From: Evan Hunt <each@isc.org>
Date: Wed, 22 Jul 2026 21:35:19 +0000 (-0700)
Subject: Don't use wildcard keys in update-policy in ddns-confgen
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=31e37b6178a7d46dc351a38c0e04ea170829030b;p=thirdparty%2Fbind9.git

Don't use wildcard keys in update-policy in ddns-confgen

In ddns-confgen, if the requested key name is a wildcard, don't generate
an update-policy statement, since using a wildcard as an SSU identity
allows other keys that match the wildcard to update records.
---

diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
index 40123b15b8a..5bc7e1d0fbf 100644
--- a/bin/confgen/keygen.c
+++ b/bin/confgen/keygen.c
@@ -95,7 +95,8 @@ alg_bits(dns_secalg_t alg) {
  * rndc.conf and named.conf.
  */
 void
-makesafe_keyname(const char *keyname, char *namebuf, size_t length) {
+makesafe_keyname(const char *keyname, char *namebuf, size_t length,
+		 bool *wildcard) {
 	dns_fixedname_t fixed;
 	dns_name_t *name = dns_fixedname_initname(&fixed);
 	isc_result_t result;
@@ -109,6 +110,8 @@ makesafe_keyname(const char *keyname, char *namebuf, size_t length) {
 		fatal("invalid key name: %s", isc_result_totext(result));
 	}
 
+	SET_IF_NOT_NULL(wildcard, dns_name_iswildcard(name));
+
 	isc_buffer_init(&b, namebuf, length);
 	result = dns_name_totext(name, DNS_NAME_QUOTED | DNS_NAME_OMITFINALDOT,
 				 &b);
diff --git a/bin/confgen/keygen.h b/bin/confgen/keygen.h
index 97be9b4e1cc..8392f020094 100644
--- a/bin/confgen/keygen.h
+++ b/bin/confgen/keygen.h
@@ -21,7 +21,8 @@
 #include <dns/secalg.h>
 
 void
-makesafe_keyname(const char *keyname, char *namebuf, size_t length);
+makesafe_keyname(const char *keyname, char *namebuf, size_t length,
+		 bool *wildcard);
 
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
index 5ddede48ad9..a63614d18c9 100644
--- a/bin/confgen/rndc-confgen.c
+++ b/bin/confgen/rndc-confgen.c
@@ -208,7 +208,7 @@ main(int argc, char **argv) {
 		usage(EXIT_FAILURE);
 	}
 
-	makesafe_keyname(keyname, namebuf, sizeof(namebuf));
+	makesafe_keyname(keyname, namebuf, sizeof(namebuf), NULL);
 
 	if (alg == DST_ALG_HMACMD5) {
 		fprintf(stderr, "warning: use of hmac-md5 for RNDC keys "
diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
index c6af0ed7b6a..88acff9e096 100644
--- a/bin/confgen/tsig-keygen.c
+++ b/bin/confgen/tsig-keygen.c
@@ -94,6 +94,7 @@ main(int argc, char **argv) {
 	int keysize = 256;
 	int len = 0;
 	int ch;
+	bool wildcard;
 
 	isc_commandline_init(argc, argv);
 
@@ -213,7 +214,7 @@ main(int argc, char **argv) {
 		}
 	}
 
-	makesafe_keyname(keyname, namebuf, sizeof(namebuf));
+	makesafe_keyname(keyname, namebuf, sizeof(namebuf), &wildcard);
 
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 
@@ -234,7 +235,10 @@ key \"%s\" {\n\
 	       namebuf, algname, (int)isc_buffer_usedlength(&key_txtbuffer),
 	       (char *)isc_buffer_base(&key_txtbuffer));
 
-	if (!quiet) {
+	if (wildcard && !quiet) {
+		printf("\n\
+# This is a wildcard key, and should not be used in an update-policy.\n");
+	} else if (!quiet) {
 		if (self_domain != NULL) {
 			printf("\n\
 # Then, in the \"zone\" statement for the zone containing the\n\