mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-02 15:45:25 +00:00
Code Issues Releases Wiki Activity

Merge branch 'misc-fixes-kasp' into 'master'

Browse Source 
Miscellaneous fixes kasp

See merge request isc-projects/bind9!2711
This commit is contained in:
Matthijs Mekking
2019-12-09 08:22:56 +00:00
parent 6f096f5245 4b66c0ebf4
commit edd6a084f0
7 changed files with 108 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
5334. [doc] Update documentation with dnssec-policy clarifications.
Also change some defaults.
5333. [bug] Fix duration printing on Solaris when value is not 5333. [bug] Fix duration printing on Solaris when value is not
an ISO 8601 duration. [GL #1460] an ISO 8601 duration. [GL #1460]

10
bin/tests/system/kasp/tests.sh
View File

@@ -724,7 +724,7 @@ status=$((status+ret))
# #
zone_properties "ns3" "rsasha1.kasp" "rsasha1" "1234" "3" "10.53.0.3" zone_properties "ns3" "rsasha1.kasp" "rsasha1" "1234" "3" "10.53.0.3"
key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes" key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes"
key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "1024" "yes" "no" key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "2048" "yes" "no"
key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no" key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no"
# The first keys are immediately published and activated. # The first keys are immediately published and activated.
# Because lifetime > 0, retired timing is also set. # Because lifetime > 0, retired timing is also set.
@@ -997,7 +997,7 @@ check_subdomain
# #
zone_properties "ns3" "inherit.kasp" "rsasha1" "1234" "3" "10.53.0.3" zone_properties "ns3" "inherit.kasp" "rsasha1" "1234" "3" "10.53.0.3"
key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes" key_properties "KEY1" "ksk" "315360000" "5" "RSASHA1" "2048" "no" "yes"
key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "1024" "yes" "no" key_properties "KEY2" "zsk" "157680000" "5" "RSASHA1" "2048" "yes" "no"
key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no" key_properties "KEY3" "zsk" "31536000" "5" "RSASHA1" "2000" "yes" "no"
# The first keys are immediately published and activated. # The first keys are immediately published and activated.
# Because lifetime > 0, retired timing is also set. # Because lifetime > 0, retired timing is also set.
@@ -1107,7 +1107,7 @@ status=$((status+ret))
# #
zone_properties "ns3" "rsasha1-nsec3.kasp" "rsasha1-nsec3" "1234" "3" "10.53.0.3" zone_properties "ns3" "rsasha1-nsec3.kasp" "rsasha1-nsec3" "1234" "3" "10.53.0.3"
key_properties "KEY1" "ksk" "315360000" "7" "NSEC3RSASHA1" "2048" "no" "yes" key_properties "KEY1" "ksk" "315360000" "7" "NSEC3RSASHA1" "2048" "no" "yes"
key_properties "KEY2" "zsk" "157680000" "7" "NSEC3RSASHA1" "1024" "yes" "no" key_properties "KEY2" "zsk" "157680000" "7" "NSEC3RSASHA1" "2048" "yes" "no"
key_properties "KEY3" "zsk" "31536000" "7" "NSEC3RSASHA1" "2000" "yes" "no" key_properties "KEY3" "zsk" "31536000" "7" "NSEC3RSASHA1" "2000" "yes" "no"
# key_timings and key_states same as above. # key_timings and key_states same as above.
check_keys check_keys
@@ -1120,7 +1120,7 @@ dnssec_verify
# #
zone_properties "ns3" "rsasha256.kasp" "rsasha256" "1234" "3" "10.53.0.3" zone_properties "ns3" "rsasha256.kasp" "rsasha256" "1234" "3" "10.53.0.3"
key_properties "KEY1" "ksk" "315360000" "8" "RSASHA256" "2048" "no" "yes" key_properties "KEY1" "ksk" "315360000" "8" "RSASHA256" "2048" "no" "yes"
key_properties "KEY2" "zsk" "157680000" "8" "RSASHA256" "1024" "yes" "no" key_properties "KEY2" "zsk" "157680000" "8" "RSASHA256" "2048" "yes" "no"
key_properties "KEY3" "zsk" "31536000" "8" "RSASHA256" "2000" "yes" "no" key_properties "KEY3" "zsk" "31536000" "8" "RSASHA256" "2000" "yes" "no"
# key_timings and key_states same as above. # key_timings and key_states same as above.
check_keys check_keys
@@ -1133,7 +1133,7 @@ dnssec_verify
# #
zone_properties "ns3" "rsasha512.kasp" "rsasha512" "1234" "3" "10.53.0.3" zone_properties "ns3" "rsasha512.kasp" "rsasha512" "1234" "3" "10.53.0.3"
key_properties "KEY1" "ksk" "315360000" "10" "RSASHA512" "2048" "no" "yes" key_properties "KEY1" "ksk" "315360000" "10" "RSASHA512" "2048" "no" "yes"
key_properties "KEY2" "zsk" "157680000" "10" "RSASHA512" "1024" "yes" "no" key_properties "KEY2" "zsk" "157680000" "10" "RSASHA512" "2048" "yes" "no"
key_properties "KEY3" "zsk" "31536000" "10" "RSASHA512" "2000" "yes" "no" key_properties "KEY3" "zsk" "31536000" "10" "RSASHA512" "2000" "yes" "no"
# key_timings and key_states same as above. # key_timings and key_states same as above.
check_keys check_keys

