[#2011] Checkpoint: finished doc part

diff --git a/ChangeLog b/ChangeLog
index e4ffb430efdb9abc77108a8536e975d967680085..7f6805d4460179257be9d4d2428445a7d2fccd95 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+1933.  [func]          fdupont
+       Per DNS server TSIG keys are now supported in the DHCP-DDNS
+       (aka D2) server configuration. A new callout point 'select_key'
+       gives access to the selected TSIG key before DNS update
+       sending.
+       (Gitlab #2011)
+
 Kea 1.9.11 (development) released on Aug 30, 2021
 
 1940.  [build]         razvan

diff --git a/doc/sphinx/arm/ddns.rst b/doc/sphinx/arm/ddns.rst
index 1f420b00e34e2eb98ff5255a2d795573ad7762b6..b17ea0395136bea073fdfe265576f2a7ea9e76de 100644 (file)
--- a/doc/sphinx/arm/ddns.rst
+++ b/doc/sphinx/arm/ddns.rst
@@ -529,7 +529,6 @@ running at "172.88.99.10", set the Forward DNS Server as follows:
                    "key-name": "",
                    "dns-servers": [
                        {
-                           "hostname": "",
                            "ip-address": "172.88.99.10",
                            "port": 53
                        }
@@ -665,7 +664,6 @@ service is running at "172.88.99.10", then set it as follows:
                    "key-name": "",
                    "dns-servers": [
                        {
-                           "hostname": "",
                            "ip-address": "172.88.99.10",
                            "port": 53
                        }
@@ -682,6 +680,84 @@ service is running at "172.88.99.10", then set it as follows:
    Since "hostname" is not yet supported, the parameter "ip-address"
    must be set to the address of the DNS server.
 
+.. _per-server-keys:
+
+Per DNS server TSIG keys
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Since Kea version 2.0.0 a TSIG key can be specified in a DNS server
+configuration. The priority rule is:
+
+-  if a not empty key name is specified in a DNS server entry this TSIG
+   key will protect DNS updates sent to this server.
+
+-  if empty or no key name is specified in a DNS server entry but a not
+   empty key name is specified in the parent domain entry, the domain
+   TSIG key will protect DNS updates sent to this server.
+
+-  if empty or no key name is specified in a DNS server entry and its parent
+   domain entry, no TSIG will protect DNS updates sent to this server.
+
+Fon instance in this configuration:
+
+::
+
+   "DhcpDdns": {
+       "forward-ddns": {
+           "ddns-domains": [
+               {
+                   "name": "other.example.com.",
+                   "key-name": "foo",
+                   "dns-servers": [
+                       {
+                           "ip-address": "172.88.99.10",
+                           "port": 53
+                       },
+                       {
+                           "ip-address": "172.88.99.11",
+                           "port": 53,
+                           "key-name": "bar"
+                       }
+                   ]
+               }
+           ]
+       },
+       "reverse-ddns": {
+           "ddns-domains": [
+               {
+                   "name": "1.0.0.0.8.B.D.0.1.0.0.2.ip6.arpa.",
+                   "dns-servers": [
+                       {
+                           "ip-address": "172.88.99.12",
+                           "port": 53
+                       },
+                       {
+                           "ip-address": "172.88.99.13",
+                           "port": 53,
+                           "key-name": "bar"
+                       }
+                   ]
+               }
+           ]
+       },
+       "tsig-keys": [
+           {
+               "name": "foo",
+               "algorithm": "HMAC-MD5",
+               "secret": "LSWXnfkKZjdPJI5QxlpnfQ=="
+           },
+           {
+               "name": "bar",
+               "algorithm": "HMAC-SHA224",
+               "secret": "bZEG7Ow8OgAUPfLWV3aAUQ=="
+           }
+       ]
+   }
+
+
+The 172.88.99.10 server will use the foo TSIG key, 172.88.99.11 and
+172.88.99.13 servers the bar one and 172.88.99.12 will not use TSIG.
+
 .. _d2-user-contexts:
 
 User Contexts in DDNS