Don't check DNS_KEYFLAG_NOAUTH

All DNSKEY keys are able to authenticate. The DNS_KEYTYPE_NOAUTH
(and DNS_KEYTYPE_NOCONF) flags were defined for the KEY rdata type,
and are not applicable to DNSKEY.

Previously, because the DNSKEY implementation was built on top of
KEY, the NOAUTH flag prevented authentication in DNSKEYs as well.
This has been corrected.

(cherry picked from commit 5c21576f82f9f62c2e22aac920a37a4013ac3a80)

diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 662136db8777fbef1aa3ba99374e7169d9655184..3fc39882814bd2a1423da2a929df259fdd3ff2b3 100644 (file)
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -194,7 +194,6 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
        isc_result_t ret;
        isc_buffer_t *databuf = NULL;
        char data[256 + 8];
-       uint32_t flags;
        unsigned int sigsize;
        dns_fixedname_t fnewname;
        dns_fixedname_t fsigner;
@@ -212,17 +211,6 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
                return DNS_R_INVALIDTIME;
        }
 
-       /*
-        * Is the key allowed to sign data?
-        */
-       flags = dst_key_flags(key);
-       if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
-               return DNS_R_KEYUNAUTHORIZED;
-       }
-       if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
-               return DNS_R_KEYUNAUTHORIZED;
-       }
-
        sig.mctx = mctx;
        sig.common.rdclass = set->rdclass;
        sig.common.rdtype = dns_rdatatype_rrsig;
@@ -385,7 +373,6 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
        unsigned char data[300];
        dst_context_t *ctx = NULL;
        int labels = 0;
-       uint32_t flags;
        bool downcase = false;
 
        REQUIRE(name != NULL);
@@ -450,19 +437,6 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
                break;
        }
 
-       /*
-        * Is the key allowed to sign data?
-        */
-       flags = dst_key_flags(key);
-       if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
-               inc_stat(dns_dnssecstats_fail);
-               return DNS_R_KEYUNAUTHORIZED;
-       }
-       if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
-               inc_stat(dns_dnssecstats_fail);
-               return DNS_R_KEYUNAUTHORIZED;
-       }
-
 again:
        ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
                                 maxbits, &ctx);
@@ -1687,9 +1661,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
                RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &dnskey));
                dst_key_setttl(dnskey, keys.ttl);
 
-               if (!is_zone_key(dnskey) ||
-                   (dst_key_flags(dnskey) & DNS_KEYTYPE_NOAUTH) != 0)
-               {
+               if (!is_zone_key(dnskey)) {
                        goto skip;
                }
 
@@ -1792,11 +1764,6 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
                }
                RETERR(result);
 
-               /* This should never happen. */
-               if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0) {
-                       goto skip;
-               }
-
                /*
                 * Whatever the key's default TTL may have
                 * been, the rdataset TTL takes priority.

diff --git a/lib/dns/key.c b/lib/dns/key.c
index 0b4b3d261fb3787a8f22da1aeddc03820e87dd34..7f496ff08627553dc4199b51f94c6ee40e974b87 100644 (file)
--- a/lib/dns/key.c
+++ b/lib/dns/key.c
@@ -127,9 +127,6 @@ bool
 dst_key_iszonekey(const dst_key_t *key) {
        REQUIRE(VALID_KEY(key));
 
-       if ((key->key_flags & DNS_KEYTYPE_NOAUTH) != 0) {
-               return false;
-       }
        if ((key->key_flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
                return false;
        }

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index ac4263fb466b50e6599aae241c741a7641f973ad..e91c2f6bde8168f18c0df54d24cd6e00b48ff2ea 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -20851,8 +20851,7 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
 
                result = dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
-               if ((dnskey.flags & (DNS_KEYFLAG_OWNERMASK |
-                                    DNS_KEYTYPE_NOAUTH)) != DNS_KEYOWNER_ZONE)
+               if ((dnskey.flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
                {
                        ISC_LIST_UNLINK(diff->tuples, tuple, link);
                        ISC_LIST_APPEND(tuples, tuple, link);