From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Fri, 15 Sep 2017 14:08:48 +0000 (+0200)
Subject: auth: make default-{k,z}sk-algorithms singular
X-Git-Tag: rec-4.1.0-rc1~32^2~3
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c01b3507dc2fc6076081060a06b6b879c6dee47c;p=thirdparty%2Fpdns.git

auth: make default-{k,z}sk-algorithms singular
---

diff --git a/docs/settings.rst b/docs/settings.rst
index ea3922be24..a0d2fe4d71 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -272,13 +272,17 @@ Debugging switch - don't use.
 Operate as a daemon.
 
 .. _setting-default-ksk-algorithms:
+.. _setting-default-ksk-algorithm:
 
-``default-ksk-algorithms``
+``default-ksk-algorithm``
 --------------------------
 
 -  String
 -  Default: ecdsa256
 
+.. versionchanged:: 4.1.0
+  Renamed from ``default-ksk-algorithms``. Does no longer support multiple algorithm names.
+
 The algorithm that should be used for the KSK when running
 :doc:`pdnsutil secure-zone <manpages/pdnsutil.1>`. Must be one
 of: 
@@ -301,9 +305,10 @@ of:
 --------------------
 
 -  Integer
--  Default: whichever is default for ``default-ksk-algorithms``
+-  Default: whichever is default for `default-ksk-algorithm`_
 
 The default keysize for the KSK generated with :doc:`pdnsutil secure-zone <dnssec/pdnsutil>`.
+Only relevant for algorithms with non-fixed keysizes (like RSA)
 
 .. _setting-default-soa-name:
 
@@ -358,13 +363,17 @@ Mail address to insert in the SOA record if none set in the backend.
 TTL to use when none is provided.
 
 .. _setting-default-zsk-algorithms:
+.. _setting-default-zsk-algorithm:
 
-``default-zsk-algorithms``
+``default-zsk-algorithm``
 --------------------------
 
 -  String
 -  Default: (empty)
 
+.. versionchanged:: 4.1.0
+  Renamed from ``default-zsk-algorithms``. Does no longer support multiple algorithm names.
+
 The algorithm that should be used for the ZSK when running
 :doc:`pdnsutil secure-zone <manpages/pdnsutil.1>`. Must be one
 of: 
@@ -387,9 +396,10 @@ of:
 --------------------
 
 -  Integer
--  Default: whichever is default for ``default-zsk-algorithms``
+-  Default: 0 (automatic default for `default-zsk-algorithm`_)
 
 The default keysize for the ZSK generated with :doc:`pdnsutil secure-zone <dnssec/pdnsutil>`.
+Only relevant for algorithms with non-fixed keysizes (like RSA)
 
 .. _setting-direct-dnskey:
 
diff --git a/docs/upgrading.rst b/docs/upgrading.rst
index 5a6a964c33..a8d48f75af 100644
--- a/docs/upgrading.rst
+++ b/docs/upgrading.rst
@@ -36,6 +36,12 @@ Changed options
   ``allow-recursion``, ``recursive-cache-ttl`` and ``recursor`` options have
   been removed as well.
 
+- ``default-ksk-algorithms`` has been renamed to :ref:`setting-default-ksk-algorithm`
+  and only supports a single algorithm name now.
+
+- ``default-zsk-algorithms`` has been renamed to :ref:`setting-default-zsk-algorithm`
+  and only supports a single algorithm name now.
+
 Changed defaults
 ~~~~~~~~~~~~~~~~
 
diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 2bf1d18f44..ef6689adb3 100644
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -183,9 +183,9 @@ void declareArguments()
 
   ::arg().setSwitch("traceback-handler","Enable the traceback handler (Linux only)")="yes";
   ::arg().setSwitch("direct-dnskey","Fetch DNSKEY RRs from backend during DNSKEY synthesis")="no";
-  ::arg().set("default-ksk-algorithms","Default KSK algorithms")="ecdsa256";
+  ::arg().set("default-ksk-algorithm","Default KSK algorithms")="ecdsa256";
   ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0";
-  ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="";
+  ::arg().set("default-zsk-algorithm","Default ZSK algorithms")="";
   ::arg().set("default-zsk-size","Default ZSK size (0 means default)")="0";
   ::arg().set("max-nsec3-iterations","Limit the number of NSEC3 hash iterations")="500"; // RFC5155 10.3
 
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index b7b48ce53f..f6b43bc221 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -80,9 +80,9 @@ void loadMainConfig(const std::string& configdir)
   string configname=::arg()["config-dir"]+"/"+s_programname+".conf";
   cleanSlashes(configname);
 
-  ::arg().set("default-ksk-algorithms","Default KSK algorithms")="ecdsa256";
+  ::arg().set("default-ksk-algorithm","Default KSK algorithms")="ecdsa256";
   ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0";
-  ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="";
+  ::arg().set("default-zsk-algorithm","Default ZSK algorithms")="";
   ::arg().set("default-zsk-size","Default ZSK size (0 means default)")="0";
   ::arg().set("default-soa-edit","Default SOA-EDIT value")="";
   ::arg().set("default-soa-edit-signed","Default SOA-EDIT value for signed zones")="";
@@ -1780,23 +1780,21 @@ bool showZone(DNSSECKeeper& dk, const DNSName& zone, bool exportDS = false)
 bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
 {
   // parse attribute
-  vector<string> k_algos;
-  vector<string> z_algos;
   int k_size;
   int z_size;
   // temp var for addKey
   int64_t id;
 
-  stringtok(k_algos, ::arg()["default-ksk-algorithms"], " ,");
+  string k_algo = ::arg()["default-ksk-algorithm"];
   k_size = ::arg().asNum("default-ksk-size");
-  stringtok(z_algos, ::arg()["default-zsk-algorithms"], " ,");
+  string z_algo = ::arg()["default-zsk-algorithm"];
   z_size = ::arg().asNum("default-zsk-size");
 
   if (k_size < 0) {
      throw runtime_error("KSK key size must be equal to or greater than 0");
   }
 
-  if (k_algos.size() < 1 && z_algos.size() < 1) {
+  if (k_algo == "" && z_algo == "") {
      throw runtime_error("Zero algorithms given for KSK+ZSK in total");
   }
 
@@ -1822,20 +1820,17 @@ bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
     cerr<<"pdnsutil disable-dnssec "<<zone<<" right now!"<<endl;
   }
 
-  if (k_size)
-    cout << "Securing zone with key size " << k_size << endl;
-  else
-    cout << "Securing zone with default key size" << endl;
-
-  if (k_algos.empty()) { /* only a ZSK was requested by the defaults, set the SEP bit */
-  }
+  if (k_algo != "") { // Add a KSK
+    if (k_size)
+      cout << "Securing zone with key size " << k_size << endl;
+    else
+      cout << "Securing zone with default key size" << endl;
 
-  for(auto &k_algo: k_algos) {
-    cout << "Adding "<<(z_algos.empty()? "CSK (257)" : "KSK")<<" with algorithm " << k_algo << endl;
+    cout << "Adding "<<(z_algo == "" ? "CSK (257)" : "KSK")<<" with algorithm " << k_algo << endl;
 
-    int algo = DNSSECKeeper::shorthand2algorithm(k_algo);
+    int k_real_algo = DNSSECKeeper::shorthand2algorithm(k_algo);
 
-    if (!dk.addKey(zone, true, algo, id, k_size, true)) {
+    if (!dk.addKey(zone, true, k_real_algo, id, k_size, true)) {
       cerr<<"No backend was able to secure '"<<zone<<"', most likely because no DNSSEC"<<endl;
       cerr<<"capable backends are loaded, or because the backends have DNSSEC disabled."<<endl;
       cerr<<"For the Generic SQL backends, set the 'gsqlite3-dnssec', 'gmysql-dnssec' or"<<endl;
@@ -1844,13 +1839,12 @@ bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
     }
   }
 
-  for(auto &z_algo :  z_algos)
-  {
-    cout << "Adding "<<(k_algos.empty()? "CSK (256)" : "ZSK")<<" with algorithm " << z_algo << endl;
+  if (z_algo != "") {
+    cout << "Adding "<<(k_algo == "" ? "CSK (256)" : "ZSK")<<" with algorithm " << z_algo << endl;
 
-    int algo = DNSSECKeeper::shorthand2algorithm(z_algo);
+    int z_real_algo = DNSSECKeeper::shorthand2algorithm(z_algo);
 
-    if (!dk.addKey(zone, false, algo, id, z_size, true)) {
+    if (!dk.addKey(zone, false, z_real_algo, id, z_size, true)) {
       cerr<<"No backend was able to secure '"<<zone<<"', most likely because no DNSSEC"<<endl;
       cerr<<"capable backends are loaded, or because the backends have DNSSEC disabled."<<endl;
       cerr<<"For the Generic SQL backends, set the 'gsqlite3-dnssec', 'gmysql-dnssec' or"<<endl;