From: Peter Thomassen <peter@desec.io>
Date: Mon, 15 Apr 2024 14:58:46 +0000 (+0200)
Subject: auth: add SIGNALING-ZONE metadata setting
X-Git-Tag: rec-5.4.0-alpha0~21^2~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b225f077702a397e88af553e571e0bd51fb36bc;p=thirdparty%2Fpdns.git

auth: add SIGNALING-ZONE metadata setting
---

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index f2c7f2c216..ed5e08e626 100644
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -85,6 +85,17 @@ bool DNSSECKeeper::isPresigned(const ZoneName& name, bool useCache)
   return meta=="1";
 }
 
+bool DNSSECKeeper::isSignalingZone(const ZoneName& name, bool useCache)
+{
+  string meta;
+  if (useCache) {
+    getFromMeta(name, "SIGNALING-ZONE", meta);
+  }
+  else {
+    getFromMetaNoCache(name, "SIGNALING-ZONE", meta);
+  }
+  return meta=="1";
+}
 
 bool DNSSECKeeper::addKey(const ZoneName& name, bool setSEPBit, int algorithm, int64_t& keyId, int bits, bool active, bool published)
 {
diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index 7b5614f792..f0ee85bbb7 100644
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -213,6 +213,7 @@ public:
   bool isPresigned(const ZoneName& zname, bool useCache=true);
   bool setPresigned(const ZoneName& zname);
   bool unsetPresigned(const ZoneName& zname);
+  bool isSignalingZone(const ZoneName& zname, bool useCache=true);
   bool setPublishCDNSKEY(const ZoneName& zname, bool deleteAlg);
   void getPublishCDNSKEY(const ZoneName& zname, std::string& value);
   bool unsetPublishCDNSKEY(const ZoneName& zname);
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 518b10e523..733b05fdb0 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1342,6 +1342,9 @@ void PacketHandler::completeANYRecords(DNSPacket& p, std::unique_ptr<DNSPacket>&
 
 bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSName &target) {
   DLOG(g_log<<Logger::Warning<<"Let's try authenticated DNSSEC bootstrapping (RFC 9615) ..."<<endl);
+  if(d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
+    return false;
+  }
 
   // Check that we're doing online signing in narrow mode (as we don't know next owner names)
   if(!d_dk.isSecuredZone(d_sd.zonename) || d_dk.isPresigned(d_sd.zonename)) {
diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index a1a6247f94..a72e5c057a 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -969,6 +969,7 @@ static bool isValidMetadataKind(const string& kind, bool readonly)
     {"PRESIGNED", true},
     {"PUBLISH-CDNSKEY", false},
     {"PUBLISH-CDS", false},
+    {"SIGNALING-ZONE", false},
     {"SLAVE-RENOTIFY", false},
     {"SOA-EDIT", true},
     {"SOA-EDIT-DNSUPDATE", false},