zonemd: additional warning when signer verifies ZONEMD

diff --git a/src/knot/conf/tools.c b/src/knot/conf/tools.c
index 2e6271731c06002ca4e07a858782e233895b5b45..971b52fa79f28296e8a864d5dc31bc67edf6cb0c 100644 (file)
--- a/src/knot/conf/tools.c
+++ b/src/knot/conf/tools.c
@@ -1144,6 +1144,11 @@ static int check_zone_or_tpl(
                        args->err_str = "'dnssec-validation' is not compatible with 'dnssec-signing'";
                        return KNOT_EINVAL;
                }
+
+               conf_val_t zonemd_verify = conf_get_wrap(args, C_ZONEMD_VERIFY);
+               if (conf_bool(&zonemd_verify)) {
+                       CONF_LOG(LOG_WARNING, "'zonemd-verify' not compatible with 'dnssec-signing' as incremental changes to the zone will always fail");
+               }
        } else {
                conf_val_t ddnsmaster = conf_get_wrap(args, C_DDNS_MASTER);
                if (ddnsmaster.code == KNOT_EOK && *conf_str(&ddnsmaster) == '\0') {

diff --git a/tests/knot/test_confio.c b/tests/knot/test_confio.c
index f6bb5ba98732c0bfe5d59924b68213b6f08996db..7c8251728c01aab480e5baac90c06cf87dfbb04f 100644 (file)
--- a/tests/knot/test_confio.c
+++ b/tests/knot/test_confio.c
@@ -1027,6 +1027,7 @@ static const knot_lookup_t opts[] = {
        { C_DNSSEC_SIGNING,    YP_TBOOL, YP_VNONE }, \
        { C_DNSSEC_VALIDATION, YP_TBOOL, YP_VNONE }, \
        { C_SERIAL_MODULO,     YP_TSTR,  YP_VSTR = { "0/1" } }, \
+       { C_ZONEMD_VERIFY,     YP_TBOOL, YP_VNONE }, \
        { C_CATALOG_ROLE,      YP_TOPT,  YP_VOPT = { opts, 0 } }, \
        { C_CATALOG_TPL,       YP_TREF,  YP_VREF = { C_RMT } }, \
        { C_COMMENT,           YP_TSTR,  YP_VNONE },