2011-02-02 18:59:06 +00:00
|
|
|
2011-01-11 Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* jdnssec-zoneformat: add a -m option for formatting as multiline.
|
|
|
|
|
|
2010-12-14 18:01:12 +00:00
|
|
|
2010-12-14 Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* jdnssec-verifyzone: Add options to either fudge or ignore RRSIG
|
|
|
|
|
inception and expiration times.
|
|
|
|
|
|
2010-12-06 05:59:42 +00:00
|
|
|
2010-12-06 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* jdnssec-verifyzone: Complete refactored the verification code to
|
|
|
|
|
more comprehensively check a zone for DNSSEC validity. Instead of
|
|
|
|
|
just verifying signatures, it will also check to see if the NSEC
|
|
|
|
|
or NSEC3 chains are valid.
|
|
|
|
|
|
2010-12-05 23:08:13 +00:00
|
|
|
2010-12-05 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
2010-12-06 00:25:04 +00:00
|
|
|
* jdnssec-signzone: Fix a bug that would incorrectly handle
|
|
|
|
|
delgations below delegations (those should be ignored.)
|
|
|
|
|
|
|
|
|
|
* jdnssec-signzone: Make the signer ignore junk below a DNAME.
|
|
|
|
|
This differs from BIND's dnssec-signzone behavior (currently), but
|
|
|
|
|
is the correct behavior, as stuff below a DNAME doesn't actually
|
|
|
|
|
exist in DNS. Note that if a name in a zone has both a DNAME and
|
|
|
|
|
a NS RRset (and is not at the apex), then the behavior is a bit
|
|
|
|
|
undefined.
|
|
|
|
|
|
|
|
|
|
* jdnssec-signzone: Fix a bug that would incorrectly set the RRSIG
|
|
|
|
|
bit for NSEC3 RRs corresponding to insecure delegations.
|
|
|
|
|
|
2010-12-05 23:08:13 +00:00
|
|
|
* jdnssec-signzone: add a "verbose signing" option. This will
|
|
|
|
|
cause the pre-signed bytes and the raw signature bytes to be
|
|
|
|
|
output when signing.
|
|
|
|
|
* Other fixes: some minor tweaks and comment fixes.
|
|
|
|
|
Unfortunately, also a lot of rewrapping and whitespace changes due
|
|
|
|
|
to Eclipse. Sigh.
|
|
|
|
|
|
2010-01-14 16:40:32 +00:00
|
|
|
2010-01-14 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.9.6
|
|
|
|
|
|
2010-01-10 02:52:02 +00:00
|
|
|
2010-01-09 David Blacka <davidb@verisignlabs.com>
|
2010-01-08 00:42:27 +00:00
|
|
|
|
2010-01-10 02:52:02 +00:00
|
|
|
* Upgrade to DNSJava 2.0.8 (plus a few local changes). 2.0.8
|
|
|
|
|
fixes a major bug in typemap wire conversion.
|
2010-01-08 00:42:27 +00:00
|
|
|
|
2009-11-03 02:24:06 +00:00
|
|
|
2009-11-02 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.9.5
|
|
|
|
|
|
|
|
|
|
2009-11-01 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Upgrade to DNSJava 2.0.7 (plus a few local changes).
|
|
|
|
|
* DnsKeyAlogorithm: change the RSASHA512 number to 10.
|
|
|
|
|
|
2009-08-23 19:13:42 +00:00
|
|
|
2009-08-23 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.9.4
|
|
|
|
|
|
|
|
|
|
2009-07-15 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* SignUtils: Fix major issue where the code that generates that
|
|
|
|
|
canonical RRset given signature data wasn't obeying the "Orig TTL"
|
|
|
|
|
and "Labels" fields. This is a major issue with verification,
|
|
|
|
|
although it doesn't affect signature generation.
|
|
|
|
|
|
|
|
|
|
* VerifyZone: Fix bug where the whole-zone security status was
|
|
|
|
|
still wrong: unsigned RRsets shouldn't make the zone Bogus.
|
|
|
|
|
|
|
|
|
|
2009-06-12 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* VerifyZone: Fix bug in verification logic so that RRsets that
|
|
|
|
|
never find a valid signature (i.e., only have signatures by keys
|
|
|
|
|
that aren't in the zone) are considered Bogus. Note that
|
|
|
|
|
VerifyZone still can't tell if a RRset that should be signed
|
|
|
|
|
wasn't (or vice versa).
|
|
|
|
|
|
|
|
|
|
* dnsjava: Update local copy of dnsjava library. This version
|
|
|
|
|
adds NSEC3 agorithms to DNSSECVerifier and KEYConverter, emulates
|
|
|
|
|
DiG's "OPT PSEUDOSECTION" formatting in Message.toString(), and
|
|
|
|
|
adds a minimal DHCIDRecord type. Note that the DNSjava trunk has
|
|
|
|
|
a different (although functional similar) version of this type.
|
|
|
|
|
|
|
|
|
|
2009-06-09 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* VerifyZone: Improve the output.
|
|
|
|
|
|
|
|
|
|
* SignKeyset: Add a command line tool for just signing DNSKEY RRsets.
|
|
|
|
|
|
2009-02-10 14:19:00 +00:00
|
|
|
2009-02-10 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.9.0
|
|
|
|
|
|
2009-02-09 02:54:51 +00:00
|
|
|
2009-02-08 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* KeyGen: make RSA large exponent the default. Make it possible
|
|
|
|
|
to select small exponent.
|
|
|
|
|
|
|
|
|
|
* KeyInfoTool: add more info to the output, handle multiple files
|
|
|
|
|
on the command line.
|
|
|
|
|
|
|
|
|
|
* DnsKeyAlgorithm: use DNSjava constants, BIND 9.6 mnemonics for
|
|
|
|
|
NSEC3 key aliases.
|
|
|
|
|
|
2009-02-07 16:21:18 +00:00
|
|
|
2009-02-07 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
2009-02-07 21:01:28 +00:00
|
|
|
* SignZone: add argument for setting the TTL of the NSEC3PARAM
|
|
|
|
|
record. This is so we can match current dnssec-signzone
|
|
|
|
|
(9.6.0-p1) behavior of using a TTL of zero.
|
|
|
|
|
|
|
|
|
|
* Update dnsjava to 2.0.6-vrsn-2, commons-cli to 1.1
|
|
|
|
|
|
|
|
|
|
* SignUtils: fix bug where NSEC3 algorithm and flags were transposed.
|
|
|
|
|
|
2009-02-07 16:21:18 +00:00
|
|
|
* SignUtils: Make sure to use the SOA minimum value for NSEC TTLs,
|
|
|
|
|
instead of the ttl of the "node".
|
|
|
|
|
|
2009-02-05 05:38:16 +00:00
|
|
|
2009-02-04 David Blacka <davidb@verisignlabs.com>
|
2009-02-05 05:06:32 +00:00
|
|
|
|
2009-02-05 05:38:16 +00:00
|
|
|
* update to dnsjava-2.0.1-vrsn-4 (updated typecodes for
|
|
|
|
|
NSEC3/NSEC3PARAM).
|
2009-02-07 16:21:18 +00:00
|
|
|
|
2009-02-05 05:06:32 +00:00
|
|
|
* SignUtils: use JDK-native SHA-256 code instead of broken
|
|
|
|
|
contributed implementation.
|
|
|
|
|
|
|
|
|
|
* DnsKeyAlgorithm: Add RSASHA256 and RSASHA512 algorithm, guessing
|
|
|
|
|
at the code points. Note, these require Java 5 or later, or an
|
|
|
|
|
alternate crypto provider.
|
|
|
|
|
|
|
|
|
|
* ZoneUtils: add a method to find specific RRs in a list of RRs
|
|
|
|
|
or RRsets.
|
|
|
|
|
|
|
|
|
|
* SignZone: make jdnssec-signzone a bit more aggressive in finding
|
|
|
|
|
keys. Now it will look for keyfiles matching keys at the zone
|
|
|
|
|
apex, and, failing that, just look for keyfiles named after the
|
|
|
|
|
zone. Specifying any keys at all on the command line will
|
|
|
|
|
override this behavior.
|
|
|
|
|
|
2009-02-02 05:27:43 +00:00
|
|
|
2009-02-01 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
2009-02-05 05:06:32 +00:00
|
|
|
* DnsKeyAlgorithm: add official aliases from RFC 5155.
|
2009-02-02 05:27:43 +00:00
|
|
|
|
|
|
|
|
* JCEDnsSecSigner: refactor zone signing methods to remove
|
|
|
|
|
duplicate code.
|
|
|
|
|
|
|
|
|
|
* SignZone: move the signZone() methods to JCEDnsSecSigner
|
|
|
|
|
|
|
|
|
|
* BINDKeyUtils: close the private key file after reading it.
|
|
|
|
|
Patch by Wolfgang Nagele.
|
|
|
|
|
|
2006-12-15 15:03:15 +00:00
|
|
|
2006-12-15 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Release version 0.8.4
|
|
|
|
|
|
|
|
|
|
* SignZone: updated internals (and dnsjava lib) to match wire
|
|
|
|
|
format changes introduced by the nsec3-08 draft.
|
|
|
|
|
|
2006-10-10 23:18:28 +00:00
|
|
|
2006-10-10 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.8.3
|
|
|
|
|
|
|
|
|
|
* ZoneFormat: fix RRSIG ordering issue when dealing with multiple
|
|
|
|
|
RRSIGs for a given RRset.
|
|
|
|
|
|
|
|
|
|
* ZoneFormat: lowercase all names in the zone.
|
|
|
|
|
|
|
|
|
|
* Fix packaging errors.
|
|
|
|
|
|
|
|
|
|
|
2006-09-12 12:11:28 +00:00
|
|
|
2006-09-12 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Released version 0.8.0.
|
|
|
|
|
|
2006-09-10 16:48:21 +00:00
|
|
|
2006-09-10 David Blacka <davidb@fury.blacka.com>
|
|
|
|
|
|
2006-09-10 17:05:18 +00:00
|
|
|
* Added the "KeyInfoTool" command line tool as the start of a tool
|
|
|
|
|
for decoding DNSKEY information. Right now, mostly just useful
|
|
|
|
|
for checking the public exponenent of RSA keys.
|
|
|
|
|
|
2006-09-10 16:48:21 +00:00
|
|
|
* Added the "-e" option to jdnssec-keygen, to instruct the key
|
|
|
|
|
generator to use the (common) large exponent in RSA key
|
|
|
|
|
generation.
|
|
|
|
|
|
2006-09-01 02:23:40 +00:00
|
|
|
2006-08-31 David Blacka <davidb@fury.blacka.com>
|
|
|
|
|
|
|
|
|
|
* Modified jdnssec-signzone to set the ttls of NSEC3 records (so
|
|
|
|
|
far) to the SOA minimum value.
|
|
|
|
|
|
|
|
|
|
* Add NSEC3PARAM support for compatibility with the -07 NSEC3
|
|
|
|
|
draft.
|
|
|
|
|
|
2006-05-24 22:21:06 +00:00
|
|
|
2006-05-24 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Add some error checking for the NSEC3 command line parameters
|
|
|
|
|
for jdnssec-signzone.
|
|
|
|
|
|
2006-05-24 22:31:53 +00:00
|
|
|
* Update local dnsjava build to 2.0.1. This also contains a
|
|
|
|
|
change to the NSEC3 rdata format (as per the -06pre NSEC3 draft).
|
|
|
|
|
The change is the addition of a "next hashed owner name" length
|
|
|
|
|
octet.
|
2006-05-24 22:21:06 +00:00
|
|
|
|
2006-05-24 22:23:58 +00:00
|
|
|
* Modified the jdnssec-* shell wrappers to also use the local
|
|
|
|
|
build area version of the jdnssec-tools.jar file. This allows the
|
|
|
|
|
standard jdnssec-* wrappers to work right from the build area.
|
|
|
|
|
|
2006-05-24 22:31:53 +00:00
|
|
|
* Add support of the SHA256 algorithm for DS records. This uses
|
|
|
|
|
the SHA256 class that I obtained from Scott Rose (thanks Scott!).
|
2006-05-24 22:23:58 +00:00
|
|
|
|
|
|
|
|
* Change the name of the package and jar file to jdnssec-tools
|
|
|
|
|
(from java-dnssec-tools) for consistency.
|
|
|
|
|
|
|
|
|
|
* release version 0.7.0.
|
|
|
|
|
|
2006-05-24 22:21:06 +00:00
|
|
|
2006-05-23 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Add support for algorithm aliases. This feature is so that the
|
|
|
|
|
user can declare the DNSKEY algorithm x is the same as algorithm 5
|
|
|
|
|
(e.g.). So far, this only works with straight integer algorithm
|
|
|
|
|
identifiers (no private alg support yet).
|
|
|
|
|
|
|
|
|
|
* Fix jdnssec-signzone so that you can specify multiple KSKs on
|
|
|
|
|
the command line. Apparently, commons-cli actually does handle
|
|
|
|
|
repeating command line options correctly.
|
|
|
|
|
|
|
|
|
|
2006-05-03 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Add preliminary implementation of jdnssec-dstool. This is a
|
|
|
|
|
simple command line tool that takes a DNSKEY record and converts
|
|
|
|
|
it into a DS record (or a DLV record). Right now, it requires
|
|
|
|
|
that the key is stored in a file ending with '.key'.
|
|
|
|
|
|
|
|
|
|
* release version 0.6.0.
|
|
|
|
|
|
|
|
|
|
2006-03-15 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Type map changes for NSEC3, corresponding to changes in draft
|
|
|
|
|
-05pre. Essentially: NSEC3 and RRSIG bits are not set for most
|
|
|
|
|
(all) NSEC3 records any longer.
|
|
|
|
|
|
|
|
|
|
2006-03-06 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* release version 0.5.0.
|
|
|
|
|
|
|
|
|
|
2006-02-16 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Make RecordComparator also compare RDATA so the removeDuplicates
|
|
|
|
|
step actually works reliabled. This was masked by the dupicate
|
|
|
|
|
suppression in org.xbill.DNS.RRset.
|
|
|
|
|
|
|
|
|
|
* Only allow one command line specified KSK since commons-cli
|
|
|
|
|
doesn't seem to handle multi-arg options correctly.
|
|
|
|
|
|
|
|
|
|
* Do not croak on the lack of the command-line keys for now.
|
|
|
|
|
|
|
|
|
|
* New version of local dnsjava build containing NSEC3 changes
|
|
|
|
|
corresponding to the -04pre draft.
|
|
|
|
|
|
|
|
|
|
2005-11-16 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Make jdnssec-verifyzone work with just the zone (which is
|
|
|
|
|
self-signed anyway).
|
|
|
|
|
|
|
|
|
|
* release version 0.4.2.
|
|
|
|
|
|
|
|
|
|
2005-11-09 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Add original ownername comments to the NSEC3 generation.
|
2006-05-24 22:23:58 +00:00
|
|
|
|
2006-05-24 22:21:06 +00:00
|
|
|
2005-11-08 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* New zone formatter.
|
|
|
|
|
|
|
|
|
|
* Misc bug fixes.
|
|
|
|
|
|
|
|
|
|
* release version 0.4.1.
|
|
|
|
|
|
|
|
|
|
2005-11-07 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Update the local dnsjava build with a bugfix.
|
|
|
|
|
|
|
|
|
|
* Fix ordering problem with ProtoNSEC3s.
|
|
|
|
|
|
|
|
|
|
2005-11-06 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Actually use the --iterations command line option of
|
|
|
|
|
jdnssec-signzone.
|
|
|
|
|
|
|
|
|
|
2005-10-27 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Add NSEC3 support for jdnssec-signzone.
|
|
|
|
|
|
|
|
|
|
* Remove support for plain Opt-In (until private algorithms work).
|
|
|
|
|
|
|
|
|
|
* release version 0.4.0.
|
2006-05-24 22:23:58 +00:00
|
|
|
|
2006-05-24 22:21:06 +00:00
|
|
|
2005-08-14 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Move the signZone function into the SignZone class (from the
|
|
|
|
|
SignUtils) class.
|
|
|
|
|
|
|
|
|
|
* General cleanup.
|
|
|
|
|
|
|
|
|
|
* Add local _jdnssec-* shell wrappers. These use build/classes in
|
|
|
|
|
the classpath so can be used to run the tools right out of the
|
|
|
|
|
build area.
|
|
|
|
|
|
|
|
|
|
2005-08-13 David Blacka <davidb@verisignlabs.com>
|
|
|
|
|
|
|
|
|
|
* Update to DNSjava 2.0.0
|
|
|
|
|
|
|
|
|
|
* Refactor command line parsing.
|
|
|
|
|
|
|
|
|
|
* Switch to using java.util.logging for logging.
|
