| Subject: | [PATCH] apply dnskey-kskonly logic to CDNSKEY and CDS |
| Date: | Fri, 4 Aug 2017 14:24:20 +0100 |
| To: | bind9-bugs@isc.org |
| From: | "Tony Finch" <dot@dotat.at> |
| CC: | "Tony Finch" <dot@dotat.at> |
I was surprised to see double signatures on CDS / CDNSKEY records when
using `dnsssec-signzone -x` - I thought the KSK signing behaviour should
be the same for CDNSKEY / CDS as it is for DNSKEY.
I would like to avoid them for CDNSKEY in particular, since I want to
avoid sending large responses as much as I can.
---
bin/dnssec/dnssec-signzone.c | 8 ++++----
bin/dnssec/dnssec-signzone.docbook | 5 +++--
doc/arm/Bv9ARM-book.xml | 6 +++---
lib/dns/zone.c | 13 +++++++------
4 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 4775955..5d278a1 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -659,7 +659,9 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
if (!issigningkey(key))
continue;
- if (set->type == dns_rdatatype_dnskey &&
+ if ((set->type == dns_rdatatype_cds ||
+ set->type == dns_rdatatype_cdnskey ||
+ set->type == dns_rdatatype_dnskey) &&
dns_name_equal(name, gorigin)) {
isc_boolean_t have_ksk;
dns_dnsseckey_t *tmpkey;
@@ -680,9 +682,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
(iszsk(key) && !keyset_kskonly))
signwithkey(name, set, key->key, ttl, add,
"signing with dnskey");
- } else if (set->type == dns_rdatatype_cds ||
- set->type == dns_rdatatype_cdnskey ||
- iszsk(key)) {
+ } else if (iszsk(key)) {
signwithkey(name, set, key->key, ttl, add,
"signing with dnskey");
}
diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook
index 82089a9..79e5d25 100644
--- a/bin/dnssec/dnssec-signzone.docbook
+++ b/bin/dnssec/dnssec-signzone.docbook
@@ -705,8 +705,9 @@
<term>-x</term>
<listitem>
<para>
- Only sign the DNSKEY RRset with key-signing keys, and omit
- signatures from zone-signing keys. (This is similar to the
+ Only sign the DNSKEY, CDNSKEY, and CDS RRsets with
+ key-signing keys, and omit signatures from zone-signing
+ keys. (This is similar to the
<command>dnssec-dnskey-kskonly yes;</command> zone option in
<command>named</command>.)
</para>
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 2c5ff64..c2f7add 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -7261,9 +7261,9 @@ options {
When this option and <command>update-check-ksk</command>
are both set to <literal>yes</literal>, only key-signing
keys (that is, keys with the KSK bit set) will be used
- to sign the DNSKEY RRset at the zone apex. Zone-signing
- keys (keys without the KSK bit set) will be used to sign
- the remainder of the zone, but not the DNSKEY RRset.
+ to sign the DNSKEY, CDNSKEY, and CDS RRsets at the zone apex.
+ Zone-signing keys (keys without the KSK bit set) will be used
+ to sign the remainder of the zone, but not the DNSKEY RRset.
This is similar to the
<command>dnssec-signzone -x</command> command line option.
</para>
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2b56aff..248bf3d 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6643,15 +6643,16 @@ sign_a_node(dns_db_t *db, dns_name_t *name, dns_dbnode_t *node,
if (rdataset.type == dns_rdatatype_soa ||
rdataset.type == dns_rdatatype_rrsig)
goto next_rdataset;
- if (rdataset.type == dns_rdatatype_dnskey) {
+ if (rdataset.type == dns_rdatatype_dnskey ||
+ rdataset.type == dns_rdatatype_cdnskey ||
+ rdataset.type == dns_rdatatype_cds) {
+ /*
+ * CDS and CDNSKEY are signed with KSK like DNSKEY
+ * (RFC 7344, 4.1).
+ */
if (!is_ksk && keyset_kskonly)
goto next_rdataset;
} else if (is_ksk) {
- /*
- * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
- */
- if (rdataset.type != dns_rdatatype_cds &&
- rdataset.type != dns_rdatatype_cdnskey)
goto next_rdataset;
}
if (*delegation &&
--
2.10.1.445.g3cdd5d1