NetBSD Problem Report #52465
From clare@csel.org Sat Aug 5 22:04:49 2017
Return-Path: <clare@csel.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (verified OK))
by mollari.NetBSD.org (Postfix) with ESMTPS id 578887A27C
for <gnats-bugs@gnats.NetBSD.org>; Sat, 5 Aug 2017 22:04:49 +0000 (UTC)
Message-Id: <20170805120720.EBE4250044@kanako.csel.org>
Date: Sat, 5 Aug 2017 21:07:20 +0900 (JST)
From: Shinichi Doyashiki <clare@csel.org>
Reply-To: clare@csel.org
To: gnats-bugs@NetBSD.org
Subject: /etc/namedb/bind.keys did not updated
X-Send-Pr-Version: 3.95
>Number: 52465
>Notify-List: kim
>Category: bin
>Synopsis: /etc/namedb/bind.keys did not updated
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: jnemeth
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sat Aug 05 22:05:01 +0000 2017
>Closed-Date:
>Last-Modified: Mon Oct 26 09:44:49 +0000 2026
>Originator: Shinichi Doyashiki
>Release: NetBSD 8.99.1
>Organization:
at home
>Environment:
System: NetBSD kanako.csel.org 8.99.1 NetBSD 8.99.1 (KANAKO) #11: Sat Jul 8 17:18:43 JST 2017 clare@kanako.csel.org:/export/stage/hack/sys/arch/amd64/compile/KANAKO amd64
Architecture: x86_64
Machine: amd64
>Description:
we should update /etc/namedb/bind.keys before DNSsec key rollover.
>How-To-Repeat:
run build.sh and see $destdir/etc/namedb/bind.keys
and compare with $src/external/bsd/bind/dist/bind.keys
>Fix:
unknown
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback
State-Changed-By: reed@NetBSD.org
State-Changed-When: Fri, 03 May 2024 19:35:50 +0000
State-Changed-Why:
Since this ticket the bind.keys has been updated several times.
Is it okay if we close this ticket?
From: Shinichi Doyashiki <clare@csel.org>
To: gnats-bugs@netbsd.org
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, reed@netbsd.org
Subject: Re: bin/52465 (/etc/namedb/bind.keys did not updated)
Date: Sat, 4 May 2024 09:38:49 +0900
Is the currently distributed key operationally correct?
It looks to me like an old key is being distributed.
$ locate bind.keys | grep stable-10
/export/netbsd/stable-10/destdir.amd64/etc/namedb/bind.keys
/export/netbsd/stable-10/objdir.amd64/distrib/amd64/cdroms/bootcd/cdrom/etc=
/namedb/bind.keys
/export/netbsd/stable-10/objdir.amd64/distrib/amd64/cdroms/bootcd-com/cdrom=
/etc/namedb/bind.keys
/export/netbsd/stable-10/src/etc/namedb/bind.keys=E3=80=80<--- this file is=
old one
/export/netbsd/stable-10/src/external/mpl/bind/dist/bind.keys
/export/netbsd/stable-10/src/external/mpl/bind/include/bind.keys.h
$ diff -u /export/netbsd/stable-10/destdir.amd64/etc/namedb/bind.keys
/export/netbsd/stable-10/src/external/mpl/bind/dist/bind.keys
--- /export/netbsd/stable-10/destdir.amd64/etc/namedb/bind.keys
2024-04-29 22:09:04.670117188 +0900
+++ /export/netbsd/stable-10/src/external/mpl/bind/dist/bind.keys
2024-04-20 23:25:45.565502784 +0900
@@ -1,70 +1,49 @@
-/* $NetBSD: bind.keys,v 1.2 2018/03/09 18:56:02 christos Exp $ */
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
# The bind.keys file is used to override the built-in DNSSEC trust anchors
-# which are included as part of BIND 9. As of the current release, the on=
ly
-# trust anchors it contains are those for the DNS root zone ("."), and for
-# the ISC DNSSEC Lookaside Validation zone ("dlv.isc.org"). Trust anchors
-# for any other zones MUST be configured elsewhere; if they are configured
-# here, they will not be recognized or used by named.
