Hello Sebastian, Thanks for the report. We have to improve the implementation to allow different serial policies between master and slave.
Stay tuned! Daniel On 5/31/19 12:38 PM, Sebastian Wiesinger wrote: > Hi, > > we're using knot as a bump-in-the-wire DNSSEC Signer. The setup is as > follows: > > BIND9(unsigned) -> AXFR -> knot(signing) -> AXFR -> BIND9(signed) > > > The zone starts out with a low serial like 10 or 11. knot has a > serial-policy: unixtime for the zones. > > Problem is, whenever an update is pushed the serial number is > decreased again from unixtime back to the original serial which > prevents the zone from propagating to the slaves. > > Example (test zone): > > template: > - id: slave-dnssec-ecdsap256 > storage: "/var/lib/knot/slave" > file: "%s.zone" > zonefile-load: difference > dnssec-signing: on > dnssec-policy: ecdsap256 > master: ns1_signer > notify: ns1 > acl: acl_ns1 > > zone: > - domain: xn--78jubwhb.xn--q9jyb4c > template: slave-dnssec-ecdsap256 > serial-policy: unixtime > > > Here is an example where first a manual "zone-sign" is done to update > the serial to current unixtime (12 -> 1559298292) and after that the > zone is transferred in again which results in a serial decrease > (1559298292 -> 13). > > [xn--78jubwhb.xn--q9jyb4c.] control, received command 'zone-sign' > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, dropping previous signatures, re-signing > zone > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 49852, algorithm > ECDSAP256SHA256, KSK, public, active > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 55142, algorithm > ECDSAP256SHA256, public, active > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, signing started > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, successfully signed > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, next signing at 2019-06-07T12:24:52 > [xn--78jubwhb.xn--q9jyb4c.] zone file updated, serial 12 -> 1559298292 > [xn--78jubwhb.xn--q9jyb4c.] notify, outgoing, remote 176.9.75.248@53, serial > 1559298292 > [xn--78jubwhb.xn--q9jyb4c.] AXFR, outgoing, remote 176.9.75.248@60025, > started, serial 1559298292 > [xn--78jubwhb.xn--q9jyb4c.] AXFR, outgoing, remote 176.9.75.248@60025, > finished, 0.00 seconds, 1 messages, 1819 bytes > [xn--78jubwhb.xn--q9jyb4c.] notify, incoming, remote 176.9.75.248@9104, > received, serial 13 > [xn--78jubwhb.xn--q9jyb4c.] refresh, remote 176.9.75.248@53, remote serial > 13, zone is outdated > [xn--78jubwhb.xn--q9jyb4c.] IXFR, incoming, remote 176.9.75.248@53, receiving > AXFR-style IXFR > [xn--78jubwhb.xn--q9jyb4c.] AXFR, incoming, remote 176.9.75.248@53, starting > [xn--78jubwhb.xn--q9jyb4c.] AXFR, incoming, remote 176.9.75.248@53, finished, > 0.00 seconds, 1 messages, 321 bytes > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 49852, algorithm > ECDSAP256SHA256, KSK, public, active > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 55142, algorithm > ECDSAP256SHA256, public, active > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, signing started > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, successfully signed > [xn--78jubwhb.xn--q9jyb4c.] DNSSEC, next signing at 2019-06-07T12:25:21 > [xn--78jubwhb.xn--q9jyb4c.] refresh, remote 176.9.75.248@53, zone updated, > 0.10 seconds, serial 12 -> 13 > [xn--78jubwhb.xn--q9jyb4c.] zone file updated, serial 1559298292 -> 13 > [xn--78jubwhb.xn--q9jyb4c.] notify, outgoing, remote 176.9.75.248@53, serial > 13 > > How to prevent this? We want knot to always use the current unixtime > for the zone. > > Best Regards > > Sebastian > -- https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
