ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Better PKCS#11 label creation

Browse Source 
When using the same PKCS#11 URI for a zone that uses different
DNSSEC policies, the PKCS#11 label could collide, i.e. the same
label could be used for different keys. Add the policy name to
the label to make it more unique.

Also, the zone name could contain characters that are interpreted
as special characters when parsing the PKCS#11 URI string. Mangle
the zone name through 'dns_name_tofilenametext()' to make it
PKCS#11 safe.

Move the creation to a separate function for clarity.

Furthermore, add a log message whenever a PKCS#11 object has been
successfully created.
This commit is contained in:
Matthijs Mekking
2023-11-17 10:45:05 +01:00
parent 89cf3049d4
commit 934d17255e
4 changed files with 111 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
bin/dnssec/dnssec-keygen.c
View File

@@ -697,10 +697,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
fprintf(stderr, "Generating key pair.");
}
if (ctx->keystore != NULL) {
ret = dns_keystore_keygen(ctx->keystore, name,
ctx->rdclass, mctx, ctx->alg,
ctx->size, flags, &key);
if (ctx->keystore != NULL && ctx->policy != NULL) {
ret = dns_keystore_keygen(
ctx->keystore, name, ctx->policy, ctx->rdclass,
mctx, ctx->alg, ctx->size, flags, &key);
} else if (!ctx->quiet && show_progress) {
ret = dst_key_generate(name, ctx->alg, ctx->size, param,
flags, ctx->protocol,