Skip to content

GitLab

Open
Created by Lefteris@Tsintjelis

dnssec-keymgr needs clearer error for undefined policies

I am using FreeBSD 12 with bind binary port v9.11.8. v9.11.6P1 also had the same problem/bug(?).

I am using ECDSAP256SHA256 for ZSK and KSK. I have made a very simple policy that I am trying to automate by using dnssec-keymgr in crontab.

policy default {
        directory "/usr/local/etc/namedb/keys";
        algorithm ECDSAP256SHA256;
        pre-publish zsk 1w;
        post-publish zsk 1w;
        roll-period zsk 2mo;
};

zone example.com {
        policy default;
};

However, every time I run:

dnssec-keymgr -K /usr/local/etc/namedb/keys -r /dev/random

I always get this message:

Unable to apply policy: example.com/ECDSAP256SHA256: unsupported operand type(s) for +: 'float' and 'NoneType'

Edited by Evan Hunt