Uploaded image for project: 'Support'
  1. Support
  2. SUPPORT-57

Cannot use `unixtime' SOA serial with DNS Output Adapter when incoming serials from DNS Input Adapter are in `datecounter' format

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Won't Fix
    • Affects Version/s: OpenDNSSEC 1.4.0rc3
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None
    • Environment:

      Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-40-generic x86_64)

      Description

      Using DNS Input and Output Adapters, ods-signerd falls back to using `counter' mode SOA serial number in signed zones when configured to use `unixtime' but incoming unsigned zone has `datecounter' format serial.

      Expected/desired behaviour is that ods-signerd would overwrite the incoming SOA serial with `unixtime', not requiring the serial to increase in signed zone wrt incoming unsigned zone's serial (but perhaps check that the serial increases wrt the previously used outgoing serial).

      With current behaviour a hot standby signing server needs to know what is/was the `outgoing' SOA serial used by ods-signerd on the active server. If overwriting serial as `unixtime' was allowed no synchronization of ods-signerd state from active to standby server would be necessary (only KASP would have to be kept in sync and of course signing server's clocks should not be drifting too heavily wrt each other).

      This issue has also been discussed on the users' mailing list:
      http://lists.opendnssec.org/pipermail/opendnssec-user/2013-April/002423.html

      Details / how to reproduce:

      • ods-signerd receives unsigned zones with DNS Input Adapter and provides them to DNS servers using DNS Output Adapter.
      • Zone signing policy configured (in /etc/opendnssec/kasp.xml) with:
        <SOA>
        <TTL>PT300S</TTL>
        <Minimum>PT300S</Minimum>
        <Serial>unixtime</Serial>
        </SOA>
      • Zone is added to KASP by adding it to /etc/opendnssec/zonelist.xml
        and running 'ods-ksmutil update zonelist', incoming unsigned zone SOA
        serial is 2013041212. ods-signerd reports it refuses to use the configured `unixtime' format serial, falls back to `counter' mode:

      Apr 12 12:34:17 signer1 ods-signerd: [namedb] unable to use unixtime as serial: 1365759257 does not increase 2013041212. Serial set to 2013041213
      Apr 12 12:34:17 signer1 ods-signerd: [namedb] update serial: 2013041212 + 1 = 2013041213

        Attachments

          Activity

            People

            Assignee:
            matthijs Matthijs Mekking
            Reporter:
            vmattila Ville Mattila
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: