diff options
| author | Daniel Salzman <daniel.salzman@nic.cz> | 2024-10-18 10:41:37 +0200 |
|---|---|---|
| committer | Daniel Salzman <daniel.salzman@nic.cz> | 2024-10-18 10:41:37 +0200 |
| commit | d1da7b4eb0e017a6d78f6110e6eee55e4607098f (patch) | |
| tree | 71957741be7ff9d69e43c26b4c61731f1336955c | |
| parent | Merge branch 'log_full_sign_had_failed' into 'master' (diff) | |
| parent | keymgr/pregenerate: initial ZSK even when KSK exists (diff) | |
| download | knot-d1da7b4eb0e017a6d78f6110e6eee55e4607098f.tar.xz knot-d1da7b4eb0e017a6d78f6110e6eee55e4607098f.zip | |
Merge branch 'initial_zsk' into 'master'
keymgr/pregenerate: initial ZSK even when KSK exists
See merge request knot/knot-dns!1722
| -rw-r--r-- | src/knot/dnssec/key-events.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/knot/dnssec/key-events.c b/src/knot/dnssec/key-events.c index db762b629..bf32d82c6 100644 --- a/src/knot/dnssec/key-events.c +++ b/src/knot/dnssec/key-events.c @@ -722,8 +722,10 @@ int knot_dnssec_key_rollover(kdnssec_ctx_t *ctx, zone_sign_roll_flags_t flags, uint16_t ready_keytag = 0; const char *ready_keyid = NULL; bool allowed_general_roll = ((flags & KEY_ROLL_ALLOW_KSK_ROLL) && (flags & KEY_ROLL_ALLOW_ZSK_ROLL)); + bool allowed_zsk_only = (!(flags & KEY_ROLL_ALLOW_KSK_ROLL) && (flags & KEY_ROLL_ALLOW_ZSK_ROLL)); // generate initial keys if missing - if (!key_present(ctx, true, false) && !key_present(ctx, true, true)) { + if ((!key_present(ctx, true, false) && !key_present(ctx, true, true)) || + (allowed_zsk_only && !key_present(ctx, false, true) && !key_present(ctx, true, true))) { if ((flags & KEY_ROLL_ALLOW_KSK_ROLL)) { if (ctx->policy->ksk_shared) { ret = share_or_generate_key(ctx, GEN_KSK_FLAGS, ctx->now, false); |