ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Tiny refactor revoked key check

Browse Source 
This makes the code flow a bit more readable.
This commit is contained in:
Matthijs Mekking
2023-07-20 12:44:19 +02:00
parent 3e49223a67
commit 3bcb096a0e
2 changed files with 46 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/update.c
+23 -26
View File
@@ -1160,17 +1160,6 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
continue;
}
if (!REVOKE(keys[i])) {
/*
* Don't consider inactive keys, however the KSK may be
* temporary offline, so do consider KSKs which private
* key files are unavailable.
*/
both = dst_key_have_ksk_and_zsk(
keys, nkeys, i, false, KSK(keys[i]),
!KSK(keys[i]), NULL, NULL);
}
if (use_kasp) {
/*
* A dnssec-policy is found. Check what RRsets this
@@ -1216,26 +1205,34 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
*/
continue;
}
} else if (!REVOKE(keys[i])) {
/*
* If this key is revoked, it may only sign the
* DNSKEY RRset.
* Don't consider inactive keys, however the KSK may be
* temporary offline, so do consider KSKs which private
* key files are unavailable.
*/
if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
continue;
}
} else if (both) {
/*
* CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
*/
if (dns_rdatatype_iskeymaterial(type)) {
if (!KSK(keys[i])) {
both = dst_key_have_ksk_and_zsk(
keys, nkeys, i, false, KSK(keys[i]),
!KSK(keys[i]), NULL, NULL);
if (both) {
/*
* CDS and CDNSKEY are signed with KSK (RFC
* 7344, 4.1).
*/
if (dns_rdatatype_iskeymaterial(type)) {
if (!KSK(keys[i])) {
continue;
}
} else if (KSK(keys[i])) {
continue;
}
} else if (KSK(keys[i])) {
continue;
}
} else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
}
/*
* If this key is revoked, it may only sign the DNSKEY RRset.
*/
if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
continue;
}
lib/dns/zone.c
+23 -36
View File
@@ -6596,16 +6596,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
continue;
}
if (!REVOKE(keys[i])) {
/*
* Don't consider inactive keys, however the KSK may be
* temporary offline, so do consider keys which private
* key files are unavailable.
*/
both = dst_key_have_ksk_and_zsk(
keys, nkeys, i, false, KSK(keys[i]),
!KSK(keys[i]), NULL, NULL);
}
if (use_kasp) {
/*
* A dnssec-policy is found. Check what RRsets this
@@ -6665,26 +6655,34 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
*/
continue;
}
} else if (!REVOKE(keys[i])) {
/*
* If this key is revoked, it may only sign the
* DNSKEY RRset.
* Don't consider inactive keys, however the KSK may be
* temporary offline, so do consider keys which private
* key files are unavailable.
*/
if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
continue;
}
} else if (both) {
/*
* CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
*/
if (dns_rdatatype_iskeymaterial(type)) {
if (!KSK(keys[i])) {
bool both = dst_key_have_ksk_and_zsk(
keys, nkeys, i, false, KSK(keys[i]),
!KSK(keys[i]), NULL, NULL);
if (both) {
/*
* CDS and CDNSKEY are signed with KSK (RFC
* 7344, 4.1).
*/
if (dns_rdatatype_iskeymaterial(type)) {
if (!KSK(keys[i])) {
continue;
}
} else if (KSK(keys[i])) {
continue;
}
} else if (KSK(keys[i])) {
continue;
}
} else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
}
/*
* If this key is revoked, it may only sign the DNSKEY RRset.
*/
if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
continue;
}
@@ -9279,17 +9277,6 @@ zone_sign(dns_zone_t *zone) {
/*
* We do KSK processing.
*/
if (!REVOKE(zone_keys[i])) {
/*
* Don't consider inactive keys, however the key
* may be temporary offline, so do consider KSKs
* which private key files are unavailable.
*/
both = dst_key_have_ksk_and_zsk(
zone_keys, nkeys, i, false,
KSK(zone_keys[i]), !KSK(zone_keys[i]),
NULL, NULL);
}
if (use_kasp) {
/*
* A dnssec-policy is found. Check what