From: Libor Peltan <libor.peltan@nic.cz>
Date: Sat, 27 Dec 2025 16:55:38 +0000 (+0100)
Subject: dnssec/DELEG: set ADT flag for newly generated keys
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8fae6d7c8bedd640bb7dba8764133c990cfb9b73;p=thirdparty%2Fknot-dns.git

dnssec/DELEG: set ADT flag for newly generated keys
---

diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index e5ba22b30d..8c8abb1db8 100644
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -62,7 +62,7 @@ static int generate_dnssec_key(dnssec_keystore_t *keystore,
 		goto fail;
 	}
 
-	dnssec_key_set_flags(*key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+	dnssec_key_set_flags(*key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON, flags & DNSKEY_GENERATE_ADT_ON));
 	dnssec_key_set_algorithm(*key, alg);
 
 	ret = dnssec_keystore_get_private(keystore, *id, *key);
@@ -154,6 +154,9 @@ int kdnssec_generate_key(kdnssec_ctx_t *ctx, kdnssec_generate_flags_t flags,
 	assert(ctx->policy);
 
 	normalize_generate_flags(&flags);
+	if (ctx->policy->deleg_aware) {
+		flags |= DNSKEY_GENERATE_ADT_ON;
+	}
 
 	for (size_t i = 0; !(flags & DNSKEY_GENERATE_FOR_LATER) && i < ctx->zone->num_keys; i++) {
 		knot_kasp_key_t *k = &ctx->zone->keys[i];
diff --git a/src/knot/dnssec/zone-keys.h b/src/knot/dnssec/zone-keys.h
index 5dc2233e9a..928f042a06 100644
--- a/src/knot/dnssec/zone-keys.h
+++ b/src/knot/dnssec/zone-keys.h
@@ -63,9 +63,9 @@ enum {
 	DNSKEY_FLAGS_REVOKED = KNOT_DNSKEY_FLAG_ZONE | KNOT_DNSKEY_FLAG_SEP | KNOT_DNSKEY_FLAG_REVOKE,
 };
 
-inline static uint16_t dnskey_flags(bool is_ksk)
+inline static uint16_t dnskey_flags(bool is_ksk, bool adt)
 {
-	return is_ksk ? DNSKEY_FLAGS_KSK : DNSKEY_FLAGS_ZSK;
+	return adt ? (is_ksk ? DNSKEY_FLAGS_KSK_ADT : DNSKEY_FLAGS_ZSK_ADT) : (is_ksk ? DNSKEY_FLAGS_KSK : DNSKEY_FLAGS_ZSK);
 }
 
 typedef enum {
@@ -74,6 +74,7 @@ typedef enum {
 	DNSKEY_GENERATE_SEP_SPEC  = (1 << 2), // not (SEP bit set iff KSK)
 	DNSKEY_GENERATE_SEP_ON    = (1 << 3), // SEP bit set on
 	DNSKEY_GENERATE_FOR_LATER = (1 << 4), // Pregenerated key for later automatic use.
+	DNSKEY_GENERATE_ADT_ON    = (1 << 5), // DELEG-awareness signaling flag
 } kdnssec_generate_flags_t;
 
 void normalize_generate_flags(kdnssec_generate_flags_t *flags);
diff --git a/src/utils/keymgr/functions.c b/src/utils/keymgr/functions.c
index df00464aae..b5d1c63479 100644
--- a/src/utils/keymgr/functions.c
+++ b/src/utils/keymgr/functions.c
@@ -479,7 +479,7 @@ int keymgr_import_bind(kdnssec_ctx_t *ctx, const char *import_file, bool pub_onl
 	kkey->key = key;
 	kkey->timing = timing;
 	kkey->is_pub_only = pub_only;
-	kkey->is_ksk = (dnssec_key_get_flags(kkey->key) == DNSKEY_FLAGS_KSK);
+	kkey->is_ksk = (dnssec_key_get_flags(kkey->key) & DNSKEY_FLAGS_KSK) == DNSKEY_FLAGS_KSK;
 	kkey->is_zsk = !kkey->is_ksk;
 
 	// append to zone
@@ -603,7 +603,7 @@ static int import_key(kdnssec_ctx_t *ctx, unsigned backend, const char *param,
 	if (ret != KNOT_EOK) {
 		goto fail;
 	}
-	dnssec_key_set_flags(key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+	dnssec_key_set_flags(key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON, ctx->policy->deleg_aware));
 	dnssec_key_set_algorithm(key, ctx->policy->algorithm);
 
 	// fill key structure from keystore (incl. pubkey from privkey computation)
@@ -918,7 +918,8 @@ int keymgr_set_timing(knot_kasp_key_t *key, int argc, char *argv[])
 			normalize_generate_flags(&flags);
 			key->is_ksk = (flags & DNSKEY_GENERATE_KSK);
 			key->is_zsk = (flags & DNSKEY_GENERATE_ZSK);
-			return dnssec_key_set_flags(key->key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON));
+			return dnssec_key_set_flags(key->key, dnskey_flags(flags & DNSKEY_GENERATE_SEP_ON,
+			                                                   dnssec_key_get_flags(key->key) & KNOT_DNSKEY_FLAG_ADT));
 		}
 		return KNOT_EOK;
 	}