3.4 development was shifted by one month, moving tickets to reflect reality better.

Adjusting time plan - 3.4 development was postponed as we focused on 3.3.x testing and stabilization.

Moving unfinished November tickets to January.

As a workaround for bind-dyndb-ldap limitation described in ticket #128 we need to restart named after each ns-slapd restart.

Petr2 owns this effort.

DNSSEC is still far from completion, moving to April.

Reassigning as we discussed in person:

Please add attribute & respective option option for dnszone-mod and dnszone-add:

ipa dnszone-mod --dnssec=TRUE/FALSE

should change boolean attribute idnsSecInlineSigning in idnsZone object class. Thanks!

I have reserved OID 2.16.840.1.113730.3.8.5.18 for it.

I have found that we also need to remove following attributes from LDAP & CLI & WebUI. Following record types will be managed automatically by BIND in memory and never read/stored from/to database.

attributeTypes: (1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Signature, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: (1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: (1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord' DESC 'RRSIG, RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: (1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord' DESC 'NSEC, RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Please file a separate ticket for removing the options.

Accepting this for the framework changes.

Schema changes were moved to #4328.

Web UI part sent for review

/etc/named.conf in section options has to contain statement:

options {
    dnssec-enable yes;
};

I think that dnssec-validation yes; seems too much for now, I would enable it later when we have some experience with DNSSEC in FreeIPA.

Framework & schema changes are now in master:

• 8b7daf675e77d7a5e2de6eadb26ca3b682c0d67f dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone

Web UI part of idnsSecInlineSigning attribute, master:

• 9c97bbd347b89634a844726c5d1f0ef39df4d139 webui: add idnsSecInlineSigning option to DNS zone details facet

This feature is not ready to be fully supported in 4.0 GA. There are ongoing security related discussions on freeipa-devel that we do not want to rush.

I am thus moving the full support (mainly focused on secure signing key exchange between replicas) RFE to FreeIPA 4.1 release. FreeIPA 4.0 should release at least experimental support so that people can test this technology in their infrastructure - see RFE ticket #4408.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1115294

Reseting reviewers and patch posted for review because this is tracker for FreeIPA 4.1.

master:

• 3be8ff6c46184d9ec81ee2f75b0e85fe5ccffeb5 DNSSEC: fix DS record validation
• 155126b524f990facf767171f94d3733663602f8 Tests: DNS dsrecord validation
• d0130195a91eae5734be5438d997c8e2918eaebd DNS fix NS record coexistence validator
• 2b3be21b2565ecd46a6f037f3291aee0dbc24c4f Test: DNS NS validation
• 7e76bba5123d5acaf4f26927b3909a095a0a5f07 Fix DNS record rename test

ipa-4-1:

• 734883282e7ace0b4eb5bdeb211b4571121b303d DNSSEC: fix DS record validation
• 2863fc94b22e666d78dca16e964cb33013b99847 Tests: DNS dsrecord validation
• f605fe8614a08a6a63a827fb74357228504317cf DNS fix NS record coexistence validator
• c7dc1b508c73a1ab3d91484e6090d4a14190ed0d Test: DNS NS validation
• a32736320a23d7f0cf069c64a50f8f176e99d045 Fix DNS record rename test

One more thing:
/etc/named.conf has to contain line:

include "/etc/named.root.key";

at top level (i.e. besides "options"):

options {
...
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

bind package in Fedora includes this line in its default configuration file but IPA overwites the whole file without any inheritance so we need to add this line to the IPA template.

Ah, I can see that Fedora adds additional configuration:

options {
        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
        managed-keys-directory "/var/named/dynamic";
};

IPA has to follow.

This reminds me that IPA spec file should require following files:

• /etc/named.iscdlv.key
• /etc/named.root.key
• /etc/named.rfc1912.zones
• /var/named/dynamic
• /var/named/data
• /run/named

This should ensure that we will catch packaging changes in BIND package.

bind and bind-dyndb-ldap is not required by freeipa's specfile. DNS support is optional, should we really require these files?

Good point! We should add these files to planned ipa-server-dns package.

