knotc/zone-ksk-submitted: implemented +ttl for delaying old KSK removal

diff --git a/doc/man_knotc.rst b/doc/man_knotc.rst
index 33368f36a5e6f02a244a5f1781d3f143d7651833..39e75e9c5c569470a38aacb4c0135497145d8ffe 100644 (file)
--- a/doc/man_knotc.rst
+++ b/doc/man_knotc.rst
@@ -183,10 +183,12 @@ Actions
   key management enabled. Note that complete key rollover consists of several steps
   and the blocking mode relates to the initial one only! (#)
 
-**zone-ksk-submitted** *zone*...
+**zone-ksk-submitted** *zone*... [**+ttl** *seconds*]
   Use when the zone's KSK rollover is in submission phase. By calling this command
   the user confirms manually that the parent zone contains DS record for the new
-  KSK in submission phase and the old KSK can be retired. (#)
+  KSK in submission phase and the old KSK can be retired. The optional **+ttl**
+  parameter specifies the parent DS's TTL and possibly other delays, with the
+  effect that the removal of old KSK is postponed by this amount of seconds. (#)
 
 **zone-freeze** [*zone*...]
   Trigger a zone freeze. All running events will be finished and all new and pending

diff --git a/python/libknot/README.md b/python/libknot/README.md
index 181693bd837def069e0c4b445bb2d1e928058c93..bf0ec5bc491684441a579c31d69fa3dd2a771874 100644 (file)
--- a/python/libknot/README.md
+++ b/python/libknot/README.md
@@ -137,7 +137,9 @@ The following commands apply to all zones if `ZONE` is left empty.
 * `zone-validate([ZONE], [FLAGS="B"])`
 * `zone-keys-load([ZONE], [FLAGS="B"])`
 * `zone-key-rollover([ZONE], TYPE="ksk"|"zsk", [FLAGS="B"])`
-* `zone-ksk-submitted([ZONE], [FLAGS="B"])`
+* `zone-ksk-submitted([ZONE], [FILTERS="t", DATA], [FLAGS="B"])`
+  + the **t**tl filter commands that removal of old KSK is postponed by the amount of seconds
+    stored in the `DATA` section
 * `zone-freeze([ZONE], [FLAGS="B"])`
 * `zone-thaw([ZONE], [FLAGS="B"])`
 * `zone-xfr-freeze([ZONE], [FLAGS="B"])`

diff --git a/src/knot/ctl/commands.c b/src/knot/ctl/commands.c
index 392f0664a0303e49417b9a19d71d712fb9f6e018..7614a2511e1a1e824c5b59f810adaca182d3be04 100644 (file)
--- a/src/knot/ctl/commands.c
+++ b/src/knot/ctl/commands.c
@@ -845,12 +845,23 @@ static int zone_ksk_sbm_confirm(zone_t *zone, _unused_ ctl_args_t *args)
 {
        kdnssec_ctx_t ctx = { 0 };
 
-       int ret = kdnssec_ctx_init(conf(), &ctx, zone->name, zone_kaspdb(zone), NULL);
+       int ret = KNOT_EOK;
+
+       uint32_t ds_ttl = 0;
+       const char *ds_ttl_s = args->data[KNOT_CTL_IDX_DATA];
+       if (MATCH_AND_FILTER(args, CTL_FILTER_KSK_SBM_TTL) && ds_ttl_s != NULL) {
+               ret = str_to_u32(ds_ttl_s, &ds_ttl);
+               if (ret != KNOT_EOK) {
+                       return ret;
+               }
+       }
+
+       ret = kdnssec_ctx_init(conf(), &ctx, zone->name, zone_kaspdb(zone), NULL);
        if (ret != KNOT_EOK) {
                return ret;
        }
 
-       ret = knot_dnssec_ksk_sbm_confirm(&ctx, 0);
+       ret = knot_dnssec_ksk_sbm_confirm(&ctx, ds_ttl);
        kdnssec_ctx_deinit(&ctx);
 
        conf_val_t val = conf_zone_get(conf(), C_DNSSEC_SIGNING, zone->name);

diff --git a/src/knot/ctl/commands.h b/src/knot/ctl/commands.h
index 25b893514abbbeed27766779549096d92f8003b8..0e435192737a163b4c98abd0c45d7ec92a1e005f 100644 (file)
--- a/src/knot/ctl/commands.h
+++ b/src/knot/ctl/commands.h
@@ -20,6 +20,8 @@
 
 #define CTL_FILTER_FLUSH_OUTDIR                "d"
 
+#define CTL_FILTER_KSK_SBM_TTL         "t"
+
 #define CTL_FILTER_STATUS_LOADING      "l"
 
 #define CTL_FILTER_STATUS_ROLE         "r"

diff --git a/src/utils/knotc/commands.c b/src/utils/knotc/commands.c
index 3e78ba307ce618c8947406e55527c4a83a92be57..a8af19b109847d3d0b81d3f50aa1d14f16695a33 100644 (file)
--- a/src/utils/knotc/commands.c
+++ b/src/utils/knotc/commands.c
@@ -652,6 +652,11 @@ const filter_desc_t zone_flush_filters[] = {
        { NULL },
 };
 
+const filter_desc_t zone_ksk_sbm_filters[] = {
+       { "+ttl", CTL_FILTER_KSK_SBM_TTL, true },
+       { NULL },
+};
+
 const filter_desc_t zone_backup_filters[] = {
        { "+backupdir",   CTL_FILTER_BACKUP_OUTDIR,      true },  // This must be the first.
        { "+zonefile",    CTL_FILTER_BACKUP_ZONEFILE,   false },
@@ -706,6 +711,9 @@ static const filter_desc_t *get_filter(ctl_cmd_t cmd, const char *filter_name)
        case CTL_ZONE_FLUSH:
                fd = zone_flush_filters;
                break;
+       case CTL_ZONE_KSK_SBM:
+               fd = zone_ksk_sbm_filters;
+               break;
        case CTL_ZONE_BACKUP:
        case CTL_ZONE_RESTORE:
                fd = zone_backup_filters;