ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add check for NSEC3 and key algorithms

Browse Source 
NSEC3 is not backwards compatible with key algorithms that existed
before the RFC 5155 specification was published.

(cherry picked from commit 00c5dabea3)
This commit is contained in:
Matthijs Mekking
2020-10-19 10:19:52 +02:00
parent 00d7cc5144
commit d35dab3db8
6 changed files with 64 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
View File

@@ -11,14 +11,14 @@
dnssec-policy "rsasha1" {
keys {
csk lifetime P10Y algorithm rsasha1 1024;
csk lifetime P10Y algorithm nsec3rsasha1 1024;
};
nsec3param iterations 150;
};
dnssec-policy "rsasha1-bad" {
keys {
csk lifetime P10Y algorithm rsasha1 1024;
csk lifetime P10Y algorithm nsec3rsasha1 1024;
};
nsec3param iterations 151;
};