Replying to [comment:31 pspacek]:

One more thing:
...

master:

• 97195eb07cb70bfa8cb6e57977e59a871a8df3b4 Add missing attributes to named.conf
• 7ad70025eb2deaf5c7c79149673dc2fbde2b7c2c Make named.conf template platform independent

ipa-4-1:

• ec928b1aec6c9d910b52406e7fc955ff0edad659 Add missing attributes to named.conf
• bac2cc979907b1069ccb0c563636b6e06f9a0721 Make named.conf template platform independent

ipa-4-1:

• f31f5f53447027360afedeca649db4ea610b7ac0 Add mask, unmask methods for service
• 82961a03afc3046a5a947912543e59306aac5b5a DNSSEC: dependencies
• 3f0440f1950319febabcf726304bc10954c8b2b8 DNSSEC: schema
• 3c7bc2a4fdef3bafea469d4b633faf72cc316d35 DNSSEC: add ipapk11helper module
• 52acc54f9efbac863e06d130f7e2110f3ee71db9 DNSSEC: DNS key synchronization daemon
• abf4418c4612e5354e85c00a461bf537d8deff9c DNSSEC: opendnssec services
• 9af49ff97fe999ae507f6bf06c99a79f6c4a1eeb DNSSEC: platform paths and services
• f01acf8e534e98d5d740dd28b9d1aa0d3c7a37e7 DNSSEC: validate forwarders
• cc50112f7915f591901e5fd04be91a66d8a638df DNSSEC: modify named service to support dnssec
• 877fedf6e4448d3480f3488b04ffb6ca22c0790b DNSSEC: installation
• 45353245dd65ad5228f9c6ef133aa0e3cbe3ba5e DNSSEC: uninstallation
• d254bcb146d8954dc062af3af5951fe14d701915 DNSSEC: upgrading
• 4ddc978cea5229f6429221a37cc657b88a734736 DNSSEC: ACI
• dc5b3af72ad8d26c3aceedd9034a731494ab0204 DNSSEC: add ipa dnssec daemons
• bcb1e91a192fb06aed707b9574d45c401c629b53 DNSSEC: add files to backup
• b84fc92fd7321ed249d0d7fc4d5bd29c111536fd DNSSEC: change link to ipa page

ipa-4-1:

• 98100feb4e76964ae0fe2c5d70ba3c672ce17b06 DNSSEC: remove container_dnssec_keys

master:

• 78018dd67d28fd4c58dbfd68014907cb46f3eff1 Add mask, unmask methods for service
• c909690c8ad7f4d9c7901a1f89756a921f0b285e DNSSEC: dependencies
• 9184d9a1bb500bde4e5bfcea2f54ceb5c7886a81 DNSSEC: schema
• bcce86554fd8185d7917053f31d179c8c23bf478 DNSSEC: add ipapk11helper module
• eb548147413d63ca368bb92aaca126fd59fc0bee DNSSEC: DNS key synchronization daemon
• 9101cfa60f715d03bcb4b0c88a69899b102a16bc DNSSEC: opendnssec services
• 30bc3a55cf816cc5114ddbd102afa8b52f598dec DNSSEC: platform paths and services
• ca030a089f9e45a5dae5f6fb5993f4cc714f1ab2 DNSSEC: validate forwarders
• 8f2f5dfbdf6864b7f522aaf2fcf4e337488c87c8 DNSSEC: modify named service to support dnssec
• e798bad646f648748872a841f282462d28af795f DNSSEC: installation
• 21aef21fb5542e890851f2b9189daa13d168e3e7 DNSSEC: uninstallation
• d673ebe4a11981646a81abc97e3f632687693631 DNSSEC: upgrading
• 5556b7f50e2939d0c61d852f2b0dcd82ba2fcf9c DNSSEC: ACI
• 276e69de874f269f6e9089aebb650a5e0814a626 DNSSEC: add ipa dnssec daemons
• 49547a54ddacfcf4e2e6f148ebb6b374e5f1258c DNSSEC: add files to backup
• 10725033c66cfd89340dcc95085cf1daaa18b4c0 DNSSEC: change link to ipa page
• 2a4ba3d3cc5660b4dd377708ab80e5724277e032 DNSSEC: remove container_dnssec_keys