Add configuration option 'cdnskey'

Add the 'cdnskey' configuration option to 'dnssec-policy'.

diff --git a/bin/named/config.c b/bin/named/config.c
index 2149b29b85946ad65a6253dadbf09a057ba60fca..12b00891ca71b5d4091f0484b55151c703540d44 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -296,6 +296,7 @@ dnssec-policy \"default\" {\n\
                csk key-directory lifetime unlimited algorithm 13;\n\
        };\n\
 \n\
+       cdnskey yes;\n\
        cds-digest-types { 2; };\n\
        dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
        publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\

diff --git a/bin/tests/system/checkconf/good-kasp.conf b/bin/tests/system/checkconf/good-kasp.conf
index 67f3d5d869c0a48c97b2abf2ef19e108e49ccc89..384fcfe34b1f967a54a17ed3d793223ac0aa9781 100644 (file)
--- a/bin/tests/system/checkconf/good-kasp.conf
+++ b/bin/tests/system/checkconf/good-kasp.conf
@@ -17,6 +17,7 @@
 
 /* cut here */
 dnssec-policy "test" {
+       cdnskey yes;
        cds-digest-types {
                "sha-256";
        };

diff --git a/bin/tests/system/checkconf/good.conf.in b/bin/tests/system/checkconf/good.conf.in
index 1e2f49f94fef51d916294a361f3ef2aaaf5fc7a1..2ba4a0738e9bea1ed87b1291be4b907a1683507f 100644 (file)
--- a/bin/tests/system/checkconf/good.conf.in
+++ b/bin/tests/system/checkconf/good.conf.in
@@ -17,6 +17,7 @@
 
 /* cut here */
 dnssec-policy "test" {
+       cdnskey yes;
        cds-digest-types {
                "sha-256";
        };

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index b2683d84a939d76e533fd8a55c812ef58c4ca98d..62386a6106d81c957827fbc3a598f3c210802a70 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -6229,6 +6229,14 @@ retired when the existing key's lifetime ends.
 
 The following options can be specified in a :any:`dnssec-policy` statement:
 
+.. namedconf:statement:: cdnskey
+   :tags: dnssec
+   :short: Specifies whether a CDNSKEY record should be published during KSK rollover.
+
+    When set to the default value of ``yes``, a CDNSKEY record is published
+    during KSK rollovers when the DS of the successor key may be submitted to
+    the parent.
+
 .. namedconf:statement:: cds-digest-types
    :tags: dnssec
    :short: Specifies the digest types to use for CDS resource records.

diff --git a/doc/misc/dnssec-policy.default.conf b/doc/misc/dnssec-policy.default.conf
index e21bb36dc9e45376d7df9fa4491482ecacb5456d..785a36c02eb4f154c41513f0506dec9ef8f2f6c4 100644 (file)
--- a/doc/misc/dnssec-policy.default.conf
+++ b/doc/misc/dnssec-policy.default.conf
@@ -18,6 +18,7 @@ dnssec-policy "default" {
        };
 
        // Key timings
+       cdnskey yes;
        cds-digest-types { 2; };
        dnskey-ttl 3600;
        publish-safety 1h;

diff --git a/doc/misc/options b/doc/misc/options
index e55cbdd0776765c813347f26d0ef9780a490a6c0..dd33c52f14c31adf615ad149833fe1e7bd67a854 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -11,6 +11,7 @@ dlz <string> {
 }; // may occur multiple times
 
 dnssec-policy <string> {
+       cdnskey <boolean>;
        cds-digest-types { <string>; ... };
        dnskey-ttl <duration>;
        keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };

diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index e0d362870f0514f4bbb62744c7b225ccfc343e28..03d1a1fa68869173f850fa1585acfc2c7903f845 100644 (file)
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -462,6 +462,15 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
        dns_kasp_setparentpropagationdelay(kasp, parentpropdelay);
 
        /* Configuration: Keys */
+       obj = NULL;
+       (void)confget(maps, "cdnskey", &obj);
+       if (obj != NULL) {
+               dns_kasp_setcdnskey(kasp, cfg_obj_asboolean(obj));
+       } else {
+               dns_kasp_setcdnskey(kasp, true);
+       }
+
+       obj = NULL;
        (void)confget(maps, "cds-digest-types", &obj);
        if (obj != NULL) {
                for (element = cfg_list_first(obj); element != NULL;

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 7239e39b16ecce6ad17651abfd3d4a631199bedf..3d3153e37456af2325ebf343683539efadc59714 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2205,6 +2205,7 @@ static cfg_type_t cfg_type_checkdstype = {
  * Clauses that can be found in a 'dnssec-policy' statement.
  */
 static cfg_clausedef_t dnssecpolicy_clauses[] = {
+       { "cdnskey", &cfg_type_boolean, 0 },
        { "cds-digest-types", &cfg_type_algorithmlist, 0 },
        { "dnskey-ttl", &cfg_type_duration, 0 },
        { "keys", &cfg_type_kaspkeys, 0 },