ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

dnssec-keygen: -K keydir takes priority

Browse Source 
When using dnssec-policy with dnssec-keygen in combination with setting
the key-directory on the command line, the commandline argument takes
priority over the key-directory from the default named.conf.
This commit is contained in:
Matthijs Mekking
2023-04-13 11:17:43 +02:00
parent 224a6a6cf8
commit b0f14a604d
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
bin/dnssec/dnssec-keygen.c
View File

@@ -256,7 +256,7 @@ progress(int p) {
static void static void
kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name, kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
const char *engine, dns_kasp_t **kaspp) { const char *keydir, const char *engine, dns_kasp_t **kaspp) {
isc_result_t result = ISC_R_NOTFOUND; isc_result_t result = ISC_R_NOTFOUND;
const cfg_listelt_t *element; const cfg_listelt_t *element;
const cfg_obj_t *kasps = NULL; const cfg_obj_t *kasps = NULL;
@@ -289,6 +289,10 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
ks = NULL; ks = NULL;
(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks); (void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
INSIST(ks != NULL); INSIST(ks != NULL);
if (keydir != NULL) {
/* '-K keydir' takes priority */
dns_keystore_setdirectory(ks, keydir);
}
dns_keystore_detach(&ks); dns_keystore_detach(&ks);
(void)cfg_map_get(config, "dnssec-policy", &kasps); (void)cfg_map_get(config, "dnssec-policy", &kasps);
@@ -1328,7 +1332,8 @@ main(int argc, char **argv) {
ctx.policy, ctx.configfile); ctx.policy, ctx.configfile);
} }
kasp_from_conf(config, mctx, ctx.policy, engine, &kasp); kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
engine, &kasp);
if (kasp == NULL) { if (kasp == NULL) {
fatal("failed to load dnssec-policy '%s'", fatal("failed to load dnssec-policy '%s'",
ctx.policy); ctx.policy);

1
bin/tests/system/kasp/tests.sh
View File

@@ -97,6 +97,7 @@ set_zonesigning "KEY4" "yes"
lines=$(get_keyids "$DIR" "$ZONE" | wc -l) lines=$(get_keyids "$DIR" "$ZONE" | wc -l)
test "$lines" -eq $NUM_KEYS || log_error "bad number of key ids" test "$lines" -eq $NUM_KEYS || log_error "bad number of key ids"
status=$((status + ret))
ids=$(get_keyids "$DIR" "$ZONE") ids=$(get_keyids "$DIR" "$ZONE")
for id in $ids; do for id in $ids; do