Credns is a software program aimed at fortifying DNSSEC by performing validation in the DNS notify/transfer-chain. Currently credns is a fork of the NSD_3_2 branch that has been extended with the possibility to assess zones (received or updated by AXFR or IXFR) by running an external verifier. Only zones that are deemed correct by the verifier will be notified to (public) slave servers and offered for transfer.
Credns allows to specify an external validator which is called just after a zone is received by transfer, but just before the zone will be served (and delivered via transfer). Below a brief overview of credns operation will follow.
DownloadThe latest release is 0.2.10, dating Jun 22, 2012
Download (checksum sha1: b61a9315faffcec0a1399641246307ad08ae3419)
With credns, an external verifier can be configured per zone. When a zone with a verifier is received or updated via an (incremental) zone transfer, it will be submitted to this external verifier for evaluation. When the verifier deems the updated zone to be correct, it has to indicate this by exiting with status code 0. The zone will then be served. Other exit status codes will discard the update and credns will continue to serve the zone before the update.
A verifier is specified with the "verifier:" option in the "zone:" clause.
The zone can be provided to the verifier in two ways:
A verifier is informed about the domain name of the zone to be verified, and the accessablity of the system submitting the zone via environment variables.
For each zone one verifier will be run at the same time, but when
multiple to-be-verified zones are received, multiple verifiers may be
run simultaneously. The number of verifiers that may be run
simultaneously is configured with the
The time a verifier may take can be configured with the
A minimal credns setup
Suppose you have a hidden master for example.com on 10.0.0.1 and a public slave on 10.20.0.1. We will configure credns listening on 10.10.0.1 in between those two validating with ldns-verify-zone.
In the configuration file /etc/credns/credns.conf we configure the address this credns instance is listening on for all its zones in the server section:
server: ip-address: 10.10.0.1 username: credns
The "username:" has to be an existing user identify which credns can run as. The zone sections starts with the name.
zone: name: example.com
In the zone section we allow notifies from the hidden master and indicate that we transfer the zone from that master as well.
allow-notify: 10.0.0.1 NOKEY request-xfr: 10.0.0.1 NOKEY
Then we configure that we use ldns-verify-zone to validate the zone:
verifier: ldns-verify-zone -V2
And when validated successfully the zone is notified and offered for transfer to the public slave:
notify: 10.20.0.1 NOKEY provide-xfr: 10.20.0.1 NOKEY
We are ready to startup credns:
# crednsc start
credns will now (after some initial setup) request transfer from the hidden master: 10.0.0.1. It will pass the zonefile for assessment to ldns-verify-zone. Then, when the zone is valid, it notifies the public slave on 10.20.0.1 and offers the newly loaded and validated zone for transfer.
The syslog now contain messages reflecting this sequence of affairs:
credns[<m1pid>]: new database created (/var/db/credns/credns.db) credns[<m1pid>]: credns started (credns 0.2.10), pid <m1pid> credns[<c1pid>]: adding 1 udp handlers to netio. credns[<c1pid>]: udp socket 10.10.0.1:domain added to netio credns[<c1pid>]: adding 1 tcp handlers to netio. credns[<c1pid>]: tcp socket 10.10.0.1:domain added to netio credns[<m1pid>]: signal received, reloading... credns[<m2pid>]: memory recyclebin holds 1208 bytes credns[<m2pid>]: Zone example.com has changed. credns[<m2pid>]: Zone is verified and complete credns[<m2pid>]: Zone example.com verified successfully. credns[<m2pid>]: Zone verifying done... Good: 1, Bad: 0. credns[<c2pid>]: adding 1 udp handlers to netio. credns[<c2pid>]: udp socket 10.10.0.1:domain added to netio credns[<c2pid>]: adding 1 tcp handlers to netio. credns[<c2pid>]: tcp socket 10.10.0.1:domain added to netio credns[<xfrdpid>]: Zone example.com serial 0 is updated to <serial>.