Commit 05578670a1 for bind
commit 05578670a1f72fcd8e4d482884654b03812d882e
Author: Matthijs Mekking <matthijs@isc.org>
Date: Fri Oct 9 12:47:19 2026 +0200
Use kasp key flags when creating key
When generating a new key, use the explicit key flags, rather than
deriving it from the key role.
Also, if the flags are different in the kasp configuration and the
actual key, they no longer match.
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 9a90171c6b..57dbf4d25a 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -81,6 +81,7 @@ struct keygen_ctx {
dns_keystore_t *keystore;
char *algname;
int size;
+ uint16_t flags;
uint16_t tag_min;
uint16_t tag_max;
dns_rdataclass_t rdclass;
@@ -231,7 +232,6 @@ static void
keygen(keygen_ctx_t *ctx, const char *keyname) {
char filename[255];
char algstr[DST_ALG_FORMATSIZE];
- uint16_t flags = 0;
bool conflict = false;
bool show_progress = false;
isc_buffer_t buf;
@@ -395,7 +395,7 @@ keygen(keygen_ctx_t *ctx, const char *keyname) {
name = dst_key_name(prevkey);
ctx->alg = dst_key_alg(prevkey);
ctx->size = dst_key_size(prevkey);
- flags = dst_key_flags(prevkey);
+ ctx->flags = dst_key_flags(prevkey);
dst_key_format(prevkey, keystr, sizeof(keystr));
dst_key_getprivateformat(prevkey, &major, &minor);
@@ -494,23 +494,10 @@ keygen(keygen_ctx_t *ctx, const char *keyname) {
fatal("not a dnskey algorithm %u\n", ctx->alg);
}
- if ((ctx->options & DST_TYPE_KEY) == 0) {
- flags |= DNS_KEYOWNER_ZONE; /* DNSKEY: name type ZONE */
- }
-
if (ctx->directory == NULL) {
ctx->directory = ".";
}
- if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
- if (ctx->ksk || ctx->wantksk) {
- flags |= DNS_KEYFLAG_KSK;
- }
- if (ctx->wantrev) {
- flags |= DNS_KEYFLAG_REVOKE;
- }
- }
-
switch (ctx->alg) {
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
@@ -541,17 +528,18 @@ keygen(keygen_ctx_t *ctx, const char *keyname) {
if (ctx->keystore != NULL && ctx->policy != NULL) {
result = dns_keystore_keygen(
ctx->keystore, name, ctx->policy, ctx->rdclass,
- isc_g_mctx, ctx->alg, ctx->size, flags, &key);
+ isc_g_mctx, ctx->alg, ctx->size, ctx->flags,
+ &key);
} else if (!ctx->quiet && show_progress) {
- result = dst_key_generate(name, ctx->alg, ctx->size, 0,
- flags, DNS_KEYPROTO_DNSSEC,
- ctx->rdclass, NULL,
- isc_g_mctx, &key, &progress);
+ result = dst_key_generate(
+ name, ctx->alg, ctx->size, 0, ctx->flags,
+ DNS_KEYPROTO_DNSSEC, ctx->rdclass, NULL,
+ isc_g_mctx, &key, &progress);
} else {
- result = dst_key_generate(name, ctx->alg, ctx->size, 0,
- flags, DNS_KEYPROTO_DNSSEC,
- ctx->rdclass, NULL,
- isc_g_mctx, &key, NULL);
+ result = dst_key_generate(
+ name, ctx->alg, ctx->size, 0, ctx->flags,
+ DNS_KEYPROTO_DNSSEC, ctx->rdclass, NULL,
+ isc_g_mctx, &key, NULL);
}
if (!ctx->quiet && show_progress) {
@@ -1076,6 +1064,7 @@ main(int argc, char **argv) {
ctx.use_nsec3 = false;
ctx.alg = DST_ALG_ECDSA256;
ctx.size = 0;
+ ctx.flags = DNS_KEYOWNER_ZONE | DNS_KEYFLAG_KSK;
ctx.ttl = 3600;
ctx.setttl = true;
ctx.ksk = true;
@@ -1116,6 +1105,7 @@ main(int argc, char **argv) {
ctx.use_nsec3 = false;
