WIP: NOTIFY(CDNSKEY)

lib/dns/dnssec.c

@@ -2260,7 +2260,7 @@ failure:
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
-		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
+		      dns_ttl_t hint_ttl, dns_diff_t *diff, bool *notify, isc_mem_t *mctx,
 		      void (*report)(const char *, ...)
 			      ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
@@ -2366,6 +2366,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					keystr1,
 					key1->ksk ? (key1->zsk ? "CSK" : "KSK")
 						  : "ZSK");
+				*notify = true;
 				if (key1->hint_sign || key1->force_sign) {
 					key1->first_sign = true;
 					isc_log_write(
@@ -2406,6 +2407,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					keystr2,
 					key2->ksk ? (key2->zsk ? "CSK" : "KSK")
 						  : "ZSK");
+				*notify = true;
 			} else {
 				dns_dnsseckey_destroy(mctx, &key2);
 			}
@@ -2431,6 +2433,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					key2->ksk ? (key2->zsk ? "CSK" : "KSK")
 						  : "ZSK",
 					dst_key_id(key1->key));
+				*notify = true;
 			} else {
 				dns_dnsseckey_destroy(mctx, &key2);
 			}

lib/dns/include/dns/dnssec.h

@@ -338,7 +338,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
-		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
+		      dns_ttl_t hint_ttl, dns_diff_t *diff, bool *notify, isc_mem_t *mctx,
 		      void (*report)(const char *, ...)
 			      ISC_FORMAT_PRINTF(1, 2));
 /*%<
@@ -353,6 +353,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
  *   remove it from 'keys', and place a dns_difftuple into 'diff' so
  *   the key can be removed from the DNSKEY set.  if 'removed' is non-NULL,
  *   copy the key into that list; otherwise destroy it.
+ * - The 'notify' parameter stores whether a NOTIFY DNSKEY needs to be sent.
  * - Otherwise, make sure keys has current metadata.
  *
  * 'hint_ttl' is the TTL to use for the DNSKEY RRset if there is no

lib/dns/zone.c

@@ -22139,6 +22139,15 @@ zone_notifycds(dns_zone_t *zone) {
 #endif /* ifdef ENABLE_AFL */
 }
 
+static void
+zone_notifycdnskey(dns_zone_t *zone) {
+	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+		dnssec_log(zone, ISC_LOG_DEBUG(3),
+			   "Creating zone NOTIFY fetch in "
+			   "zone_notifycdnskey()");
+	}
+}
+
 static void
 zone_rekey(dns_zone_t *zone) {
 	isc_result_t result;
@@ -22300,7 +22309,8 @@ zone_rekey(dns_zone_t *zone) {
 		bool cdnskeydel = false;
 		bool cdnskeypub = true;
 		bool sane_diff, sane_dnskey;
-		bool notify = false;
+		bool notifycds = false;
+		bool notifycdnskey = false;
 		isc_stdtime_t when;
 
 		/*
@@ -22376,8 +22386,8 @@ zone_rekey(dns_zone_t *zone) {
 		}
 
 		result = dns_dnssec_updatekeys(&dnskeys, &keys, &rmkeys,
-					       &zone->origin, ttl, &diff, mctx,
-					       dnssec_report);
+					       &zone->origin, ttl, &diff,
+					       &notifycdnskey, mctx, dnssec_report);
 		/*
 		 * Keys couldn't be updated for some reason;
 		 * try again later.
@@ -22394,7 +22404,7 @@ zone_rekey(dns_zone_t *zone) {
 		 */
 		result = dns_dnssec_syncupdate(
 			&dnskeys, &rmkeys, &cdsset, &cdnskeyset, now, &digests,
-			cdnskeypub, ttl, &diff, &notify, mctx);
+			cdnskeypub, ttl, &diff, &notifycds, mctx);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_rekey:couldn't update CDS/CDNSKEY: %s",
@@ -22430,6 +22440,10 @@ zone_rekey(dns_zone_t *zone) {
 				cdnskeydel = allow;
 			}
 		}
+		/*
+		 * WMM: Also need to update notifycds if CDS RRset is set
+		 * to DELETE.
+		 */
 		result = dns_dnssec_syncdelete(
 			&cdsset, &cdnskeyset, &zone->origin, zone->rdclass, ttl,
 			&diff, mctx, cdsdel, cdnskeydel);
@@ -22441,11 +22455,16 @@ zone_rekey(dns_zone_t *zone) {
 			goto failure;
 		}
 
-		if (notify) {
+		if (notifycds) {
 			/* Send NOTIFY(CDS) to parents. */
 			zone_notifycds(zone);
 		}
 
+		if (notifycdnskey) {
+			/* Send NOTIFY(CDNSKEY) to peers. */
+			zone_notifycdnskey(zone);
+		}
+
 		/*
 		 * See if any pre-existing keys have newly become active;
 		 * also, see if any new key is for a new algorithm, as in that