Send NOTIFY CDS queries

When the CDS/CDNSKEY RRset is updated, send NOTIFY CDS queries to
parental agents. These servers are looked up in the parent by querying
for NOTIFY records at the parent's apex.

bin/dnssec/dnssec-signzone.c

@@ -106,7 +106,7 @@ static int nsec_datatype = dns_rdatatype_nsec;
 		     "dns_dbiterator_current()")
 
 #define IS_NSEC3  (nsec_datatype == dns_rdatatype_nsec3)
-#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
+#define OPTOUT(x) (((x)&DNS_NSEC3FLAG_OPTOUT) != 0)
 
 #define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
 
@@ -2797,6 +2797,7 @@ build_final_keylist(void) {
 	dns_kasp_digestlist_t digests;
 	dns_kasp_digest_t *d, *d_next;
 	bool cdnskey = false;
+	bool notify = false;
 
 	ISC_LIST_INIT(rmkeys);
 	ISC_LIST_INIT(matchkeys);
@@ -2868,9 +2869,10 @@ findkeys:
 	/*
 	 * Update keylist with sync records.
 	 */
-
 	dns_dnssec_syncupdate(&keylist, &rmkeys, &cdsset, &cdnskeyset, now,
-			      &digests, cdnskey, keyttl, &diff, mctx);
+			      &digests, cdnskey, keyttl, &diff, &notify, mctx);
+
+	UNUSED(notify);
 
 	dns_name_format(gorigin, name, sizeof(name));
 

bin/named/server.c

@@ -1933,6 +1933,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	}
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	setquerystats(zone, mctx, dns_zonestat_none);
@@ -3504,6 +3505,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setautomatic(zone, true);
@@ -3605,6 +3607,7 @@ create_ipv4only_zone(dns_zone_t *pzone, dns_view_t *view,
 		dns_zone_setdbtype(zone, dbtypec, dbtype);
 		dns_zone_setdialup(zone, dns_dialuptype_no);
 		dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+		dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 		dns_zone_setnotifytype(zone, dns_notifytype_no);
 		dns_zone_setautomatic(zone, true);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
@@ -6914,6 +6917,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	dns_zone_setjournalsize(zone, 0);

bin/named/zoneconf.c

@@ -881,6 +881,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *kaspname = NULL;
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
+	dns_notifycdstype_t notifycdstype = dns_notifycdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	uint32_t count;
 	unsigned int dbargc;
@@ -1280,6 +1281,19 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setalsonotify(zone, NULL, NULL, NULL, NULL, 0);
 		}
 
+		obj = NULL;
+		result = named_config_get(maps, "notify-cds", &obj);
+		if (result == ISC_R_SUCCESS) {
+			if (cfg_obj_isboolean(obj)) {
+				if (cfg_obj_asboolean(obj)) {
+					notifycdstype = dns_notifycdstype_yes;
+				} else {
+					notifycdstype = dns_notifycdstype_no;
+				}
+			}
+		}
+		dns_zone_setnotifycdstype(zone, notifycdstype);
+
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);

lib/dns/dnssec.c

@@ -1965,7 +1965,7 @@ exists(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 static isc_result_t
 add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 	dns_rdataset_t *cds, unsigned int digesttype, dns_ttl_t ttl,
-	dns_diff_t *diff, isc_mem_t *mctx) {
+	dns_diff_t *diff, bool *notify, isc_mem_t *mctx) {
 	isc_result_t r = ISC_R_SUCCESS;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
@@ -1993,6 +1993,9 @@ add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 			      "CDS (%s) for key %s is now published", algbuf,
 			      keystr);
 		r = addrdata(&cdsrdata, diff, origin, ttl, mctx);
+		if (r == ISC_R_SUCCESS) {
+			*notify = true;
+		}
 	}
 	return (r);
 }
@@ -2000,7 +2003,7 @@ add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 static isc_result_t
 delete_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 	   dns_rdataset_t *cds, unsigned int digesttype, dns_diff_t *diff,
-	   isc_mem_t *mctx) {
+	   bool *notify, isc_mem_t *mctx) {
 	isc_result_t r = ISC_R_SUCCESS;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
@@ -2021,6 +2024,9 @@ delete_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 			      "CDS (%s) for key %s is now deleted", algbuf,
 			      keystr);
 		r = delrdata(&cdsrdata, diff, origin, cds->ttl, mctx);
+		if (r == ISC_R_SUCCESS) {
+			*notify = true;
+		}
 	}
 	return (r);
 }
@@ -2030,7 +2036,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
 		      bool gencdnskey, dns_ttl_t ttl, dns_diff_t *diff,
-		      isc_mem_t *mctx) {
+		      bool *notify, isc_mem_t *mctx) {
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	isc_result_t result;
 	dns_dnsseckey_t *key;
@@ -2058,7 +2064,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 			{
 				RETERR(add_cds(key, &cdnskeyrdata,
 					       (const char *)keystr, cds,
-					       alg->digest, ttl, diff, mctx));
+					       alg->digest, ttl, diff, notify,
+					       mctx));
 			}
 
