From 04a5529c2da2187dde4cfce656fee023d55b1b47 Mon Sep 17 00:00:00 2001 From: Tony Finch Date: Tue, 5 Oct 2021 10:01:54 +1100 Subject: [PATCH] dnssec-dsfromkey should not convert revoked keys it is pointless to convert revoked keys to DS or CDS records as they cannot be used to provide a cryptographic link from the parent zone. --- bin/dnssec/dnssec-dsfromkey.c | 4 ++++ bin/dnssec/dnssec-dsfromkey.rst | 4 ++++ doc/man/dnssec-dsfromkey.1in | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c index 0214e72579..8cb3f41bbf 100644 --- a/bin/dnssec/dnssec-dsfromkey.c +++ b/bin/dnssec/dnssec-dsfromkey.c @@ -260,6 +260,10 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) { fatal("can't convert DNSKEY"); } + if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) { + return; + } + if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) { return; } diff --git a/bin/dnssec/dnssec-dsfromkey.rst b/bin/dnssec/dnssec-dsfromkey.rst index 35d62c0bcb..4d68ca80ef 100644 --- a/bin/dnssec/dnssec-dsfromkey.rst +++ b/bin/dnssec/dnssec-dsfromkey.rst @@ -43,6 +43,10 @@ Description The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records (RRs), or CDS (Child DS) RRs with the ``-C`` option. +By default, only KSKs are converted (keys with flags = 257). The +``-A`` option includes ZSKs (flags = 256). Revoked keys are never +included. + The input keys can be specified in a number of ways: By default, ``dnssec-dsfromkey`` reads a key file named in the format diff --git a/doc/man/dnssec-dsfromkey.1in b/doc/man/dnssec-dsfromkey.1in index 75684f1ea1..6964eaacee 100644 --- a/doc/man/dnssec-dsfromkey.1in +++ b/doc/man/dnssec-dsfromkey.1in @@ -44,6 +44,10 @@ dnssec-dsfromkey \- DNSSEC DS RR generation tool The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource records (RRs), or CDS (Child DS) RRs with the \fB\-C\fP option. .sp +By default, only KSKs are converted (keys with flags = 257). The +\fB\-A\fP option includes ZSKs (flags = 256). Revoked keys are never +included. +.sp The input keys can be specified in a number of ways: .sp By default, \fBdnssec\-dsfromkey\fP reads a key file named in the format