apply_dnssec_request

bindcar::zones

Function apply_dnssec_request 

Source 
pub fn apply_dnssec_request(
    zone_config: &mut ZoneConfig,
    requested_policy: Option<&str>,
    requested_inline_signing: Option<bool>,
    zone_serves_dnskey: bool,
) -> Result<bool, ApiError>
Expand description

Applies the DNSSEC fields of a ModifyZoneRequest to a parsed zone configuration, enforcing the ADR-0001 transition rules.

Merge semantics: a None request field means “leave as is”, never “remove” — verified on BIND 9.18.50, re-issuing a zone config without its dnssec-policy abruptly unsigns the zone at the next reconfig.

  • a policy name enables signing or switches policies (BIND manages the rollover); inline-signing yes is set implicitly when the zone has no dynamic-update configuration, since BIND requires one or the other
  • DNSSEC_POLICY_INSECURE is the only path from signed to unsigned
  • DNSSEC_POLICY_NONE removes the directive, and is refused while the zone still serves DNSKEY records

§Arguments

  • zone_config - Parsed showzone configuration to mutate
  • requested_policy - dnssecPolicy field of the PATCH body
  • requested_inline_signing - inlineSigning field of the PATCH body
  • zone_serves_dnskey - Whether rndc dnssec -status reports a key whose DNSKEY state is still rumoured or omnipresent

§Returns

true when the request changed DNSSEC configuration (the caller must run rndc reconfig after rndc modzone to activate it, per ADR-0001).

§Errors

Returns ApiError::UnsafeDnssecTransition when the request would remove the policy from a zone that still serves DNSKEY records.