+                                       if (!KSK(keys[i])) {
+                                               continue;
+                                       }
+                               } else if (KSK(keys[i])) {
                                        continue;
                                }
-                       } else if (KSK(keys[i])) {
-                               continue;
                        }
-               } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
+               }
+
+               /*
+                * If this key is revoked, it may only sign the DNSKEY RRset.
+                */
+               if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
                        continue;
                }
 

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 4b07ae669924868b62dd08b44110fd6e15a5981f..5f284829d038abac15644d04e5f93b18a2fc98d2 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6596,16 +6596,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
                        continue;
                }
 
-               if (!REVOKE(keys[i])) {
-                       /*
-                        * Don't consider inactive keys, however the KSK may be
-                        * temporary offline, so do consider keys which private
-                        * key files are unavailable.
-                        */
-                       both = dst_key_have_ksk_and_zsk(
-                               keys, nkeys, i, false, KSK(keys[i]),
-                               !KSK(keys[i]), NULL, NULL);
-               }
                if (use_kasp) {
                        /*
                         * A dnssec-policy is found. Check what RRsets this
@@ -6665,26 +6655,34 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
                                 */
                                continue;
                        }
-
-                       /*
-                        * If this key is revoked, it may only sign the
-                        * DNSKEY RRset.
-                        */
-                       if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
-                               continue;
-                       }
-               } else if (both) {
+               } else if (!REVOKE(keys[i])) {
                        /*
-                        * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
+                        * Don't consider inactive keys, however the KSK may be
+                        * temporary offline, so do consider keys which private
+                        * key files are unavailable.
                         */
-                       if (dns_rdatatype_iskeymaterial(type)) {
-                               if (!KSK(keys[i])) {
+                       bool both = dst_key_have_ksk_and_zsk(
+                               keys, nkeys, i, false, KSK(keys[i]),
+                               !KSK(keys[i]), NULL, NULL);
+                       if (both) {
+                               /*
+                                * CDS and CDNSKEY are signed with KSK (RFC
+                                * 7344, 4.1).
+                                */
+                               if (dns_rdatatype_iskeymaterial(type)) {
+                                       if (!KSK(keys[i])) {
+                                               continue;
+                                       }
+                               } else if (KSK(keys[i])) {
                                        continue;
                                }
-                       } else if (KSK(keys[i])) {
-                               continue;
                        }
-               } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
+               }
+
+               /*
+                * If this key is revoked, it may only sign the DNSKEY RRset.
+                */
+               if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
                        continue;
                }
 
@@ -9279,17 +9277,6 @@ zone_sign(dns_zone_t *zone) {
                        /*
                         * We do KSK processing.
                         */
-                       if (!REVOKE(zone_keys[i])) {
-                               /*
-                                * Don't consider inactive keys, however the key
-                                * may be temporary offline, so do consider KSKs
-                                * which private key files are unavailable.
-                                */
-                               both = dst_key_have_ksk_and_zsk(
-                                       zone_keys, nkeys, i, false,
-                                       KSK(zone_keys[i]), !KSK(zone_keys[i]),
-                                       NULL, NULL);
-                       }
                        if (use_kasp) {
                                /*
                                 * A dnssec-policy is found. Check what