| Subject: | DNSKEY privatekeyname broken for non-lowercase key names |
Consider axfr returns a DNSKEY RR such as
4.3.2.1.IN-ADDR.ARPA.600 DNSKEY ...
Calling $rr->privatekeyname will produce something like; K4.3.2.1.IN-
ADDR.ARPA+007+47553.private
Unfortunately, dnssec-keygen and bind expect IN-ADDR.ARPA to be in
lower case.
One can "fix" this with something like the following - which is
expensive:
$rr = Net::DNS::RR::->new(
name => lc $rr->name,
ttl => $rr->ttl,
class => $rr->class,
type => 'DNSKEY',
flags => $rr->flags,
protocol => $rr->protocol,
algorithm => $rr->algorithm,
keybin => $rr->keybin,
keytag => $rr->keytag,
);
Note also that it would be useful to access all 5 of the key timing
attributes from the RR instead of activating dnssec-settime -p all -u.
(Create, Activate, Publish, Revoke, Retire and Delete). Better if they
can be set too.
Rather than read the file, I do this - but it's expensive:
my $DNSTIME = '/usr/sbin/dnssec-settime';
sub getKeyAttributes($$$) {
my( $view, $rr, $fmt ) = @_;
# Copy the RR to downcase the name so that the keyfile can be found
# Grrrh.
$rr = Net::DNS::RR::->new(
name => lc $rr->name,
ttl => $rr->ttl,
class => $rr->class,
type => 'DNSKEY',
flags => $rr->flags,
protocol => $rr->protocol,
algorithm => $rr->algorithm,
keybin => $rr->keybin,
keytag => $rr->keytag,
);
my %kt;
my $fn = $rr->privatekeyname;
$fn =~ /^(.*)$/;
$fn = $1;
open( KT, '-|', "$DNSTIME -p all -u -K $bindDir/$view-keys $fn
Show quoted text
2>&1" ) or die( "Can't run $DNSTIME: $!\n" );
while( <KT> ) {
if( /^dnssec-settime:/ ) {
die( "Failed to read key data: $_" );
}
next unless( /^\s*(\S+):\s*(\d+|UNSET)\s*$/ );
$kt{$1} = $2;
$kt{"d-$1"} = ($2 eq 'UNSET'? $2 : POSIX::strftime( $fmt,
localtime( $2 ) ) );
}
close KT;
return \%kt;
}