Allow ZONEMD generation without DNSSEC

With -Z option to ldns-signzone

diff --git a/dnssec_sign.c b/dnssec_sign.c
index d68d0e2c23fbedf796753871550b81967586c080..3c8856f505bc3ad8701099e30b11233488dae05c 100644 (file)
--- a/dnssec_sign.c
+++ b/dnssec_sign.c
@@ -1407,7 +1407,13 @@ ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
                return result;
        }
        /* check whether we need to add nsecs */
-       if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
+       if ((flags & LDNS_SIGN_NO_KEYS_NO_NSECS)
+       &&  ldns_key_list_key_count(key_list) < 1)
+               ; /* pass */
+
+       else if (zone->names
+            && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
+
                result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
                if (result != LDNS_STATUS_OK) {
                        return result;
@@ -1487,7 +1493,13 @@ ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
                }
 
                nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
-               if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
+
+               /* check whether we need to add nsecs */
+               if ((signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)
+               &&  ldns_key_list_key_count(key_list) < 1)
+                       ; /* pass */
+
+               else if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
                        /* no need to recreate */
                } else {
                        if (!ldns_dnssec_zone_find_rrset(zone,

diff --git a/examples/ldns-signzone.1 b/examples/ldns-signzone.1
index 5f80b43f8a89ab7ece057b679fc9f8ff1ed931bc..174bd71a06f945ddff511c9b72fa7778a5956c76 100644 (file)
--- a/examples/ldns-signzone.1
+++ b/examples/ldns-signzone.1
@@ -79,6 +79,10 @@ Calculate the zone's digest and add those as ZONEMD RRs. The (optional)
 `scheme' must be `simple` (or 1) and `hash' should be `sha384' (or 1) or
 `sha512' (or 2).  This option can be given more than once.
 
+.TP
+\fB-Z\fR
+Allow ZONEMDs to be added without signing
+
 .TP
 \fB-A\fR
 Sign the DNSKEY record with all keys.  By default it is signed with a

diff --git a/examples/ldns-signzone.c b/examples/ldns-signzone.c
index d14526de14de4e7f2c877f693b8b1d0fd75a9304..53954af2801187cccaf0f3d25004d585e58cda7f 100644 (file)
--- a/examples/ldns-signzone.c
+++ b/examples/ldns-signzone.c
@@ -48,6 +48,7 @@ usage(FILE *fp, const char *prog) {
        fprintf(fp, "\t\t<scheme> should be \"simple\" (or 1)\n");
        fprintf(fp, "\t\t<hash> should be \"sha384\" or \"sha512\" (or 1 or 2)\n");
        fprintf(fp, "\t\tthis option can be given more than once\n");
+       fprintf(fp, "  -Z\t\tAllow ZONEMDs to be added without signing\n");
        fprintf(fp, "  -A\t\tsign DNSKEY with all keys instead of minimal\n");
        fprintf(fp, "  -U\t\tSign with every unique algorithm in the provided keys\n");
 #ifndef OPENSSL_NO_ENGINE
@@ -668,7 +669,7 @@ main(int argc, char *argv[])
        
        keys = ldns_key_list_new();
 
-       while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:uvz:AUE:K:")) != -1) {
+       while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:uvz:ZAUE:K:")) != -1) {
                switch (c) {
                case 'a':
                        nsec3_algorithm = (uint8_t) atoi(optarg);
@@ -772,6 +773,9 @@ main(int argc, char *argv[])
                                exit(EXIT_FAILURE);
                        }
                        break;
+               case 'Z':
+                       signflags |= LDNS_SIGN_NO_KEYS_NO_NSECS;
+                       break;
                case 'A':
                        signflags |= LDNS_SIGN_DNSKEY_WITH_ZSK;
                        break;
@@ -986,8 +990,9 @@ main(int argc, char *argv[])
                                  inception,
                                  expiration );
 #endif
-       
-       if (ldns_key_list_key_count(keys) < 1) {
+       if (ldns_key_list_key_count(keys) < 1 
+       &&  !(signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)) {
+                       
                fprintf(stderr, "Error: no keys to sign with. Aborting.\n\n");
                usage(stderr, prog);
                exit(EXIT_FAILURE);

diff --git a/keys.c b/keys.c
index ddff6f35325fb5bc2d374dbb3ac37498a59d958a..d8d18817b5a6b6b9bc8b70bb210ed0e748f4ae9b 100644 (file)
--- a/keys.c
+++ b/keys.c
@@ -1446,7 +1446,7 @@ ldns_key_set_keytag(ldns_key *k, uint16_t tag)
 size_t
 ldns_key_list_key_count(const ldns_key_list *key_list)
 {
-               return key_list->_key_count;
+       return key_list ? key_list->_key_count : 0;
 }       
 
 ldns_key *

diff --git a/ldns/dnssec_sign.h b/ldns/dnssec_sign.h
index 96bc8cdd9be22d00dddd555eb580914f538f727a..2f1e5c60724208e769b09334208c7d357a6ea88c 100644 (file)
--- a/ldns/dnssec_sign.h
+++ b/ldns/dnssec_sign.h
@@ -12,10 +12,11 @@ extern "C" {
 /* sign functions */
 
 /** Sign flag that makes DNSKEY type signed by all keys, not only by SEP keys*/
-#define LDNS_SIGN_DNSKEY_WITH_ZSK 1
-#define LDNS_SIGN_WITH_ALL_ALGORITHMS 2 
-#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 4
-#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 8
+#define LDNS_SIGN_DNSKEY_WITH_ZSK            1
+#define LDNS_SIGN_WITH_ALL_ALGORITHMS        2 
+#define LDNS_SIGN_NO_KEYS_NO_NSECS           4
+#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384  8
+#define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 16
 
 /**
  * Create an empty RRSIG RR (i.e. without the actual signature data)