Optimize selecting the signing key

Don't parse the crypto data before parsing and matching the id and the
algorithm.

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 9b7a90637ef6635bfa11d45bf76a4c367e3c7c86..b3b8be279c56bd71465b77d1e36f4521042bc39e 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -105,6 +105,7 @@ static isc_result_t frombuffer(dns_name_t *name,
                                   dns_rdataclass_t rdclass,
                                   isc_buffer_t *source,
                                   isc_mem_t *mctx,
+                                  bool no_rdata,
                                   dst_key_t **keyp);
 
 static isc_result_t    algorithm_status(unsigned int alg);
@@ -741,6 +742,13 @@ isc_result_t
 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
                isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
 {
+       return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
+}
+
+isc_result_t
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
+                  isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
+                  dst_key_t **keyp) {
        uint8_t alg, proto;
        uint32_t flags, extflags;
        dst_key_t *key = NULL;
@@ -769,7 +777,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
        }
 
        result = frombuffer(name, alg, flags, proto, rdclass, source,
-                           mctx, &key);
+                           mctx, no_rdata, &key);
        if (result != ISC_R_SUCCESS)
                return (result);
        key->key_id = id;
@@ -791,7 +799,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
        REQUIRE(dst_initialized);
 
        result = frombuffer(name, alg, flags, protocol, rdclass, source,
-                           mctx, &key);
+                           mctx, false, &key);
        if (result != ISC_R_SUCCESS)
                return (result);
 
@@ -1892,7 +1900,8 @@ computeid(dst_key_t *key) {
 static isc_result_t
 frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
           unsigned int protocol, dns_rdataclass_t rdclass,
-          isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
+          isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
+          dst_key_t **keyp)
 {
        dst_key_t *key;
        isc_result_t ret;
@@ -1917,10 +1926,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
                        return (DST_R_UNSUPPORTEDALG);
                }
 
-               ret = key->func->fromdns(key, source);
-               if (ret != ISC_R_SUCCESS) {
-                       dst_key_free(&key);
-                       return (ret);
+               if (!no_rdata) {
+                       ret = key->func->fromdns(key, source);
+                       if (ret != ISC_R_SUCCESS) {
+                               dst_key_free(&key);
+                               return (ret);
+                       }
                }
        }
 

diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index 5b42ab488ce7e7a12c3dfebbf558ddfd2ac685dd..f197cfe2f29a218c222534c568e4da260e3ef33e 100644 (file)
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -417,6 +417,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
  */
 
 isc_result_t
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
+                  isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
+                  dst_key_t **keyp);
+isc_result_t
 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
                isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
 /*%<

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index c5c54ec4dfe70f6558cec7c174aeafdb252425ad..0b257fe8741e82d36473077d642aa5213fda3edc 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1222,6 +1222,7 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
        isc_buffer_t b;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dst_key_t *oldkey = val->key;
+       bool no_rdata = false;
 
        if (oldkey == NULL) {
                result = dns_rdataset_first(rdataset);
@@ -1232,7 +1233,7 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
        }
 
        if (result != ISC_R_SUCCESS) {
-               goto failure;
+               goto done;
        }
 
        do {
@@ -1241,8 +1242,9 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
                isc_buffer_init(&b, rdata.data, rdata.length);
                isc_buffer_add(&b, rdata.length);
                INSIST(val->key == NULL);
-               result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
-                                        val->view->mctx, &val->key);
+               result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
+                                           val->view->mctx, no_rdata,
+                                           &val->key);
                if (result == ISC_R_SUCCESS) {
                        if (siginfo->algorithm ==
                                    (dns_secalg_t)dst_key_alg(val->key) &&
@@ -1252,18 +1254,24 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
                                    0 &&
                            dst_key_iszonekey(val->key))
                        {
-                               /*
-                                * This is the key we're looking for.
-                                */
-                               return (ISC_R_SUCCESS);
+                               if (no_rdata) {
+                                       /* Retry with full key */
+                                       dns_rdata_reset(&rdata);
+                                       dst_key_free(&val->key);
+                                       no_rdata = false;
+                                       continue;
+                               }
+                               /* This is the key we're looking for. */
+                               goto done;
                        }
                        dst_key_free(&val->key);
                }
                dns_rdata_reset(&rdata);
                result = dns_rdataset_next(rdataset);
+               no_rdata = true;
        } while (result == ISC_R_SUCCESS);
 
-failure:
+done:
        if (result == ISC_R_NOMORE) {
                result = ISC_R_NOTFOUND;
        }

diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index adda08d7ee8010221ee2e5fa39fcd2865bb03ce4..1cd8ebb4c85b5ac4959a3d12f0f3c3a38a692a61 100644 (file)
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -1437,6 +1437,7 @@ dst_key_format
 dst_key_free
 dst_key_frombuffer
 dst_key_fromdns
+dst_key_fromdns_ex
 dst_key_fromfile
 dst_key_fromgssapi
 dst_key_fromlabel