Don't iterate from start every time we select new signing key

Improve the selecting of the new signing key by remembering where
we stopped the iteration and just continue from that place instead
of iterating from the start over and over again each time.

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 1a1cf00258f1965349389364353c6d2d98b0a9f0..c5c54ec4dfe70f6558cec7c174aeafdb252425ad 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
  * val->key at it.
  *
  * If val->key is non-NULL, this returns the next matching key.
+ * If val->key is already non-NULL, start searching from the next position in
+ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
+ * set val->key to that.
+ *
+ * Returns ISC_R_SUCCESS if a possible matching key has been found,
+ * ISC_R_NOTFOUND if not. Any other value indicates error.
  */
 static isc_result_t
 get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
@@ -1216,18 +1222,19 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
        isc_buffer_t b;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dst_key_t *oldkey = val->key;
-       bool foundold;
 
-       if (oldkey == NULL)
-               foundold = true;
-       else {
-               foundold = false;
+       if (oldkey == NULL) {
+               result = dns_rdataset_first(rdataset);
+       } else {
+               dst_key_free(&oldkey);
                val->key = NULL;
+               result = dns_rdataset_next(rdataset);
        }
 
-       result = dns_rdataset_first(rdataset);
-       if (result != ISC_R_SUCCESS)
+       if (result != ISC_R_SUCCESS) {
                goto failure;
+       }
+
        do {
                dns_rdataset_current(rdataset, &rdata);
 
@@ -1245,27 +1252,21 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
                                    0 &&
                            dst_key_iszonekey(val->key))
                        {
-                               if (foundold) {
-                                       /*
-                                        * This is the key we're looking for.
-                                        */
-                                       return (ISC_R_SUCCESS);
-                               } else if (dst_key_compare(oldkey, val->key)) {
-                                       foundold = true;
-                                       dst_key_free(&oldkey);
-                               }
+                               /*
+                                * This is the key we're looking for.
+                                */
+                               return (ISC_R_SUCCESS);
                        }
                        dst_key_free(&val->key);
                }
                dns_rdata_reset(&rdata);
                result = dns_rdataset_next(rdataset);
        } while (result == ISC_R_SUCCESS);
-       if (result == ISC_R_NOMORE)
-               result = ISC_R_NOTFOUND;
 
- failure:
-       if (oldkey != NULL)
-               dst_key_free(&oldkey);
+failure:
+       if (result == ISC_R_NOMORE) {
+               result = ISC_R_NOTFOUND;
+       }
 
        return (result);
 }