Extract check_dnskey() from dns_zoneverify_dnssec()

Extract the part of dns_zoneverify_dnssec() responsible for checking the
DNSKEY RRset at zone apex to a separate function.

diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index 5e4da21569cca5845240f96870d34f6576f7249e..04f5a94856cca82de12efe3d4bb0799fa78f66c5 100644 (file)
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -1213,41 +1213,20 @@ check_apex_rrsets(vctx_t *vctx) {
        dns_db_detachnode(vctx->db, &node);
 }
 
-void
-dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-                     dns_name_t *origin, isc_mem_t *mctx,
-                     isc_boolean_t ignore_kskflag,
-                     isc_boolean_t keyset_kskonly)
-{
-       char algbuf[80];
-       dns_dbiterator_t *dbiter = NULL;
-       dns_dbnode_t *node = NULL, *nextnode = NULL;
-       dns_fixedname_t fname, fnextname, fprevname, fzonecut;
-       dns_name_t *name, *nextname, *prevname, *zonecut;
-       dns_rdata_dnskey_t dnskey;
+/*%
+ * Check that the DNSKEY RR has at least one self signing KSK and one ZSK per
+ * algorithm in it (or, if -x was used, one self-signing KSK).
+ */
+static void
+check_dnskey(vctx_t *vctx) {
        dns_rdata_t rdata = DNS_RDATA_INIT;
-       int i;
-       isc_boolean_t done = ISC_FALSE;
-       isc_boolean_t first = ISC_TRUE;
-       isc_result_t result, vresult = ISC_R_UNSET;
-       vctx_t vctx;
-
-       result = vctx_init(&vctx, mctx, zone, db, ver, origin);
-       if (result != ISC_R_SUCCESS) {
-               return;
-       }
-
-       check_apex_rrsets(&vctx);
+       dns_rdata_dnskey_t dnskey;
+       isc_result_t result;
 
-       /*
-        * Check that the DNSKEY RR has at least one self signing KSK
-        * and one ZSK per algorithm in it (or, if -x was used, one
-        * self-signing KSK).
-        */
-       for (result = dns_rdataset_first(&vctx.keyset);
+       for (result = dns_rdataset_first(&vctx->keyset);
             result == ISC_R_SUCCESS;
-            result = dns_rdataset_next(&vctx.keyset)) {
-               dns_rdataset_current(&vctx.keyset, &rdata);
+            result = dns_rdataset_next(&vctx->keyset)) {
+               dns_rdataset_current(&vctx->keyset, &rdata);
                result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
                check_result(result, "dns_rdata_tostruct");
 
@@ -1255,14 +1234,15 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
                        ;
                else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
                        if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
-                           !dns_dnssec_selfsigns(&rdata, vctx.origin,
-                                                 &vctx.keyset, &vctx.keysigs,
-                                                 ISC_FALSE, vctx.mctx)) {
+                           !dns_dnssec_selfsigns(&rdata, vctx->origin,
+                                                 &vctx->keyset,
+                                                 &vctx->keysigs, ISC_FALSE,
+                                                 vctx->mctx)) {
                                char namebuf[DNS_NAME_FORMATSIZE];
                                char buffer[1024];
                                isc_buffer_t buf;
 