26
dnssec-policy.default.conf Normal file
View File

@@ -0,0 +1,26 @@
dnssec-policy "default" {
// Keys
keys {
csk key-directory lifetime 0 algorithm 13;
};
// Key timings
dnskey-ttl 3600;
publish-safety 1h;
retire-safety 1h;
// Signature timings
signatures-refresh 5d;
signatures-validity 14d;
signatures-validity-dnskey 14d;
// Zone parameters
zone-max-ttl 86400;
zone-propagation-delay 300;
// Parent parameters
parent-ds-ttl 86400;
parent-registration-delay 24h;
parent-propagation-delay 1h;
};

105
doc/arm/Bv9ARM-book.xml
View File

@@ -4467,9 +4467,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The number of seconds to wait between attempts to The number of seconds to wait between attempts to
reopen a closed output stream. The minimum is 1 second, reopen a closed output stream. The minimum is 1 second,
the maximum is 600 seconds (10 minutes), and the default the maximum is 600 seconds (10 minutes), and the default
is 5 seconds. is 5 seconds. For convenience, TTL-style time unit
For convenience, TTL-style time unit suffixes may be suffixes may be used to specify the value. It also
used to specify the value. accepts ISO 8601 duration formats.
</simpara> </simpara>
</listitem> </listitem>
</itemizedlist> </itemizedlist>
@@ -5271,8 +5271,11 @@ options {
<para> <para>
For convenience, TTL-style time unit suffixes can be For convenience, TTL-style time unit suffixes can be
used to specify the NTA lifetime in seconds, minutes used to specify the NTA lifetime in seconds, minutes
or hours. <option>nta-lifetime</option> defaults to or hours. It also accepts ISO 8601 duration formats.
one hour. It cannot exceed one week. </para>
<para>
<option>nta-lifetime</option> defaults to one hour. It
cannot exceed one week.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -5305,9 +5308,13 @@ options {
<para> <para>
For convenience, TTL-style time unit suffixes can be For convenience, TTL-style time unit suffixes can be
used to specify the NTA recheck interval in seconds, used to specify the NTA recheck interval in seconds,
minutes or hours. The default is five minutes. It minutes or hours. It also accepts ISO 8601 duration
cannot be longer than <option>nta-lifetime</option> formats.
(which cannot be longer than a week). </para>
<para>
The default is five minutes. It cannot be longer than
<option>nta-lifetime</option> (which cannot be longer
than a week).
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -5318,7 +5325,10 @@ options {
<para> <para>
Specifies a maximum permissible TTL value in seconds. Specifies a maximum permissible TTL value in seconds.
For convenience, TTL-style time unit suffixes may be For convenience, TTL-style time unit suffixes may be
used to specify the maximum value. used to specify the maximum value. It also
accepts ISO 8601 duration formats.
</para>
<para>
When loading a zone file using a When loading a zone file using a
<option>masterfile-format</option> of <option>masterfile-format</option> of
<constant>text</constant> or <constant>raw</constant>, <constant>text</constant> or <constant>raw</constant>,
@@ -8463,7 +8473,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
<command>listen-on</command> configuration), and <command>listen-on</command> configuration), and
will stop listening on interfaces that have gone away. will stop listening on interfaces that have gone away.
For convenience, TTL-style time unit suffixes may be For convenience, TTL-style time unit suffixes may be
used to specify the value. used to specify the value. It also accepts ISO 8601
duration formats.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -8744,9 +8755,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
stores negative answers. <command>min-ncache-ttl</command> is stores negative answers. <command>min-ncache-ttl</command> is
used to set a minimum retention time for these answers in the used to set a minimum retention time for these answers in the
server in seconds. For convenience, TTL-style time unit server in seconds. For convenience, TTL-style time unit
suffixes may be used to specify the value. The default suffixes may be used to specify the value. It also
<command>min-ncache-ttl</command> is <literal>0</literal> accepts ISO 8601 duration formats.
seconds. <command>min-ncache-ttl</command> cannot exceed 90 </para>
<para>
The default <command>min-ncache-ttl</command> is
<literal>0</literal> seconds.
<command>min-ncache-ttl</command> cannot exceed 90
seconds and will be truncated to 90 seconds if set to a seconds and will be truncated to 90 seconds if set to a
greater value. greater value.
</para> </para>
@@ -8758,10 +8773,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
<listitem> <listitem>
<para> <para>
Sets the minimum time for which the server will cache ordinary Sets the minimum time for which the server will cache ordinary
(positive) answers in seconds. For convenience, TTL-style time (positive) answers in seconds. For convenience, TTL-style
unit suffixes may be used to specify the value. The default time unit suffixes may be used to specify the value. It also
<command>min-cache-ttl</command> is <literal>0</literal> accepts ISO 8601 duration formats.
seconds. <command>min-cache-ttl</command> cannot exceed 90 </para>
<para>
The default <command>min-cache-ttl</command> is
<literal>0</literal> seconds.
<command>min-cache-ttl</command> cannot exceed 90
seconds and will be truncated to 90 seconds if set to a seconds and will be truncated to 90 seconds if set to a
greater value. greater value.
</para> </para>
@@ -8773,15 +8792,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
<listitem> <listitem>
<para> <para>
To reduce network traffic and increase performance, To reduce network traffic and increase performance,
the server stores negative answers. <command>max-ncache-ttl</command> is the server stores negative answers.
<command>max-ncache-ttl</command> is
used to set a maximum retention time for these answers in used to set a maximum retention time for these answers in
the server in seconds. the server in seconds. For convenience, TTL-style time unit
For convenience, TTL-style time unit suffixes may be suffixes may be used to specify the value. It also accepts
used to specify the value. The default ISO 8601 duration formats.
<command>max-ncache-ttl</command> is <literal>10800</literal> seconds (3 hours). </para>
<command>max-ncache-ttl</command> cannot exceed <para>
7 days and will The default <command>max-ncache-ttl</command> is
be silently truncated to 7 days if set to a greater value. <literal>10800</literal> seconds (3 hours).
<command>max-ncache-ttl</command> cannot exceed 7 days and
will be silently truncated to 7 days if set to a greater
value.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -8793,7 +8816,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Sets the maximum time for which the server will Sets the maximum time for which the server will
cache ordinary (positive) answers in seconds. cache ordinary (positive) answers in seconds.
For convenience, TTL-style time unit suffixes may be For convenience, TTL-style time unit suffixes may be
used to specify the value. used to specify the value. It also accepts ISO 8601
duration formats.
</para>
<para>
The default is 604800 (one week). The default is 604800 (one week).
A value of zero may cause all queries to return A value of zero may cause all queries to return
SERVFAIL, because of lost caches of intermediate SERVFAIL, because of lost caches of intermediate
@@ -10099,7 +10125,9 @@ deny-answer-aliases { "example.net"; };
The <command>max-policy-ttl</command> clause changes the The <command>max-policy-ttl</command> clause changes the
maximum seconds from its default of 5. maximum seconds from its default of 5.
For convenience, TTL-style time unit suffixes may be For convenience, TTL-style time unit suffixes may be
used to specify the value. used to specify the value. It also accepts ISO 8601 duration
formats.
</para> </para>
<para> <para>
@@ -10195,7 +10223,8 @@ example.com CNAME rpz-tcp-only.
recent update, then the changes will not be carried out until this recent update, then the changes will not be carried out until this
interval has elapsed. The default is <literal>60</literal> seconds. interval has elapsed. The default is <literal>60</literal> seconds.
For convenience, TTL-style time unit suffixes may be For convenience, TTL-style time unit suffixes may be
used to specify the value. used to specify the value. It also accepts ISO 8601 duration
formats.
</para> </para>
</section> </section>
@@ -11117,8 +11146,8 @@ example.com CNAME rpz-tcp-only.
<para> <para>
A margin that is added to the publish interval in key A margin that is added to the publish interval in key
timing equations to give some extra time to cover timing equations to give some extra time to cover
unforeseen events. Default is <constant>PT5M</constant> unforeseen events. Default is <constant>PT1H</constant>
(5 minutes). (1 hour).
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -11129,8 +11158,8 @@ example.com CNAME rpz-tcp-only.
<para> <para>
A margin that is added to the retire interval in key A margin that is added to the retire interval in key
timing equations to give some extra time to cover timing equations to give some extra time to cover
unforeseen events. Default is <constant>PT5M</constant> unforeseen events. Default is <constant>PT1H</constant>
(5 minutes). (1 hour).
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -11222,7 +11251,7 @@ example.com CNAME rpz-tcp-only.
<listitem> <listitem>
<para> <para>
The TTL of the DS RRset that the parent uses. Default is The TTL of the DS RRset that the parent uses. Default is
<constant>PT1H</constant> (1 hour). <constant>P1D</constant> (1 day).
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@@ -12131,9 +12160,13 @@ view "external" {
<term><command>dnssec-policy</command></term> <term><command>dnssec-policy</command></term>
<listitem> <listitem>
<para> <para>
The key and signing policy for this zone. Set to The key and signing policy for this zone. This is a string
<userinput>"default"</userinput> if you want to make use referring to a <command>dnssec-policy</command> statement.
of the default policy. There are two built-in policies:
<userinput>"default"</userinput> allows you to use the
default policy, and <userinput>"none"</userinput> means
not to use any DNSSEC policy, keeping the zone unsigned.
The default is <userinput>"none"</userinput>.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>

