ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Support for NSEC3 in dnssec-policy

Browse Source 
Implement support for NSEC3 in dnssec-policy.  Store the configuration
in kasp objects. When configuring a zone, call 'dns_zone_setnsec3param'
to queue an nsec3param event. This will ensure that any previous
chains will be removed and a chain according to the dnssec-policy is
created.

Add tests for dnssec-policy zones that uses the new 'nsec3param'
option, as well as changing to new values, changing to NSEC, and
changing from NSEC.

(cherry picked from commit 114af58ee2)
This commit is contained in:
Matthijs Mekking
2020-10-13 14:39:21 +02:00
parent 5dfd3b2d7b
commit 008e84e965
17 changed files with 801 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
lib/dns/include/dns/kasp.h
View File

@@ -50,6 +50,14 @@ struct dns_kasp_key {
uint8_t role;
};
struct dns_kasp_nsec3param {
unsigned char salt[255];
uint8_t saltlen;
uint8_t algorithm;
uint8_t iterations;
bool optout;
};
/* Stores a DNSSEC policy */
struct dns_kasp {
unsigned int magic;
@@ -75,6 +83,10 @@ struct dns_kasp {
dns_kasp_keylist_t keys;
dns_ttl_t dnskey_ttl;
/* Configuration: Denial of existence */
bool nsec3;
dns_kasp_nsec3param_t nsec3param;
/* Configuration: Timings */
uint32_t publish_safety;
uint32_t retire_safety;
@@ -86,8 +98,6 @@ struct dns_kasp {
/* Parent settings */
dns_ttl_t parent_ds_ttl;
uint32_t parent_propagation_delay;
/* TODO: The rest of the KASP configuration */
};
#define DNS_KASP_MAGIC ISC_MAGIC('K', 'A', 'S', 'P')
@@ -604,6 +614,94 @@ dns_kasp_key_zsk(dns_kasp_key_t *key);
*
*/
bool
dns_kasp_nsec3(dns_kasp_t *kasp);
/*%<
* Return true if NSEC3 chain should be used.
*
* Requires:
*
*\li 'kasp' is a valid, frozen kasp.
*
*/
uint8_t
dns_kasp_nsec3iter(dns_kasp_t *kasp);
/*%<
* The number of NSEC3 iterations to use.
*
* Requires:
*
*\li 'kasp' is a valid, frozen kasp.
*\li 'kasp->nsec3' is true.
*
*/
uint8_t
dns_kasp_nsec3flags(dns_kasp_t *kasp);
/*%<
* The NSEC3 flags field value.
*
* Requires:
*
*\li 'kasp' is a valid, frozen kasp.
*\li 'kasp->nsec3' is true.
*
*/
uint8_t
dns_kasp_nsec3saltlen(dns_kasp_t *kasp);
/*%<
* The NSEC3 salt length.
*
* Requires:
*
*\li 'kasp' is a valid, frozen kasp.
*\li 'kasp->nsec3' is true.
*
*/
unsigned char *
dns_kasp_nsec3salt(dns_kasp_t *kasp);
/*%<
* The NSEC3 salt used.
*
* Requires:
*
*\li 'kasp' is a valid, frozen kasp.
*\li 'kasp->nsec3' is true.
*
*/
void
dns_kasp_setnsec3(dns_kasp_t *kasp, bool nsec3);
/*%<
* Set to use NSEC3 if 'nsec3' is 'true', otherwise policy will use NSEC.
*
* Requires:
*
*\li 'kasp' is a valid, unfrozen kasp.
*
*/
isc_result_t
dns_kasp_setnsec3param(dns_kasp_t *kasp, uint8_t iter, bool optout,
const char *salt);
/*%<
* Set the desired NSEC3 parameters.
*
* Requires:
*
*\li 'kasp' is a valid, unfrozen kasp.
*\li 'kasp->nsec3' is true.
*
* Returns:
*
*\li ISC_R_SUCCESS, if NSEC3 parameters are set.
*\li Error, if isc_hex_decodestring() fails.
*
*/
ISC_LANG_ENDDECLS
#endif /* DNS_KASP_H */

5
lib/dns/include/dns/types.h
View File

@@ -95,8 +95,9 @@ typedef struct dns_kasp dns_kasp_t;
typedef ISC_LIST(dns_kasp_t) dns_kasplist_t;
typedef struct dns_kasp_key dns_kasp_key_t;
typedef ISC_LIST(dns_kasp_key_t) dns_kasp_keylist_t;
typedef uint16_t dns_keyflags_t;
typedef struct dns_keynode dns_keynode_t;
typedef struct dns_kasp_nsec3param dns_kasp_nsec3param_t;
typedef uint16_t dns_keyflags_t;
typedef struct dns_keynode dns_keynode_t;
typedef ISC_LIST(dns_keynode_t) dns_keynodelist_t;
typedef struct dns_keytable dns_keytable_t;
typedef uint16_t dns_keytag_t;