upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-16 00:02:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

dnssec-dsfromkey should not convert revoked keys

Browse source 
it is pointless to convert revoked keys to DS or CDS records as
they cannot be used to provide a cryptographic link from the parent
zone.
This commit is contained in:
Tony Finch 2021-10-05 10:01:54 +11:00 committed by Mark Andrews
parent 3443938b99
commit 04a5529c2d
3 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
bin/dnssec/dnssec-dsfromkey.c
View file

@ -260,6 +260,10 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
fatal("can't convert DNSKEY");
}
if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
return;
}
if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) {
return;
}

4
bin/dnssec/dnssec-dsfromkey.rst
View file

@ -43,6 +43,10 @@ Description
The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
(RRs), or CDS (Child DS) RRs with the ``-C`` option.
By default, only KSKs are converted (keys with flags = 257). The
``-A`` option includes ZSKs (flags = 256). Revoked keys are never
included.
The input keys can be specified in a number of ways:
By default, ``dnssec-dsfromkey`` reads a key file named in the format

4
doc/man/dnssec-dsfromkey.1in
View file

@ -44,6 +44,10 @@ dnssec-dsfromkey \- DNSSEC DS RR generation tool
The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource records
(RRs), or CDS (Child DS) RRs with the \fB\-C\fP option.
.sp
By default, only KSKs are converted (keys with flags = 257). The
\fB\-A\fP option includes ZSKs (flags = 256). Revoked keys are never
included.
.sp
The input keys can be specified in a number of ways:
.sp
By default, \fBdnssec\-dsfromkey\fP reads a key file named in the format