dnssec/DELEG: set ADT flag for newly generated keys

diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index e5ba22b30d0dfe3e00e1000b886284be0bc8135b..8c8abb1db883edb9eedbd562410460c139323719 100644 (file)
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -62,7 +62,7 @@ static int generate_dnssec_key(dnssec_keystore_t *keystore,
                goto fail;
        }
 
-       dnssec_key_set_flags(*key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+       dnssec_key_set_flags(*key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON, flags & DNSKEY_GENERATE_ADT_ON));
        dnssec_key_set_algorithm(*key, alg);
 
        ret = dnssec_keystore_get_private(keystore, *id, *key);
@@ -154,6 +154,9 @@ int kdnssec_generate_key(kdnssec_ctx_t *ctx, kdnssec_generate_flags_t flags,
        assert(ctx->policy);
 
        normalize_generate_flags(&flags);
+       if (ctx->policy->deleg_aware) {
+               flags |= DNSKEY_GENERATE_ADT_ON;
+       }
 
        for (size_t i = 0; !(flags & DNSKEY_GENERATE_FOR_LATER) && i < ctx->zone->num_keys; i++) {
                knot_kasp_key_t *k = &ctx->zone->keys[i];

diff --git a/src/knot/dnssec/zone-keys.h b/src/knot/dnssec/zone-keys.h
index 5dc2233e9a6dcdcbb67660160370b0d09c8e4ef4..928f042a0617b2104d61de4971a90b32f3f2fd63 100644 (file)
--- a/src/knot/dnssec/zone-keys.h
+++ b/src/knot/dnssec/zone-keys.h
@@ -63,9 +63,9 @@ enum {
        DNSKEY_FLAGS_REVOKED = KNOT_DNSKEY_FLAG_ZONE | KNOT_DNSKEY_FLAG_SEP | KNOT_DNSKEY_FLAG_REVOKE,
 };
 
-inline static uint16_t dnskey_flags(bool is_ksk)
+inline static uint16_t dnskey_flags(bool is_ksk, bool adt)
 {
-       return is_ksk ? DNSKEY_FLAGS_KSK : DNSKEY_FLAGS_ZSK;
+       return adt ? (is_ksk ? DNSKEY_FLAGS_KSK_ADT : DNSKEY_FLAGS_ZSK_ADT) : (is_ksk ? DNSKEY_FLAGS_KSK : DNSKEY_FLAGS_ZSK);
 }
 
 typedef enum {
@@ -74,6 +74,7 @@ typedef enum {
        DNSKEY_GENERATE_SEP_SPEC  = (1 << 2), // not (SEP bit set iff KSK)
        DNSKEY_GENERATE_SEP_ON    = (1 << 3), // SEP bit set on
        DNSKEY_GENERATE_FOR_LATER = (1 << 4), // Pregenerated key for later automatic use.
+       DNSKEY_GENERATE_ADT_ON    = (1 << 5), // DELEG-awareness signaling flag
 } kdnssec_generate_flags_t;
 
 void normalize_generate_flags(kdnssec_generate_flags_t *flags);

diff --git a/src/utils/keymgr/functions.c b/src/utils/keymgr/functions.c
index df00464aaeeb3bb602c307165de6502026222470..b5d1c63479a7b0f47327531dc9761173751e6f19 100644 (file)
--- a/src/utils/keymgr/functions.c
+++ b/src/utils/keymgr/functions.c
@@ -479,7 +479,7 @@ int keymgr_import_bind(kdnssec_ctx_t *ctx, const char *import_file, bool pub_onl
        kkey->key = key;
        kkey->timing = timing;
        kkey->is_pub_only = pub_only;
-       kkey->is_ksk = (dnssec_key_get_flags(kkey->key) == DNSKEY_FLAGS_KSK);
+       kkey->is_ksk = (dnssec_key_get_flags(kkey->key) & DNSKEY_FLAGS_KSK) == DNSKEY_FLAGS_KSK;
        kkey->is_zsk = !kkey->is_ksk;
 
        // append to zone
@@ -603,7 +603,7 @@ static int import_key(kdnssec_ctx_t *ctx, unsigned backend, const char *param,
        if (ret != KNOT_EOK) {
                goto fail;
        }
-       dnssec_key_set_flags(key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+       dnssec_key_set_flags(key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON, ctx->policy->deleg_aware));
        dnssec_key_set_algorithm(key, ctx->policy->algorithm);
 
        // fill key structure from keystore (incl. pubkey from privkey computation)
@@ -918,7 +918,8 @@ int keymgr_set_timing(knot_kasp_key_t *key, int argc, char *argv[])
                        normalize_generate_flags(&flags);
                        key->is_ksk = (flags & DNSKEY_GENERATE_KSK);
                        key->is_zsk = (flags & DNSKEY_GENERATE_ZSK);
-                       return dnssec_key_set_flags(key->key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+                       return dnssec_key_set_flags(key->key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON,
+                                                                          dnssec_key_get_flags(key->key) & KNOT_DNSKEY_FLAG_ADT));
                }
                return KNOT_EOK;
        }