-#
-# The built-in trust anchors are provided for convenience of configuration=
.
-# They are not activated within named.conf unless specifically switched on=
.
-# To use the built-in root key, set "dnssec-validation auto;" in
-# named.conf options. To use the built-in DLV key, set
-# "dnssec-lookaside auto;". Without these options being set,
-# the keys in this file are ignored.
+# which are included as part of BIND 9. The only trust anchors it contain=
s
+# are for the DNS root zone ("."). Trust anchors for any other zones MUST
+# be configured elsewhere; if they are configured here, they will not be
+# recognized or used by named.
+#
+# To use the built-in root key, set "dnssec-validation auto;" in the
+# named.conf options, or else leave "dnssec-validation" unset. If
+# "dnssec-validation" is set to "yes", then the keys in this file are
+# ignored; keys will need to be explicitly configured in named.conf for
+# validation to work. "auto" is the default setting, unless named is
+# built with "configure --disable-auto-validation", in which case the
+# default is "yes".
#
# This file is NOT expected to be user-configured.
#
-# These keys are current as of February 2017. If any key fails to
-# initialize correctly, it may have expired. In that event you should
-# replace this file with a current version. The latest version of
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-ke=
ys.
-
-managed-keys {
- # ISC DLV: See https://www.isc.org/solutions/dlv for details.
- #
- # NOTE: The ISC DLV zone is being phased out as of February 2017;
- # the key will remain in place but the zone will be otherwise empty=
.
- # Configuring "dnssec-lookaside auto;" to activate this key is
- # harmless, but is no longer useful and is not recommended.
- dlv.isc.org. initial-key 257 3 5
"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2
- brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+
- 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5
- ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk
- Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM
- QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt
- TDN0YUuWrBNh";
-
- # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xm=
l
- # for current trust anchor information.
- #
- # These keys are activated by setting "dnssec-validation auto;"
- # in named.conf.
- #
- # This key (19036) is to be phased out starting in 2017. It will
- # remain in the root zone for some time after its successor key
- # has been added. It will remain this file until it is removed from
- # the root zone.
- . initial-key 257 3 8
"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
- FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
- bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
- X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
- W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
- Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
- QxA+Uk1ihz0=3D";
+# Servers being set up for the first time can use the contents of this fil=
e
+# as initializing keys; thereafter, the keys in the managed key database
+# will be trusted and maintained automatically.
+#
+# These keys are current as of Mar 2019. If any key fails to initialize
+# correctly, it may have expired. In that event you should replace this
+# file with a current version. The latest version of bind.keys can always
+# be obtained from ISC at https://www.isc.org/bind-keys.
+#
+# See https://data.iana.org/root-anchors/root-anchors.xml for current trus=
t
+# anchor information for the root zone.
- # This key (20326) is to be published in the root zone in 2017.
- # Servers which were already using the old key (19036) should
- # roll seamlessly to this new one via RFC 5011 rollover. Servers
- # being set up for the first time can use the contents of this
- # file as initializing keys; thereafter, the keys in the
- # managed key database will be trusted and maintained
- # automatically.
- . initial-key 257 3 8
"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
- +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
- ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
- 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
- oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
- RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
- R1AkUTV74bU=3D";
+trust-anchors {
+ # This key (20326) was published in the root zone in 2017.
+ . initial-key 257 3 8
"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+ +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+ ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+ 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+ oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+ RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+ R1AkUTV74bU=3D";
};
2024=E5=B9=B45=E6=9C=884=E6=97=A5(=E5=9C=9F) 4:35 <reed@netbsd.org>:
>
> Synopsis: /etc/namedb/bind.keys did not updated
>
> State-Changed-From-To: open->feedback
> State-Changed-By: reed@NetBSD.org
> State-Changed-When: Fri, 03 May 2024 19:35:50 +0000
> State-Changed-Why:
> Since this ticket the bind.keys has been updated several times.
> Is it okay if we close this ticket?
>
>
>
--=20
Shinichi Doyashiki <clare@csel.org>
Responsible-Changed-From-To: bin-bug-people->jnemeth
Responsible-Changed-By: jnemeth@NetBSD.org
Responsible-Changed-When: Sun, 18 Oct 2026 22:41:57 +0000
Responsible-Changed-Why:
The current bind.keys is woefully out of date, I'll be working on updating it.
State-Changed-From-To: feedback->open
State-Changed-By: jnemeth@NetBSD.org
State-Changed-When: Sun, 18 Oct 2026 22:41:57 +0000
State-Changed-Why:
The current bind.keys is woefully out of date.
From: "John Nemeth" <jnemeth@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/52465 CVS commit: src/etc/mtree
Date: Mon, 19 Oct 2026 03:50:49 +0000
Module Name: src
Committed By: jnemeth
Date: Mon Oct 19 03:50:49 UTC 2026
Modified Files:
src/etc/mtree: NetBSD.dist.base
Log Message:
Make namedb subdirectories for non-chroot case.
Part of fix for PR/52465 and PR/60864
To generate a diff of this commit:
cvs rdiff -u -r1.264 -r1.265 src/etc/mtree/NetBSD.dist.base
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "John Nemeth" <jnemeth@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/52465 CVS commit: src/etc/namedb
Date: Mon, 19 Oct 2026 04:06:03 +0000
Module Name: src
Committed By: jnemeth
Date: Mon Oct 19 04:06:03 UTC 2026
Modified Files:
src/etc/namedb: bind.keys
Log Message:
Update bind.keys from src/external/mpl/dist/bind.keys.
managed-keys is ancient history and just generated warnings doing
nothing useful. The proper keyword to use is trust-anchors and
this file is now current. The latest root key is only partially
specified as it wasn't published at the time this file was updated,
but enough information is provided for named to download the full
key using RFC 5011.
Fixes PR/52465 and PR/60864
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/etc/namedb/bind.keys
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->pending-pullups
State-Changed-By: jnemeth@NetBSD.org
State-Changed-When: Mon, 19 Oct 2026 06:30:46 +0000
State-Changed-Why:
pullup-10 #1367 , pullup-11 #534
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/52465 CVS commit: [netbsd-11] src
Date: Tue, 20 Oct 2026 19:07:05 +0000
Module Name: src
Committed By: martin
Date: Tue Oct 20 19:07:05 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-11]: mi
src/etc/mtree [netbsd-11]: NetBSD.dist.base
src/etc/namedb [netbsd-11]: bind.keys
Log Message:
Pull up following revision(s) (requested by jnemeth in ticket #534):
etc/mtree/NetBSD.dist.base: revision 1.265
distrib/sets/lists/base/mi: revision 1.1391
distrib/sets/lists/base/mi: revision 1.1392
etc/namedb/bind.keys: revision 1.3
Make namedb subdirectories for non-chroot case.
Part of fix for PR/52465 and PR/60864
Update bind.keys from src/external/mpl/dist/bind.keys.
managed-keys is ancient history and just generated warnings doing
nothing useful. The proper keyword to use is trust-anchors and
this file is now current. The latest root key is only partially
specified as it wasn't published at the time this file was updated,
but enough information is provided for named to download the full
key using RFC 5011.
