Hello Sebastian,
On 19 Feb 2016, at 17:38, l...@hosting.de wrote:
we use PowerDNS version 3.4 for our nameserver backend. Recently we
have added a signing server which signs zones with ldns. Ldns creates
both NSEC(3) and NSEC3PARAM records. As PowerDNS synthesizes these
records we have to throw them away and create record ordernames and
domain metadata to add the zone to our nameservers. We couldn't find
much documentation about how to add presigned zones to a PowerDNS
database, so it took a while to get this to work. Now we have a
signing server that is tightly coupled to our nameserver even though
both systems work completely independently.
Out of curiosity, why are you signing outside of PowerDNS instead of
with PowerDNS itself?
Second, have you looked at AXFRing the zones in from your signing
solution, instead of mangling a presigned zone until PowerDNS likes it?
If you let PowerDNS do the AXFR in, all the throwing away of records
etc. happens automatically.
While looking through the PowerDNS code we found the calls to
UeberBackend::getDirectNSECx in PacketHandler::addNSEC and
PacketHandler::addNSEC3 and noticed that UeberBackend::getDirectNSECx
calls DNSBackend::getDirectNSECx for every backend. However, that
method isn't implemented in the GSQLBackend, which we use.
These methods are gone in version 4 - they were only used by the LMDB
backend for hacky reasons, and we dropped the LMDB backend in that form.
What we would like to do is implement GSQLBackend::getDirectNSECx to
fetch NSEC(3) records from the database, if they are stored there, or
else return false.
Are you running into problems with the ‘synthesized’ NSEC(3)s?
Additionaly we would like to expand the PacketHandler::addNSEC3Param
method to try to fetch the NSEC3PARAM record from the database before
synthesizing one as well.
What we would like to know is if you would be interested in those
changes and would be willing to accept a corresponding pull request?
We need to understand what problem is being solved before we’ll
consider this added complexity (ignoring, for a moment, that the -x
calls are not even present in 4).
Kind regards,
--
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/
_______________________________________________
Pdns-dev mailing list
Pdns-dev@mailman.powerdns.com
http://mailman.powerdns.com/mailman/listinfo/pdns-dev
