From 3e6f79e602d853799b72018a63880f66fce4face Mon Sep 17 00:00:00 2001 From: Philip-NLnetLabs Date: Tue, 16 Sep 2025 15:49:14 +0200 Subject: [PATCH 1/7] Implement the set default-ttl command. (#127) --- src/commands/keyset/cmd.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs index dfa2701..150a530 100644 --- a/src/commands/keyset/cmd.rs +++ b/src/commands/keyset/cmd.rs @@ -455,6 +455,12 @@ enum SetCommands { opt_duration: OptDuration, }, + /// Set the TTL to be used DNSKEY/CDS/CDNSKEY records. + DefaultTtl { + /// TTL value to set. + ttl: u32, + }, + /// Set the command to run when the DS records at the parent need updating. UpdateDsCommand { /// Command and arguments. @@ -1753,6 +1759,9 @@ fn set_command( SetCommands::CskValidity { opt_duration } => { ksc.csk_validity = opt_duration; } + SetCommands::DefaultTtl { ttl } => { + ksc.default_ttl = Ttl::from_secs(ttl); + } SetCommands::UpdateDsCommand { args } => { ksc.update_ds_command = args; } From 7d2cece9f2914662105ec2c7e7aa7b8d6993c194 Mon Sep 17 00:00:00 2001 From: Philip-NLnetLabs Date: Tue, 23 Sep 2025 15:31:56 +0200 Subject: [PATCH 2/7] Create parent directories for config and state files. (#129) --- src/commands/keyset/cmd.rs | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs index 150a530..c98892c 100644 --- a/src/commands/keyset/cmd.rs +++ b/src/commands/keyset/cmd.rs @@ -18,6 +18,8 @@ // config_changed, state_changed, and run_update_ds_command falgs. This // reduces parameter passing. It also allows KMIP to store its connection // pool in State instead of in KeySetState as it currently does. +// - add a -v option to keyset. Remove the -v option from status. Add +// verbose output for creation and deletion of keys. use crate::env::Env; use crate::error::Error; @@ -63,7 +65,7 @@ use std::collections::{BTreeMap, HashMap, HashSet}; use std::convert::From; use std::ffi::OsStr; use std::fmt::{Debug, Display, Formatter}; -use std::fs::{remove_file, File}; +use std::fs::{create_dir_all, remove_file, File}; use std::io::{self, Write}; use std::net::{IpAddr, SocketAddr}; use std::path::{absolute, Path, PathBuf}; @@ -607,10 +609,13 @@ impl Keyset { keyset_state, } = self.cmd { + let config_file_dir = make_parent_dir(self.keyset_conf.clone()); + let state_file = absolute(&keyset_state).map_err(|e| { format!("unable to make {} absolute: {}", keyset_state.display(), e) })?; - let keys_dir = make_parent_dir(state_file.clone()); + let state_file_dir = make_parent_dir(state_file.clone()); + let keys_dir = state_file_dir.clone(); let ks = KeySet::new(domain_name); let kss = KeySetState { @@ -650,6 +655,21 @@ impl Keyset { autoremove: false, update_ds_command: Vec::new(), }; + + // Create the parent directies. + create_dir_all(&state_file_dir).map_err(|e| { + format!( + "unable to create directory '{}': {e}", + state_file_dir.display() + ) + })?; + create_dir_all(&config_file_dir).map_err(|e| { + format!( + "unable to create directory '{}': {e}", + config_file_dir.display() + ) + })?; + let json = serde_json::to_string_pretty(&kss).expect("should not fail"); let mut file = File::create(&state_file) .map_err(|e| format!("unable to create file {}: {e}", state_file.display()))?; From c62a0978d6cb1642ee056edc6891da02e468e397 Mon Sep 17 00:00:00 2001 From: arya dradjica Date: Sun, 28 Sep 2025 18:49:42 +0200 Subject: [PATCH 3/7] Update 'Cargo.lock' --- Cargo.lock | 132 ++++++++++++++++++----------------------------------- 1 file changed, 45 insertions(+), 87 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 33ec6b9..a288aa9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -361,7 +361,7 @@ dependencies = [ "rand 0.9.2", "rayon", "regex", - "ring 0.17.14", + "ring", "serde", "serde_json", "tempfile", @@ -375,7 +375,7 @@ dependencies = [ [[package]] name = "domain" version = "0.11.1-dev" -source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#922a74acb96728100ce4ff0b7494b7f0210f181c" +source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#4f2e0ced06c06f8c66aa71b398237ce9189835dc" dependencies = [ "arc-swap", "bcder", @@ -393,7 +393,7 @@ dependencies = [ "openssl", "parking_lot", "rand 0.8.5", - "ring 0.17.14", + "ring", "rustversion", "secrecy", "serde", @@ -411,7 +411,7 @@ dependencies = [ [[package]] name = "domain-macros" version = "0.11.1-dev" -source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#922a74acb96728100ce4ff0b7494b7f0210f181c" +source = "git+https://github.com/NLnetLabs/domain.git?branch=patches-for-nameshed-prototype#4f2e0ced06c06f8c66aa71b398237ce9189835dc" dependencies = [ "proc-macro2", "quote", @@ -863,7 +863,7 @@ dependencies = [ [[package]] name = "kmip-protocol" version = "0.5.0" -source = "git+https://github.com/NLnetLabs/kmip-protocol?branch=next#d57571f186e5809d35b31003e02c496141deee55" +source = "git+https://github.com/NLnetLabs/kmip-protocol?branch=next#ad08d63ffd9bbb96ec29d1272d08244e86ed74e6" dependencies = [ "cfg-if", "enum-display-derive", @@ -881,7 +881,7 @@ dependencies = [ "serde_derive", "tracing", "trait-set", - "webpki", + "webpki-roots", ] [[package]] @@ -1383,21 +1383,6 @@ version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001" -[[package]] -name = "ring" -version = "0.16.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc" -dependencies = [ - "cc", - "libc", - "once_cell", - "spin", - "untrusted 0.7.1", - "web-sys", - "winapi", -] - [[package]] name = "ring" version = "0.17.14" @@ -1408,7 +1393,7 @@ dependencies = [ "cfg-if", "getrandom 0.2.16", "libc", - "untrusted 0.9.0", + "untrusted", "windows-sys 0.52.0", ] @@ -1442,15 +1427,17 @@ dependencies = [ [[package]] name = "rustls" -version = "0.19.1" +version = "0.23.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7" +checksum = "cd3c25631629d034ce7cd9940adc9d45762d46de2b0f57193c4443b92c6d4d40" dependencies = [ - "base64", "log", - "ring 0.16.20", - "sct", - "webpki", + "once_cell", + "ring", + "rustls-pki-types", + "rustls-webpki", + "subtle", + "zeroize", ] [[package]] @@ -1462,6 +1449,26 @@ dependencies = [ "base64", ] +[[package]] +name = "rustls-pki-types" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79" +dependencies = [ + "zeroize", +] + +[[package]] +name = "rustls-webpki" +version = "0.103.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb" +dependencies = [ + "ring", + "rustls-pki-types", + "untrusted", +] + [[package]] name = "rustversion" version = "1.0.22" @@ -1495,16 +1502,6 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" -[[package]] -name = "sct" -version = "0.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce" -dependencies = [ - "ring 0.16.20", - "untrusted 0.7.1", -] - [[package]] name = "secrecy" version = "0.10.3" @@ -1604,12 +1601,6 @@ dependencies = [ "windows-sys 0.59.0", ] -[[package]] -name = "spin" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d" - [[package]] name = "stable_deref_trait" version = "1.2.0" @@ -1622,6 +1613,12 @@ version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" +[[package]] +name = "subtle" +version = "2.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" + [[package]] name = "syn" version = "1.0.109" @@ -1884,12 +1881,6 @@ version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" -[[package]] -name = "untrusted" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a" - [[package]] name = "untrusted" version = "0.9.0" @@ -2018,47 +2009,14 @@ dependencies = [ ] [[package]] -name = "web-sys" -version = "0.3.78" +name = "webpki-roots" +version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77e4b637749ff0d92b8fad63aa1f7cff3cbe125fd49c175cd6345e7272638b12" +checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2" dependencies = [ - "js-sys", - "wasm-bindgen", + "rustls-pki-types", ] -[[package]] -name = "webpki" -version = "0.21.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e38c0608262c46d4a56202ebabdeb094cef7e560ca7a226c6bf055188aa4ea" -dependencies = [ - "ring 0.16.20", - "untrusted 0.7.1", -] - -[[package]] -name = "winapi" -version = "0.3.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" -dependencies = [ - "winapi-i686-pc-windows-gnu", - "winapi-x86_64-pc-windows-gnu", -] - -[[package]] -name = "winapi-i686-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" - -[[package]] -name = "winapi-x86_64-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" - [[package]] name = "windows" version = "0.61.3" From 67b99a10a4d9ae61924192b272e09cbed9af93a7 Mon Sep 17 00:00:00 2001 From: arya dradjica Date: Mon, 29 Sep 2025 20:27:15 +0200 Subject: [PATCH 4/7] [keyset] Don't fail on repeated 'init' Cascade uses this because it can't easily tell whether the keyset state is already initialized, in some cases. --- src/commands/keyset/cmd.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs index c98892c..eff428a 100644 --- a/src/commands/keyset/cmd.rs +++ b/src/commands/keyset/cmd.rs @@ -718,7 +718,8 @@ impl Keyset { // Check for re-init. if !kss.dnskey_rrset.is_empty() { // Avoid re-init. - return Err("already initialized\n".into()); + println!("Already initialized, skipping"); + return Ok(()); } // Check if we have any imported keys. Include doesn't count. From 2f7c2f51d2af11ae84d0b91b21e235bf7b603cdd Mon Sep 17 00:00:00 2001 From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com> Date: Wed, 1 Oct 2025 09:40:03 +0200 Subject: [PATCH 5/7] Replace `Keys(s)` with `key(s)`. (#130) --- src/commands/keyset/cmd.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs index eff428a..1e99bd3 100644 --- a/src/commands/keyset/cmd.rs +++ b/src/commands/keyset/cmd.rs @@ -884,7 +884,7 @@ impl Keyset { println!(); } Action::ReportRrsigPropagated | Action::WaitRrsigPropagated => { - println!("Check that all authoritative records in the zone have been signed with the following Key(s) and that all nameservers of the zone serve that version or later:"); + println!("Check that all authoritative records in the zone have been signed with the following key(s) and that all nameservers of the zone serve that version or later:"); // This clone is needed because // public_key_from_url needs a mutable // reference to kss. Rewrite the kmip From be7e53e0e8ab7d0b622a8c8e54440da66f46f7a3 Mon Sep 17 00:00:00 2001 From: Philip Homburg Date: Wed, 1 Oct 2025 13:54:20 +0200 Subject: [PATCH 6/7] Revert "[keyset] Don't fail on repeated 'init'" This reverts commit 67b99a10a4d9ae61924192b272e09cbed9af93a7. --- src/commands/keyset/cmd.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs index 1e99bd3..446438a 100644 --- a/src/commands/keyset/cmd.rs +++ b/src/commands/keyset/cmd.rs @@ -718,8 +718,7 @@ impl Keyset { // Check for re-init. if !kss.dnskey_rrset.is_empty() { // Avoid re-init. - println!("Already initialized, skipping"); - return Ok(()); + return Err("already initialized\n".into()); } // Check if we have any imported keys. Include doesn't count. From cbd7a7b56b6e85f67c99b4ad1f0bc5b28647d978 Mon Sep 17 00:00:00 2001 From: Philip Homburg Date: Wed, 1 Oct 2025 14:24:51 +0200 Subject: [PATCH 7/7] Removed unused import. --- src/commands/keyset/kmip.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/commands/keyset/kmip.rs b/src/commands/keyset/kmip.rs index b8198b1..7f32f7a 100644 --- a/src/commands/keyset/kmip.rs +++ b/src/commands/keyset/kmip.rs @@ -29,7 +29,7 @@ use std::{ time::Duration, }; -use clap::{arg, Subcommand}; +use clap::Subcommand; use domain::{ base::{name::ToLabelIter, Name, NameBuilder}, crypto::kmip::{ClientCertificate, ConnectionSettings, KeyUrl},