2
doc/arm/dnssec-policy.grammar.xml
View File

@@ -14,7 +14,7 @@
<programlisting> <programlisting>
<command>dnssec-policy</command> <replaceable>string</replaceable> { <command>dnssec-policy</command> <replaceable>string</replaceable> {
<command>dnskey-ttl</command> <replaceable>duration</replaceable>; <command>dnskey-ttl</command> <replaceable>duration</replaceable>;
<command>keys</command> { ( csk | ksk | zsk ) key-directory <replaceable>duration</replaceable> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... }; <command>keys</command> { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
<command>parent-ds-ttl</command> <replaceable>duration</replaceable>; <command>parent-ds-ttl</command> <replaceable>duration</replaceable>;
<command>parent-propagation-delay</command> <replaceable>duration</replaceable>; <command>parent-propagation-delay</command> <replaceable>duration</replaceable>;
<command>parent-registration-delay</command> <replaceable>duration</replaceable>; <command>parent-registration-delay</command> <replaceable>duration</replaceable>;

6
lib/dns/include/dns/kasp.h
View File

@@ -99,9 +99,9 @@ struct dns_kasp {
#define DNS_KASP_SIG_VALIDITY (86400*14) #define DNS_KASP_SIG_VALIDITY (86400*14)
#define DNS_KASP_SIG_VALIDITY_DNSKEY (86400*14) #define DNS_KASP_SIG_VALIDITY_DNSKEY (86400*14)
#define DNS_KASP_KEY_TTL (3600) #define DNS_KASP_KEY_TTL (3600)
#define DNS_KASP_DS_TTL (3600) #define DNS_KASP_DS_TTL (86400)
#define DNS_KASP_PUBLISH_SAFETY (300) #define DNS_KASP_PUBLISH_SAFETY (3600)
#define DNS_KASP_RETIRE_SAFETY (300) #define DNS_KASP_RETIRE_SAFETY (3600)
#define DNS_KASP_ZONE_MAXTTL (86400) #define DNS_KASP_ZONE_MAXTTL (86400)
#define DNS_KASP_ZONE_PROPDELAY (300) #define DNS_KASP_ZONE_PROPDELAY (300)
#define DNS_KASP_PARENT_PROPDELAY (3600) #define DNS_KASP_PARENT_PROPDELAY (3600)

4
lib/dns/kasp.c
View File

@@ -395,10 +395,8 @@ dns_kasp_key_size(dns_kasp_key_t *key) {
if (size > 4096) { if (size > 4096) {
size = 4096; size = 4096;
} }
} else if (key->role & DNS_KASP_KEY_ROLE_KSK) {
size = 2048;
} else { } else {
size = 1024; size = 2048;
} }
break; break;
case DNS_KEYALG_ECDSA256: case DNS_KEYALG_ECDSA256: