-
Type:
Bug
-
Status: Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: 2.1.5
-
Fix Version/s: None
-
Component/s: Enforcer
-
Labels:None
-
Environment:
NetBSD 9.0_BETA / amd64
I am looking for a way to get the DS for a key in "waiting for ds-gone" state exported,
so that I can initiate action to have the correct now-obsolete DS record removed
from the DNS. However, "key list --verbose --zone <zone>" only leaves me with cka_id and keytag to uniquely identify a given key.
However, "key export" does apparently not accept either "--cka_id"
or "--keytag" to identify the key to be exported.
"key export" has a "--keystate <state>" option, but that leaves me with the
unanswered question about how the different states are presented to the operator
and how "key export" expects its input as a value to the "--keystate" option.
So this turned me back to "key list" again.
However, doing
ods @ hugin: {37} ods-enforcer key list --zone 62.38.158.in-addr.arpa --verbose --keystate Keys: Zone: Keytype: State: Date of next transition: Size: Algorithm: CKA_ID: Repository: KeyTag: [Remote closed connection] ods @ hugin: {38}
leaves me with an error message and an ods-enforcer which has either crashed or exit()ed. This is quite serious in my judgement, and violates the most basic robustness principles, especially since the "--keystate" option is among the documented options for "key list".
Also, the question about how to get at the "--keystate" values is left unanswered.
Just for reference, when I omit the "--keystate" option, I get:
ods @ hugin: {41} ods-enforcer key list --zone 62.38.158.in-addr.arpa --verbose
Keys:
Zone: Keytype: State: Date of next transition: Size: Algorithm: CKA_ID: Repository: KeyTag:
62.38.158.in-addr.arpa KSK retire waiting for ds-gone 2048 8 22ec65fc0843188321b5ce68da186317 SoftHSM 2966
62.38.158.in-addr.arpa ZSK retire ds-unsubmitted 1280 8 df0f2ec165e2e6a0338cd317412cd0a1 SoftHSM 3114
62.38.158.in-addr.arpa ZSK active ds-unsubmitted 1280 8 f19e5f007a7da953e6b0d9f816415447 SoftHSM 53118
62.38.158.in-addr.arpa KSK active ds-seen 2048 8 465bba03e99cac2fb4a5bf9bb9331cc2 SoftHSM 34886
ods @ hugin: {42}
which doesn't say anything about the values of "--keystate", and does not bring
me closer to being able to identify the now-obsolete DS key in the DNS.
"Help!"
Håvard