Add signzone command. #8
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ximon18
changed the title
12 tasks
Member
|
dnst-signzone currently allows not specifying a key to sign with. In that case it just copies the original zone over into the .signed file (with no signatures ofc). |
Merged
Member
Author
That's a bug. Update: Fixed in 907a634. |
mozzieongit
reviewed
Nov 20, 2024
… private keys else fall back to loading public keys.
…sting LDNS option.
…n test failure. (#63)
* Remove -M option. * Fallout of merging.
- Add a test of '-u' that sets the SOA SERIAL to the Epoch time now if ahead of the SOA SERIAL, or increments the SOA SERIAL otherwise. - Change the code that determines the serial now to do so with its own mockable source of time from the environment, instead of using Serial::now() which hard-codes use of the real system clock. - Extend the concept of Env to support seconds since the epoch which can be overridden when using FakeEnv. --------- Co-authored-by: Philip-NLnetLabs <[email protected]>
* Add missing arguments and re-order arguments to match -h output, plus some argument re-ordering to better group related arguments together in -h output. * Remove orphaned comment. * Note that we don't attempt to detect a zone file origin if not defined, unlike ldns-signzone which will use the owner of the first SOA RR as the origin. To support this would require a change in the `domain` zonefile parser which we are not convinced would be right, but may revisit this if there appears to be actual users out there depending on and wanting this detection logic.
- Be consistent with trailing periods (not shown in -h but the inconsistencies are visible via --help). - Document in --help output arguments that have dependencies on other arguments. - Encode some inter-argument dependencies via Clap rules. - Also makes LDNS mode error message the same as the real ldns-signzone.
- Require `-o` for `dnst signzone`, but for `ldns-signzone` allow it to be missing and then use the owner name first SOA found as the apex. This avoids unreliable apex detection in `dnst`, while keeping maximum backward compatibility with `ldns`. - Removed the no longer necessary separation of `execute()` into an extra `go_further()` fn, which was previously needed as a workaround for using the right generic values. - Did some cleanup in affected/related code, e.g. bump the SOA SERIAL and use only that bumped SOA RR rather than use two different SOA RRs, refer to `new_default_rr_ttl` instead of `soa_rr.ttl()` to make it clear that it's not per se the SOA RR TTL we are interested in, this is just the default we choose to use, and make more use of the `apex` variable. - Improved an error message. - Added some tests for the case of early glue showing that the wrong apex is no longer searched for a SOA by the signer.
…::into_path`: use TempDir::keep()".
…esn't have this option.
Member
Author
|
We agreed to ignore the Windows CI failures for the moment for this PR and so are ready to merge this as is. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently depends on
domainbranchinitial-nsec3-generation, which has had multiple branches/PRs merged into it (see NLnetLabs/domain#416)Supports:
zonefile key [key [key]]and the NSEC3 arguments-n,-a,-t,-sand-p.-o,-i,d,-e,-f,-u,-A,-Uand-v.-zand-Zfor ZONEMDPartially supports:
-b(support for Bubble Babble DS comment output is not planned at present).Lacks but should have support for:
domainlibrary. See:Lacks and do not plan to add support for:
Other:
dnstremoves DNSSEC records on loading already signed zonefiles.-Uoption causes a warning fromdnssec-verify(it also does so for the originalldns-signzonewhen using-Uso I think this is fine). We should think do we want to support the-Uoption fordnst signzone?ldns-signzoneas the behaviour is determined by thedomaincrate. (seeldns_rr2buffer_str_fmt()in LDNS). Known differences are:Additional related DRAFT PRs:
This PR adds automated tests but has also been tested manually against the original
ldns-signzoneanddnssec-signzone.