From 2021d4cec0c08861ad7d046c7c6671a75a9728b7 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ale=C5=A1=20Mr=C3=A1zek?= Date: Fri, 28 Mar 2025 15:07:03 +0100 Subject: [PATCH] datamodel: stabilize dnssec schema --- NEWS | 7 + doc/_static/config.schema.json | 165 ++++++++---------- doc/user/config-dnssec.rst | 29 ++- .../knot_resolver/datamodel/config_schema.py | 11 +- .../knot_resolver/datamodel/dnssec_schema.py | 27 ++- .../datamodel/templates/dnssec.lua.j2 | 38 ++-- tests/manager/datamodel/test_config_schema.py | 16 +- 7 files changed, 128 insertions(+), 165 deletions(-) diff --git a/NEWS b/NEWS index 5c1473994..ac83edbf1 100644 --- a/NEWS +++ b/NEWS @@ -9,11 +9,18 @@ Incompatible changes -------------------- - Removed options from declarative configuration model (YAML). These are mostly experimental and debugging/testing options that are not useful for general users (remain in Lua): + - /dnssec/refresh-time + - /dnssec/hold-down-time + - /dnssec/time-skew-detection - /logging/debugging - /max-workers - /network/tls/auto-discovery - /webmgmt - Renamed/moved options in the declarative configuration model (YAML). + - /dnssec: true|false -> /dnssec/enabled: true|false + - /dnssec/keep-removed -> /dnssec/trust-anchors-keep-removed + - /dnssec/trust-anchor-sentinel -> /dnssec/sentinel + - /dnssec/trust-anchor-signal-query -> /dnssec/signal-query - /network/tls/files-watchdog -> /network/tls/watchdog diff --git a/doc/_static/config.schema.json b/doc/_static/config.schema.json index cfef3cb8a..3d0c0cfdf 100644 --- a/doc/_static/config.schema.json +++ b/doc/_static/config.schema.json @@ -1192,101 +1192,86 @@ } }, "dnssec": { - "anyOf": [ - { - "type": "boolean" + "description": "DNSSEC configuration.", + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable/disable DNSSEC.", + "default": true }, - { - "description": "DNSSEC configuration.", - "type": "object", - "properties": { - "trust-anchor-sentinel": { - "type": "boolean", - "description": "Allows users of DNSSEC validating resolver to detect which root keys are configured in resolver's chain of trust. (RFC 8509)", - "default": true - }, - "trust-anchor-signal-query": { - "type": "boolean", - "description": "Signaling Trust Anchor Knowledge in DNSSEC Using Key Tag Query, according to (RFC 8145#section-5).", - "default": true - }, - "time-skew-detection": { - "type": "boolean", - "description": "Detection of difference between local system time and expiration time bounds in DNSSEC signatures for '. NS' records.", - "default": true - }, - "keep-removed": { - "type": "integer", - "minimum": 0, - "description": "How many removed keys should be held in history (and key file) before being purged.", - "default": 0 - }, - "refresh-time": { - "type": [ - "string", - "null" - ], - "pattern": "^(\\d+)(us|ms|s|m|h|d)$", - "description": "Force trust-anchors to be updated every defined time periodically instead of relying on (RFC 5011) logic and TTLs. Intended only for testing purposes.", - "default": null - }, - "hold-down-time": { - "type": "string", - "pattern": "^(\\d+)(us|ms|s|m|h|d)$", - "description": "Modify hold-down timer (RFC 5011). Intended only for testing purposes.", - "default": "30d" - }, - "trust-anchors": { - "type": [ - "array", - "null" - ], - "items": { - "type": "string" - }, - "description": "List of trust-anchors in DS/DNSKEY records format.", - "default": null - }, - "negative-trust-anchors": { - "type": [ - "array", - "null" - ], - "items": { + "sentinel": { + "type": "boolean", + "description": "Allows users of DNSSEC validating resolver to detect which root keys are configured in resolver's chain of trust. (RFC 8509)", + "default": true + }, + "signal-query": { + "type": "boolean", + "description": "Signaling Trust Anchor Knowledge in DNSSEC Using Key Tag Query, according to (RFC 8145#section-5).", + "default": true + }, + "trust-anchors-keep-removed": { + "type": "integer", + "minimum": 0, + "description": "How many removed keys should be held in history (and key file) before being purged.", + "default": 0 + }, + "trust-anchors": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + }, + "description": "Trust-anchors configuration.", + "default": null + }, + "trust-anchors-files": { + "type": [ + "array", + "null" + ], + "items": { + "description": "Trust-anchor zonefile configuration.", + "type": "object", + "properties": { + "file": { "type": "string", - "pattern": "(?=^.{,253}\\.?$)(^(?!-)[^.]{,62}[^.-](\\.(?!-)[^.]{,62}[^.-])*\\.?$)|^\\.$" - }, - "description": "List of domain names representing negative trust-anchors. (RFC 7646)", - "default": null - }, - "trust-anchors-files": { - "type": [ - "array", - "null" - ], - "items": { - "description": "Trust-anchor zonefile configuration.", - "type": "object", - "properties": { - "file": { - "type": "string", - "description": "Path to the zonefile that stores trust-anchors." - }, - "read-only": { - "type": "boolean", - "description": "Blocks zonefile updates according to RFC 5011.", - "default": false - } - } + "description": "Path to the zonefile that stores trust-anchors." }, - "description": "List of zonefiles where trust-anchors are stored.", - "default": null + "read-only": { + "type": "boolean", + "description": "Blocks zonefile updates according to RFC 5011.", + "default": false + } } - } + }, + "description": "List of zone-files where trust-anchors are stored.", + "default": null + }, + "negative-trust-anchors": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "pattern": "(?=^.{,253}\\.?$)(^(?!-)[^.]{,62}[^.-](\\.(?!-)[^.]{,62}[^.-])*\\.?$)|^\\.$" + }, + "description": "List of domain names representing negative trust-anchors. (RFC 7646)", + "default": null } - ], - "description": "Disable DNSSEC, enable with defaults or set new configuration.", - "default": true + }, + "default": { + "enabled": true, + "sentinel": true, + "signal_query": true, + "trust_anchors_keep_removed": 0, + "trust_anchors": null, + "trust_anchors_files": null, + "negative_trust_anchors": null + } }, "dns64": { "anyOf": [ diff --git a/doc/user/config-dnssec.rst b/doc/user/config-dnssec.rst index d22ee4f2b..f3cd45f60 100644 --- a/doc/user/config-dnssec.rst +++ b/doc/user/config-dnssec.rst @@ -20,7 +20,8 @@ system by doing so, add the following snippet to your configuration file. .. code-block:: yaml # turns off DNSSEC validation - dnssec: false + dnssec: + enabled: false The resolver supports DNSSEC including :rfc:`5011` automated DNSSEC TA updates and :rfc:`7646` negative trust anchors. Depending on your distribution, DNSSEC @@ -30,11 +31,17 @@ policy, or automatically maintained by the resolver itself. In practice this means that you can forget about it and your favorite Linux distribution will take care of it for you. -Following :option:`dnssec >` section allow to modify DNSSEC configuration *if you really have to*: +Following :option:`dnssec >` section allows to modify DNSSEC configuration *if you really have to*: -.. option:: dnssec: false| +.. option:: dnssec: - DNSSEC configuration options. If ``false``, DNSSEC is disabled. + DNSSEC configuration options. + + .. option:: enabled: true|false + + :default: true + + If ``false``, DNSSEC is disabled. .. option:: trust-anchors-files: @@ -63,19 +70,7 @@ Following :option:`dnssec >` section allow to modify DNS - file: root.key read-only: false - .. option:: hold-down-time: