adam/jarl
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 34 Wiki Activity

Add DNSSEC signing, key backups and Porkbun support

Browse Source 
Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed 2026-10-08 21:19:04 +00:00
1 parent 293e6ddd33
commit 5630e7a848
72 files changed
+5760 -153
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/dnssec/testdata/Kexample.test.+013+22642.key
Vendored
+6
View File
@@ -0,0 +1,6 @@
; This is a key-signing key, keyid 22642, for example.test.
; Created: 20261008190331 (Thu Oct 8 19:03:31 2026)
; Publish: 20261008190331 (Thu Oct 8 19:03:31 2026)
; Activate: 20261008190331 (Thu Oct 8 19:03:31 2026)
; SyncPublish: 20261009190831 (Fri Oct 9 19:08:31 2026)
example.test. 3600 IN DNSKEY 257 3 13 fiSDgJJGHyAp36ZNGOeb45gn+O1pF3hCbTUPHeJ3ztIuisGoywmo7Be3 +vUPyC6e9BmTCIRIeElB4f2o9HoPXg==
internal/dnssec/testdata/Kexample.test.+013+22642.private
Vendored
+1
View File
@@ -0,0 +1 @@
Private-key-format: v1.3 (test data, not a real key)
internal/dnssec/testdata/Kexample.test.+013+22642.state
Vendored
+19
View File
@@ -0,0 +1,19 @@
; This is the state of key 22642, for example.test.
Algorithm: 13
Length: 256
Lifetime: 0
KSK: yes
ZSK: yes
Generated: 20261008190331 (Thu Oct 8 19:03:31 2026)
Published: 20261008190331 (Thu Oct 8 19:03:31 2026)
Active: 20261008190331 (Thu Oct 8 19:03:31 2026)
PublishCDS: 20261009190831 (Fri Oct 9 19:08:31 2026)
DNSKEYChange: 20261008190331 (Thu Oct 8 19:03:31 2026)
ZRRSIGChange: 20261008190331 (Thu Oct 8 19:03:31 2026)
KRRSIGChange: 20261008190331 (Thu Oct 8 19:03:31 2026)
DSChange: 20261008190331 (Thu Oct 8 19:03:31 2026)
DNSKEYState: rumoured
ZRRSIGState: rumoured
KRRSIGState: rumoured
DSState: hidden
GoalState: omnipresent
internal/dnssec/testdata/Kfast.test.+013+00642.key
Vendored
+8
View File
@@ -0,0 +1,8 @@
; This is a key-signing key, keyid 642, for fast.test.
; Created: 20261008203220 (Thu Oct 8 20:32:20 2026)
; Publish: 20261008203220 (Thu Oct 8 20:32:20 2026)
; Activate: 20261008203220 (Thu Oct 8 20:32:20 2026)
; Inactive: 20261008203319 (Thu Oct 8 20:33:19 2026)
; Delete: 20261024213819 (Sat Oct 24 21:38:19 2026)
; SyncPublish: 20261008203234 (Thu Oct 8 20:32:34 2026)
fast.test. 3600 IN DNSKEY 257 3 13 D6O3u6ZWXwKPu/Y4acS2eRm1zKQ8LaN8zhvkr6KNWP+fEPgko6yLib94 J5KcUXpFcG6Y/jdxKM8FgeASRDq/ow==
internal/dnssec/testdata/Kfast.test.+013+00642.private
Vendored
+1
View File
@@ -0,0 +1 @@
Private-key-format: v1.3 (test data, not a real key)
internal/dnssec/testdata/Kfast.test.+013+00642.state
Vendored
+23
View File
@@ -0,0 +1,23 @@
; This is the state of key 642, for fast.test.
Algorithm: 13
Length: 256
Lifetime: 0
KSK: yes
ZSK: yes
Generated: 20261008203220 (Thu Oct 8 20:32:20 2026)
Published: 20261008203220 (Thu Oct 8 20:32:20 2026)
Active: 20261008203220 (Thu Oct 8 20:32:20 2026)
Retired: 20261008203319 (Thu Oct 8 20:33:19 2026)
Removed: 20261024213819 (Sat Oct 24 21:38:19 2026)
DSPublish: 20261008203249 (Thu Oct 8 20:32:49 2026)
DSRemoved: 20261008203329 (Thu Oct 8 20:33:29 2026)
PublishCDS: 20261008203234 (Thu Oct 8 20:32:34 2026)
DNSKEYChange: 20261008203234 (Thu Oct 8 20:32:34 2026)
ZRRSIGChange: 20261008203232 (Thu Oct 8 20:32:32 2026)
KRRSIGChange: 20261008203234 (Thu Oct 8 20:32:34 2026)
DSChange: 20261008203319 (Thu Oct 8 20:33:19 2026)
DNSKEYState: omnipresent
ZRRSIGState: omnipresent
KRRSIGState: omnipresent
DSState: unretentive
GoalState: hidden
internal/dnssec/testdata/Kfast2.test.+013+28643.key
Vendored
+8
View File
@@ -0,0 +1,8 @@
; This is a key-signing key, keyid 28643, for fast2.test.
; Created: 20261008203340 (Thu Oct 8 20:33:40 2026)
; Publish: 20261008203340 (Thu Oct 8 20:33:40 2026)
; Activate: 20261008203340 (Thu Oct 8 20:33:40 2026)
; Inactive: 20261008203344 (Thu Oct 8 20:33:44 2026)
; Delete: 20261024213844 (Sat Oct 24 21:38:44 2026)
; SyncPublish: 20261008203354 (Thu Oct 8 20:33:54 2026)
fast2.test. 3600 IN DNSKEY 257 3 13 6WkqPp3kxXxMJtC9clsF4zTnZGPXaFRikSdMLG1eFExa4d0Uo+PtMbqo KHR/Qe601tO7yZoY8itie0aZzPaMiA==
internal/dnssec/testdata/Kfast2.test.+013+28643.private
Vendored
+1
View File
@@ -0,0 +1 @@
Private-key-format: v1.3 (test data, not a real key)
internal/dnssec/testdata/Kfast2.test.+013+28643.state
Vendored
+21
View File
@@ -0,0 +1,21 @@
; This is the state of key 28643, for fast2.test.
Algorithm: 13
Length: 256
Lifetime: 0
KSK: yes
ZSK: yes
Generated: 20261008203340 (Thu Oct 8 20:33:40 2026)
Published: 20261008203340 (Thu Oct 8 20:33:40 2026)
Active: 20261008203340 (Thu Oct 8 20:33:40 2026)
Retired: 20261008203344 (Thu Oct 8 20:33:44 2026)
Removed: 20261024213844 (Sat Oct 24 21:38:44 2026)
PublishCDS: 20261008203354 (Thu Oct 8 20:33:54 2026)
DNSKEYChange: 20261008203344 (Thu Oct 8 20:33:44 2026)
ZRRSIGChange: 20261008203344 (Thu Oct 8 20:33:44 2026)
KRRSIGChange: 20261008203344 (Thu Oct 8 20:33:44 2026)
DSChange: 20261008203340 (Thu Oct 8 20:33:40 2026)
DNSKEYState: unretentive
ZRRSIGState: unretentive
KRRSIGState: unretentive
DSState: hidden
GoalState: hidden