-                               dns_name_format(vctx.origin, namebuf,
+                               dns_name_format(vctx->origin, namebuf,
                                                sizeof(namebuf));
                                isc_buffer_init(&buf, buffer, sizeof(buffer));
                                result = dns_rdata_totext(&rdata, NULL, &buf);
@@ -1272,40 +1252,67 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
                                      (int)isc_buffer_usedlength(&buf), buffer);
                        }
                        if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
-                            vctx.revoked_ksk[dnskey.algorithm] != 255)
-                               vctx.revoked_ksk[dnskey.algorithm]++;
+                            vctx->revoked_ksk[dnskey.algorithm] != 255)
+                               vctx->revoked_ksk[dnskey.algorithm]++;
                        else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 &&
-                                vctx.revoked_zsk[dnskey.algorithm] != 255)
-                               vctx.revoked_zsk[dnskey.algorithm]++;
+                                vctx->revoked_zsk[dnskey.algorithm] != 255)
+                               vctx->revoked_zsk[dnskey.algorithm]++;
                } else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {
-                       if (dns_dnssec_selfsigns(&rdata, vctx.origin,
-                                                &vctx.keyset, &vctx.keysigs,
-                                                ISC_FALSE, vctx.mctx)) {
-                               if (vctx.ksk_algorithms[dnskey.algorithm] != 255)
-                                       vctx.ksk_algorithms[dnskey.algorithm]++;
-                               vctx.goodksk = ISC_TRUE;
+                       if (dns_dnssec_selfsigns(&rdata, vctx->origin,
+                                                &vctx->keyset, &vctx->keysigs,
+                                                ISC_FALSE, vctx->mctx)) {
+                               if (vctx->ksk_algorithms[dnskey.algorithm] != 255)
+                                       vctx->ksk_algorithms[dnskey.algorithm]++;
+                               vctx->goodksk = ISC_TRUE;
                        } else {
-                               if (vctx.standby_ksk[dnskey.algorithm] != 255)
-                                       vctx.standby_ksk[dnskey.algorithm]++;
+                               if (vctx->standby_ksk[dnskey.algorithm] != 255)
+                                       vctx->standby_ksk[dnskey.algorithm]++;
                        }
-               } else if (dns_dnssec_selfsigns(&rdata, vctx.origin,
-                                               &vctx.keyset, &vctx.keysigs,
-                                               ISC_FALSE, vctx.mctx)) {
-                       if (vctx.zsk_algorithms[dnskey.algorithm] != 255)
-                               vctx.zsk_algorithms[dnskey.algorithm]++;
-                       vctx.goodzsk = ISC_TRUE;
-               } else if (dns_dnssec_signs(&rdata, vctx.origin, &vctx.soaset,
-                                           &vctx.soasigs, ISC_FALSE,
-                                           vctx.mctx)) {
-                       if (vctx.zsk_algorithms[dnskey.algorithm] != 255)
-                               vctx.zsk_algorithms[dnskey.algorithm]++;
+               } else if (dns_dnssec_selfsigns(&rdata, vctx->origin,
+                                               &vctx->keyset, &vctx->keysigs,
+                                               ISC_FALSE, vctx->mctx)) {
+                       if (vctx->zsk_algorithms[dnskey.algorithm] != 255)
+                               vctx->zsk_algorithms[dnskey.algorithm]++;
+                       vctx->goodzsk = ISC_TRUE;
+               } else if (dns_dnssec_signs(&rdata, vctx->origin,
+                                           &vctx->soaset, &vctx->soasigs,
+                                           ISC_FALSE, vctx->mctx)) {
+                       if (vctx->zsk_algorithms[dnskey.algorithm] != 255)
+                               vctx->zsk_algorithms[dnskey.algorithm]++;
                } else {
-                       if (vctx.standby_zsk[dnskey.algorithm] != 255)
-                               vctx.standby_zsk[dnskey.algorithm]++;
+                       if (vctx->standby_zsk[dnskey.algorithm] != 255)
+                               vctx->standby_zsk[dnskey.algorithm]++;
                }
                dns_rdata_freestruct(&dnskey);
                dns_rdata_reset(&rdata);
        }
+}
+
+void
+dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
+                     dns_name_t *origin, isc_mem_t *mctx,
+                     isc_boolean_t ignore_kskflag,
+                     isc_boolean_t keyset_kskonly)
+{
+       char algbuf[80];
+       dns_dbiterator_t *dbiter = NULL;
+       dns_dbnode_t *node = NULL, *nextnode = NULL;
+       dns_fixedname_t fname, fnextname, fprevname, fzonecut;
+       dns_name_t *name, *nextname, *prevname, *zonecut;
+       int i;
+       isc_boolean_t done = ISC_FALSE;
+       isc_boolean_t first = ISC_TRUE;
+       isc_result_t result, vresult = ISC_R_UNSET;
+       vctx_t vctx;
+
+       result = vctx_init(&vctx, mctx, zone, db, ver, origin);
+       if (result != ISC_R_SUCCESS) {
+               return;
+       }
+
+       check_apex_rrsets(&vctx);
+
+       check_dnskey(&vctx);
 
        if (ignore_kskflag ) {
                if (!vctx.goodksk && !vctx.goodzsk)