Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

auth: added a new config for direct queries of dnskey signature #14581

Merged
merged 8 commits into from
Jan 20, 2025
Merged

auth: added a new config for direct queries of dnskey signature #14581

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
141ded7
auth: added a new config for direct queries of dnskey signature
d-wibowo Aug 23, 2024
6317421
updated settings.rst for direct-dnskey-signature
d-wibowo Jan 8, 2025
7c30df1
added regression test for direct dnskey signature
d-wibowo Jan 9, 2025
7446800
ended regression test file in newline
d-wibowo Jan 14, 2025
73cb7ed
updated docs for 'direct-dnskey-signature'
d-wibowo Jan 14, 2025
1d5c4ea
Update docs/settings.rst
d-wibowo Jan 15, 2025
18f17eb
assert key_tag too
Habbie Jan 17, 2025
8aa9a84
only look up direct-dnskey-signature in the config once
Habbie Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pdns/auth-main.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,6 +295,7 @@ static void declareArguments()

::arg().setSwitch("traceback-handler", "Enable the traceback handler (Linux only)") = "yes";
::arg().setSwitch("direct-dnskey", "Fetch DNSKEY, CDS and CDNSKEY RRs from backend during DNSKEY or CDS/CDNSKEY synthesis") = "no";
::arg().setSwitch("direct-dnskey-signature", "Fetch signature of DNSKEY RRs from backend directly") = "no";
::arg().set("default-ksk-algorithm", "Default KSK algorithm") = "ecdsa256";
::arg().set("default-ksk-size", "Default KSK size (0 means default)") = "0";
::arg().set("default-zsk-algorithm", "Default ZSK algorithm") = "";
Expand Down
2 changes: 1 addition & 1 deletion pdns/dnssecsigner.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ static void addSignature(DNSSECKeeper& dk, UeberBackend& db, const DNSName& sign
if(toSign.empty())
return;
vector<RRSIGRecordContent> rrcs;
if(dk.isPresigned(signer)) {
if(dk.isPresigned(signer) || (::arg().mustDo("direct-dnskey-signature") && signQType == QType::DNSKEY)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just realised this mustDo needs to be stored in a bool, to avoid a lookup every time. I can add that commit :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright I'll let you add the commit, thanks.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, please have a look

//cerr<<"Doing presignatures"<<endl;
dk.getPreRRSIGs(db, outsigned, origTTL, packet); // does it all
}
Expand Down
Loading