Skip to content
Snippets Groups Projects
Commit d7f3adc4 authored by Daniel Salzman's avatar Daniel Salzman
Browse files

Replace 'resign' with 're-sign'

parent 09bfc191
Branches
Tags
No related merge requests found
Pipeline #19434 passed with stages
in 19 minutes and 39 seconds
......@@ -369,7 +369,7 @@ the server logs to see whether everything went well.
enabling the automatic key management. If the zone was already signed, all
existing keys must be imported using ``keymgr import-bind`` command
before enabling the automatic signing. Also the algorithm in the policy must
match the algorithm of all imported keys. Otherwise the zone will be resigned
match the algorithm of all imported keys. Otherwise the zone will be re-signed
at all.
.. _dnssec-automatic-ksk-management:
......@@ -499,7 +499,7 @@ The signing process consists of the following steps:
#. Creating missing signatures. Unless the Single-Type Signing Scheme
is used, DNSKEY records in a zone apex are signed by KSK keys and
all other records are signed by ZSK keys.
#. Updating and resigning SOA record.
#. Updating and re-signing SOA record.
The signing is initiated on the following occasions:
......@@ -508,12 +508,12 @@ The signing is initiated on the following occasions:
- Reaching the signature refresh period
- Key set changed due to rollover event
- Received DDNS update
- Forced zone resign via server control interface
- Forced zone re-sign via server control interface
On a forced zone resign, all signatures in the zone are dropped and recreated.
On a forced zone re-sign, all signatures in the zone are dropped and recreated.
The ``knotc zone-status`` command can be used to see when the next scheduled
DNSSEC resign will happen.
DNSSEC re-sign will happen.
.. _dnssec-on-slave-signing:
......
......@@ -297,7 +297,7 @@ int knot_dnssec_sign_update(zone_update_t *update, zone_sign_reschedule_t *resch
log_zone_info(zone_name, "DNSSEC, successfully signed");
// schedule next resigning (only new signatures are made)
// schedule next re-signing (only new signatures are made)
reschedule->next_sign = ctx.now + ctx.policy->rrsig_lifetime - ctx.policy->rrsig_refresh_before;
assert(reschedule->next_sign > 0);
(void)expire_at; // the result of expire_at is actually unused because we computed next_sign easily
......
......@@ -53,7 +53,7 @@ int knot_dnssec_sign_process_events(const kdnssec_ctx_t *kctx,
const knot_dname_t *zone_name);
/*!
* \brief DNSSEC resign zone, store new records into changeset. Valid signatures
* \brief DNSSEC re-sign zone, store new records into changeset. Valid signatures
* and NSEC(3) records will not be changed.
*
* \param update Zone Update structure with current zone contents to be updated by signing.
......
......@@ -37,17 +37,17 @@ typedef struct event_info {
} event_info_t;
static const event_info_t EVENT_INFO[] = {
{ ZONE_EVENT_LOAD, event_load, "load" },
{ ZONE_EVENT_REFRESH, event_refresh, "refresh" },
{ ZONE_EVENT_UPDATE, event_update, "update" },
{ ZONE_EVENT_EXPIRE, event_expire, "expiration" },
{ ZONE_EVENT_FLUSH, event_flush, "journal flush" },
{ ZONE_EVENT_NOTIFY, event_notify, "notify" },
{ ZONE_EVENT_DNSSEC, event_dnssec, "DNSSEC resign" },
{ ZONE_EVENT_UFREEZE, event_ufreeze, "update freeze" },
{ ZONE_EVENT_UTHAW, event_uthaw, "update thaw" },
{ ZONE_EVENT_NSEC3RESALT, event_nsec3resalt, "NSEC3 resalt" },
{ ZONE_EVENT_PARENT_DS_Q, event_parent_ds_q, "parent DS query" },
{ ZONE_EVENT_LOAD, event_load, "load" },
{ ZONE_EVENT_REFRESH, event_refresh, "refresh" },
{ ZONE_EVENT_UPDATE, event_update, "update" },
{ ZONE_EVENT_EXPIRE, event_expire, "expiration" },
{ ZONE_EVENT_FLUSH, event_flush, "journal flush" },
{ ZONE_EVENT_NOTIFY, event_notify, "notify" },
{ ZONE_EVENT_DNSSEC, event_dnssec, "DNSSEC re-sign" },
{ ZONE_EVENT_UFREEZE, event_ufreeze, "update freeze" },
{ ZONE_EVENT_UTHAW, event_uthaw, "update thaw" },
{ ZONE_EVENT_NSEC3RESALT, event_nsec3resalt, "NSEC3 resalt" },
{ ZONE_EVENT_PARENT_DS_Q, event_parent_ds_q, "parent DS query" },
{ 0 }
};
......
......@@ -72,7 +72,7 @@ int event_dnssec(conf_t *conf, zone_t *zone)
if (zone->flags & ZONE_FORCE_RESIGN) {
log_zone_info(zone->name, "DNSSEC, dropping previous "
"signatures, resigning zone");
"signatures, re-signing zone");
zone->flags &= ~ZONE_FORCE_RESIGN;
sign_flags = ZONE_SIGN_DROP_SIGNATURES;
} else {
......
......@@ -45,7 +45,7 @@ struct zone_update;
*/
typedef enum zone_flag_t {
ZONE_FORCE_AXFR = 1 << 0, /* Force AXFR as next transfer. */
ZONE_FORCE_RESIGN = 1 << 1, /* Force zone resign. */
ZONE_FORCE_RESIGN = 1 << 1, /* Force zone re-sign. */
ZONE_FORCE_FLUSH = 1 << 2, /* Force zone flush. */
} zone_flag_t;
......
......@@ -40,7 +40,7 @@ soa2rrsig_expire = str(soa2.resp.answer[1].to_rdataset()).split()[7]
detail_log("soa2rrsig_exp "+soa2rrsig_expire)
if soa2rrsig_expire == soa1rrsig_expire:
set_err("Zone not resigned, test error")
set_err("Zone not re-signed, test error")
if soa2serial == soa1serial:
set_err("Serial not incremented on AXFR")
......
#!/usr/bin/env python3
'''Test for no resigning if the zone is properly signed.'''
'''Test for no re-signing if the zone is properly signed.'''
from dnstest.utils import set_err
from dnstest.test import Test
......
#!/usr/bin/env python3
'''Test for no resigning if the zone is properly signed.'''
'''Test for no re-signing if the zone is properly signed.'''
from dnstest.utils import *
from dnstest.test import Test
......@@ -59,11 +59,11 @@ t.sleep(10)
new_nsec_serial = master.zone_wait(nsec_zone)
new_static_serial = master.zone_wait(static_zone)
# Check if the zones are resigned.
# Check if the zones are re-signed.
if old_nsec_serial != new_nsec_serial:
if not only_nsec_changed(master, nsec_zone, old_nsec_serial):
set_err("NSEC zone got resigned")
set_err("NSEC zone got re-signed")
compare(old_static_serial, new_static_serial, "static zone got resigned")
compare(old_static_serial, new_static_serial, "static zone got re-signed")
t.stop()
......@@ -42,7 +42,7 @@ t.sleep(4) # zones_wait fails if an empty update is generated
slave.ctl("zone-refresh")
t.sleep(5)
# resign master and check that the resign made nothing
# re-sign master and check that the re-sign made nothing
master.ctl("zone-sign")
master.zones_wait(zones)
......
......@@ -210,7 +210,7 @@ class ZoneFile(object):
os.remove(old_name)
def update_rnd(self):
'''Add random records or resign zone.'''
'''Add random records or re-sign zone.'''
dnssec = False
nsec3 = False
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment