surfnet/ldns-zonediff

ldns-zonediff

Copyright (c) 2018 SURFnet bv http://www.surf.nl/en/about-surf/subsidiaries/surfnet

All rights reserved. This tool is distributed under a BSD-style license. For more information, see LICENSE

1. INTRODUCTION

This tool can compute the difference between two DNS zone files and outputs the result to the standard output. By default, it will ignore DNSSEC records.

2. PREREQUISITES

Building ldns-zonediff, requires the following dependencies to be installed:

• POSIX-compliant build system
• make
• libldns >= 1.6.17
• OpenSSL >= 1.0.1

On Ubuntu, you may find libldns-dev lacking ldns-config, and possibly more. You can repackage ldns with contrib/pkg-ldns.sh before building. This script additionally requires

• debhelper (for Ubuntu)
• dpkg-dev (for Ubuntu)
• dh-make (for Ubuntu)

3. BUILDING

To build ldns-zonediff fresh from the repository, execute the following commands:

make

4. USING THE TOOL

The tool basically takes two zone files as input and will output the differences between the two zones. In standard mode, it will ignore DNSSEC records, such as keys, signatures and authenticated denial-of-existence records. For more information on other options, please run:

ldns-zonediff -h

5. CONTACT

Questions/remarks/suggestions/praise on this tool can be sent to:

Roland van Rijswijk-Deij [email protected]

ldns-zonediff's Issues

Monitoring feature: Suppress SOA serial differences/rises

The monitoring script below works well, but it will report SOA serial differences, usually caused as a report of special treatment by ldns-zonediff at the time of producing an update (and forwarding that to Knot DNS) and/or by the (Knot DNS) signer to automatically increment the SOA serial during a re-sign of the zone.

So, if scripts like these are to be used, differences solely in the SOA serial should be suppressed, or a requirement should exist that L<R, L<=R, L>=R, L>R (so, an operator perhaps) or perhaps just L<=R under the assumption that R is the published zone. The option might express "additional leniency" for this specific comparison.

Suggesting to add an option to allow for this.

( cd /var/opendnssec/uploaded ; ls) | \
while read zonefile
do
	zone=${zonefile%.txt}
	echo "ldns-zonediff -o \"$zone\""
	ldns-zonediff -o "$zone" "/var/opendnssec/uploaded/$zonefile" "/var/opendnssec/signed/$zonefile"
	if [ $? -ne 0 ]
	then
		echo '###'
		echo '### ZONE FILES DIFFERED ###'
		echo '###'
	fi
done

Current output sample on one zone:

ldns-zonediff -o "orvelte.nep"
; Collected 6 records from 7 lines of zone data in /var/opendnssec/uploaded/orvelte.nep.txt
; Collected 6 records from 10 lines of zone data in /var/opendnssec/signed/orvelte.nep.txt
-- orvelte.nep. 20800 SOA ns1.surfnet.nl. hostmaster.surfnet.nl. 2018062901 20800 3600 604800 86400
++ orvelte.nep. 20800 SOA ns1.surfnet.nl. hostmaster.surfnet.nl. 2018062902 20800 3600 604800 86400
###
### ZONE FILES DIFFERED ###
###

Knot mode should do zone-unset before zone-set

Knot uses the TTL for the (first) zone-set, but never in zone-unset, as documented:

zone-set zone owner [ttl] type rdata
   Add zone record within the transaction. The first record in a rrset requires a ttl value specified.
zone-unset zone owner [type [rdata]]
   Remove zone data within the transaction.

Well, sort-of documented. There simply is no [ttl] in the latter.

This can be a problem when changing the TTL. The zone-set sometimes appears before the zone-unset (probably hash-order-based, because it varies) and then Knot happily removes a value that it just set.