-
Type:
Bug
-
Status: Closed
-
Priority:
Minor
-
Resolution: Won't Fix
-
Affects Version/s: OpenDNSSEC 1.4.0rc3
-
Fix Version/s: None
-
Component/s: None
-
Labels:None
-
Environment:
Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-40-generic x86_64)
Using DNS Input and Output Adapters, ods-signerd falls back to using `counter' mode SOA serial number in signed zones when configured to use `unixtime' but incoming unsigned zone has `datecounter' format serial.
Expected/desired behaviour is that ods-signerd would overwrite the incoming SOA serial with `unixtime', not requiring the serial to increase in signed zone wrt incoming unsigned zone's serial (but perhaps check that the serial increases wrt the previously used outgoing serial).
With current behaviour a hot standby signing server needs to know what is/was the `outgoing' SOA serial used by ods-signerd on the active server. If overwriting serial as `unixtime' was allowed no synchronization of ods-signerd state from active to standby server would be necessary (only KASP would have to be kept in sync and of course signing server's clocks should not be drifting too heavily wrt each other).
This issue has also been discussed on the users' mailing list:
http://lists.opendnssec.org/pipermail/opendnssec-user/2013-April/002423.html
Details / how to reproduce:
- ods-signerd receives unsigned zones with DNS Input Adapter and provides them to DNS servers using DNS Output Adapter.
- Zone signing policy configured (in /etc/opendnssec/kasp.xml) with:
<SOA>
<TTL>PT300S</TTL>
<Minimum>PT300S</Minimum>
<Serial>unixtime</Serial>
</SOA> - Zone is added to KASP by adding it to /etc/opendnssec/zonelist.xml
and running 'ods-ksmutil update zonelist', incoming unsigned zone SOA
serial is 2013041212. ods-signerd reports it refuses to use the configured `unixtime' format serial, falls back to `counter' mode:
Apr 12 12:34:17 signer1 ods-signerd: [namedb] unable to use unixtime as serial: 1365759257 does not increase 2013041212. Serial set to 2013041213
Apr 12 12:34:17 signer1 ods-signerd: [namedb] update serial: 2013041212 + 1 = 2013041213