WEBDIENSTE/NLnetLabs-dnst
1
0
Fork 0
mirror of https://github.com/NLnetLabs/dnst.git synced 2026-09-08 10:57:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'keyset' into keyset-signer

Browse Source
This commit is contained in:
Philip Homburg
2025-10-03 11:26:27 +02:00
parent 2a20885e88 cbd7a7b56b
commit 7a737553ae
3 changed files with 78 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+45 -87
View File
@@ -361,7 +361,7 @@ dependencies = [
"rand 0.9.2",
"rayon",
"regex",
"ring 0.17.14",
"ring",
"serde",
"serde_json",
"smallvec",
@@ -376,7 +376,7 @@ dependencies = [
[[package]]
name = "domain"
version = "0.11.1-dev"
source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#922a74acb96728100ce4ff0b7494b7f0210f181c"
source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#4f2e0ced06c06f8c66aa71b398237ce9189835dc"
dependencies = [
"arc-swap",
"bcder",
@@ -394,7 +394,7 @@ dependencies = [
"openssl",
"parking_lot",
"rand 0.8.5",
"ring 0.17.14",
"ring",
"rustversion",
"secrecy",
"serde",
@@ -412,7 +412,7 @@ dependencies = [
[[package]]
name = "domain-macros"
version = "0.11.1-dev"
source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#922a74acb96728100ce4ff0b7494b7f0210f181c"
source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#4f2e0ced06c06f8c66aa71b398237ce9189835dc"
dependencies = [
"proc-macro2",
"quote",
@@ -864,7 +864,7 @@ dependencies = [
[[package]]
name = "kmip-protocol"
version = "0.5.0"
source = "git+https://github.com/NLnetLabs/kmip-protocol?branch=next#d57571f186e5809d35b31003e02c496141deee55"
source = "git+https://github.com/NLnetLabs/kmip-protocol?branch=next#ad08d63ffd9bbb96ec29d1272d08244e86ed74e6"
dependencies = [
"cfg-if",
"enum-display-derive",
@@ -882,7 +882,7 @@ dependencies = [
"serde_derive",
"tracing",
"trait-set",
"webpki",
"webpki-roots",
]
[[package]]
@@ -1384,21 +1384,6 @@ version = "0.8.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
[[package]]
name = "ring"
version = "0.16.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
dependencies = [
"cc",
"libc",
"once_cell",
"spin",
"untrusted 0.7.1",
"web-sys",
"winapi",
]
[[package]]
name = "ring"
version = "0.17.14"
@@ -1409,7 +1394,7 @@ dependencies = [
"cfg-if",
"getrandom 0.2.16",
"libc",
"untrusted 0.9.0",
"untrusted",
"windows-sys 0.52.0",
]
@@ -1443,15 +1428,17 @@ dependencies = [
[[package]]
name = "rustls"
version = "0.19.1"
version = "0.23.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7"
checksum = "cd3c25631629d034ce7cd9940adc9d45762d46de2b0f57193c4443b92c6d4d40"
dependencies = [
"base64",
"log",
"ring 0.16.20",
"sct",
"webpki",
"once_cell",
"ring",
"rustls-pki-types",
"rustls-webpki",
"subtle",
"zeroize",
]
[[package]]
@@ -1463,6 +1450,26 @@ dependencies = [
"base64",
]
[[package]]
name = "rustls-pki-types"
version = "1.12.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
dependencies = [
"zeroize",
]
[[package]]
name = "rustls-webpki"
version = "0.103.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb"
dependencies = [
"ring",
"rustls-pki-types",
"untrusted",
]
[[package]]
name = "rustversion"
version = "1.0.22"
@@ -1496,16 +1503,6 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]
name = "sct"
version = "0.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce"
dependencies = [
"ring 0.16.20",
"untrusted 0.7.1",
]
[[package]]
name = "secrecy"
version = "0.10.3"
@@ -1605,12 +1602,6 @@ dependencies = [
"windows-sys 0.59.0",
]
[[package]]
name = "spin"
version = "0.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
[[package]]
name = "stable_deref_trait"
version = "1.2.0"
@@ -1623,6 +1614,12 @@ version = "0.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
[[package]]
name = "subtle"
version = "2.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
[[package]]
name = "syn"
version = "1.0.109"
@@ -1885,12 +1882,6 @@ version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
[[package]]
name = "untrusted"
version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
[[package]]
name = "untrusted"
version = "0.9.0"
@@ -2019,47 +2010,14 @@ dependencies = [
]
[[package]]
name = "web-sys"
version = "0.3.78"
name = "webpki-roots"
version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "77e4b637749ff0d92b8fad63aa1f7cff3cbe125fd49c175cd6345e7272638b12"
checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
dependencies = [
"js-sys",
"wasm-bindgen",
"rustls-pki-types",
]
[[package]]
name = "webpki"
version = "0.21.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b8e38c0608262c46d4a56202ebabdeb094cef7e560ca7a226c6bf055188aa4ea"
dependencies = [
"ring 0.16.20",
"untrusted 0.7.1",
]
[[package]]
name = "winapi"
version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
dependencies = [
"winapi-i686-pc-windows-gnu",
"winapi-x86_64-pc-windows-gnu",
]
[[package]]
name = "winapi-i686-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
[[package]]
name = "winapi-x86_64-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "windows"
version = "0.61.3"
src/commands/keyset/cmd.rs
+32 -3
View File
@@ -18,6 +18,8 @@
// config_changed, state_changed, and run_update_ds_command falgs. This
// reduces parameter passing. It also allows KMIP to store its connection
// pool in State instead of in KeySetState as it currently does.
