]> git.ipfire.org Git - thirdparty/knot-dns.git/commitdiff
projects / thirdparty / knot-dns.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: b8fe253)
DNSSEC validation: allow garbage NSEC3 nodes...
authorLibor Peltan <libor.peltan@nic.cz>
Fri, 27 Mar 2020 10:59:27 +0000 (11:59 +0100)
committerDaniel Salzman <daniel.salzman@nic.cz>
Mon, 3 Aug 2020 14:08:28 +0000 (16:08 +0200)
...more precisely, if zone has NSEC3 tree, allow any NSEC3 records with different salt
this is useful for checking zones with slow-resalt

src/knot/dnssec/nsec-chain.c patch | blob | blame | history
tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone [new file with mode: 0644] patch | blob
tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2 [new file with mode: 0644] patch | blob
tests-extra/tests/dnssec/validate/test.py patch | blob | blame | history

diff --git a/src/knot/dnssec/nsec-chain.c b/src/knot/dnssec/nsec-chain.c
index 6344f7cdacd200705eef6d87315cfa68fcd45e73..f4b160ebc35f58ad0c5264c01179c7a6f5d9a056 100644 (file)
--- a/src/knot/dnssec/nsec-chain.c
+++ b/src/knot/dnssec/nsec-chain.c
@@ -286,10 +286,27 @@ static int nsec_update_bitmaps(zone_tree_t *node_ptrs,
        return ret;
 }
 
+static bool node_nsec3_unmatching(const zone_node_t *node, const dnssec_nsec3_params_t *params)
+{
+       knot_rdataset_t *nsec3 = node_rdataset(node, KNOT_RRTYPE_NSEC3);
+       if (nsec3 == NULL || nsec3->count < 1 || params == NULL) {
+               return false;
+       }
+       knot_rdata_t *rdata = nsec3->rdata;
+       for (int i = 0; i < nsec3->count; i++) {
+               if (knot_nsec3_salt_len(rdata) == params->salt.size &&
+                   memcmp(knot_nsec3_salt(rdata), params->salt.data, params->salt.size) == 0) {
+                       return false;
+               }
+               rdata = knot_rdataset_next(rdata);
+       }
+       return true;
+}
+
 int nsec_check_connect_nodes(zone_node_t *a, zone_node_t *b,
                              nsec_chain_iterate_data_t *data)
 {
-       if (node_no_nsec(b)) {
+       if (node_no_nsec(b) || node_nsec3_unmatching(b, data->nsec3_params)) {
                return NSEC_NODE_SKIP;
        }
        knot_rdataset_t *nsec = node_rdataset(a, data->nsec_type);
@@ -319,7 +336,17 @@ int nsec_check_connect_nodes(zone_node_t *a, zone_node_t *b,
        return KNOT_EOK;
 }
 
-static zone_node_t *nsec_prev(zone_node_t *node); // declaration
+static zone_node_t *nsec_prev(zone_node_t *node, const dnssec_nsec3_params_t *matching_params)
+{
+       zone_node_t *res = node;
+       do {
+               res = node_prev(res);
+       } while (res != NULL && ((res->flags & NODE_FLAGS_NONAUTH) ||
+                                res->rrset_count == 0 ||
+                                node_nsec3_unmatching(res, matching_params)));
+       assert(res == NULL || !knot_nsec_empty_nsec_and_rrsigs_in_node(res));
+       return res;
+}
 
 static int nsec_check_prev_next(zone_node_t *node, void *ctx)
 {
@@ -328,7 +355,10 @@ static int nsec_check_prev_next(zone_node_t *node, void *ctx)
        }
 
        nsec_chain_iterate_data_t *data = ctx;
-       int ret = nsec_check_connect_nodes(nsec_prev(node), node, data);
+       int ret = nsec_check_connect_nodes(nsec_prev(node, data->nsec3_params), node, data);
+       if (ret == NSEC_NODE_SKIP) {
+               return KNOT_EOK;
+       }
        if (ret != KNOT_EOK) {
                return ret;
        }
@@ -363,7 +393,7 @@ static int nsec_check_prev_next(zone_node_t *node, void *ctx)
                hint->rrtype = KNOT_RRTYPE_ANY;
                return KNOT_DNSSEC_ENSEC_CHAIN;
        }
-       if (nsec_prev((zone_node_t *)nn) != node) {
+       if (nsec_prev((zone_node_t *)nn, data->nsec3_params) != node) {
                hint->node = node->owner;
                hint->rrtype = data->nsec_type;
                return KNOT_DNSSEC_ENSEC_CHAIN;
@@ -446,16 +476,6 @@ int nsec_check_bitmaps(zone_tree_t *nsec_ptrs, nsec_chain_iterate_data_t *data)
        return zone_tree_apply(nsec_ptrs, check_nsec_bitmap, data);
 }
 
-static zone_node_t *nsec_prev(zone_node_t *node)
-{
-       zone_node_t *res = node;
-       do {
-               res = node_prev(res);
-       } while (res != NULL && ((res->flags & NODE_FLAGS_NONAUTH) || res->rrset_count == 0));
-       assert(res == NULL || !knot_nsec_empty_nsec_and_rrsigs_in_node(res));
-       return res;
-}
-
 /*! \brief Return the one from those nodes which has
  * closest lower (lexicographically) owner name to ref. */
 static zone_node_t *node_nearer(zone_node_t *a, zone_node_t *b, zone_node_t *ref)
@@ -563,7 +583,7 @@ int knot_nsec_chain_iterate_fix(zone_tree_t *node_ptrs,
                if (!del_old && del_new && started_with != NULL) {
                        zone_node_t *prev_old = curr_old, *prev_new;
                        do {
-                               prev_old = nsec_prev(prev_old);
+                               prev_old = nsec_prev(prev_old, NULL);
                                prev_new = binode_counterpart(prev_old);
                        } while (node_no_nsec(prev_new));
 
@@ -571,7 +591,7 @@ int knot_nsec_chain_iterate_fix(zone_tree_t *node_ptrs,
                        ret = cb_reconn(curr_old, prev_near, data);
                }
                if (del_old && !del_new && started_with != NULL) {
-                       zone_node_t *prev_new = nsec_prev(curr_new);
+                       zone_node_t *prev_new = nsec_prev(curr_new, NULL);
                        ret = cb_reconn(prev_new, curr_new, data);
                        if (ret == KNOT_EOK) {
                                ret = callback(prev_new, curr_new, data);
diff --git a/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone
new file mode 100644 (file)
index 0000000..c853e99
--- /dev/null
+++ b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone
@@ -0,0 +1,19 @@
+ok.2nsec3.             3600    SOA     a.ok.2nsec3. a.ok.2nsec3. 1000000003 10800 10 1209600 7200
+ok.2nsec3.             3600    NS      a.ok.2nsec3.
+ok.2nsec3.             3600    MX      10 a.ok.2nsec3.
+ok.2nsec3.             2       DNSKEY  256 3 8 AwEAAcTVitl37eO+ViFZOpPM3UuH9oKfE0LVfFrNJOTGqHOQngySB71OExKsaS6Y08RRpNfMS94sGIxchjMXRZyLJi3zH2ukiUiubXjTI0rymIRLDpNHaYm6dR+hR2YEQtERmsQ4ttgNkU1Dl9tPGg1Yt2ILfEK/8OFTkz5r69u2V/f/
+ok.2nsec3.             2       DNSKEY  257 3 8 AwEAAcOyxKOo35/KKf4o2MJYNpRA5CHX627jaeLqrWsVgZx7mTg+Uxcv3KSHZKXoS8IWUL/7K9YccU9fxDzQimK03yoGk9vqxCJXiBQIrt6XJiMX6FNtu4QoDzEcJX95ib664AlpGPRFIjNqKhS3HvvAxC93ktiXbpbCcKH5y+AcqJ4r
+ok.2nsec3.             0       NSEC3PARAM      1 0 15 16BB2CD605BF6409
+a.ok.2nsec3.           3600    A       1.2.3.4
+ok.2nsec3.             3600    RRSIG   NS 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. F0a5ni5zuVx7d+G1eYl2VInmpGh6WirWcxi9od8ryinYl+Kzqax25BzWFUREoaqh2jzDBh/e0PjdoawUPPlaFxKwFX2XNc4wdpazCHaRO2zVi+OMaDEgSU5hSNGQrRS3VdAdRNhg2wq8up2n8NKvCPzryA5e7FLQMxd0m8QdSm8=
