Use keywords in dnssec-policy keys configuration

Add keywords 'lifetime' and 'algorithm' to make the key configuration
more clear.

diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index f9696fa3fa00b5615cd0c363ebd1122975f8541a..61016b6094fdbf08db1e0aee88d6247bb2222d18 100644 (file)
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -1015,7 +1015,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
     <literallayout class="normal">
 dnssec-policy <replaceable>string</replaceable> {
        dnskey-ttl <replaceable>ttlval</replaceable>;
-       keys { ( csk | ksk | zsk ) key-directory <replaceable>duration</replaceable> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
+       keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
        parent-ds-ttl <replaceable>duration</replaceable>;
        parent-propagation-delay <replaceable>duration</replaceable>;
        parent-registration-delay <replaceable>duration</replaceable>;

diff --git a/bin/tests/system/checkconf/good-kasp.conf b/bin/tests/system/checkconf/good-kasp.conf
index 804637a345c9bf7ac441d59a60c0eb3a942aa695..041e6bfae80b3b6eb0c9a8daa06f4a3d751b580a 100644 (file)
--- a/bin/tests/system/checkconf/good-kasp.conf
+++ b/bin/tests/system/checkconf/good-kasp.conf
@@ -17,9 +17,9 @@
 dnssec-policy "test" {
        dnskey-ttl 3600;
        keys {
-               ksk key-directory P1Y 13 256;
-               zsk key-directory P30D 13;
-               csk key-directory P30D 8 2048;
+               ksk key-directory lifetime P1Y algorithm 13 256;
+               zsk key-directory lifetime P30D algorithm 13;
+               csk key-directory lifetime P30D algorithm 8 2048;
        };
        publish-safety PT3600S;
        retire-safety PT3600S;

diff --git a/bin/tests/system/kasp/kasp.conf b/bin/tests/system/kasp/kasp.conf
index 2ef71b3f4d8187c3cdab3a69007609c14e4c307a..5b09682fcf10de8a4dc923d173e568e8862bfed3 100644 (file)
--- a/bin/tests/system/kasp/kasp.conf
+++ b/bin/tests/system/kasp/kasp.conf
@@ -17,9 +17,9 @@ dnssec-policy "kasp" {
        dnskey-ttl 200;
 
        keys {
-               csk key-directory P1Y 13;
-               ksk key-directory P1Y 8;
-               zsk key-directory P30D 8 1024;
-               zsk key-directory P6M 8 2000;
+               csk key-directory lifetime P1Y  algorithm 13;
+               ksk key-directory lifetime P1Y  algorithm 8;
+               zsk key-directory lifetime P30D algorithm 8 1024;
+               zsk key-directory lifetime P6M  algorithm 8 2000;
        };
 };

diff --git a/bin/tests/system/kasp/ns3/policies/autosign.conf b/bin/tests/system/kasp/ns3/policies/autosign.conf
index 3a0d028d009dbe906f74fe08238a091814bc4ac3..f04d219e6ddfa69b5f4f021a2f04de248598c18c 100644 (file)
--- a/bin/tests/system/kasp/ns3/policies/autosign.conf
+++ b/bin/tests/system/kasp/ns3/policies/autosign.conf
@@ -18,8 +18,8 @@ dnssec-policy "autosign" {
        dnskey-ttl 300;
 
        keys {
-               ksk key-directory P2Y 13;
-               zsk key-directory P1Y 13;
+               ksk key-directory lifetime P2Y algorithm 13;
+               zsk key-directory lifetime P1Y algorithm 13;
        };
 };
 
