WIP: NOTIFY(CDNSKEY)

Make sure the signer sends out NOTIFY CDS queries.

bin/dnssec/dnssec-signzone.c

@@ -106,7 +106,7 @@ static int nsec_datatype = dns_rdatatype_nsec;
 		     "dns_dbiterator_current()")
 
 #define IS_NSEC3  (nsec_datatype == dns_rdatatype_nsec3)
-#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
+#define OPTOUT(x) (((x)&DNS_NSEC3FLAG_OPTOUT) != 0)
 
 #define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
 
@@ -2797,6 +2797,7 @@ build_final_keylist(void) {
 	dns_kasp_digestlist_t digests;
 	dns_kasp_digest_t *d, *d_next;
 	bool cdnskey = false;
+	bool notify = false;
 
 	ISC_LIST_INIT(rmkeys);
 	ISC_LIST_INIT(matchkeys);
@@ -2868,9 +2869,10 @@ findkeys:
 	/*
 	 * Update keylist with sync records.
 	 */
-
 	dns_dnssec_syncupdate(&keylist, &rmkeys, &cdsset, &cdnskeyset, now,
-			      &digests, cdnskey, keyttl, &diff, mctx);
+			      &digests, cdnskey, keyttl, &diff, &notify, mctx);
+
+	UNUSED(notify);
 
 	dns_name_format(gorigin, name, sizeof(name));
 

bin/named/server.c

@@ -1933,6 +1933,7 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	}
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	setquerystats(zone, mctx, dns_zonestat_none);
@@ -3504,6 +3505,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setautomatic(zone, true);
@@ -3605,6 +3607,7 @@ create_ipv4only_zone(dns_zone_t *pzone, dns_view_t *view,
 		dns_zone_setdbtype(zone, dbtypec, dbtype);
 		dns_zone_setdialup(zone, dns_dialuptype_no);
 		dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+		dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 		dns_zone_setnotifytype(zone, dns_notifytype_no);
 		dns_zone_setautomatic(zone, true);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
@@ -6914,6 +6917,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
+	dns_zone_setnotifycdstype(zone, dns_notifycdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	dns_zone_setjournalsize(zone, 0);

bin/named/zoneconf.c

@@ -881,6 +881,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *kaspname = NULL;
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
+	dns_notifycdstype_t notifycdstype = dns_notifycdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	uint32_t count;
 	unsigned int dbargc;
@@ -1280,6 +1281,19 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setalsonotify(zone, NULL, NULL, NULL, NULL, 0);
 		}
 
+		obj = NULL;
+		result = named_config_get(maps, "notify-cds", &obj);
+		if (result == ISC_R_SUCCESS) {
+			if (cfg_obj_isboolean(obj)) {
+				if (cfg_obj_asboolean(obj)) {
+					notifycdstype = dns_notifycdstype_yes;
+				} else {
+					notifycdstype = dns_notifycdstype_no;
+				}
+			}
+		}
+		dns_zone_setnotifycdstype(zone, notifycdstype);
+
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);

bin/tests/system/checkzone/zones/good-notify.db

@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+		NOTIFY	CDS 1 59 scanner.parent.
+		NOTIFY	CSYNC 1 60 scanner.parent.
+		NOTIFY	DNSKEY 1 5900 ctrl.multi-signer.example

bin/tests/system/genzone.sh

@@ -382,7 +382,17 @@ zonemd02		ZONEMD	2019020700 1 2 (
                                 2E0CC4827E7A3204F166B47E5613FD27
 				)
 
-; type 64 -- 98 (unassigned)
+; type 64
+
+svcb0			SVCB	0 example.net.
+svcb1			SVCB	1 . port=60
+
+; type 65
+
+https0			HTTPS	0 example.net.
+https1			HTTPS	1 . port=60
+
+; type 66 -- 98 (unassigned)
 
 ; type 99
 spf01			SPF	"v=spf1 -all"
@@ -494,11 +504,9 @@ dlv			DLV	30795 1 1 (
 
 ; type 65280-65534 (private use)
 
-https0			HTTPS	0 example.net.
-https1			HTTPS	1 . port=60
-
-svcb0			SVCB	0 example.net.
-svcb1			SVCB	1 . port=60
+notify		         NOTIFY		CDS	1 59 scanner.parent.
+notify		         NOTIFY		CSYNC	1 59 scanner.parent.
+notify		         NOTIFY		DSNSKEY	1 5900 ctrl.multi-signer.example.
 
 ; keydata (internal type used for managed keys)
 keydata			TYPE65533	\# 0

bin/tests/system/multisigner/ns1/named.conf.in

@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS1
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db.signed";
+};

bin/tests/system/multisigner/ns1/root.db.in

@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@			SOA	me. hostmaster. 1 1800 900 604800 86400
+
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+
+multisigner.		NS	ns2.multisigner.
+ns2.multisigner.	A	10.53.0.2
+
+secondary.		NS	ns2.secondary.
+ns2.secondary.		A	10.53.0.2

bin/tests/system/multisigner/ns1/setup.sh

@@ -0,0 +1,35 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+set -e
+
+zone=.
+infile=root.db.in
+zonefile=root.db
+
+echo_i "ns1/setup.sh"
+
+ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+
+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>signer.root.out
+
+# Configure the resolving server with a static key.
+keyfile_to_static_ds "$ksk" >trusted.conf
+cp trusted.conf ../ns3/trusted.conf
+cp trusted.conf ../ns4/trusted.conf
+cp trusted.conf ../ns5/trusted.conf

bin/tests/system/multisigner/ns2/multisigner.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  me.multisigner. hostmaster.multisigner. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+multisigner.			NS	ns2
+ns2.multisigner.		A	10.53.0.2
+
+multisigner.			NOTIFY	CDS 1 @PORT@ scanner.multisigner.
+scanner.multisigner.		A	10.53.0.2
+
+model2.multisigner.		NS	ns3
+model2.multisigner.		NS	ns4
+ns3.model2.multisigner.		A	10.53.0.3
+ns4.model2.multisigner.		A	10.53.0.4

bin/tests/system/multisigner/ns2/named.conf.in

@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
+
+zone "multisigner" {
+	type primary;
+	dnssec-policy default;
+	file "multisigner.db";
+};
+
+zone "secondary" {
+	type primary;
+	dnssec-policy default;
+	file "secondary.db";
+};

bin/tests/system/multisigner/ns2/secondary.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  me.secondary. hostmaster.secondary. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+secondary.			NS	ns2
+ns2.secondary.			A	10.53.0.2
+
+secondary.			NOTIFY	CDS 1 @PORT@ scanner.secondary.
+scanner.secondary.		A	10.53.0.2
+
+model2.secondary.		NS	ns3
+model2.secondary.		NS	ns4
+ns3.model2.secondary.		A	10.53.0.3
+ns4.model2.secondary.		A	10.53.0.4

bin/tests/system/multisigner/ns2/setup.sh

@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+for zn in multisigner secondary; do
+  zone="${zn}"
+  infile="${zn}.db.in"
+  unsigned="${zn}.db.unsigned"
+  zonefile="${zn}.db"
+
+  copy_setports $infile $unsigned
+
+  csk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+  cat "$csk.key" >> "$unsigned"
+  private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$csk" >> "$unsigned"
+
+  $SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $unsigned > signer.out.$zone 2>&1
+
+  cp "dsset-${zn}." ../ns1/
+done

bin/tests/system/multisigner/ns3/named.conf.in

@@ -24,9 +24,9 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-transfer { any; };
-	recursion no;
 	key-directory ".";
-	dnssec-validation no;
+	recursion yes;
+	dnssec-validation yes;
 };
 
 key rndc_key {
@@ -53,3 +53,10 @@ zone "model2.secondary." {
 	dnssec-policy model2;
 	inline-signing yes;
 };
+
+zone "." {
+        type hint;
+        file "../../_common/root.hint";
+};
+
+include "trusted.conf";

bin/tests/system/multisigner/ns3/setup.sh

@@ -30,6 +30,8 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1
 # ZSK will be added to the other provider with nsupdate.
 cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk"
+# Append DS to DS from ns4
+$DSFROMKEY ${KSK} >> "../ns2/dsset-${zone}."
 
 zone="model2.secondary"
 echo_i "setting up zone: $zone"
@@ -42,3 +44,5 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1
 # ZSK will be added to the other provider with nsupdate.
 cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk"
+# Append DS to DS from ns4
+$DSFROMKEY ${KSK} >> "../ns2/dsset-${zone}."

