Implement dummy 'rndc skr -import' command

Add the code and documentation required to provide KSR import using
rndc.  This is just the command, and the feature is at this point in
time still not implemented.

diff --git a/bin/named/control.c b/bin/named/control.c
index 8ea363b5bdb28685c7aa412d3c21d477849ff212..7a60bae870761fc56fd5e9165ec86157dfd86093 100644 (file)
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -228,6 +228,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
                result = named_server_flushnode(named_g_server, lex, true);
        } else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
                result = named_server_freeze(named_g_server, true, lex, text);
+       } else if (command_compare(command, NAMED_COMMAND_SKR)) {
+               result = named_server_skr(named_g_server, lex, text);
        } else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
                   command_compare(command, NAMED_COMMAND_SIGN))
        {

diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
index 6f3660ad0f4487b41867cc8c5967aa25c48d7594..c00900847fd425d06b740d404f767c11d56efc0b 100644 (file)
--- a/bin/named/include/named/control.h
+++ b/bin/named/include/named/control.h
@@ -61,6 +61,7 @@
 #define NAMED_COMMAND_SHOWZONE    "showzone"
 #define NAMED_COMMAND_SIGN        "sign"
 #define NAMED_COMMAND_SIGNING     "signing"
+#define NAMED_COMMAND_SKR         "skr"
 #define NAMED_COMMAND_STATUS      "status"
 #define NAMED_COMMAND_STOP        "stop"
 #define NAMED_COMMAND_SYNC        "sync"

diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 9ad18bde7f36a0283ad3a38a012cbd6ce0b2a753..a95c6544fb4d5b694c9414de88f741460a487fec 100644 (file)
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -376,3 +376,9 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
                        isc_buffer_t **text);
+
+/*%
+ * Import SKR file for offline KSK signing.
+ */
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);

diff --git a/bin/named/server.c b/bin/named/server.c
index bc96a77ce38853dae5b26b79a291d8d155b5e68a..6addb6108ad54ceb705e5c56e7d68220a7faa704 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -16667,3 +16667,61 @@ cleanup:
 
        return (result);
 }
+
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+       isc_result_t result = ISC_R_SUCCESS;
+       dns_zone_t *zone = NULL;
+       dns_kasp_t *kasp = NULL;
+       const char *ptr;
+       char skrfile[PATH_MAX];
+
+       /* Skip the command name. */
+       ptr = next_token(lex, text);
+       if (ptr == NULL) {
+               return (ISC_R_UNEXPECTEDEND);
+       }
+
+       /* Find out what we are to do. */
+       ptr = next_token(lex, text);
+       if (ptr == NULL) {
+               return (ISC_R_UNEXPECTEDEND);
+       }
+
+       if (strcasecmp(ptr, "-import") != 0) {
+               CHECK(DNS_R_SYNTAX);
+       }
+
+       ptr = next_token(lex, NULL);
+       if (ptr == NULL) {
+               return (ISC_R_UNEXPECTEDEND);
+       }
+       (void)snprintf(skrfile, sizeof(skrfile), "%s", ptr);
+
+       CHECK(zone_from_args(server, lex, NULL, &zone, NULL, text, false));
+       if (zone == NULL) {
+               CHECK(ISC_R_UNEXPECTEDEND);
+       }
+       kasp = dns_zone_getkasp(zone);
+       if (kasp == NULL) {
+               CHECK(putstr(text, "zone does not have a dnssec-policy"));
+               CHECK(putnull(text));
+               goto cleanup;
+       }
+
+       if (!dns_kasp_offlineksk(kasp)) {
+               CHECK(putstr(text, "zone does not have offline-ksk enabled"));
+               CHECK(putnull(text));
+               goto cleanup;
+       }
+
+       CHECK(putstr(text, "import command not implemented"));
+       CHECK(putnull(text));
+
+cleanup:
+       if (zone != NULL) {
+               dns_zone_detach(&zone);
+       }
+
+       return (result);
+}

diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 0cdc162bb7304675cd4617c1d12a3696733eb2fe..d3e14a9c291e90131dce7a11b078273ed303b0b8 100644 (file)
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -132,6 +132,9 @@ command is one of the following:\n\
   halt         Stop the server without saving pending updates.\n\
   halt -p      Stop the server without saving pending updates reporting\n\
                process id.\n\
+  skr -import file zone [class [view]]\n\
+               Import a SKR file for the specified zone, for offline KSK\n\
+               signing.\n\
   loadkeys zone [class [view]]\n\
                Update keys without signing immediately.\n\
   managed-keys refresh [class [view]]\n\

diff --git a/bin/rndc/rndc.rst b/bin/rndc/rndc.rst
index 531a56430e47cc29573a66e58e34a33cc5bf4109..55ea4d3147adceb2bdb263299840ca5205f53a8b 100644 (file)
--- a/bin/rndc/rndc.rst
+++ b/bin/rndc/rndc.rst
@@ -266,6 +266,11 @@ Currently supported commands are:
 
    See also :option:`rndc stop`.
 
+.. option:: skr -import file zone [class [view]]
+
+   This command allows you to import a SKR file for the specified zone, to
+   support offline KSK signing.
+
 .. option:: loadkeys [zone [class [view]]]
 
    This command fetches all DNSSEC keys for the given zone from the key directory. If