[Opendnssec-user] Issues with INCLUDE statements
Sebastian Castro
sebastian at nzrs.net.nz
Mon Nov 22 03:53:31 UTC 2010
Hi:
As an experiment with empty non-terminals I had the org.nz zone contents
as part of the .nz zone, not as a delegation.
To do that, I used the $INCLUDE directive in the nz zone file. Something
like:
$INCLUDE "/var/opendnssec/unsigned/org.nz.zone"
At some point we dropped the INCLUDE line and put the
delegation back, increased the serial number, executed
"ods-signer sign nz"
and the result is a signed nz zone with the org.nz as a delegation AND
the org.nz contents included in it. To illustrate the point, the zone
looks something like this:
org.nz IN NS <list_of_NS>
org.nz IN DS <list_of_DS>
org.nz. IN RRSIG DS ....
org.nz. IN NSEC parliament.nz. NS DS RRSIG NSEC
org.nz. IN RRSIG NSEC .......
0.org.nz. IN NSEC 08000mumdad.org.nz. NS RRSIG NSEC
.... all org.nz contents here ...
zygem.org.nz. IN NSEC parliament.nz. NS RRSIG NSEC
zygem.org.nz. IN RRSIG NSEC ....
parliament.nz. IN NS <list_of_NS>
It seems there are two issues: more data than expected and wrong NSEC
chains.
To confirm the issue we created a zone file for example.com, singing it
with the default policy.
The original zone looks like this:
$TTL 86400
$ORIGIN example.com.
@ 1D IN SOA ns1.example.com. hostmaster.example.com. (
2002022401 ; serial
3H ; refresh
15 ; retry
1w ; expire
3h ; minimum
)
IN NS ns1.example.com. ; in the domain
IN NS ns2.smokeyjoe.com. ; external to domain
IN MX 10 mail.another.com. ; external mail provider
; server host definitions
ns1 IN A 192.168.0.1 ;name server definition
www IN A 192.168.0.2 ;web server definition
ftp IN CNAME www.example.com. ;ftp server definition
; non server domain hosts
bill IN A 192.168.0.3
fred IN A 192.168.0.4
and the resulting signing zone is attached as
'example.com.2002022401.signed'
Then we add an INCLUDE statement and increase the serial number:
--- example.com.2002022401.unsigned 2010-11-22 15:51:58.000000000 +1300
+++ example.com.2002022402.unsigned 2010-11-22 15:59:33.000000000 +1300
@@ -1,7 +1,7 @@
$TTL 86400
$ORIGIN example.com.
@ 1D IN SOA ns1.example.com. hostmaster.example.com. (
- 2002022401 ; serial
+ 2002022402 ; serial
3H ; refresh
15 ; retry
1w ; expire
@@ -14,6 +14,7 @@
ns1 IN A 192.168.0.1 ;name server definition
www IN A 192.168.0.2 ;web server definition
ftp IN CNAME www.example.com. ;ftp server definition
+$INCLUDE /var/opendnssec/unsigned/example.com.include
; non server domain hosts
bill IN A 192.168.0.3
fred IN A 192.168.0.4
The contents of the 'example.com.include' file are
-------------------------------
; Additional data
ns2 IN A 10.0.0.1
gopher IN A 10.0.0.2
lastmod IN TXT "Mon Nov 22 15:54:14 NZDT 2010"
-------------------------------
The corresponding signed output is attached as
'example.com.2002022402.signed'
The differences between signed zones are
- new SOA and signature... OK
- new records and their signatures.... OK
- recalculated NSEC records.... OK
- and....
-fred.example.com. 86400 IN A 192.168.0.4
+fred.example.com. 3600 IN A 192.168.0.4
this record got its TTL changed, but the signature is not changed!
If you have reached this far... excellent!, because it gets more
interesting.
We dropped the INCLUDE statement and increased the serial number:
--- example.com.2002022402.unsigned 2010-11-22 15:59:33.000000000 +1300
+++ example.com.2002022403.unsigned 2010-11-22 16:03:34.000000000 +1300
@@ -1,7 +1,7 @@
$TTL 86400
$ORIGIN example.com.
@ 1D IN SOA ns1.example.com. hostmaster.example.com. (
- 2002022402 ; serial
+ 2002022403 ; serial
3H ; refresh
15 ; retry
1w ; expire
@@ -14,7 +14,6 @@
ns1 IN A 192.168.0.1 ;name server definition
www IN A 192.168.0.2 ;web server definition
ftp IN CNAME www.example.com. ;ftp server definition
-$INCLUDE /var/opendnssec/unsigned/example.com.include
; non server domain hosts
bill IN A 192.168.0.3
fred IN A 192.168.0.4
and the resulting signed file (attached as
'example.com.2002022403.signed') includes:
- updated SOA and its signature.... GOOD
- fred.example.com. get its TTL back to the original value, signature
it's not changed... GOOD?
- ns2, gopher and lastmod records and their corresponding signatures are
dropped, but NSEC records remain.
In summary, we have:
- trailing NSEC records
- changed TTLs for a record, without proper signature update
- phantom contents (although I couldn't replicate the issue)
All the necessary files are attached if you want to replicate the issue.
PS: If you run 'ods-signer clear nz' and then 'ods-signer sign nz' the
trailing dat is eliminated.
Regards,
--
Sebastian Castro
DNS Specialist
.nz Registry Services (New Zealand Domain Name Registry Limited)
desk: +64 4 495 2337
mobile: +64 21 400535
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.include
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022401.signed
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0001.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022403.signed
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0002.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022402.unsigned
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0003.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022402.signed
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0004.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022401.unsigned
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0005.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: example.com.2002022403.unsigned
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20101122/736195b6/attachment-0006.ksh>
More information about the Opendnssec-user
mailing list