Martin Mares [Wed, 30 Jan 2019 12:04:29 +0000 (13:04 +0100)]
DNSSEC: Signing of reverse zones
Unlike primary and secondary zones, file names of reverse zones
and their configurations are different from full domain names.
So far, we ignored this difference when handling keys.
From this point on, key files are named after the configuration files
and key-gen is able to synthesize the full domain name by interpreting
the configuration. In bin/genzone, we extract the domain name from
$ORIGIN in the raw zone file.
Martin Mares [Wed, 30 Jan 2019 10:51:15 +0000 (11:51 +0100)]
DNSSEC: Complete support for key delegations to sub-domains
- key-delegate script for constructing DS record sets in dss/*
- DS macro for importing DS record sets to zones
- DSFOR macro for adding dependencies on DS record sets to Makefile
- key-update does not choke on empty directories
- resign-stamp moved back to keys, so that it is not deleted by key
hash cleanups
- dnssec-signzone cannot be told to skip creation of dsset files,
so redirect them from current directory to tmp/
- terminology: domain vs. zone
Martin Mares [Wed, 30 Jan 2019 09:44:02 +0000 (10:44 +0100)]
Most directory names are now fixed
Using variables for names of all directories was generating much noise
and it was never useful. So was configuring the absolute path to our
root directory. We always assume that our root directory is the cwd
anyway.
Martin Mares [Tue, 29 Jan 2019 20:45:25 +0000 (21:45 +0100)]
Switched to stand-alone shell environment file
Previously, we generated bin/genzone script by m4. As we will need more
parametrized scripts in the future, we now generate just an auxiliary
file bin/shell-env with shell environment variables.
Martin Mares [Sun, 16 Oct 2011 19:24:17 +0000 (21:24 +0200)]
When zone contents do not change, version number is not incremented
Replaced direct calls to M4 from the Makefile by calling an auxiliary
script (generated by m4/mkgenzone.m4), which calculates a MD5 hash of
a (suitably normalized) zone file and compares it with a cached hash
of the current version.
The downside is that we run M4 twice on each changed zone. If it ever
causes any harm, we can generate the zone once and move updating of the
version number to the shell script, too.
Martin Mares [Sat, 15 Oct 2011 21:14:57 +0000 (23:14 +0200)]
Blackhole: One more rewrite
We generate the blackhole zone as any other zone, except that we
hack nsc.m4 to accept `SOA(@)', so that the same zone file can supply
all blackholed domains.
The consequence is that the blackhole zone is properly versioned
and BIND no longer complains that the SOA is the same, while the
file has changed its timestamp.
projects / nsc-5.git / log