Allow dig to SIG(0) sign a message

(cherry picked from commit 4d248ee78e310fba2e98bb437793fc26ca8162b7)

diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
index a5bfb865565c64014411e0fdf83296e5d5229707..798931bebc52afae0009cb1722ada7ce52a35abc 100644 (file)
--- a/bin/dig/dig.rst
+++ b/bin/dig/dig.rst
@@ -132,12 +132,14 @@ Options
 
 .. option:: -k keyfile
 
-   This option tells :iscman:`named` to sign queries using TSIG using a key read from the given file. Key
-   files can be generated using :iscman:`tsig-keygen`. When using TSIG
-   authentication with :program:`dig`, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is done
-   by providing appropriate ``key`` and ``server`` statements in
-   :iscman:`named.conf`.
+   This option tells :program:`dig` to sign queries using TSIG or
+   SIG(0) using a key read from the given file. Key files can be
+   generated using :iscman:`tsig-keygen`. When using TSIG authentication
+   with :program:`dig`, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is
+   done by providing appropriate ``key`` and ``server`` statements
+   in :iscman:`named.conf` for TSIG and by looking up the KEY record
+   in zone data for SIG(0).
 
 .. option:: -m
 

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 1ff13b25581f54c2686e55b8909e4ad202c1ad31..99bda7215a8e525575ae7b6cdfeb53830f8b8ef8 100644 (file)
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -146,6 +146,7 @@ const dns_name_t *hmacname = NULL;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
+dst_key_t *sig0key = NULL;
 bool validated = true;
 bool debugging = false;
 bool debugtiming = false;
@@ -1158,6 +1159,10 @@ setup_file_key(void) {
 
        debug("setup_file_key()");
 
+       if (sig0key != NULL) {
+               dst_key_free(&sig0key);
+       }
+
        /* Try reading the key from a K* pair */
        result = dst_key_fromnamedfile(
                keyfile, NULL, DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx, &dstkey);
@@ -1195,18 +1200,20 @@ setup_file_key(void) {
        case DST_ALG_HMACSHA512:
                hmacname = DNS_TSIG_HMACSHA512_NAME;
                break;
-       default:
-               printf(";; Couldn't create key %s: bad algorithm\n",
-                      keynametext);
-               goto failure;
        }
-       result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
-                                          dstkey, false, NULL, 0, 0, mctx,
-                                          NULL, &tsigkey);
-       if (result != ISC_R_SUCCESS) {
-               printf(";; Couldn't create key %s: %s\n", keynametext,
-                      isc_result_totext(result));
-               goto failure;
+
+       if (hmacname != NULL) {
+               result = dns_tsigkey_createfromkey(
+                       dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
+                       0, mctx, NULL, &tsigkey);
+               if (result != ISC_R_SUCCESS) {
+                       printf(";; Couldn't create key %s: %s\n", keynametext,
+                              isc_result_totext(result));
+                       goto failure;
+               }
+       } else {
+               dst_key_attach(dstkey, &sig0key);
+               dst_key_free(&dstkey);
        }
 failure:
        if (dstkey != NULL) {
@@ -2453,6 +2460,10 @@ setup_lookup(dig_lookup_t *lookup) {
                debug("initializing keys");
                result = dns_message_settsigkey(lookup->sendmsg, tsigkey);
                check_result(result, "dns_message_settsigkey");
+       } else if (sig0key != NULL) {
+               debug("initializing keys");
+               result = dns_message_setsig0key(lookup->sendmsg, sig0key);
+               check_result(result, "dns_message_setsig0key");
        }
 
        lookup->sendspace = isc_mem_get(mctx, COMMSIZE);
@@ -4716,10 +4727,17 @@ destroy_libs(void) {
        clear_searchlist();
 
        if (tsigkey != NULL) {
-               debug("freeing key %p", tsigkey);
+               debug("freeing TSIG key %p", tsigkey);
                dns_tsigkey_detach(&tsigkey);
        }
+
+       if (sig0key != NULL) {
+               debug("freeing SIG(0) key %p", sig0key);
+               dst_key_free(&sig0key);
+       }
+
        if (namebuf != NULL) {
+               debug("freeing key %p", tsigkey);
                isc_buffer_free(&namebuf);
        }
 

diff --git a/doc/man/dig.1in b/doc/man/dig.1in
index d5f42ed852941c2d8e2b4059a6f47a0a2888d610..42a8dc7124eacb833e167979a4962b44ee6277a9 100644 (file)
--- a/doc/man/dig.1in
+++ b/doc/man/dig.1in
@@ -153,12 +153,14 @@ Print a usage summary.
 .INDENT 0.0
 .TP
 .B \-k keyfile
-This option tells \fI\%named\fP to sign queries using TSIG using a key read from the given file. Key
-files can be generated using \fI\%tsig\-keygen\fP\&. When using TSIG
-authentication with \fBdig\fP, the name server that is queried needs to
-know the key and algorithm that is being used. In BIND, this is done
-by providing appropriate \fBkey\fP and \fBserver\fP statements in
-\fI\%named.conf\fP\&.
+This option tells \fBdig\fP to sign queries using TSIG or
+SIG(0) using a key read from the given file. Key files can be
+generated using \fI\%tsig\-keygen\fP\&. When using TSIG authentication
+with \fBdig\fP, the name server that is queried needs to
+know the key and algorithm that is being used. In BIND, this is
+done by providing appropriate \fBkey\fP and \fBserver\fP statements
+in \fI\%named.conf\fP for TSIG and by looking up the KEY record
+in zone data for SIG(0).
 .UNINDENT
 .INDENT 0.0
 .TP