KNOWN_ISSUES

$Id: KNOWN_ISSUES 6950 2013-01-16 11:26:19Z matthijs $

OpenDNSSEC 1.4.0rc1 - Known Restrictions

The following are the known problems and/or restrictions of release 1.4.0rc1 of
OpenDNSSEC.

BUGS: 
-----

OPENDNSSEC-332: Statistics on average sigs/sec not accurate


Limitations on Number of Zones
------------------------------

Owing to contention in the key management database, performance is degraded if
OpenDNSSEC is used to sign large numbers of zones that do not share common
keys. The problem is worse if SQLite is used for the key and signature manager
database.

As a workaround, we suggest that either the same key is used for all zones, or
that the number of zones be limited to about 5,000.

This will be addressed in a future release of the software.


Issue with rolling from one algorithm to another
------------------------------------------------

The current version will handle key rollovers that also change algorithm just 
the same as any other key rollover. This is not sufficient; and so rolling 
between algorithms is broken and should not be done with the current system.


Handling of external command calls
----------------------------------

External commands (e.g. NotifyCommand or DelegationSignerSubmitCommand) are 
called with popen. This can lead to errors with these external scripts not
being noticed by OpenDNSSEC. It is therefore recommended that when writing
scripts like these that they log enough information for the user to tell
independently if they failed.


Maximum number of HSMs
----------------------

The datatype of the column storing HSMs in the kasp database is only large 
enough to store 127 separate HSMs (with a MySQL backend).


Quotation marks in strings
--------------------------

Enforcer does not remove/handle any quotation marks in the imported strings.
This will create a problem when importing the information from e.g. the policy
description field into the Enforcer database.