+ok.2nsec3.             3600    RRSIG   SOA 8 2 3600 20300325100908 20200327083908 1083 ok.2nsec3. RbesJicqOnwXIr95RZynBBfQj+akrfA9VilBoqXf3KX+2X3ypzVDZtKvNfua4Wk3g4iLf5pxAh7es58MOVPrEQkVhGau/rC3g+xkQ/TJVKR151C6UBYtsrgohQwQmBZB6Z4/Wz3fNmJWLg2+1NVz/aqWSwT/uQfxM33Nmo6jW88=
+ok.2nsec3.             3600    RRSIG   MX 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. gDAZeV5cC+DnHr3/CRSn1xxksjSq2kh39p4b84JYkIiA9WhH4+T1fE87H0CMDuWisaa3+G+ViCVF+EsvJJylOGzpdMNl2RLeigNIyrsYQnWz7m5r7RvGhRtOQMMsMi7FvfY8FuYlunoTUMqwFxPKmLunGuqwDAa99MdayNq3y9g=
+ok.2nsec3.             2       RRSIG   DNSKEY 8 2 2 20300325100832 20200327083832 19360 ok.2nsec3. L675OPk6MW8vm6Yi5boyp2IumEgcEYWyed3stGWAYihxZrpFZ5RgfxboVgcM3wvq3rxV5e/fe/CQ/LxKh7VH/tR5swoOfQSlTby9CI6MuF5UJ3EbsVNKQ3YYSIbuYH9WkhRfM4lx4aVgy/ZXiMd6VC0RUbK4idlbDkcOiqkUGe8=
+ok.2nsec3.             0       RRSIG   NSEC3PARAM 8 2 0 20300325100832 20200327083832 1083 ok.2nsec3. DmJ1pcboLskCahOSZTsg9vn2x7vue4j4+QwnNIWqardVvk4vbmdHckxmHJ6XVKrhjjU67WP42j0MLYLRfIYNuc73UwQZi/kSMzuBCFTAcGFrzgB8hiN0PRxqjZtJb+iYVCN9aBghwpBzMOCwKkkUVsYtJOL7RkSkX2mkD7QHV2o=
+a.ok.2nsec3.           3600    RRSIG   A 8 3 3600 20300325100832 20200327083832 1083 ok.2nsec3. R3CQNVWaO3veiZPsJAbdo3lz1tBTQLhkvNbKZepq4kRtvqbh74CfMqiKvUx0O8o9EkF5/fhbB9qqKbrDETeu4wU0xjZzCSsQ+75Pfn2HyC1WM+GgLx2vZec8YCTR9fkDPNiABbPywt791wlID0x8mQzF8XPyKyW0oLcINy0F6yk=
+1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200       NSEC3   1 0 15 16BB2CD605BF6409 spcsif81i3ij1na7td4othdersk0ddvh NS SOA MX RRSIG DNSKEY NSEC3PARAM
+eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       NSEC3   1 0 10 874A1253FD24911F p6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG
+spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200       NSEC3   1 0 15 16BB2CD605BF6409 1ncif4ogq3uov6dsuppl2jc5q3dq6d5m A RRSIG
+1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. lYbsiUFKA0El/qInmq6MUZfMmTCvbXcIatHvLs5jIR3qQYal1Y4WM/k0ZYtmkJAp3olto2fO8TO2JN1xx1sCi5EilaHWrX/iQc6ftWi+QR0Z/YdpkQYZEYHKu8AgmnYDUxruu4c/rAqJmqZ3TRu8dT+Xmc8nLPRK0r0byUW1/OQ=
+eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100908 20200327083908 1083 ok.2nsec3. wlAETOQ94sWCcS5Cb8ojK8iIgciCVck2vWfpSdpmcmStAKKHirCHIPnvhj46eR+WXAnHWonDHwcmpZq+joVdip3XZ287oVmqmZEYse5WcrGzb5OGqOwzNwbzXRXyChLwALfZ/xWRYMvGn0nis4eqqa1e4nb5M3K4pUXAQWJRNO8=
+spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. A8S3oFHSlw/x7+We0FsHZiJJKHKJfyps1gQ/fmCL6LvNcOR+upUTubBAw92bqxMoq4mAcn4a9dW8wnukfy9WtMggD5LVzDH9SH2VYDdcaHpV4PlLD/qCtGsZVNh9IHcBJP1n69Yr9Q2Fr70ARsaXM5PoRDxe4657Fhb3sM8cEb8=
diff --git a/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2 b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2
new file mode 100644 (file)
index 0000000..7419274
