Update NEWS for upcoming 4.4 release.

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Bump NVR to 4.4.

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Refactor empty zone handling.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Rename variables in ldap_parse_master_zoneentry() and create_zone().

This is preparation for future changes related to DNSSEC support.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56
Add support for key-directory to configure_paths().

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Refactor master zone configuration.

ldap_parse_master_zoneentry() is way too long and unmanageable.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Refactor zone apex synchronization and serial maintenance.

ldap_parse_master_zoneentry() is way too long and unmanageable.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Separate raw and secure zones in Zone Register.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add basic support for inline-signing.

Inline-signing is enabled for zones with idnsSecInlineSigning attribute = TRUE.

Limitations:
- Signing configuration is hardcoded in create_zone() as magic constants
- idnsSecInlineSigning attribute cannot be changed at run-time
- DNS updates are not supported
- Signing keys have to be pre-generated and stored in
  <dyndb-ldap working directory>/<ldap intance name>/<zone name>/keys
  directory before named is started

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Move secure zone configuration from create_zone() to zone_master_reconfigure().

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Follow query/transfer/update policies for secure zones.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Cleanup logging in zone_master_reconfigure().

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Rename zone variables in update_record().

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Propagate DNS updates & changes from LDAP to signed version of the zone.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Fix false error message about secure zones.

In-line secure zone is loaded asynchronously in background
so immediate dns_zone_getserial2() call following dns_zone_load()
can fail sometimes.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Separate LDAP entry initialization and allocation.

It is handy to have ability to create an empty entry without data.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Remove KEY, SIG, DNSKEY, RRSIG and NSEC records from LDAP schema.

These record types are either obsolete (KEY, SIG) or will be managed
automatically by BIND in memory and should never be read/stored from/to
database (DNSKEY, RRSIG, NSEC).

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add new attributes required for DNSSEC integration to LDAP schema.

NSEC3PARAM and idnsSecInlineSigning attributes were added to idnsZone
objectClass.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Add support for NSEC3.

NSEC3PARAM is loaded from NSEC3PARAMRecord attribute at zone apex
in LDAP. Default (when the attribute is not present) is to use NSEC.

Limitation: Only one NSEC3PARAM record per zone is supported at the moment.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Fix race condition during zone loading.

DNS zone has to be added to DNS view before dns_zone_load() is called.
It is necessary to prevent dns_zone_load() from racing with dns_zone_setview().

This race condition sometimes prevents zone from being signed.
Now the unsigned zone is visible until signing process is complete. This
mimics BIND behavior for in-line signed zones.

https://fedorahosted.org/bind-dyndb-ldap/ticket/56

Signed-off-by: Petr Spacek <pspacek@redhat.com>