Separate raw and secure zones in Zone Register.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add basic support for inline-signing.

Inline-signing is enabled for zones with idnsSecInlineSigning attribute = TRUE.

Limitations:
- Signing configuration is hardcoded in create_zone() as magic constants
- idnsSecInlineSigning attribute cannot be changed at run-time
- DNS updates are not supported
- Signing keys have to be pre-generated and stored in
  <dyndb-ldap working directory>/<ldap intance name>/<zone name>/keys
  directory before named is started

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Move secure zone configuration from create_zone() to zone_master_reconfigure().

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Follow query/transfer/update policies for secure zones.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Cleanup logging in zone_master_reconfigure().

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Rename zone variables in update_record().

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Propagate DNS updates & changes from LDAP to signed version of the zone.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Fix false error message about secure zones.

In-line secure zone is loaded asynchronously in background
so immediate dns_zone_getserial2() call following dns_zone_load()
can fail sometimes.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Separate LDAP entry initialization and allocation.

It is handy to have ability to create an empty entry without data.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Remove KEY, SIG, DNSKEY, RRSIG and NSEC records from LDAP schema.

These record types are either obsolete (KEY, SIG) or will be managed
automatically by BIND in memory and should never be read/stored from/to
database (DNSKEY, RRSIG, NSEC).

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add new attributes required for DNSSEC integration to LDAP schema.

NSEC3PARAM and idnsSecInlineSigning attributes were added to idnsZone
objectClass.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add support for NSEC3.

NSEC3PARAM is loaded from NSEC3PARAMRecord attribute at zone apex
in LDAP. Default (when the attribute is not present) is to use NSEC.

Limitation: Only one NSEC3PARAM record per zone is supported at the moment.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>