--- /dev/null
+++ b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2
@@ -0,0 +1,25 @@
+ok.2nsec3.             3600    SOA     a.ok.2nsec3. a.ok.2nsec3. 1000000004 10800 10 1209600 7200
+ok.2nsec3.             3600    NS      a.ok.2nsec3.
+ok.2nsec3.             3600    MX      10 a.ok.2nsec3.
+ok.2nsec3.             2       DNSKEY  256 3 8 AwEAAcTVitl37eO+ViFZOpPM3UuH9oKfE0LVfFrNJOTGqHOQngySB71OExKsaS6Y08RRpNfMS94sGIxchjMXRZyLJi3zH2ukiUiubXjTI0rymIRLDpNHaYm6dR+hR2YEQtERmsQ4ttgNkU1Dl9tPGg1Yt2ILfEK/8OFTkz5r69u2V/f/
+ok.2nsec3.             2       DNSKEY  257 3 8 AwEAAcOyxKOo35/KKf4o2MJYNpRA5CHX627jaeLqrWsVgZx7mTg+Uxcv3KSHZKXoS8IWUL/7K9YccU9fxDzQimK03yoGk9vqxCJXiBQIrt6XJiMX6FNtu4QoDzEcJX95ib664AlpGPRFIjNqKhS3HvvAxC93ktiXbpbCcKH5y+AcqJ4r
+ok.2nsec3.             0       NSEC3PARAM      1 0 15 16BB2CD605BF6409
+a.ok.2nsec3.           3600    A       1.2.3.4
+added.ok.2nsec3.       3600    A       3.4.5.6
+ok.2nsec3.             3600    RRSIG   NS 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. F0a5ni5zuVx7d+G1eYl2VInmpGh6WirWcxi9od8ryinYl+Kzqax25BzWFUREoaqh2jzDBh/e0PjdoawUPPlaFxKwFX2XNc4wdpazCHaRO2zVi+OMaDEgSU5hSNGQrRS3VdAdRNhg2wq8up2n8NKvCPzryA5e7FLQMxd0m8QdSm8=
+ok.2nsec3.             3600    RRSIG   SOA 8 2 3600 20300325100941 20200327083941 1083 ok.2nsec3. B7mqYKCvO+pMFtmmoPyV9I+ZvwXqLV3OE/H7RtGkGvxcLym+03lSpmnfppyKgWGdwSeHOwsEoUI4OX7I/oNjCbyWex17ijj7MkRmBLsH8vkeXANPYQ0QQjGergObmqYHPqe6jFZiqML/UVS+rrRO63QhORbcl05fiWLZtx7Q8CI=
+ok.2nsec3.             3600    RRSIG   MX 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. gDAZeV5cC+DnHr3/CRSn1xxksjSq2kh39p4b84JYkIiA9WhH4+T1fE87H0CMDuWisaa3+G+ViCVF+EsvJJylOGzpdMNl2RLeigNIyrsYQnWz7m5r7RvGhRtOQMMsMi7FvfY8FuYlunoTUMqwFxPKmLunGuqwDAa99MdayNq3y9g=
+ok.2nsec3.             2       RRSIG   DNSKEY 8 2 2 20300325100832 20200327083832 19360 ok.2nsec3. L675OPk6MW8vm6Yi5boyp2IumEgcEYWyed3stGWAYihxZrpFZ5RgfxboVgcM3wvq3rxV5e/fe/CQ/LxKh7VH/tR5swoOfQSlTby9CI6MuF5UJ3EbsVNKQ3YYSIbuYH9WkhRfM4lx4aVgy/ZXiMd6VC0RUbK4idlbDkcOiqkUGe8=
+ok.2nsec3.             0       RRSIG   NSEC3PARAM 8 2 0 20300325100832 20200327083832 1083 ok.2nsec3. DmJ1pcboLskCahOSZTsg9vn2x7vue4j4+QwnNIWqardVvk4vbmdHckxmHJ6XVKrhjjU67WP42j0MLYLRfIYNuc73UwQZi/kSMzuBCFTAcGFrzgB8hiN0PRxqjZtJb+iYVCN9aBghwpBzMOCwKkkUVsYtJOL7RkSkX2mkD7QHV2o=
+a.ok.2nsec3.           3600    RRSIG   A 8 3 3600 20300325100832 20200327083832 1083 ok.2nsec3. R3CQNVWaO3veiZPsJAbdo3lz1tBTQLhkvNbKZepq4kRtvqbh74CfMqiKvUx0O8o9EkF5/fhbB9qqKbrDETeu4wU0xjZzCSsQ+75Pfn2HyC1WM+GgLx2vZec8YCTR9fkDPNiABbPywt791wlID0x8mQzF8XPyKyW0oLcINy0F6yk=
+added.ok.2nsec3.       3600    RRSIG   A 8 3 3600 20300325100941 20200327083941 1083 ok.2nsec3. rzw0Qa3bcVgNo6/7UDM8jXnw1hFOIX0qEwaB4H0VbuevYtVtKU3bkoTF2mOXiIDnz2OZSAJqWXAXQUkNh4J6mKniGXyXH/IGgAzladdLDGEvt7TMKU10SecaUzl4qhXOj8yWt+fwKyGmXdDzB1IgHVOI16kRa6xeUVg4g+AXCEE=
