From: Libor Peltan <libor.peltan@nic.cz>
Date: Fri, 10 Dec 2021 15:20:15 +0000 (+0100)
Subject: dnssec: rrsig-refresh: warn if too low
X-Git-Tag: v3.3.dev~255^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bbcb937ad1612cde437f4e4010afe0e2ca1ce3e5;p=thirdparty%2Fknot-dns.git

dnssec: rrsig-refresh: warn if too low
---

diff --git a/src/knot/dnssec/zone-events.c b/src/knot/dnssec/zone-events.c
index ab2ca836fa..8811099c95 100644
--- a/src/knot/dnssec/zone-events.c
+++ b/src/knot/dnssec/zone-events.c
@@ -137,6 +137,10 @@ int knot_dnssec_zone_sign(zone_update_t *update,
 	// update policy based on the zone content
 	update_policy_from_zone(ctx.policy, update->new_cont);
 
+	if (ctx.policy->rrsig_refresh_before < ctx.policy->zone_maximal_ttl + ctx.policy->propagation_delay) {
+		log_zone_warning(zone_name, "DNSSEC, rrsig-refresh too low to prevent expired RRSIGs in resolver caches");
+	}
+
 	// perform key rollover if needed
 	result = knot_dnssec_key_rollover(&ctx, roll_flags, reschedule);
 	if (result != KNOT_EOK) {