Subject: [dane] antique signer?

From: [email-masked]
Date: Tue, 10 Apr 2012 16:41:31 +0000

dnssec-signzone -o bar.scan.net bar.scan.net
dnssec-signzone: warning: bar.scan.net:17: unknown RR type 'TLSA'
dnssec-signzone: fatal: failed loading zone from 'bar.scan.net': unknown class/type

sadness.

/bill

---

From: Mark Andrews <[email-masked]>
Date: Sat, 14 Apr 2012 17:59:21 +1000

> dnssec-signzone: fatal: failed loading zone from 'bar.scan.net': unknown class/
 
And the purpose of this was what?  To show that someone hasn't added
type specific code for TLSA records withing 24 hours of the type
being assigned despite there being no need for that type specific
code to be written to actually use TLSA records?

% dnssec-signzone -S -o example.net junk
dnssec-signzone: warning: junk:1: no TTL specified; using SOA MINTTL instead
Fetching ZSK 26127/RSASHA1 from key repository.
Fetching KSK 61969/RSASHA1 from key repository.
Verifying the zone using the following algorithms: RSASHA1.
Zone signing complete:
Algorithm: RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked
                    ZSKs: 1 active, 0 stand-by, 0 revoked
junk.signed
% cat junk
@	SOA	. . 0 0 0 0 0
@	NS @
@	TYPE52	\# 11 00 00 00 1234567890abcdef
% 

Of course it isn't that hard to add support for TLSA but like all
things the changes will need to be reviewed.  You could have just
submitted patches instead of waiting for someone else to do it.  It's
not like you don't have the skill to do it.

% cat junk
@	SOA	. . 0 0 0 0 0
@	NS @
@	TLSA	0 0 0 1234567890abcdef
% dnssec-keygen example.net
Generating key pair..............++++++ ..............++++++ 
Kexample.net.+005+26127
[drugs:~/git/bind9] marka% dnssec-keygen -f KSK example.net
Generating key pair...........................................................................................................................................................................................................................+++ ...............................................................................+++ 
Kexample.net.+005+61969
% bin/dnssec/dnssec-signzone -S -o example.net junk
dnssec-signzone: warning: junk:1: no TTL specified; using SOA MINTTL instead
Fetching ZSK 26127/RSASHA1 from key repository.
Fetching KSK 61969/RSASHA1 from key repository.
Verifying the zone using the following algorithms: RSASHA1.
Zone signing complete:
Algorithm: RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked
                    ZSKs: 1 active, 0 stand-by, 0 revoked
junk.signed
% 

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Sat, 14 Apr 2012 10:10:43 +0000

> code to be written to actually use TLSA records?
[elided]
> not like you don't have the skill to do it.

	I run -two- (and occasionally more) trees of code, mine and 	
	and ISCs.   This was a gentle nudge to ISC that yes, there are
	folks who still use their signing code.  

	In my tree, it works just fine thanks. But then again, my tree
	has A6, BITSTRING, and DISCOVER support too.  And there is quite
	a bit of code excised that has no purposed for me. I stopped 
	submitting patches about 15 years ago when Paul asked me to.
	
/bill