 			if (gencdnskey &&
@@ -2072,6 +2079,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					keystr);
 				RETERR(addrdata(&cdnskeyrdata, diff, origin,
 						ttl, mctx));
+				*notify = true;
 			}
 		}
 
@@ -2083,13 +2091,16 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 				/* Delete all possible CDS records */
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA1, diff, mctx);
+					   DNS_DSDIGEST_SHA1, diff, notify,
+					   mctx);
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA256, diff, mctx);
+					   DNS_DSDIGEST_SHA256, diff, notify,
+					   mctx);
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA384, diff, mctx);
+					   DNS_DSDIGEST_SHA384, diff, notify,
+					   mctx);
 			}
 
 			if (dns_rdataset_isassociated(cdnskey)) {
@@ -2104,6 +2115,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					RETERR(delrdata(&cdnskeyrdata, diff,
 							origin, cdnskey->ttl,
 							mctx));
+					*notify = true;
 				}
 			}
 		}
@@ -2132,11 +2144,13 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 
 		if (dns_rdataset_isassociated(cds)) {
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA1, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA1, diff, notify, mctx);
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA256, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA256, diff, notify,
+				   mctx);
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA384, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA384, diff, notify,
+				   mctx);
 		}
 
 		if (dns_rdataset_isassociated(cdnskey)) {
@@ -2148,12 +2162,11 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					keystr);
 				RETERR(delrdata(&cdnskeyrdata, diff, origin,
 						cdnskey->ttl, mctx));
+				*notify = true;
 			}
 		}
 	}
 
-	result = ISC_R_SUCCESS;
-
 failure:
 	return (result);
 }

lib/dns/include/dns/dnssec.h

@@ -371,7 +371,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
 		      bool gencdnskey, dns_ttl_t hint_ttl, dns_diff_t *diff,
-		      isc_mem_t *mctx);
+		      bool *notify, isc_mem_t *mctx);
 /*%<
  * Update the CDS and CDNSKEY RRsets, adding and removing keys as needed.
  *
@@ -386,7 +386,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
  * 'hint_ttl' is the TTL to use for the CDS and CDNSKEY RRsets if there is no
  * existing RRset.
  *
- * Any changes made also cause a dns_difftuple to be added to 'diff'.
+ * Any changes made also cause a dns_difftuple to be added to 'diff', and
+ * 'notify' to be set to true.
  *
  * Requires:
  *\li	'keys' is not NULL.

lib/dns/include/dns/types.h

@@ -211,6 +211,11 @@ typedef enum {
 	dns_checkdstype_explicit = 2
 } dns_checkdstype_t;
 
+typedef enum {
+	dns_notifycdstype_no = 0,
+	dns_notifycdstype_yes = 1
+} dns_notifycdstype_t;
+
 typedef enum {
 	dns_notifytype_no = 0,
 	dns_notifytype_yes = 1,

lib/dns/include/dns/zone.h

@@ -1531,6 +1531,12 @@ dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype);
  * Sets zone notify method to "notifytype"
  */
 
+void
+dns_zone_setnotifycdstype(dns_zone_t *zone, dns_notifycdstype_t notifycdstype);
+/*%<
+ * Sets zone checkds method to "notifycdstype"
+ */
+
 void
 dns_zone_setcheckdstype(dns_zone_t *zone, dns_checkdstype_t checkdstype);
 /*%<