blob: 9230f8620d73c41d01b5f54e093a45082b6c4ec1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
$Id: DNSSEC,v 8.2 1999/10/12 18:23:27 ogud Exp $
DNSSEC Notes:
This file contains description of two interoperabilty problems related
to DNSSEC that only affect sites using DNSSEC.
1. All versions of bind-8 older than 8.2.2
Between versions 8.2.1 and 8.2.2 the printed format of SIG records
changed. As a result, using a signer, named and named-xfer of
differrent versions will cause parsing errors on signed zonefiles.
Included is an AWK program that converts old signed zone files to new
new format, see contrib/dns_signer/add_labels.awk
Usage: awk -f <path>/contrib/dns_signer/add_labels.awk <signed_zone >fixed_zone
2. BIND-8.1 BIND-8.1.1 BIND-8.1.2 Interoperability
If you wish to use BIND-8.1.x as a master server (either primary or
secondary) for DNSSEC signed zone you MUST apply the following patch
to the file src/bin/named/db_load.c. It fixes a bug that rejects
valid RSA signatures on load.
You can patch the file by running following command from this directory
patch -d bin/named <DNSSEC
--- db_load.c.old Mon Oct 11 15:21:24 1999
+++ db_load.c Mon Oct 11 15:21:38 1999
@@ -1123,9 +1123,6 @@
ERRTO("Signature too short");
if (siglen > (NS_MD5RSA_MAX_BITS + 7) / 8)
ERRTO("Signature too long");
- /* We rely on cp from parse */
- if (*cp == 0)
- ERRTO("Signature starts with zeroes");
break;
case NS_ALG_EXPIRE_ONLY:
|