// - add a -v option to keyset. Remove the -v option from status. Add
// verbose output for creation and deletion of keys.
use crate::env::Env;
use crate::error::Error;
@@ -63,7 +65,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
use std::convert::From;
use std::ffi::OsStr;
use std::fmt::{Debug, Display, Formatter};
use std::fs::{remove_file, File};
use std::fs::{create_dir_all, remove_file, File};
use std::io::{self, Write};
use std::net::{IpAddr, SocketAddr};
use std::path::{absolute, Path, PathBuf};
@@ -455,6 +457,12 @@ enum SetCommands {
opt_duration: OptDuration,
},
/// Set the TTL to be used DNSKEY/CDS/CDNSKEY records.
DefaultTtl {
/// TTL value to set.
ttl: u32,
},
/// Set the command to run when the DS records at the parent need updating.
UpdateDsCommand {
/// Command and arguments.
@@ -601,10 +609,13 @@ impl Keyset {
keyset_state,
} = self.cmd
{
let config_file_dir = make_parent_dir(self.keyset_conf.clone());
let state_file = absolute(&keyset_state).map_err(|e| {
format!("unable to make {} absolute: {}", keyset_state.display(), e)
})?;
let keys_dir = make_parent_dir(state_file.clone());
let state_file_dir = make_parent_dir(state_file.clone());
let keys_dir = state_file_dir.clone();
let ks = KeySet::new(domain_name);
let kss = KeySetState {
@@ -644,6 +655,21 @@ impl Keyset {
autoremove: false,
update_ds_command: Vec::new(),
};
// Create the parent directies.
create_dir_all(&state_file_dir).map_err(|e| {
format!(
"unable to create directory '{}': {e}",
state_file_dir.display()
)
})?;
create_dir_all(&config_file_dir).map_err(|e| {
format!(
"unable to create directory '{}': {e}",
config_file_dir.display()
)
})?;
let json = serde_json::to_string_pretty(&kss).expect("should not fail");
let mut file = File::create(&state_file)
.map_err(|e| format!("unable to create file {}: {e}", state_file.display()))?;
@@ -857,7 +883,7 @@ impl Keyset {
println!();
}
Action::ReportRrsigPropagated | Action::WaitRrsigPropagated => {
println!("Check that all authoritative records in the zone have been signed with the following Key(s) and that all nameservers of the zone serve that version or later:");
println!("Check that all authoritative records in the zone have been signed with the following key(s) and that all nameservers of the zone serve that version or later:");
// This clone is needed because
// public_key_from_url needs a mutable
// reference to kss. Rewrite the kmip
@@ -1753,6 +1779,9 @@ fn set_command(
SetCommands::CskValidity { opt_duration } => {
ksc.csk_validity = opt_duration;
}
SetCommands::DefaultTtl { ttl } => {
ksc.default_ttl = Ttl::from_secs(ttl);
}
SetCommands::UpdateDsCommand { args } => {
ksc.update_ds_command = args;
}
src/commands/keyset/kmip.rs
+1 -1
View File
@@ -29,7 +29,7 @@ use std::{
time::Duration,
};
use clap::{arg, Subcommand};
use clap::Subcommand;
use domain::{
base::{name::ToLabelIter, Name, NameBuilder},
crypto::kmip::{ClientCertificate, ConnectionSettings, KeyUrl},