max-zone-ttl duration;
parent-ds-ttl duration;
parent-propagation-delay duration;
- parent-registration-delay duration;
publish-safety duration;
retire-safety duration;
signatures-refresh duration;
max-zone-ttl 86400;
parent-ds-ttl 7200;
parent-propagation-delay PT1H;
- parent-registration-delay P1D;
publish-safety PT3600S;
retire-safety PT3600S;
signatures-refresh P3D;
max-zone-ttl 86400;
parent-ds-ttl 7200;
parent-propagation-delay PT1H;
- parent-registration-delay P1D;
publish-safety PT3600S;
retire-safety PT3600S;
signatures-refresh P3D;
publish-safety PT5M;
parent-propagation-delay 1h;
- parent-registration-delay P1D;
parent-ds-ttl 2h;
keys {
max-zone-ttl 1d;
parent-ds-ttl 3600;
- parent-registration-delay P1D;
parent-propagation-delay PT1H;
};
max-zone-ttl P1D;
parent-ds-ttl 1h;
- parent-registration-delay 1d;
parent-propagation-delay 1h;
};
max-zone-ttl 1d;
parent-ds-ttl PT1H;
- parent-registration-delay PT0S;
parent-propagation-delay P1W;
};
retire-safety 2h;
zone-propagation-delay 3600;
max-zone-ttl 6h;
- parent-registration-delay 1d;
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
retire-safety 2h;
zone-propagation-delay 3600;
max-zone-ttl 6h;
- parent-registration-delay 1d;
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
retire-safety 2h;
zone-propagation-delay 3600;
max-zone-ttl 6h;
- parent-registration-delay 1d;
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
retire-safety 2h;
zone-propagation-delay 3600;
max-zone-ttl 6h;
- parent-registration-delay 1d;
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
zone-propagation-delay 3600;
max-zone-ttl 11h;
- // Together 24h
- parent-registration-delay 21h;
+ // Together 3h
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
zone-propagation-delay 3600;
max-zone-ttl 11h;
- // Together 24h
- parent-registration-delay 21h;
+ // Together 3h
parent-propagation-delay pt1h;
parent-ds-ttl 7200;
};
# ECDSAP256SHA256 keys.
setup migrate-nomatch-algnum.kasp
echo "$zone" >> zones
-Tds="now-24h" # Time according to dnssec-policy that DS will be OMNIPRESENT
+Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
Tkey="now-3900s" # DNSKEY TTL + propagation delay
Tsig="now-12h" # Zone's maximum TTL + propagation delay
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
# dictates 2048 bits RSASHA1 keys.
setup migrate-nomatch-alglen.kasp
echo "$zone" >> zones
-Tds="now-24h" # Time according to dnssec-policy that DS will be OMNIPRESENT
+Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
Tkey="now-3900s" # DNSKEY TTL + propagation delay
Tsig="now-12h" # Zone's maximum TTL + propagation delay
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
# The KSK is immediately published and activated.
# -P : now-3900s
-# -P sync: now-24h
+# -P sync: now-3h
# -A : now-3900s
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "PUBLISHED" "${created}" -3900
set_addkeytime "KEY1" "ACTIVE" "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -86400
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
# The ZSK is immediately published and activated.
# -P: now-12h
# -A: now-12h
# The KSK is immediately published and activated.
# -P : now-3900s
-# -P sync: now-24h
+# -P sync: now-3h
# -A : now-3900s
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "PUBLISHED" "${created}" -3900
set_addkeytime "KEY1" "ACTIVE" "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -86400
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
# The ZSK is immediately published and activated.
# -P: now-12h
# -A: now-12h
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
-# -P sync: now-24h
+# -P sync: now-3h
# -A : now-3900s
# The key is removed after the retire interval:
# IretKSK = TTLds + DprpP + retire_safety.
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "PUBLISHED" "${created}" -3900
set_addkeytime "KEY1" "ACTIVE" "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -86400
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
keyfile=$(key_get KEY1 BASEFILE)
grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
retired=$(awk '{print $3}' < retired.test${n}.ksk)
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
-# -P sync: now-24h
+# -P sync: now-3h
# -A : now-3900s
# The key is removed after the retire interval:
# IretKSK = TTLds + DprpP + retire_safety.
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "PUBLISHED" "${created}" -3900
set_addkeytime "KEY1" "ACTIVE" "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -86400
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
keyfile=$(key_get KEY1 BASEFILE)
grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
retired=$(awk '{print $3}' < retired.test${n}.ksk)
is served by all of the parent zone's name servers.
The default is ``PT1H`` (1 hour).
- ``parent-registration-delay``
- This is the expected registration delay from the time when a DS
- RRset change is requested to the time when the DS RRset
- is updated in the parent zone. The default is
- ``P1D`` (1 day).
-
.. _managed-keys:
``managed-keys`` Statement Grammar
max\-zone\-ttl duration;
parent\-ds\-ttl duration;
parent\-propagation\-delay duration;
- parent\-registration\-delay duration;
publish\-safety duration;
retire\-safety duration;
signatures\-refresh duration;
// Parent parameters
parent-ds-ttl 86400;
- parent-registration-delay 24h;
parent-propagation-delay 1h;
};
max-zone-ttl <duration>;
parent-ds-ttl <duration>;
parent-propagation-delay <duration>;
- parent-registration-delay <duration>;
publish-safety <duration>;
retire-safety <duration>;
signatures-refresh <duration>;
max-zone-ttl duration;
parent-ds-ttl duration;
parent-propagation-delay duration;
- parent-registration-delay duration;
publish-safety duration;
retire-safety duration;
signatures-refresh duration;
max-zone-ttl <duration>;
parent-ds-ttl <duration>;
parent-propagation-delay <duration>;
- parent-registration-delay <duration>;
+ parent-registration-delay <duration>; // obsolete
publish-safety <duration>;
retire-safety <duration>;
signatures-refresh <duration>;
max-zone-ttl <duration>;
parent-ds-ttl <duration>;
parent-propagation-delay <duration>;
- parent-registration-delay <duration>;
publish-safety <duration>;
retire-safety <duration>;
signatures-refresh <duration>;
/* Parent settings */
dns_ttl_t parent_ds_ttl;
uint32_t parent_propagation_delay;
- uint32_t parent_registration_delay;
/* TODO: The rest of the KASP configuration */
};
#define DNS_KASP_ZONE_MAXTTL (86400)
#define DNS_KASP_ZONE_PROPDELAY (300)
#define DNS_KASP_PARENT_PROPDELAY (3600)
-#define DNS_KASP_PARENT_REGDELAY (86400)
/* Key roles */
#define DNS_KASP_KEY_ROLE_KSK 0x01
*\li 'kasp' is a valid, thawed kasp.
*/
-uint32_t
-dns_kasp_parentregistrationdelay(dns_kasp_t *kasp);
-/*%<
- * Get parent registration delay for submitting new DS.
- *
- * Requires:
- *
- *\li 'kasp' is a valid, frozen kasp.
- *
- * Returns:
- *
- *\li Parent registration delay.
- */
-
-void
-dns_kasp_setparentregistrationdelay(dns_kasp_t *kasp, uint32_t value);
-/*%<
- * Set parent registration delay.
- *
- * Requires:
- *
- *\li 'kasp' is a valid, thawed kasp.
- */
-
isc_result_t
dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp);
/*%<
kasp->parent_ds_ttl = DNS_KASP_DS_TTL;
kasp->parent_propagation_delay = DNS_KASP_PARENT_PROPDELAY;
- kasp->parent_registration_delay = DNS_KASP_PARENT_REGDELAY;
/* TODO: The rest of the KASP configuration */
kasp->parent_propagation_delay = value;
}
-uint32_t
-dns_kasp_parentregistrationdelay(dns_kasp_t *kasp) {
- REQUIRE(DNS_KASP_VALID(kasp));
- REQUIRE(kasp->frozen);
-
- return (kasp->parent_registration_delay);
-}
-
-void
-dns_kasp_setparentregistrationdelay(dns_kasp_t *kasp, uint32_t value) {
- REQUIRE(DNS_KASP_VALID(kasp));
- REQUIRE(!kasp->frozen);
-
- kasp->parent_registration_delay = value;
-}
-
isc_result_t
dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp) {
dns_kasp_t *kasp = NULL;
dns_kasp_keylist_empty
dns_kasp_keys
dns_kasp_parentpropagationdelay
-dns_kasp_parentregistrationdelay
dns_kasp_publishsafety
dns_kasp_retiresafety
dns_kasp_setdnskeyttl
dns_kasp_setdsttl
dns_kasp_setparentpropagationdelay
-dns_kasp_setparentregistrationdelay
dns_kasp_setpublishsafety
dns_kasp_setretiresafety
dns_kasp_setsigrefresh
dns_kasp_setparentpropagationdelay(
kasp, get_duration(maps, "parent-propagation-delay",
DNS_KASP_PARENT_PROPDELAY));
- dns_kasp_setparentregistrationdelay(
- kasp, get_duration(maps, "parent-registration-delay",
- DNS_KASP_PARENT_REGDELAY));
/* TODO: Rest of the configuration */
{ "max-zone-ttl", &cfg_type_duration, 0 },
{ "parent-ds-ttl", &cfg_type_duration, 0 },
{ "parent-propagation-delay", &cfg_type_duration, 0 },
- { "parent-registration-delay", &cfg_type_duration, 0 },
+ { "parent-registration-delay", &cfg_type_duration,
+ CFG_CLAUSEFLAG_OBSOLETE },
{ "publish-safety", &cfg_type_duration, 0 },
{ "retire-safety", &cfg_type_duration, 0 },
{ "signatures-refresh", &cfg_type_duration, 0 },
projects / thirdparty / bind9.git / commitdiff
