From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Wed, 1 Nov 2017 13:56:04 +0000 (+0100)
Subject: auth: Warn about algo 5 -> 7 upgrade in log
X-Git-Tag: auth-4.1.0-rc2~3^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F5893%2Fhead;p=thirdparty%2Fpdns.git

auth: Warn about algo 5 -> 7 upgrade in log

One step toward #3267
---

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index eb4aead429..063de10fb8 100644
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -485,8 +485,10 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const DNSName& zone, bool useCache)
 
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
-    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone))
+    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone)) {
+      L<<Logger::Warning<<"Zone '"<<zone<<"' has NSEC3 semantics, but the "<< (kd.active ? "" : "in" ) <<"active key with id "<<kd.id<<" has 'Algorithm: 5'. This should be corrected to 'Algorithm: 7' in the database (or NSEC3 should be disabled)."<<endl;
       dpk.d_algorithm+=2;
+    }
 
     KeyMetaData kmd;