Good day,
TLDR; upgrading from 1.4 to 2.1 on RPM-based distros - you need this.
I'm involved in managing DNSSEC for .sa and xn--mgberp4a5d4ar. We used to
use .rpm based distros and MariaDB/MySQL backend running with OpenDNSSEC
(later 'ODS') 1.4, naturally self-compiled because only SQLite-backend
based packages were available.
Additionally, our key material is generated using a 'proper' key ceremony,
fed into an HSM, and 'ods-enforcer key import' (..--keystate GENERATE)
with known CKA_IDs to tell ODS the relation between key type
(ZSK/KSK/CSK), their use, TLD/ccTLD domain etc.
During migration from 1.4 to 2.1.x, we faced several showstopper bugs. I
have communicated privately with two list members about two of those bugs,
and I have received either confirmation or at least positive feedback
suggesting correctness in bug evaluation and patch, and I'd like to
share these with you.
The showstopper bugs we encountered are:
SUPPORT-278 - [hsm] hsm_get_dnskey(): Got NULL key
SUPPORT-289 - Can not import keys created outside HSM: ods-enforcer key
import broken
SUPPORT-291 - Wrong inception time in keyData after migration
(these are available from
URLs like https://issues.opendnssec.org/browse/SUPPORT-278 , just change
the number).
As if this was not enough, we encountered
SUPPORT-283 - OpenDNSSEC Bogus Signature, Redhat 9 native packages
..which is NOT an ODS problem, rather probably affects all .rpm based
distros. For this, I have received confirmation from a list member.
On top of this, the 1.4 database _we_ had was broken so that it works as
expected on 1.4, but there were many time-wise impossibilities, where the
key generate (inception) time is _after_ the key has been used and one
other problem (probably not worth elaborating here, but a showstopper
too). Those needed manual UPDATE ... in SQL database before migration
(with SUPPORT-291 patch) would succeed.
I have created support requests in OpenDNSSEC JIRA and put in PRs (pull
requests) against 2.1/develop branch
https://github.com/opendnssec/opendnssec/tree/2.1/develop like this:
https://github.com/opendnssec/opendnssec/pull/849 - SUPPORT-278
https://github.com/opendnssec/opendnssec/pull/850 - SUPPORT-289
https://github.com/opendnssec/opendnssec/pull/851 - SUPPORT-291
https://github.com/opendnssec/opendnssec/pull/852 - Necessary files for
'rpmbuild' to build MariaDB/MySQL enforcer backend in RPM-based distros
The last pull request is two files, 'opendnssec-mysql.spec' and
'conf-mysql.xml.in' plus some misc stuff like RSA keylength changed
from 1024 -> 2048. With this PR, people should (_should_) be able to
rpmbuild on .rpm based distros for MariaDB/MySQL backend instead of
SQLite.
Best regards,
--
Mikko Rantanen / ods-...@hole.fi
_______________________________________________
Opendnssec-user mailing list
Opendnssec-user@lists.opendnssec.org
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
