upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- RFC 7958 is now out, updated docs for unbound-anchor.

Browse source 
git-svn-id: file:///svn/unbound/trunk@3839 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2016-09-01 07:08:22 +00:00
parent 56928896b8
commit a03a3d1d55
3 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/Changelog
View file

@ -1,4 +1,7 @@
29 August 2016: Ralph 1 September 2016: Wouter
- RFC 7958 is now out, updated docs for unbound-anchor.
29 August 2016: Wouter
- Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A. - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
Siewior. Siewior.
- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.

6
doc/unbound-anchor.8.in
View file

@ -16,6 +16,8 @@
.SH "DESCRIPTION" .SH "DESCRIPTION"
.B Unbound\-anchor .B Unbound\-anchor
performs setup or update of the root trust anchor for DNSSEC validation. performs setup or update of the root trust anchor for DNSSEC validation.
The program fetches the trust anchor with the method from RFC7958 when
regular RFC5011 update fails to bring it up to date.
It can be run (as root) from the commandline, or run as part of startup It can be run (as root) from the commandline, or run as part of startup
scripts. Before you start the \fIunbound\fR(8) DNS server. scripts. Before you start the \fIunbound\fR(8) DNS server.
.P .P
@ -39,8 +41,8 @@ update certificate files.
.P .P
It tests if the root anchor file works, and if not, and an update is possible, It tests if the root anchor file works, and if not, and an update is possible,
attempts to update the root anchor using the root update certificate. attempts to update the root anchor using the root update certificate.
It performs a https fetch of root-anchors.xml and checks the results, if It performs a https fetch of root-anchors.xml and checks the results (RFC7958),
all checks are successful, it updates the root anchor file. Otherwise if all checks are successful, it updates the root anchor file. Otherwise
the root anchor file is unchanged. It performs RFC5011 tracking if the the root anchor file is unchanged. It performs RFC5011 tracking if the
DNSSEC information available via the DNS makes that possible. DNSSEC information available via the DNS makes that possible.
.P .P

7
smallapp/unbound-anchor.c
View file

@ -37,7 +37,8 @@
* \file * \file
* *
* This file checks to see that the current 5011 keys work to prime the * This file checks to see that the current 5011 keys work to prime the
* current root anchor. If not a certificate is used to update the anchor. * current root anchor. If not a certificate is used to update the anchor,
* with RFC7958 https xml fetch.
* *
* This is a concept solution for distribution of the DNSSEC root * This is a concept solution for distribution of the DNSSEC root
* trust anchor. It is a small tool, called "unbound-anchor", that * trust anchor. It is a small tool, called "unbound-anchor", that
@ -47,7 +48,7 @@
* Management-Abstract: * Management-Abstract:
* * first run: fill root.key file with hardcoded DS record. * * first run: fill root.key file with hardcoded DS record.
* * mostly: use RFC5011 tracking, quick . DNSKEY UDP query. * * mostly: use RFC5011 tracking, quick . DNSKEY UDP query.
* * failover: use builtin certificate, do https and update. * * failover: use RFC7958 builtin certificate, do https and update.
* Special considerations: * Special considerations:
* * 30-days RFC5011 timer saves a lot of https traffic. * * 30-days RFC5011 timer saves a lot of https traffic.
* * DNSKEY probe must be NOERROR, saves a lot of https traffic. * * DNSKEY probe must be NOERROR, saves a lot of https traffic.
@ -77,7 +78,7 @@
* the file contains a list of normal DNSKEY/DS records, and uses that to * the file contains a list of normal DNSKEY/DS records, and uses that to
* bootstrap 5011 (the KSK is made VALID). * bootstrap 5011 (the KSK is made VALID).
* *
* The certificate update is done by fetching root-anchors.xml and * The certificate RFC7958 update is done by fetching root-anchors.xml and
* root-anchors.p7s via SSL. The HTTPS certificate can be logged but is * root-anchors.p7s via SSL. The HTTPS certificate can be logged but is
* not validated (https for channel security; the security comes from the * not validated (https for channel security; the security comes from the
* certificate). The 'data.iana.org' domain name A and AAAA are resolved * certificate). The 'data.iana.org' domain name A and AAAA are resolved