@@ -34,8 +34,8 @@ dnssec-policy "zsk-prepub" {
        retire-safety P2D;
 
        keys {
-               ksk key-directory P2Y 13;
-               zsk key-directory P30D 13;
+               ksk key-directory lifetime P2Y  algorithm 13;
+               zsk key-directory lifetime P30D algorithm 13;
        };
 
        zone-propagation-delay PT1H;
@@ -53,8 +53,8 @@ dnssec-policy "ksk-doubleksk" {
        retire-safety P2D;
 
        keys {
-               ksk key-directory P60D 13;
-               zsk key-directory P1Y 13;
+               ksk key-directory lifetime P60D algorithm 13;
+               zsk key-directory lifetime P1Y  algorithm 13;
        };
 
        zone-propagation-delay PT1H;

diff --git a/bin/tests/system/kasp/ns3/policies/kasp.conf b/bin/tests/system/kasp/ns3/policies/kasp.conf
index 547c5c04296504d2a602d5be00fd70b881cf4d23..fa60476e6577c479ddb3a12a857d2f486dbc2da3 100644 (file)
--- a/bin/tests/system/kasp/ns3/policies/kasp.conf
+++ b/bin/tests/system/kasp/ns3/policies/kasp.conf
@@ -13,9 +13,9 @@ dnssec-policy "rsasha1" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 5;
-               zsk key-directory P5Y 5;
-               zsk key-directory P1Y 5 2000;
+               ksk key-directory lifetime P10Y algorithm 5;
+               zsk key-directory lifetime P5Y  algorithm 5;
+               zsk key-directory lifetime P1Y  algorithm 5 2000;
        };
 };
 
@@ -23,9 +23,9 @@ dnssec-policy "rsasha1-nsec3" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 7;
-               zsk key-directory P5Y 7;
-               zsk key-directory P1Y 7 2000;
+               ksk key-directory lifetime P10Y algorithm 7;
+               zsk key-directory lifetime P5Y  algorithm 7;
+               zsk key-directory lifetime P1Y  algorithm 7 2000;
        };
 };
 
@@ -33,9 +33,9 @@ dnssec-policy "rsasha256" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 8;
-               zsk key-directory P5Y 8;
-               zsk key-directory P1Y 8 2000;
+               ksk key-directory lifetime P10Y algorithm 8;
+               zsk key-directory lifetime P5Y  algorithm 8;
+               zsk key-directory lifetime P1Y  algorithm 8 2000;
        };
 };
 
@@ -43,9 +43,9 @@ dnssec-policy "rsasha512" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 10;
-               zsk key-directory P5Y 10;
-               zsk key-directory P1Y 10 2000;
+               ksk key-directory lifetime P10Y algorithm 10;
+               zsk key-directory lifetime P5Y  algorithm 10;
+               zsk key-directory lifetime P1Y  algorithm 10 2000;
        };
 };
 
@@ -53,9 +53,9 @@ dnssec-policy "ecdsa256" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 13;
-               zsk key-directory P5Y 13;
-               zsk key-directory P1Y 13 256;
+               ksk key-directory lifetime P10Y algorithm 13;
+               zsk key-directory lifetime P5Y  algorithm 13;
+               zsk key-directory lifetime P1Y  algorithm 13 256;
        };
 };
 
@@ -63,8 +63,8 @@ dnssec-policy "ecdsa384" {
        dnskey-ttl 1234;
 
        keys {
-               ksk key-directory P10Y 14;
-               zsk key-directory P5Y 14;
-               zsk key-directory P1Y 14 384;
+               ksk key-directory lifetime P10Y algorithm 14;
+               zsk key-directory lifetime P5Y  algorithm 14;
+               zsk key-directory lifetime P1Y  algorithm 14 384;
        };
 };

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index d0c21560d98765c6dccb20fa045e3df54bad1934..2562c1f3488ae60cfd42abbba7c4f6c3ae122a5f 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -11059,9 +11059,9 @@ example.com                 CNAME   rpz-tcp-only.
                </para>
 