bin/tests/system/multisigner/ns4/named.conf.in

@@ -53,3 +53,8 @@ zone "model2.secondary." {
 	dnssec-policy model2;
 	inline-signing yes;
 };
+
+zone "." {
+        type hint;
+        file "../../_common/root.hint";
+};

bin/tests/system/multisigner/ns4/setup.sh

@@ -31,6 +31,8 @@ $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1
 # ZSK will be added to the other provider with nsupdate.
 cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk"
 
+$DSFROMKEY ${KSK} > "../ns2/dsset-${zone}."
+
 zone="model2.secondary"
 echo_i "setting up zone: $zone"
 zonefile="${zone}.db"
@@ -42,3 +44,5 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1
 # ZSK will be added to the other provider with nsupdate.
 cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk"
+
+$DSFROMKEY ${KSK} > "../ns2/dsset-${zone}."

bin/tests/system/multisigner/ns5/named.conf.in

@@ -43,3 +43,8 @@ zone "model2.secondary." {
 	allow-update { any; };
 	file "model2.secondary.db";
 };
+
+zone "." {
+        type hint;
+        file "../../_common/root.hint";
+};

bin/tests/system/multisigner/setup.sh

@@ -18,12 +18,14 @@ set -e
 
 $SHELL clean.sh
 
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 
 (
-  cd ns3
+  cd ns5
   $SHELL setup.sh
 )
 (
@@ -31,6 +33,14 @@ copy_setports ns5/named.conf.in ns5/named.conf
   $SHELL setup.sh
 )
 (
-  cd ns5
+  cd ns3
+  $SHELL setup.sh
+)
+(
+  cd ns2
+  $SHELL setup.sh
+)
+(
+  cd ns1
   $SHELL setup.sh
 )

bin/tests/system/multisigner/tests.sh

@@ -83,6 +83,17 @@ check_keytimes
 check_apex
 dnssec_verify
 
+# Check if NOTIFY CDS queries have been sent.
+n=$((n + 1))
+ret=0
+echo_i "check that NOTIFY CDS queries have been sent ($n)"
+# We check by grepping the logs. A better test would be to
+# ensure that the NOTIFY message was actually sent.
+grep "zone model2.multisigner/IN: notifycds: send NOTIFY CDS query to scanner.multisigner" ns3/named.run > /dev/null || ret=1
+grep "zone model2.secondary/IN (signed): notifycds: send NOTIFY CDS query to scanner.secondary" ns3/named.run > /dev/null || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 #
 # Update DNSKEY RRset.
 #

bin/tests/system/rrchecker/privatelist.good

@@ -0,0 +1 @@
+NOTIFY

bin/tests/system/xfer/dig1.good

@@ -110,6 +110,9 @@ ninfo12.example.	3600	IN	NINFO	"\"foo\""
 ninfo13.example.	3600	IN	NINFO	"foo;"
 ninfo14.example.	3600	IN	NINFO	"foo;"
 ninfo15.example.	3600	IN	NINFO	"bar\\;"
+notify.example.		3600	IN	NOTIFY	DNSKEY 1 5900 ctrl.multi-signer.example.
+notify.example.		3600	IN	NOTIFY	CDS 1 59 scanner.parent.
+notify.example.		3600	IN	NOTIFY	CSYNC 1 59 scanner.parent.
 ns2.example.		3600	IN	A	10.53.0.2
 ns3.example.		3600	IN	A	10.53.0.3
 nsap-ptr01.example.	3600	IN	NSAP-PTR .

bin/tests/system/xfer/dig2.good

@@ -110,6 +110,9 @@ ninfo12.example.	3600	IN	NINFO	"\"foo\""
 ninfo13.example.	3600	IN	NINFO	"foo;"
 ninfo14.example.	3600	IN	NINFO	"foo;"
 ninfo15.example.	3600	IN	NINFO	"bar\\;"
+notify.example.		3600	IN	NOTIFY	DNSKEY 1 5900 ctrl.multi-signer.example.
+notify.example.		3600	IN	NOTIFY	CDS 1 59 scanner.parent.
+notify.example.		3600	IN	NOTIFY	CSYNC 1 59 scanner.parent.
 ns2.example.		3600	IN	A	10.53.0.2
 ns3.example.		3600	IN	A	10.53.0.3
 nsap-ptr01.example.	3600	IN	NSAP-PTR .

