ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add offline-ksk option

Browse Source 
Add a new configuration option to enable Offline KSK key management.

Offline KSK cannot work with CSK because it splits how keys with the
KSK and ZSK role operate. Therefore, one key cannot have both roles.
Add a configuration check to ensure this.
This commit is contained in:
Matthijs Mekking
2024-03-22 11:48:53 +01:00
parent 2299aba5c2
commit 0598381236
11 changed files with 120 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
bin/named/config.c
View File

@@ -299,6 +299,7 @@ dnssec-policy \"default\" {\n\
cds-digest-types { 2; };\n\
dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
inline-signing yes;\n\
offline-ksk no;\n\
publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
purge-keys " DNS_KASP_PURGE_KEYS "; \n\

1
bin/tests/system/checkconf/good-kasp.conf
View File

@@ -30,6 +30,7 @@ dnssec-policy "test" {
};
max-zone-ttl 86400;
nsec3param iterations 0 optout no salt-length 8;
offline-ksk no;
parent-ds-ttl 7200;
parent-propagation-delay PT1H;
publish-safety PT3600S;

31
bin/tests/system/checkconf/kasp-bad-offline-ksk.conf Normal file
View File

@@ -0,0 +1,31 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
/*
* Offline KSK is not possible with CSK
* (even if there are other key roles present).
*/
dnssec-policy "bad-offline-ksk" {
offline-ksk yes;
keys {
ksk lifetime P10Y algorithm rsasha256;
zsk lifetime P10Y algorithm rsasha256;
csk lifetime P10Y algorithm rsasha256;
};
};
zone "example.net" {
type primary;
file "example.db";
dnssec-policy "bad-offline-ksk";
};

8
bin/tests/system/checkconf/tests.sh
View File

@@ -676,6 +676,14 @@ grep "dnssec-policy: key with algorithm rsasha256 has invalid key length 511" <c
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
echo_i "checking named-checkconf kasp offline-ksk with csk errors ($n)"
ret=0
$CHECKCONF kasp-bad-offline-ksk.conf >checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: csk keys are not allowed when offline-ksk is enabled" <checkconf.out$n >/dev/null || ret=1
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
echo_i "checking named-checkconf kasp signatures refresh errors ($n)"
ret=0