Bug 1207539

Summary: [RFE] Add support for TLSA resource records (DANE)
Product: Red Hat Enterprise Linux 7 Reporter: Martin Kosek <mkosek>
Component: bind-dyndb-ldapAssignee: Petr Spacek <pspacek>
Status: CLOSED ERRATA QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 7.0CC: ppicka, pspacek
Target Milestone: rcKeywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: bind-dyndb-ldap-7.99-1.GIT158e95e.el7 Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 10:21:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1181710    
Attachments:
Description Flags
Evidence of verify none

Description Martin Kosek 2015-03-31 07:00:14 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/bind-dyndb-ldap/ticket/94

"DNS-Based Authentication of Named Entities (DANE) - Transport Layer Security (TLS) Protocol" requires new record named "TLSA" as defined by [http://tools.ietf.org/html/rfc6698 RFC 6698].

General use cases are defined in [http://tools.ietf.org/html/rfc6394 RFC 6394].

We need to add tlsaRecord attribute and add support to bind plugin.
Comment 2 Petr Spacek 2015-05-11 08:57:58 UTC 
The tests is very same as for any other DNS recourse record type:

1) Add the record with arbitrary values:
$ ipa dnsrecord-add zone.test. name --tlsa-rec='0 0 1 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971'

2) Verify that the correct record value is visible in DNS:
$ dig name.zone.test TLSA
Comment 3 Petr Spacek 2015-06-08 15:14:26 UTC 
Fixed upstream:
35ac3e422376cc28040d03c7550c2c68a967a0cf, 174190a582825478a555c722e9e0314770b895a5
Comment 7 Petr Spacek 2015-09-10 14:54:32 UTC 
This particular bug is not worth documenting because it is only about schema extension in doc/ directory and nothing else.

According to https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/tree/NEWS, from bind-dyndb-ldap version 3.2 all RR types which have respective attribute defined in LDAP schema (and are supported by particular version of BIND) can be automatically used by bind-dyndb-ldap.
Comment 8 Pavel Picka 2015-09-21 12:31:45 UTC 
Created attachment 1075492 [details]
Evidence of verify

VERIFIED

log in attachment
Comment 9 Pavel Picka 2015-09-21 12:35:12 UTC 
VERIFIED by comment 8
Comment 11 errata-xmlrpc 2015-11-19 10:21:16 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2015-2301.html