ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add check for NSEC3 and key algorithms

Browse Source 
NSEC3 is not backwards compatible with key algorithms that existed
before the RFC 5155 specification was published.

(cherry picked from commit 00c5dabea3)
This commit is contained in:
Matthijs Mekking
2020-10-19 10:19:52 +02:00
parent 00d7cc5144
commit d35dab3db8
6 changed files with 64 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
bin/tests/system/checkconf/kasp-bad-nsec3-alg.conf Normal file
View File

@@ -0,0 +1,24 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
dnssec-policy "bad-salt" {
keys {
csk lifetime unlimited algorithm rsasha1;
};
nsec3param ;
};
zone "example.net" {
type master;
file "example.db";
dnssec-policy "bad-salt";
};