lib/dns/dnssec.c

@@ -1965,7 +1965,7 @@ exists(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 static isc_result_t
 add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 	dns_rdataset_t *cds, unsigned int digesttype, dns_ttl_t ttl,
-	dns_diff_t *diff, isc_mem_t *mctx) {
+	dns_diff_t *diff, bool *notify, isc_mem_t *mctx) {
 	isc_result_t r = ISC_R_SUCCESS;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
@@ -1993,6 +1993,9 @@ add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 			      "CDS (%s) for key %s is now published", algbuf,
 			      keystr);
 		r = addrdata(&cdsrdata, diff, origin, ttl, mctx);
+		if (r == ISC_R_SUCCESS) {
+			*notify = true;
+		}
 	}
 	return (r);
 }
@@ -2000,7 +2003,7 @@ add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 static isc_result_t
 delete_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 	   dns_rdataset_t *cds, unsigned int digesttype, dns_diff_t *diff,
-	   isc_mem_t *mctx) {
+	   bool *notify, isc_mem_t *mctx) {
 	isc_result_t r = ISC_R_SUCCESS;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
@@ -2021,6 +2024,9 @@ delete_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
 			      "CDS (%s) for key %s is now deleted", algbuf,
 			      keystr);
 		r = delrdata(&cdsrdata, diff, origin, cds->ttl, mctx);
+		if (r == ISC_R_SUCCESS) {
+			*notify = true;
+		}
 	}
 	return (r);
 }
@@ -2030,7 +2036,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
 		      bool gencdnskey, dns_ttl_t ttl, dns_diff_t *diff,
-		      isc_mem_t *mctx) {
+		      bool *notify, isc_mem_t *mctx) {
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	isc_result_t result;
 	dns_dnsseckey_t *key;
@@ -2058,7 +2064,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 			{
 				RETERR(add_cds(key, &cdnskeyrdata,
 					       (const char *)keystr, cds,
-					       alg->digest, ttl, diff, mctx));
+					       alg->digest, ttl, diff, notify,
+					       mctx));
 			}
 
 			if (gencdnskey &&
@@ -2072,6 +2079,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					keystr);
 				RETERR(addrdata(&cdnskeyrdata, diff, origin,
 						ttl, mctx));
+				*notify = true;
 			}
 		}
 
@@ -2083,13 +2091,16 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 				/* Delete all possible CDS records */
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA1, diff, mctx);
+					   DNS_DSDIGEST_SHA1, diff, notify,
+					   mctx);
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA256, diff, mctx);
+					   DNS_DSDIGEST_SHA256, diff, notify,
+					   mctx);
 				delete_cds(key, &cdnskeyrdata,
 					   (const char *)keystr, cds,
-					   DNS_DSDIGEST_SHA384, diff, mctx);
+					   DNS_DSDIGEST_SHA384, diff, notify,
+					   mctx);
 			}
 
 			if (dns_rdataset_isassociated(cdnskey)) {
@@ -2104,6 +2115,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					RETERR(delrdata(&cdnskeyrdata, diff,
 							origin, cdnskey->ttl,
 							mctx));
+					*notify = true;
 				}
 			}
 		}
@@ -2132,11 +2144,13 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 
 		if (dns_rdataset_isassociated(cds)) {
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA1, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA1, diff, notify, mctx);
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA256, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA256, diff, notify,
+				   mctx);
 			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
-				   cds, DNS_DSDIGEST_SHA384, diff, mctx);
+				   cds, DNS_DSDIGEST_SHA384, diff, notify,
+				   mctx);
 		}
 
 		if (dns_rdataset_isassociated(cdnskey)) {
@@ -2148,12 +2162,11 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 					keystr);
 				RETERR(delrdata(&cdnskeyrdata, diff, origin,
 						cdnskey->ttl, mctx));
+				*notify = true;
 			}
 		}
 	}
 
