Subject: NSD patches available

From: Ben Laurie <[email-masked]>
Date: Wed, 15 Mar 2006 19:21:50 +0000

During the pre-workshop we decided to drop support for NSEC3 in BIND and
instead to focus on NSD. This was because the complexity of BIND meant
we couldn't be sure we'd be feature complete by the workshop in May.

I'm glad to say this decision appears to have paid dividends. Patches
against NSD 2.3.3 are now available. In order to use them, you'll need a
zone signer - either Roy's or David's should work fine, the BIND signer
is not correct at present.

A resolver is also needed, and to that end, I am also providing patches
against BIND that allow dig to display NSEC3 records. The verification
code appears to be faulty, so you'll need to use Unbound if you want to
do verification other than by hand, but at least it can make queries and
display the responses.

These can all be found in the NSEC3 subversion repository, at
http://www.nsec3.org/

NSD patches:
http://www.nsec3.org/cgi-bin/trac.cgi/browser/dnssec/patches/nsd-2.3.3-ben1.diff

BIND patches:
http://www.nsec3.org/cgi-bin/trac.cgi/browser/dnssec/patches/bind-9.3.1-ws0-2.diff

Note that you can download these as text if you scroll all the way to
the bottom.

There are also example zone, queries and expected responses in:
http://www.nsec3.org/cgi-bin/trac.cgi/browser/dnssec/ws1/zones

Some of them may be out-of-date as we modified the zone as we were
testing, I'll update them soon, but right now my brain is fried :-)

In order to understand some of the responses you may need to see the -05
version of the I-D, which doesn't yet exist. However, a preliminary (and
somewhat incoherent, sorry) version exists at:
http://www.nsec3.org/cgi-bin/trac.cgi/browser/dnssec/nsec%2B%2B/nsec3.xml

Feedback on anything and everything _most_ welcome.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>