ctx.alg = dns_kasp_key_algorithm(kaspkey);
ctx.size = dns_kasp_key_size(kaspkey);
+ ctx.flags = dns_kasp_key_flags(kaspkey);
ctx.ksk = dns_kasp_key_ksk(kaspkey);
ctx.zsk = dns_kasp_key_zsk(kaspkey);
ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
@@ -1137,6 +1127,19 @@ main(int argc, char **argv) {
cfg_obj_detach(&config);
}
} else {
+ if ((ctx.options & DST_TYPE_KEY) == 0) {
+ ctx.flags |= DNS_KEYOWNER_ZONE; /* DNSKEY: name type
+ ZONE */
+ }
+ if ((ctx.flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
+ if (ctx.ksk || ctx.wantksk) {
+ ctx.flags |= DNS_KEYFLAG_KSK;
+ }
+ if (ctx.wantrev) {
+ ctx.flags |= DNS_KEYFLAG_REVOKE;
+ }
+ }
+
keygen(&ctx, argv[isc_commandline_index]);
}
diff --git a/bin/dnssec/dnssec-ksr.c b/bin/dnssec/dnssec-ksr.c
index a3ecfacce7..6e3f15a2b3 100644
--- a/bin/dnssec/dnssec-ksr.c
+++ b/bin/dnssec/dnssec-ksr.c
@@ -313,15 +313,10 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
isc_buffer_t buf;
isc_result_t result;
isc_stdtime_t prepub;
- uint16_t flags = DNS_KEYOWNER_ZONE;
+ uint16_t flags = dns_kasp_key_flags(kaspkey);
isc_stdtime_tostring(inception, timestr, sizeof(timestr));
- /* ZSK or KSK? */
- if (ksr->ksk) {
- flags |= DNS_KEYFLAG_KSK;
- }
-
/* Check algorithm and size. */
dst_algorithm_format(ksr->alg, algstr, sizeof(algstr));
if (!dst_algorithm_supported(ksr->alg)) {
diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c
index 4fb48012fb..840e451561 100644
--- a/lib/dns/kasp.c
+++ b/lib/dns/kasp.c
@@ -527,6 +527,10 @@ dns_kasp_key_match(dns_kasp_key_t *key, dns_dnsseckey_t *dkey) {
if (dst_key_size(dkey->key) != dns_kasp_key_size(key)) {
return false;
}
+ /* Matching flags? */
+ if (dst_key_flags(dkey->key) != dns_kasp_key_flags(key)) {
+ return false;
+ }
/* Matching role? */
result = dst_key_getbool(dkey->key, DST_BOOL_KSK, &role);
if (result != ISC_R_SUCCESS || role != dns_kasp_key_ksk(key)) {
diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index db4631d314..a3737ee40c 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -494,7 +494,7 @@ keymgr_createkey(dns_kasp_key_t *kkey, const dns_name_t *origin,
dst_key_t **dst_key) {
isc_result_t result = ISC_R_SUCCESS;
bool conflict = false;
- int flags = DNS_KEYOWNER_ZONE;
+ int flags = (int)dns_kasp_key_flags(kkey);
dst_key_t *newkey = NULL;
uint32_t alg = dns_kasp_key_algorithm(kkey);
dns_keystore_t *keystore = dns_kasp_key_keystore(kkey);
@@ -504,10 +504,6 @@ keymgr_createkey(dns_kasp_key_t *kkey, const dns_name_t *origin,
ISC_LIST_INIT(keykeys);
- if (dns_kasp_key_ksk(kkey)) {
- flags |= DNS_KEYFLAG_KSK;
- }
-
/*
* We also need to check against K* files for KEYs.
*/
diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index cb702d3713..7eb8a1c4f8 100644
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -980,6 +980,7 @@ cfg_kasp_builtinconfig(isc_mem_t *mctx, const char *name,
dns_kasp_key_create(kasp, &new_key);
new_key->role |= DNS_KASP_KEY_ROLE_KSK;
new_key->role |= DNS_KASP_KEY_ROLE_ZSK;
+ new_key->flags = DNS_KEYOWNER_ZONE | DNS_KEYFLAG_KSK;
new_key->lifetime = 0;
new_key->algorithm = DST_ALG_ECDSA256;
new_key->length = 256;