# /usr/local/cpanel/Cpanel/NameServer/Conf/PowerDNS.pm
# presumably adminBin sets the default algo and nsec configs using the args provided if available (none ever are) otherwise setting hard-coded defaults. lines 376-397
sub algo_config_defaults {
my ( $self, $algo_config ) = @_;
my $new_algo_config = {
algo_num => $algo_config->{algo_num} // 8,
key_setup => $algo_config->{key_setup} // 'auto',
ksk_size => $algo_config->{ksk_size} // 'auto',
zsk_size => $algo_config->{zsk_size} // 'auto',
};
return $new_algo_config;
}
sub nsec_config_defaults {
my ( $self, $nsec_config ) = @_;
my $new_nsec_config = {
use_nsec3 => $nsec_config->{use_nsec3} // 1,
nsec3_opt_out => $nsec_config->{nsec3_opt_out} // 0,
nsec3_iterations => $nsec_config->{nsec3_iterations} // 7,
nsec3_narrow => $nsec_config->{nsec3_narrow} // 1,
nsec3_salt => $nsec_config->{nsec3_salt} // Cpanel::Rand::Get::getranddata( 16, [ 0 .. 9, 'a' .. 'f' ] ),
};
return $new_nsec_config;
}
# presumably then calls validate_algo_config() line 306 and validate_nsec3_config() line 343 (not pasted here because it's just too much) which validates the configs using _supported_algorithms() (lines 408-460) to fill the missing details using the hard-coded values.
sub _supported_algorithms {
return {
'5' => {
'desc' => 'RSA/SHA-1',
'tag' => 'RSASHA1',
'ksk_size' => 2048,
'zsk_size' => 1024,
'key_setup' => 'classic',
},
'6' => {
'desc' => 'DSA-NSEC3-SHA1',
'tag' => 'DSA-NSEC3-SHA1',
'ksk_size' => 2048,
'zsk_size' => 1024,
'key_setup' => 'classic',
},
'7' => {
'desc' => 'RSASHA1-NSEC3-SHA1',
'tag' => 'RSASHA1-NSEC3-SHA1',
'ksk_size' => 2048,
'zsk_size' => 1024,
'key_setup' => 'classic',
},
'8' => {
'desc' => 'RSA/SHA-256',
'tag' => 'RSASHA256',
'ksk_size' => 2048,
'zsk_size' => 1024,
'key_setup' => 'classic',
},
'10' => {
'desc' => 'RSA/SHA-512',
'tag' => 'RSASHA512',
'ksk_size' => 2048,
'zsk_size' => 1024,
'key_setup' => 'classic',
},
'13' => {
'desc' => 'ECDSA Curve P-256 with SHA-256',
'tag' => 'ECDSAP256SHA256',
'ksk_size' => 256,
'zsk_size' => 256,
'key_setup' => 'simple',
},
'14' => {
'desc' => 'ECDSA Curve P-384 with SHA-384',
'tag' => 'ECDSAP384SHA384',
'ksk_size' => 384,
'zsk_size' => 384,
'key_setup' => 'simple',
}
};
}
# presumably adminBin then calls secure_zone() (lines 88-111) which calls _add_ksk(). if key_type is 'classic' (for algos <13) _add_zsk() is called as well. In powerDNS 4.0+ using algo 13+ generates a single key used for both ksk and zsk. Lower algos require separate key generation. I believe 'pdnsutil secure-zone' does this automatically but cpanel relies on 'pdnsutil add-zone-key' instead which requires manually generating both if the algo <13.
sub secure_zone {
my ( $self, $algo_config, $domain ) = @_;
return { 'success' => 0, 'error' => 'DNSSEC is already enabled' }
if scalar keys %{ $self->ds_records($domain) };
my $run = _add_ksk( $algo_config, $domain );
return $run if !$run->{'success'};
if ( $algo_config->{'key_setup'} eq 'classic' ) {
my $run = _add_zsk( $algo_config, $domain );
if ( !$run->{'success'} ) {
$self->unsecure_zone($domain);
return $run;
}
}
# PowerDNS docs recommend running this after securing a zone,
# as it fixes the 'ordername' and 'auth' fields.
#
# This is not strictly required on newly secured zones, but since
# it becomes a noop if no changes are needed, its safe to do.
return Cpanel::NameServer::Utils::PowerDNS::run_pdnsutil( { 'args' => [ 'rectify-zone', $domain ] } );
}
# pretty clear what happens here, _add_ksk() & _add_zsk() call run_pdnsutil() line 52 in /usr/local/cpanel/Cpanel/NameServer/Utils/powerDNS.pm with args to handle the command line action
sub _add_ksk {
my ( $algo_config, $domain ) = @_;
return Cpanel::NameServer::Utils::PowerDNS::run_pdnsutil( { 'args' => [ 'add-zone-key', $domain, 'ksk', $algo_config->{'ksk_size'}, 'active', $algo_config->{'tag'} ] } );
}
sub _add_zsk {
my ( $algo_config, $domain ) = @_;
return Cpanel::NameServer::Utils::PowerDNS::run_pdnsutil( { 'args' => [ 'add-zone-key', $domain, 'zsk', $algo_config->{'zsk_size'}, 'active', $algo_config->{'tag'} ] } );
}