-	result = ISC_R_SUCCESS;
-
 failure:
 	return (result);
 }
@@ -2247,7 +2260,7 @@ failure:
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
-		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
+		      dns_ttl_t hint_ttl, dns_diff_t *diff, bool *notify, isc_mem_t *mctx,
 		      void (*report)(const char *, ...)
 			      ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
@@ -2353,6 +2366,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					keystr1,
 					key1->ksk ? (key1->zsk ? "CSK" : "KSK")
 						  : "ZSK");
+				*notify = true;
 				if (key1->hint_sign || key1->force_sign) {
 					key1->first_sign = true;
 					isc_log_write(
@@ -2393,6 +2407,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					keystr2,
 					key2->ksk ? (key2->zsk ? "CSK" : "KSK")
 						  : "ZSK");
+				*notify = true;
 			} else {
 				dns_dnsseckey_destroy(mctx, &key2);
 			}
@@ -2418,6 +2433,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					key2->ksk ? (key2->zsk ? "CSK" : "KSK")
 						  : "ZSK",
 					dst_key_id(key1->key));
+				*notify = true;
 			} else {
 				dns_dnsseckey_destroy(mctx, &key2);
 			}

lib/dns/include/dns/dnssec.h

@@ -338,7 +338,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
-		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
+		      dns_ttl_t hint_ttl, dns_diff_t *diff, bool *notify, isc_mem_t *mctx,
 		      void (*report)(const char *, ...)
 			      ISC_FORMAT_PRINTF(1, 2));
 /*%<
@@ -353,6 +353,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
  *   remove it from 'keys', and place a dns_difftuple into 'diff' so
  *   the key can be removed from the DNSKEY set.  if 'removed' is non-NULL,
  *   copy the key into that list; otherwise destroy it.
+ * - The 'notify' parameter stores whether a NOTIFY DNSKEY needs to be sent.
  * - Otherwise, make sure keys has current metadata.
  *
  * 'hint_ttl' is the TTL to use for the DNSKEY RRset if there is no
@@ -371,7 +372,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
 		      bool gencdnskey, dns_ttl_t hint_ttl, dns_diff_t *diff,
-		      isc_mem_t *mctx);
+		      bool *notify, isc_mem_t *mctx);
 /*%<
  * Update the CDS and CDNSKEY RRsets, adding and removing keys as needed.
  *
@@ -386,7 +387,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
  * 'hint_ttl' is the TTL to use for the CDS and CDNSKEY RRsets if there is no
  * existing RRset.
  *
- * Any changes made also cause a dns_difftuple to be added to 'diff'.
+ * Any changes made also cause a dns_difftuple to be added to 'diff', and
+ * 'notify' to be set to true.
  *
  * Requires:
  *\li	'keys' is not NULL.

lib/dns/include/dns/types.h

@@ -211,6 +211,11 @@ typedef enum {
 	dns_checkdstype_explicit = 2
 } dns_checkdstype_t;
 
+typedef enum {
+	dns_notifycdstype_no = 0,
+	dns_notifycdstype_yes = 1
+} dns_notifycdstype_t;
+
 typedef enum {
 	dns_notifytype_no = 0,
 	dns_notifytype_yes = 1,

lib/dns/include/dns/zone.h

@@ -1531,6 +1531,12 @@ dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype);
  * Sets zone notify method to "notifytype"
  */
 
+void
+dns_zone_setnotifycdstype(dns_zone_t *zone, dns_notifycdstype_t notifycdstype);
+/*%<
+ * Sets zone checkds method to "notifycdstype"
+ */
+
 void
 dns_zone_setcheckdstype(dns_zone_t *zone, dns_checkdstype_t checkdstype);
 /*%<

