From 07de3d8466309d89eaa0159043b6e51ad0e2da58 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 19 Apr 2024 14:41:41 +0200
Subject: [PATCH] Implement dummy 'rndc skr -import' command

Add the code and documentation required to provide KSR import using
rndc.  This is just the command, and the feature is at this point in
time still not implemented.

(cherry picked from commit edbb219fda800eaa8652ee174604d4a9fe4cac2b)
---
 bin/named/control.c               |  2 ++
 bin/named/include/named/control.h |  1 +
 bin/named/include/named/server.h  |  6 ++++
 bin/named/server.c                | 58 +++++++++++++++++++++++++++++++
 bin/rndc/rndc.c                   |  3 ++
 bin/rndc/rndc.rst                 |  5 +++
 6 files changed, 75 insertions(+)

diff --git a/bin/named/control.c b/bin/named/control.c
index a3e009799e..6dd41064c2 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -224,6 +224,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
+		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
index ee938a5973..97fff073b1 100644
--- a/bin/named/include/named/control.h
+++ b/bin/named/include/named/control.h
@@ -58,6 +58,7 @@
 #define NAMED_COMMAND_MODZONE	   "modzone"
 #define NAMED_COMMAND_DELZONE	   "delzone"
 #define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_SYNC	   "sync"
 #define NAMED_COMMAND_SIGNING	   "signing"
 #define NAMED_COMMAND_DNSSEC	   "dnssec"
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 52a13d5658..ad82f900ed 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -375,3 +375,9 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
+
+/*%
+ * Import SKR file for offline KSK signing.
+ */
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
diff --git a/bin/named/server.c b/bin/named/server.c
index c78290f432..2fe757e029 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -16703,3 +16703,61 @@ cleanup:
 
 	return (result);
 }
+
+isc_result_t
+named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_zone_t *zone = NULL;
+	dns_kasp_t *kasp = NULL;
+	const char *ptr;
+	char skrfile[PATH_MAX];
+
+	/* Skip the command name. */
+	ptr = next_token(lex, text);
+	if (ptr == NULL) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+
+	/* Find out what we are to do. */
+	ptr = next_token(lex, text);
+	if (ptr == NULL) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+
+	if (strcasecmp(ptr, "-import") != 0) {
+		CHECK(DNS_R_SYNTAX);
+	}
+
+	ptr = next_token(lex, NULL);
+	if (ptr == NULL) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+	(void)snprintf(skrfile, sizeof(skrfile), "%s", ptr);
+
+	CHECK(zone_from_args(server, lex, NULL, &zone, NULL, text, false));
+	if (zone == NULL) {
+		CHECK(ISC_R_UNEXPECTEDEND);
+	}
+	kasp = dns_zone_getkasp(zone);
+	if (kasp == NULL) {
+		CHECK(putstr(text, "zone does not have a dnssec-policy"));
+		CHECK(putnull(text));
+		goto cleanup;
+	}
+
+	if (!dns_kasp_offlineksk(kasp)) {
+		CHECK(putstr(text, "zone does not have offline-ksk enabled"));
+		CHECK(putnull(text));
+		goto cleanup;
+	}
+
+	CHECK(putstr(text, "import command not implemented"));
+	CHECK(putnull(text));
+
+cleanup:
+	if (zone != NULL) {
+		dns_zone_detach(&zone);
+	}
+
+	return (result);
+}
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 1d35ded62b..5f17b77a01 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -132,6 +132,9 @@ command is one of the following:\n\
   halt		Stop the server without saving pending updates.\n\
   halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
+  skr -import file zone [class [view]]\n\
+		Import a SKR file for the specified zone, for offline KSK\n\
+		signing.\n\
   loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
   managed-keys refresh [class [view]]\n\
diff --git a/bin/rndc/rndc.rst b/bin/rndc/rndc.rst
index 9df484cf3d..d1ec71d8da 100644
--- a/bin/rndc/rndc.rst
+++ b/bin/rndc/rndc.rst
@@ -257,6 +257,11 @@ Currently supported commands are:
 
    See also :option:`rndc stop`.
 
+.. option:: skr -import file zone [class [view]]
+
+   This command allows you to import a SKR file for the specified zone, to
+   support offline KSK signing.
+
 .. option:: loadkeys [zone [class [view]]]
 
    This command fetches all DNSSEC keys for the given zone from the key directory. If