mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-25 19:02:12 -04:00
7e7aa5387c
Add a key manager to named. If a 'dnssec-policy' is set, 'named' will run a key manager on the matching keys. This will do a couple of things: 1. Create keys when needed (in case of rollover for example) according to the set policy. 2. Retire keys that are in excess of the policy. 3. Maintain key states according to "Flexible and Robust Key Rollover" [1]. After key manager ran, key files will be saved to disk. [1] https://matthijsmekking.nl/static/pdf/satin2012-Schaeffer.pdf KEY GENERATION Create keys according to DNSSEC policy. Zones configured with 'dnssec-policy' will allow 'named' to create DNSSEC keys (similar to dnssec-keymgr) if not available. KEY ROLLOVER Rather than determining the desired state from timing metadata, add a key state goal. Any keys that are created or picked from the key ring and selected to be a successor has its key state goal set to OMNIPRESENT (this key wants to be signing!). At the same time, a key that is being retired has its key state goal set to HIDDEN. The keymgr state machine with the three rules will make sure no introduction or withdrawal of DNSSEC records happens too soon. KEY TIMINGS All timings are based on RFC 7583. The keymgr will return when the next action is happening so that the zone can set the proper rekey event. Prior to this change the rekey event will run every hour by default (configurable), but with kasp we can determine exactly when we need to run again. The prepublication time is derived from policy. |
||
|---|---|---|
| .. | ||
| bindkeys.pl | ||
| branchsync.sh | ||
| check-ans-prereq.sh | ||
| check-categories.sh | ||
| check-changes | ||
| check-cocci | ||
| check-includes.pl | ||
| check-instincludes.sh | ||
| check-pullups.pl | ||
| check-sources.pl | ||
| check-win32util-configure | ||
| checklibs.sh | ||
| commit-arm.sh | ||
| COPYRIGHT | ||
| COPYRIGHT.BRIEF | ||
| COPYRIGHT.BSDI | ||
| COPYRIGHT.NAI | ||
| COPYRIGHT.NOM | ||
| COPYRIGHT.PORTION | ||
| COPYRIGHT.TOP | ||
| copyrights | ||
| git-replay-merge.sh | ||
| kit.sh | ||
| mandoc2docbook.pl | ||
| mdnbuildtest.sh | ||
| memleak.pl | ||
| merge_copyrights | ||
| mksymtbl.pl | ||
| models.c | ||
| nanny.pl | ||
| new-func | ||
| nt-kit | ||
| prepare-softhsm2.sh | ||
| spacewhack.pl | ||
| suppressions.txt | ||
| tabify-changes | ||
| update-drafts.pl | ||
| update_branches | ||
| update_copyrights | ||
| xc | ||