lib/dns/rdata/in_1/notify_65280.c

@@ -0,0 +1,373 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* draft-thomassen-dnsop-generalized-dnsnotif-02 */
+
+#ifndef RDATA_IN_1_NOTIFY_UNDEFINED_C
+#define RDATA_IN_1_NOTIFY_UNDEFINED_C
+
+#define RRTYPE_NOTIFY_ATTRIBUTES (0)
+
+static isc_result_t
+fromtext_in_notify(ARGS_FROMTEXT) {
+	isc_token_t token;
+	dns_rdatatype_t rrtype;
+	dns_name_t name;
+	isc_buffer_t buffer;
+	bool ok;
+
+	REQUIRE(type == dns_rdatatype_notify);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	UNUSED(rrtype);
+	UNUSED(rdclass);
+	UNUSED(callbacks);
+
+	/*
+	 * RRtype.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+				      false));
+	RETTOK(dns_rdatatype_fromtext(&rrtype, &token.value.as_textregion));
+	RETERR(uint16_tobuffer(rrtype, target));
+
+	/*
+	 * Scheme.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      false));
+	if (token.value.as_ulong > 0xffffU) {
+		RETTOK(ISC_R_RANGE);
+	}
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Port.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      false));
+	if (token.value.as_ulong > 0xffffU) {
+		RETTOK(ISC_R_RANGE);
+	}
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Target.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+				      false));
+	dns_name_init(&name, NULL);
+	buffer_fromregion(&buffer, &token.value.as_region);
+	if (origin == NULL) {
+		origin = dns_rootname;
+	}
+	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	ok = true;
+	if ((options & DNS_RDATA_CHECKNAMES) != 0) {
+		ok = dns_name_ishostname(&name, false);
+	}
+	if (!ok && (options & DNS_RDATA_CHECKNAMESFAIL) != 0) {
+		RETTOK(DNS_R_BADNAME);
+	}
+	if (!ok && callbacks != NULL) {
+		warn_badname(&name, lexer, callbacks);
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+totext_in_notify(ARGS_TOTEXT) {
+	isc_region_t region;
+	dns_name_t name;
+	dns_name_t prefix;
+	char buf[sizeof("64000")];
+	uint16_t num;
+	unsigned int opts;
+
+	REQUIRE(rdata->type == dns_rdatatype_notify);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->length != 0);
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+
+	/*
+	 * RRtype.
+	 */
+	dns_rdata_toregion(rdata, &region);
+	num = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	dns_rdatatype_totext((dns_rdatatype_t)num, target);
+	RETERR(str_totext(" ", target));
+
+	/*
+	 * Scheme.
+	 */
+	num = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	snprintf(buf, sizeof(buf), "%u", num);
+	RETERR(str_totext(buf, target));
+	RETERR(str_totext(" ", target));
+
+	/*
+	 * Port.
+	 */
+	num = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	snprintf(buf, sizeof(buf), "%u", num);
+	RETERR(str_totext(buf, target));
+	RETERR(str_totext(" ", target));
+
+	/*
+	 * Target.
+	 */
+	dns_name_fromregion(&name, &region);
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
+}
+
+static isc_result_t
+fromwire_in_notify(ARGS_FROMWIRE) {
+	dns_name_t name;
+	isc_region_t sr;
+
+	REQUIRE(type == dns_rdatatype_notify);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	dctx = dns_decompress_setpermitted(dctx, false);
+
+	dns_name_init(&name, NULL);
+
+	/*
+	 * RRtype, scheme, port.
+	 */
+	isc_buffer_activeregion(source, &sr);
+	if (sr.length < 6) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+	RETERR(mem_tobuffer(target, sr.base, 6));
+	isc_buffer_forward(source, 6);
+
+	/*
+	 * Target.
+	 */
+	return (dns_name_fromwire(&name, source, dctx, target));
+}
+
+static isc_result_t
+towire_in_notify(ARGS_TOWIRE) {
+	dns_name_t name;
+	dns_offsets_t offsets;
+	isc_region_t sr;
+
+	REQUIRE(rdata->type == dns_rdatatype_notify);
+	REQUIRE(rdata->length != 0);
+
+	dns_compress_setpermitted(cctx, false);
+	/*
+	 * RRtype, scheme, port.
+	 */
+	dns_rdata_toregion(rdata, &sr);
+	RETERR(mem_tobuffer(target, sr.base, 6));
+	isc_region_consume(&sr, 6);
+
+	/*
+	 * Target.
+	 */
+	dns_name_init(&name, offsets);
+	dns_name_fromregion(&name, &sr);
+	return (dns_name_towire(&name, cctx, target, NULL));
+}
+
+static int
+compare_in_notify(ARGS_COMPARE) {
+	dns_name_t name1;
+	dns_name_t name2;
+	isc_region_t region1;
+	isc_region_t region2;
+	int order;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == dns_rdatatype_notify);
+	REQUIRE(rdata1->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	/*
+	 * RRtype, scheme, port.
+	 */
+	order = memcmp(rdata1->data, rdata2->data, 6);
+	if (order != 0) {
+		return (order < 0 ? -1 : 1);
+	}
+
+	/*
+	 * Target.
+	 */
+	dns_name_init(&name1, NULL);
+	dns_name_init(&name2, NULL);
+
+	dns_rdata_toregion(rdata1, &region1);
+	dns_rdata_toregion(rdata2, &region2);
+
+	isc_region_consume(&region1, 6);
+	isc_region_consume(&region2, 6);
+
+	dns_name_fromregion(&name1, &region1);
+	dns_name_fromregion(&name2, &region2);
+
+	return (dns_name_rdatacompare(&name1, &name2));
+}
+
+static isc_result_t
+fromstruct_in_notify(ARGS_FROMSTRUCT) {
+	dns_rdata_in_notify_t *notify = source;
+	isc_region_t region;
+
+	REQUIRE(type == dns_rdatatype_notify);
+	REQUIRE(rdclass == dns_rdataclass_in);
+	REQUIRE(notify != NULL);
+	REQUIRE(notify->common.rdtype == type);
+	REQUIRE(notify->common.rdclass == rdclass);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	RETERR(uint16_tobuffer(notify->rrtype, target));
+	RETERR(uint16_tobuffer(notify->scheme, target));
+	RETERR(uint16_tobuffer(notify->port, target));
+	dns_name_toregion(&notify->target, &region);
+	return (isc_buffer_copyregion(target, &region));
+}
+
+static isc_result_t
+tostruct_in_notify(ARGS_TOSTRUCT) {
+	isc_region_t region;
+	dns_rdata_in_notify_t *notify = target;
+	dns_name_t name;
+
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->type == dns_rdatatype_notify);
+	REQUIRE(notify != NULL);
+	REQUIRE(rdata->length != 0);
+
+	notify->common.rdclass = rdata->rdclass;
+	notify->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&notify->common, link);
+
+	dns_name_init(&name, NULL);
+	dns_rdata_toregion(rdata, &region);
+	notify->rrtype = (dns_rdatatype_t)uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	notify->scheme = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	notify->port = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	dns_name_fromregion(&name, &region);
+	dns_name_init(&notify->target, NULL);
+	name_duporclone(&name, mctx, &notify->target);
+	notify->mctx = mctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+freestruct_in_notify(ARGS_FREESTRUCT) {
+	dns_rdata_in_notify_t *notify = source;
+
+	REQUIRE(notify != NULL);
+	REQUIRE(notify->common.rdclass == dns_rdataclass_in);
+	REQUIRE(notify->common.rdtype == dns_rdatatype_notify);
+
+	if (notify->mctx == NULL) {
+		return;
+	}
+
+	dns_name_free(&notify->target, notify->mctx);
+	notify->mctx = NULL;
+}
+
+static isc_result_t
+additionaldata_in_notify(ARGS_ADDLDATA) {
+	UNUSED(rdata);
+	UNUSED(owner);
+	UNUSED(add);
+	UNUSED(arg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+digest_in_notify(ARGS_DIGEST) {
+	isc_region_t r1, r2;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == dns_rdatatype_notify);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	dns_rdata_toregion(rdata, &r1);
+	r2 = r1;
+	isc_region_consume(&r2, 6);
+	r1.length = 6;
+	RETERR((digest)(arg, &r1));
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &r2);
+	return (dns_name_digest(&name, digest, arg));
+}
+
+static bool
+checkowner_in_notify(ARGS_CHECKOWNER) {
+	REQUIRE(type == dns_rdatatype_notify);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (true);
+}
+
+static bool
+checknames_in_notify(ARGS_CHECKNAMES) {
+	isc_region_t region;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == dns_rdatatype_notify);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	UNUSED(owner);
+
+	dns_rdata_toregion(rdata, &region);
+	isc_region_consume(&region, 6);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &region);
+	if (!dns_name_ishostname(&name, false)) {
+		if (bad != NULL) {
+			dns_name_clone(&name, bad);
+		}
+		return (false);
+	}
+	return (true);
+}
+
+static int
+casecompare_in_notify(ARGS_COMPARE) {
+	return (compare_in_notify(rdata1, rdata2));
+}
+
+#endif /* RDATA_IN_1_NOTIFY_UNDEFINED_C */

lib/dns/rdata/in_1/notify_65280.h

@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*!
+ *  \brief Per draft-ietf-thomassen-dnsop-generalized-dns-notify-02
+ */
+typedef struct dns_rdata_in_notify {
+	dns_rdatacommon_t common;
+	isc_mem_t *mctx;
+	dns_rdatatype_t rrtype;
+	uint16_t scheme;
+	uint16_t port;
+	dns_name_t target;
+} dns_rdata_in_notify_t;