From 13136697a55f736ee0de8970756bb251219c212f Mon Sep 17 00:00:00 2001
From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Wed, 1 Nov 2017 14:56:04 +0100
Subject: [PATCH] auth: Warn about algo 5 -> 7 upgrade in log

One step toward #3267
---
 pdns/dbdnsseckeeper.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index eb4aead429..063de10fb8 100644
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -485,8 +485,10 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const DNSName& zone, bool useCache)
 
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
-    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone))
+    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone)) {
+      L<<Logger::Warning<<"Zone '"<<zone<<"' has NSEC3 semantics, but the "<< (kd.active ? "" : "in" ) <<"active key with id "<<kd.id<<" has 'Algorithm: 5'. This should be corrected to 'Algorithm: 7' in the database (or NSEC3 should be disabled)."<<endl;
       dpk.d_algorithm+=2;
+    }
 
     KeyMetaData kmd;
 
-- 
2.47.2