Skip to content

Commit

Permalink
Correct filenames so DNSSEC signs Reverse Zones
Browse files Browse the repository at this point in the history
Without this change, inline signing fails to sign Reverse Zones because BIND expects to find the key files which were generated by ```dnssec-keygen``` with filenames ```/cf/named/etc/namedb/keys/K171.168.192.in-addr.arpa.+00...```.

Still, this patch does not fix the problem where keys are restored from DNSSEC backup file for a zone that was previously created, then deleted, and finally re-created. Currently, when re-creating the signed Reverse Zone, it will restore the keys from the XML config using the (wrong) old filename. DNSSEC inline signing will fail to sign the newly created Reverse Zone.
  • Loading branch information
hb9cwp authored Oct 1, 2016
1 parent fd20ca5 commit e3465c5
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions dns/pfSense-pkg-bind9/files/usr/local/pkg/bind.inc
Original file line number Diff line number Diff line change
Expand Up @@ -587,9 +587,18 @@ EOD;
log_error("[bind] {$key_restored} DNSSEC keys restored from XML backup for {$zonename} zone.");
}
$dnssec_bin = "/usr/local/sbin/dnssec-keygen";
if ($zonereverso == "on") {
if ($zonereversv6o == "on") {
$z = "${zonename}.ip6.arpa";
} else {
$z = "${zonename}.in-addr.arpa";
}
} else {
$z = $zonename;
}
if (file_exists($dnssec_bin) && $key_restored == 0) {
exec("{$dnssec_bin} -K " . CHROOT_LOCALBASE . "/etc/namedb/keys {$zonename}", $kout);
exec("{$dnssec_bin} -K " . CHROOT_LOCALBASE . "/etc/namedb/keys -fk {$zonename}", $kout);
exec("{$dnssec_bin} -K " . CHROOT_LOCALBASE . "/etc/namedb/keys {$z}", $kout);
exec("{$dnssec_bin} -K " . CHROOT_LOCALBASE . "/etc/namedb/keys -fk {$z}", $kout);
foreach ($kout as $filename) {
chown(CHROOT_LOCALBASE . "/etc/namedb/keys/{$filename}.key", "bind");
chown(CHROOT_LOCALBASE . "/etc/namedb/keys/{$filename}.private", "bind");
Expand Down

0 comments on commit e3465c5

Please sign in to comment.