Skip to content
Snippets Groups Projects

DNSSEC key pre-publishing

Merged DNSSEC key pre-publishing
key-prepublish into master
Merged Jan Včelák requested to merge key-prepublish into master

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Ghost User
    Ghost User @ghost started a thread on the diff
    • src/libknot/dnssec/zone-keys.c
    163 174 continue;
    164 175 }
    165 176
    166 if (!is_current_key(&params)) {
    167 dbg_dnssec_detail("skipping key, inactive period\n");
    177 knot_zone_key_t key;
    • Ghost User
      Ghost User @ghost ·
      Contributor

      knot_zone_key_t key = { '\0' }; ?

    • Jan Včelák
      Jan Včelák @jvcelak ·
      Author Contributor

      The first element of the structure is another structure and compiler complains: libknot/dnssec/zone-keys.c:178:27: warning: suggest braces around initialization of subobject [-Wmissing-braces]

      And I do not feel good about {{ '\0' }}. Anyway, I think the optimizer will produce the same code in the end.

    • Ghost User
      Ghost User @ghost ·
      Contributor

      Okay.

  • Ghost User
    Ghost User @ghost started a thread on the diff
    • src/libknot/dnssec/zone-keys.h
    41 typedef struct {
    42 knot_dnssec_key_t dnssec_key;
    43 knot_dnssec_sign_context_t *context;
    44 bool is_ksk; //!< Is KSK key.
    45 bool is_public; //!< Currently in zone.
    46 bool is_active; //!< Currently used for signing.
    47 } knot_zone_key_t;
    48
    41 49 /*!
    42 50 * \brief Keys used for zone signing.
    43 51 */
    44 52 typedef struct {
    45 53 unsigned count;
    46 knot_dnssec_key_t keys[KNOT_MAX_ZONE_KEYS];
    47 knot_dnssec_sign_context_t *contexts[KNOT_MAX_ZONE_KEYS];
    48 bool is_ksk[KNOT_MAX_ZONE_KEYS];
  • Ghost User
    Ghost User @ghost ·
    Contributor

    Maybe the user could get some info about which keys were used to sign the zone in the end. Or we could add a new knotc command, something like knotc keyinfo example.com - that would be a nice feature, but obviously it can wait.

  • Ghost User
    Ghost User @ghost ·
    Contributor

    About keeping expired keys in the structure: I hope that before the keys expire, we'll have a new version out :bouquet:

  • Ghost User
    Ghost User @ghost ·
    Contributor

    DNSSEC functional tests passed, I think we can go ahead and merge this, even though planning is not done yet, assuming we'll fix it in the next RC.

    • Please register or sign in to reply