Fixes PR/52465 and PR/60864
Add new bind /etc/namedb/ directories
To generate a diff of this commit:
cvs rdiff -u -r1.1367.2.1 -r1.1367.2.2 src/distrib/sets/lists/base/mi
cvs rdiff -u -r1.259.4.1 -r1.259.4.2 src/etc/mtree/NetBSD.dist.base
cvs rdiff -u -r1.2 -r1.2.16.1 src/etc/namedb/bind.keys
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/52465 CVS commit: [netbsd-10] src
Date: Tue, 20 Oct 2026 19:08:54 +0000
Module Name: src
Committed By: martin
Date: Tue Oct 20 19:08:54 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-10]: mi
src/etc/mtree [netbsd-10]: NetBSD.dist.base
src/etc/namedb [netbsd-10]: bind.keys
Log Message:
Pull up following revision(s) (requested by jnemeth in ticket #1367):
etc/mtree/NetBSD.dist.base: revision 1.265
distrib/sets/lists/base/mi: revision 1.1391
distrib/sets/lists/base/mi: revision 1.1392
etc/namedb/bind.keys: revision 1.3
Make namedb subdirectories for non-chroot case.
Part of fix for PR/52465 and PR/60864
Update bind.keys from src/external/mpl/dist/bind.keys.
managed-keys is ancient history and just generated warnings doing
nothing useful. The proper keyword to use is trust-anchors and
this file is now current. The latest root key is only partially
specified as it wasn't published at the time this file was updated,
but enough information is provided for named to download the full
key using RFC 5011.
Fixes PR/52465 and PR/60864
Add new bind /etc/namedb/ directories
To generate a diff of this commit:
cvs rdiff -u -r1.1314.2.11 -r1.1314.2.12 src/distrib/sets/lists/base/mi
cvs rdiff -u -r1.246.2.3 -r1.246.2.4 src/etc/mtree/NetBSD.dist.base
cvs rdiff -u -r1.2 -r1.2.12.1 src/etc/namedb/bind.keys
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: pending-pullups->closed
State-Changed-By: jnemeth@NetBSD.org
State-Changed-When: Wed, 21 Oct 2026 20:56:10 +0000
State-Changed-Why:
pullups completed
State-Changed-From-To: closed->open
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Mon, 26 Oct 2026 03:17:10 +0000
State-Changed-Why:
This is not fixed until we have:
(a) eliminated all duplicate copies of bind.keys in the source tree, and
(b) determined it is sensible to be shipping /etc/named/bind.keys at all.
From: Kimmo Suominen <kim@netbsd.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: bin/52465 (/etc/namedb/bind.keys did not updated)
Date: Mon, 26 Oct 2026 11:35:31 +0200
On Mon, Oct 26, 2026 at 03:17:11AM +0000, riastradh@NetBSD.org wrote:
> This is not fixed until we have:
> (a) eliminated all duplicate copies of bind.keys in the source tree, and
> (b) determined it is sensible to be shipping /etc/named/bind.keys at all.
The BIND version in -current as of today is 9.20.30, and in -11 from
20261009152657Z it is 9.20.24. The default value for dnssec-validation
in 9.20 is "auto". The default value for bindkeys-file is empty, and
its intended purpose is server testing.
The default value of dnssec-validation ("auto") works for the general
use case of Internet-connected resolving name servers. A builtin root
DNSSEC key is used and RFC 5011 is followed for root key rollovers.
Once the builtin key becomes too old, the operator is expected to
install a more recent release of BIND. The "too old" scenario only
applies to fresh server installs.
The bind.keys file is no longer read (unless explicitly configured with
bindkeys-file). It was read by version 9.18, but not by 9.20.
In a lab or other isolated environment DNSSEC is expected to be enabled
using "dnssec-validation yes" together with trust-anchors in named.conf.
In my understanding there is no need to install a bind.keys file for the
server in /etc/namedb (or elsewhere). The BIND distribution does not
install it.
The source still comes with a bind.keys file and it is the source file
for the bind.keys.h header file during the build.
References:
- https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-dnssec-validation
- https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-bindkeys-file
- https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-trust-anchors
Kind regards,
+ Kimmo
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home