[Pdns-dev] implement GSQLBackend::getDirectNSECx

[Peter van Dijk]

Hello Sebastian,

On 19 Feb 2016, at 17:38, labs at hosting.de wrote:

> we use PowerDNS version 3.4 for our nameserver backend. Recently we 
> have added a signing server which signs zones with ldns. Ldns creates 
> both NSEC(3) and NSEC3PARAM records. As PowerDNS synthesizes these 
> records we have to throw them away and create record ordernames and 
> domain metadata to add the zone to our nameservers. We couldn't find 
> much documentation about how to add presigned zones to a PowerDNS 
> database, so it took a while to get this to work. Now we have a 
> signing server that is tightly coupled to our nameserver even though 
> both systems work completely independently.

Out of curiosity, why are you signing outside of PowerDNS instead of 
with PowerDNS itself?

Second, have you looked at AXFRing the zones in from your signing 
solution, instead of mangling a presigned zone until PowerDNS likes it? 
If you let PowerDNS do the AXFR in, all the throwing away of records 
etc. happens automatically.

> While looking through the PowerDNS code we found the calls to 
> UeberBackend::getDirectNSECx in PacketHandler::addNSEC and 
> PacketHandler::addNSEC3 and noticed that UeberBackend::getDirectNSECx 
> calls DNSBackend::getDirectNSECx for every backend. However, that 
> method isn't implemented in the GSQLBackend, which we use.

These methods are gone in version 4 - they were only used by the LMDB 
backend for hacky reasons, and we dropped the LMDB backend in that form.

> What we would like to do is implement GSQLBackend::getDirectNSECx to 
> fetch NSEC(3) records from the database, if they are stored there, or 
> else return false.

Are you running into problems with the ‘synthesized’ NSEC(3)s?

> Additionaly we would like to expand the PacketHandler::addNSEC3Param 
> method to try to fetch the NSEC3PARAM record from the database before 
> synthesizing one as well.
>
> What we would like to know is if you would be interested in those 
> changes and would be willing to accept a corresponding pull request?

We need to understand what problem is being solved before we’ll 
consider this added complexity (ignoring, for a moment, that the -x 
calls are not even present in 4).

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/