 <programlisting>keys {
-       ksk key-directory P5Y 8 2048;
-       zsk key-directory P30D 8;
-       csk key-directory P6MT12H3M15S 13;
+    ksk key-directory lifetime P5Y algorithm 8 2048;
+    zsk key-directory lifetime P30D algorithm 8;
+    csk key-directory lifetime P6MT12H3M15S algorithm 13;
 };
 </programlisting>
 

diff --git a/doc/arm/dnssec.xml b/doc/arm/dnssec.xml
index be702849c3c6a2a8d7354cd6c907f618e48c196d..3c0cf4dfec88c7f9dcf6ffa1618880304118c8d2 100644 (file)
--- a/doc/arm/dnssec.xml
+++ b/doc/arm/dnssec.xml
@@ -54,7 +54,7 @@
   <programlisting>
        dnssec-policy csk {
                keys {
-                       csk key-directory P5Y 13;
+                       csk key-directory lifetime P5Y algorithm 13;
                };
        };
   </programlisting>

diff --git a/doc/design/dnssec-policy b/doc/design/dnssec-policy
index 3e695a2c3955f469e73e47cfc77ec96dfbf77157..73f032b77d10925cd661d6a818278faa1237628a 100644 (file)
--- a/doc/design/dnssec-policy
+++ b/doc/design/dnssec-policy
@@ -199,9 +199,9 @@ is referred to as a CSK. Below is an example configuration for the three types
 of keys:
 ```
        keys {
-               ksk key-directory P5Y ECDSAP256SHA256;
-               zsk key-directory P30D ECDSAP256SHA256;
-               csk key-directory PT0S 8 2048;
+               ksk key-directory lifetime P5Y  algorithm ECDSAP256SHA256;
+               zsk key-directory lifetime P30D algorithm ECDSAP256SHA256;
+               csk key-directory lifetime PT0S algorithm 8 2048;
        };
 ```
 

diff --git a/doc/misc/options b/doc/misc/options
index cb00923715ef3ffb8e10be9645b63c3ec0651c76..61dad9bbbad6d7f5887a58836570a9dfac3de931 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -27,7 +27,7 @@ dnssec-keys { <string> ( static-key |
 
 dnssec-policy <string> {
         dnskey-ttl <ttlval>;
-        keys { ( csk | ksk | zsk ) key-directory <duration> <string>
+        keys { ( csk | ksk | zsk ) key-directory lifetime <duration> algorithm <integer>
            [ <integer> ]; ... };
        parent-ds-ttl <duration>;
        parent-propagation-delay <duration>;

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 7d0dd467dbf46b74b470817dc7059fcab07aa131..746ee47a234ae00ea9f9d57940bade6f641d5ebe 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -502,11 +502,23 @@ static cfg_type_t cfg_type_dnsseckeystore = {
 /*%
  * A dnssec key, as used in the "keys" statement in a "dnssec-policy".
  */
+static keyword_type_t algorithm_kw = { "algorithm", &cfg_type_uint32 };
+static cfg_type_t cfg_type_algorithm = {
+       "algorithm", parse_keyvalue, print_keyvalue,
+       doc_keyvalue, &cfg_rep_uint32, &algorithm_kw
+};
+
+static keyword_type_t lifetime_kw = { "lifetime", &cfg_type_duration };
+static cfg_type_t cfg_type_lifetime = {
+       "lifetime", parse_keyvalue, print_keyvalue,
+       doc_keyvalue, &cfg_rep_duration, &lifetime_kw
+};
+
 static cfg_tuplefielddef_t kaspkey_fields[] = {
        { "role", &cfg_type_dnsseckeyrole, 0 },
        { "keystore-type", &cfg_type_dnsseckeystore, 0 },
-       { "lifetime", &cfg_type_duration, 0 },
-       { "algorithm", &cfg_type_uint32, 0 },
+       { "lifetime", &cfg_type_lifetime, 0 },
+       { "algorithm", &cfg_type_algorithm, 0 },
        { "length", &cfg_type_optional_uint32, 0 },
        { NULL, NULL, 0 }
 };
@@ -515,6 +527,9 @@ static cfg_type_t cfg_type_kaspkey = {
        &cfg_rep_tuple, kaspkey_fields
 };
 
+/*%
+ * Wild class, type, name.
+ */
 static keyword_type_t wild_class_kw = { "class", &cfg_type_ustring };
 
 static cfg_type_t cfg_type_optional_wild_class = {