check-zone: warn on mismatch between algo and NSEC

Closes #3267

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index 644c7825178a0530c5b4fd9d362bb7ae4beb2cfe..c7217c7f941389032929ea34b3a731ab66a3b5ae 100644 (file)
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -448,7 +448,7 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const DNSName& zone, bool useCache)
 
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
-    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone)) // XXX Needs to go, see #3267
+    if(dpk.d_algorithm == 5 && getNSEC3PARAM(zone))
       dpk.d_algorithm+=2;
 
     KeyMetaData kmd;

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 85c7d6fbf874950636547a11aa5d7c4ebc5da983..a56feb9067ab54b066a64ac7ad4202282f408f27 100644 (file)
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -408,9 +408,24 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone, const vect
   DNSResourceRecord rr;
   uint64_t numrecords=0, numerrors=0, numwarnings=0;
 
-  if (haveNSEC3 && isSecure && zone.wirelength() > 222) {
-    numerrors++;
-    cout<<"[Error] zone '" << zone << "' has NSEC3 semantics but is too long to have the hash prepended. Zone name is " << zone.wirelength() << " bytes long, whereas the maximum is 222 bytes." << endl;
+  if (haveNSEC3) {
+    if(isSecure && zone.wirelength() > 222) {
+      numerrors++;
+      cout<<"[Error] zone '" << zone << "' has NSEC3 semantics but is too long to have the hash prepended. Zone name is " << zone.wirelength() << " bytes long, whereas the maximum is 222 bytes." << endl;
+    }
+
+    vector<DNSBackend::KeyData> dbkeyset;
+    B.getDomainKeys(zone, 0, dbkeyset);
+
+    for(DNSBackend::KeyData& kd : dbkeyset) {
+      DNSKEYRecordContent dkrc;
+      shared_ptr<DNSCryptoKeyEngine>(DNSCryptoKeyEngine::makeFromISCString(dkrc, kd.content));
+
+      if(dkrc.d_algorithm == 5) {
+        cout<<"[Warning] zone '"<<zone<<"' has NSEC3 semantics, but the "<< (kd.active ? "" : "in" ) <<"active key with id "<<kd.id<<" has 'Algorithm: 5'. This should be corrected to 'Algorithm: 7' in the database (or NSEC3 should be disabled)."<<endl;
+        numwarnings++;
+      }
+    }
   }
 
   if (!validKeys) {