+1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200       NSEC3   1 0 15 16BB2CD605BF6409 spcsif81i3ij1na7td4othdersk0ddvh NS SOA MX RRSIG DNSKEY NSEC3PARAM
+bklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       NSEC3   1 0 10 874A1253FD24911F r6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG
+eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       NSEC3   1 0 10 874A1253FD24911F p6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG
+spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200       NSEC3   1 0 15 16BB2CD605BF6409 t335gu7261vda3c8h9visei2i4g64lkb A RRSIG
+t335gu7261vda3c8h9visei2i4g64lkb.ok.2nsec3. 7200       NSEC3   1 0 15 16BB2CD605BF6409 1ncif4ogq3uov6dsuppl2jc5q3dq6d5m A RRSIG
+1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. lYbsiUFKA0El/qInmq6MUZfMmTCvbXcIatHvLs5jIR3qQYal1Y4WM/k0ZYtmkJAp3olto2fO8TO2JN1xx1sCi5EilaHWrX/iQc6ftWi+QR0Z/YdpkQYZEYHKu8AgmnYDUxruu4c/rAqJmqZ3TRu8dT+Xmc8nLPRK0r0byUW1/OQ=
+bklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. nofbPG1AXGF7VZVylt4Kcw6TNykXwIlRx42WPpVUPJ4aT/h4KbSTcU5UV9MBu39hUoSBX7/6GLtA74rGYv/P5mwgan4ZGCAE6eCQShlvO70mGkkr2FC4sdZjErMokztzR/kYdTlFoow8h3ypbrEGbkEYdGTUcinxZcIabLmuHwI=
+eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. PV+/1WXuT7vjBXknFR5nLakshWiABueyRyVG1Y1m7EpL1speXfXkRs0MubA7L3vKaXbGA/WO3dhG1ORpAgLukHBMcXH2Q8vHMH9t5ol5YCVELGWdI4oA3dzIUTmpbxLsv0oR1VwWEoa5yMFmykc/2G6DoGe4v/16XuK9zA3z77E=
+spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. muXZVEt1TbllHehCx9OxRmPfqZd5sMHP+d6C4RJgE3RQZCx5EgFjlR3GgXGni0bK3AQRSjp6XHnnJyqbYkHf3bsH2ZX9AOQl+migrchLy0wmYB4lmXLJpYzhaUxfbnhnAKcTPzaM2tlbob2j+WOfTe4KG2ElIjX8RrplRD7e9ng=
+t335gu7261vda3c8h9visei2i4g64lkb.ok.2nsec3. 7200       RRSIG   NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. c1JUC38l2qea7kDosEjCdvOolrFaAnfJLpPL45RmGLjhwmLP9ORxMMZhkbLSIyOmQfOi11dEGtgyl57ORwV3vrpjo8cM5ZQXcsJZdHLCdSPdqwuGESr393lwX0BckXsgf9OFQsvJkINwFyKjjssVAjVBPyhJkp4cWKeMi+dBtfs=
diff --git a/tests-extra/tests/dnssec/validate/test.py b/tests-extra/tests/dnssec/validate/test.py
index f1a0ea7e57a37691041209294269f3f5e7476425..7c92dc697b49bb90c71fc766d0c6c5415d278a78 100644 (file)
--- a/tests-extra/tests/dnssec/validate/test.py
+++ b/tests-extra/tests/dnssec/validate/test.py
@@ -11,7 +11,7 @@ master = t.server("knot")
 slave = t.server("knot")
 
 zones_ok = t.zone("ok.nsec.", storage=".")
-zones_ok3 = t.zone("ok.nsec3.", storage=".")
+zones_ok3 = t.zone("ok.nsec3.", storage=".") + t.zone("ok.2nsec3.", storage=".")
 zones_nok = t.zone("missing.nsec.", storage=".") + t.zone("bitmap.nsec.", storage=".") + \
             t.zone("chain.nsec.", storage=".") + t.zone("rrsig.a.", storage=".") + \
             t.zone("rrsig.nsec.", storage=".")
Mirror of https://gitlab.nic.cz/knot/knot-dns.git