Commit Graph

14 Commits

Author SHA1 Message Date
Matthijs Mekking
4892006a92 Make 'parent-registration-delay' obsolete
With the introduction of 'checkds', the 'parent-registration-delay'
option becomes obsolete.

(cherry picked from commit a25f49f153)
2020-08-07 13:30:50 +02:00
Ondřej Surý
cdef20bb66 Merge branch 'each-style-tweak' into 'master'
adjust clang-format options to get closer to ISC style

See merge request isc-projects/bind9!3061

(cherry picked from commit d3b49b6675)

0255a974 revise .clang-format and add a C formatting script in util
e851ed0b apply the modified style
2020-02-14 05:35:29 +00:00
Ondřej Surý
c931d8e417 Merge branch '46-just-use-clang-format-to-reformat-sources' into 'master'
Reformat source code with clang-format

Closes #46

See merge request isc-projects/bind9!2156

(cherry picked from commit 7099e79a9b)

4c3b063e Import Linux kernel .clang-format with small modifications
f50b1e06 Use clang-format to reformat the source files
11341c76 Update the definition files for Windows
df6c1f76 Remove tkey_test (which is no-op anyway)
2020-02-12 14:51:18 +00:00
Evan Hunt
6504e7da95 various style cleanups 2020-02-07 19:17:05 +01:00
Evan Hunt
58aa084edc add support for key algorithm mnemonics in dnssec-policy 2020-02-07 19:17:05 +01:00
Matthijs Mekking
8c0db909ee Warn if key lengths are out of range/predefined 2020-02-07 09:30:26 -08:00
Matthijs Mekking
2733edb2a6 Allow for key lifetime unlimited
The keyword 'unlimited' can be used instead of PT0S which means the
same but is more comprehensible for users.

Also fix some redundant "none" parameters in the kasp test.
2020-02-07 09:30:26 -08:00
Evan Hunt
9dc630016e rename 'zone-max-ttl' to 'max-zone-ttl' for consistency 2020-02-07 09:24:06 -08:00
Matthijs Mekking
5f464d15a0 dnssec-policy inheritance from options/view
'dnssec-policy' can now also be set on the options and view level and
a zone that does not set 'dnssec-policy' explicitly will inherit it
from the view or options level.

This requires a new keyword to be introduced: 'none'.  If set to
'none' the zone will not be DNSSEC maintained, in other words it will
stay unsigned.  You can use this to break the inheritance.  Of course
you can also break the inheritance by referring to a different
policy.

The keywords 'default' and 'none' are not allowed when configuring
your own dnssec-policy statement.

Add appropriate tests for checking the configuration (checkconf)
and add tests to the kasp system test to verify the inheritance
works.

Edit the kasp system test such that it can deal with unsigned zones
and views (so setting a TSIG on the query).
2019-11-06 22:36:21 +01:00
Mark Andrews
ce1c1631b3 move appending kasp to the list until we can't fail; document why we don't detach 2019-11-06 22:36:21 +01:00
Matthijs Mekking
f11ce44818 Make kasp opaque 2019-11-06 22:36:21 +01:00
Matthijs Mekking
29e6ec3181 KASP timings all uint32_t
Get rid of the warnings in the Windows build.
2019-11-06 22:36:21 +01:00
Matthijs Mekking
1f0d6296a1 kasp: Expose more key timings
When doing rollover in a timely manner we need to have access to the
relevant kasp configured durations.

Most of these are simple get functions, but 'dns_kasp_signdelay'
will calculate the maximum time that is needed with this policy to
resign the complete zone (taking into account the refresh interval
and signature validity).

Introduce parent-propagation-delay, parent-registration-delay,
parent-ds-ttl, zone-max-ttl, zone-propagation-delay.
2019-11-06 22:36:21 +01:00
Matthijs Mekking
7bfac50336 Add code for creating kasp from config
Add code for creating, configuring, and destroying KASP keys.  When
using the default policy, create one CSK, no rollover.
2019-11-06 22:31:44 +01:00