nsd users - Feb 2012 - DS algorithm as mnemonic

Hello,

I'm playing a little with NSD. The setup I have is that NSD
is configured as a slave. I've used 'nsdc patch' to write a
zone file.

I'm looking at this file right now and DS records with algorithm
5 are written like:

    IN DS 10240 RSASHA1 2 <hash>

In stead of:

    IN DS 10240 5 2 <hash>

Other DS records with algorithms 7 and 8 are correct.

A little test show that BIND9 can at least read such a zone, but it
seems a little inconsistent.

Can someone verify this?

 grtz,

-- 
    Miek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL:
<http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20120227/79b1d0d4/attachment.bin>

Hello Miek,

On Feb 27, 2012, at 19:10 , Miek Gieben wrote:
> I'm playing a little with NSD. The setup I have is that NSD
> is configured as a slave. I've used 'nsdc patch' to write a
> zone file.
> 
> I'm looking at this file right now and DS records with algorithm
> 5 are written like:
> 
>    IN DS 10240 RSASHA1 2 <hash>
> 
> In stead of:
> 
>    IN DS 10240 5 2 <hash>
> 
> Other DS records with algorithms 7 and 8 are correct.
> 
> A little test show that BIND9 can at least read such a zone, but it
> seems a little inconsistent.
> 
> Can someone verify this?
RFC4034 5.3 (http://tools.ietf.org/html/rfc4034#section-5.3) says this is
allowed, pointing to a list in appendix A.1
(http://tools.ietf.org/html/rfc4034#appendix-A.1).

The appendix lists RSASHA1 but not 7 and 8 - so it looks like NSD uses the
mnemonic when 4034 allows it, and uses the number otherwise.

Kind regards,
Peter van Dijk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Miek,

This is correct. NSD only had up to RSASHA1 in its dns algorithm
table. Newer algorithms were never added due to backwards
incompatibility concerns.

However, we could allow newer mnemonics when reading in a zone (more
user friendly), and when writing always print the unsigned integer
value (more consistent, backwards compatible).

Best regards,
  Matthijs

On 02/27/2012 07:10 PM, Miek Gieben wrote:
> Hello,
> 
> I'm playing a little with NSD. The setup I have is that NSD is
> configured as a slave. I've used 'nsdc patch' to write a zone
> file.
> 
> I'm looking at this file right now and DS records with algorithm 5
> are written like:
> 
> IN DS 10240 RSASHA1 2 <hash>
> 
> In stead of:
> 
> IN DS 10240 5 2 <hash>
> 
> Other DS records with algorithms 7 and 8 are correct.
> 
> A little test show that BIND9 can at least read such a zone, but
> it seems a little inconsistent.
> 
> Can someone verify this?
> 
> grtz,
> 
> 
> 
> 
> _______________________________________________ nsd-users mailing
> list nsd-users at NLnetLabs.nl 
> http://open.nlnetlabs.nl/mailman/listinfo/nsd-users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPTKW2AAoJEA8yVCPsQCW5oosH/REol76AL09HCKT9GBz+qPID
gC+acH5NtaeLVABeEm2qP3wdefmCSTytznqx+6uyhKsvIaqPvJYnYHsCZvmZh+4Q
UUUcDEr/MyppsexaofpP0e6WqYQYxorItahGOuFYNFJE0naR3lZcwJUwXZkB2kDS
ccONPIAVYkQDg5wo6uNjZZnPszgSsarKeRXfSmXwlhOx652hIh3orsdSZceoZzQx
xBGPLBOPob1tsKU5YxOWNqXyj98cDCMI0Z7CIG1ilJN4pz3DMBUGXfdZNvPlr5xH
teq1cNeNSriNSYkJmNO0WzjabiY7tvC5eJYfw86+G36WRZy6ZhyhaDo8Mu29ig8=BfjD
-----END PGP SIGNATURE-----