Trust Anchors

TrustAnchorsBlock pydantic-model

Bases: BindBaseModel

Trust anchors configuration block for DNSSEC in BIND.

Grammar: trust-anchors { ( static-key | initial-key | static-ds | initial-ds ) ; ... }; // may occur multiple times

Blocks: topmost, view Tags: dnssec

Show JSON schema:

{
  "$defs": {
    "DSTrustAnchor": {
      "description": "Trust anchor entry for DS format (static-ds or initial-ds).\n\nFormat: <domain> static-ds|initial-ds <key_tag> <algorithm> <digest_type> <digest>",
      "properties": {
        "comment": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional comment for this block",
          "title": "Comment"
        },
        "domain": {
          "description": "Domain name for the trust anchor",
          "title": "Domain",
          "type": "string"
        },
        "anchor_type": {
          "description": "Type of DS trust anchor",
          "enum": [
            "static-ds",
            "initial-ds"
          ],
          "title": "Anchor Type",
          "type": "string"
        },
        "key_tag": {
          "description": "Key tag value",
          "maximum": 65535,
          "minimum": 0,
          "title": "Key Tag",
          "type": "integer"
        },
        "algorithm": {
          "description": "DNSSEC algorithm number",
          "title": "Algorithm",
          "type": "integer"
        },
        "digest_type": {
          "description": "Digest type (1=SHA1, 2=SHA256, 3=SHA384, 4=SHA512)",
          "title": "Digest Type",
          "type": "integer"
        },
        "digest": {
          "description": "Hexadecimal digest value",
          "title": "Digest",
          "type": "string"
        }
      },
      "required": [
        "domain",
        "anchor_type",
        "key_tag",
        "algorithm",
        "digest_type",
        "digest"
      ],
      "title": "DSTrustAnchor",
      "type": "object"
    },
    "KeyTrustAnchor": {
      "description": "Trust anchor entry for DNSKEY format (static-key or initial-key).\n\nFormat: <domain> static-key|initial-key <flags> <protocol> <algorithm> <key_data>",
      "properties": {
        "comment": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional comment for this block",
          "title": "Comment"
        },
        "domain": {
          "description": "Domain name for the trust anchor",
          "title": "Domain",
          "type": "string"
        },
        "anchor_type": {
          "description": "Type of key trust anchor",
          "enum": [
            "static-key",
            "initial-key"
          ],
          "title": "Anchor Type",
          "type": "string"
        },
        "flags": {
          "description": "DNSKEY flags (256 for ZSK, 257 for KSK)",
          "title": "Flags",
          "type": "integer"
        },
        "protocol": {
          "description": "DNSKEY protocol (must be 3 for DNSSEC)",
          "title": "Protocol",
          "type": "integer"
        },
        "algorithm": {
          "description": "DNSSEC algorithm number",
          "title": "Algorithm",
          "type": "integer"
        },
        "key_data": {
          "description": "Base64 encoded public key data",
          "title": "Key Data",
          "type": "string"
        }
      },
      "required": [
        "domain",
        "anchor_type",
        "flags",
        "protocol",
        "algorithm",
        "key_data"
      ],
      "title": "KeyTrustAnchor",
      "type": "object"
    }
  },
  "description": "Trust anchors configuration block for DNSSEC in BIND.\n\nGrammar:\ntrust-anchors {\n    <string> ( static-key | initial-key | static-ds | initial-ds )\n    <integer> <integer> <integer> <quoted_string>;\n    ...\n}; // may occur multiple times\n\nBlocks: topmost, view\nTags: dnssec",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "anchors": {
      "description": "List of trust anchor entries",
      "items": {
        "anyOf": [
          {
            "$ref": "#/$defs/KeyTrustAnchor"
          },
          {
            "$ref": "#/$defs/DSTrustAnchor"
          }
        ]
      },
      "title": "Anchors",
      "type": "array"
    }
  },
  "title": "TrustAnchorsBlock",
  "type": "object"
}

Fields:

• comment (string_BIND | None)
• anchors (list[TrustAnchorEntry])

Validators:

• validate_anchor_uniqueness

anchors pydantic-field

anchors: list[TrustAnchorEntry]

List of trust anchor entries

validate_anchor_uniqueness pydantic-validator

validate_anchor_uniqueness() -> TrustAnchorsBlock

Validate that there are no mixed static/initial anchors for the same domain.

TrustAnchorEntry module-attribute

TrustAnchorEntry = KeyTrustAnchor | DSTrustAnchor

BaseTrustAnchor pydantic-model

Bases: BindBaseModel

Show JSON schema:

{
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "domain": {
      "description": "Domain name for the trust anchor",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "BaseTrustAnchor",
  "type": "object"
}

Fields:

• comment (string_BIND | None)
• domain (string_BIND)

domain pydantic-field

domain: string_BIND

Domain name for the trust anchor

KeyTrustAnchor pydantic-model

Bases: BaseTrustAnchor

Trust anchor entry for DNSKEY format (static-key or initial-key).

Format: static-key|initial-key

Show JSON schema:

{
  "description": "Trust anchor entry for DNSKEY format (static-key or initial-key).\n\nFormat: <domain> static-key|initial-key <flags> <protocol> <algorithm> <key_data>",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "domain": {
      "description": "Domain name for the trust anchor",
      "title": "Domain",
      "type": "string"
    },
    "anchor_type": {
      "description": "Type of key trust anchor",
      "enum": [
        "static-key",
        "initial-key"
      ],
      "title": "Anchor Type",
      "type": "string"
    },
    "flags": {
      "description": "DNSKEY flags (256 for ZSK, 257 for KSK)",
      "title": "Flags",
      "type": "integer"
    },
    "protocol": {
      "description": "DNSKEY protocol (must be 3 for DNSSEC)",
      "title": "Protocol",
      "type": "integer"
    },
    "algorithm": {
      "description": "DNSSEC algorithm number",
      "title": "Algorithm",
      "type": "integer"
    },
    "key_data": {
      "description": "Base64 encoded public key data",
      "title": "Key Data",
      "type": "string"
    }
  },
  "required": [
    "domain",
    "anchor_type",
    "flags",
    "protocol",
    "algorithm",
    "key_data"
  ],
  "title": "KeyTrustAnchor",
  "type": "object"
}

Fields:

• comment (string_BIND | None)
• domain (string_BIND)
• anchor_type (Literal[STATIC_KEY, INITIAL_KEY])
• flags (integer_BIND)
• protocol (integer_BIND)
• algorithm (integer_BIND)
• key_data (quoted_string_BIND)

Validators:

• validate_flags → flags
• validate_protocol → protocol
• validate_algorithm → algorithm
• validate_key_data → key_data

anchor_type pydantic-field

anchor_type: Literal[STATIC_KEY, INITIAL_KEY]

Type of key trust anchor

flags pydantic-field

flags: integer_BIND

DNSKEY flags (256 for ZSK, 257 for KSK)

protocol pydantic-field

protocol: integer_BIND

DNSKEY protocol (must be 3 for DNSSEC)

algorithm pydantic-field

algorithm: integer_BIND

DNSSEC algorithm number

key_data pydantic-field

key_data: quoted_string_BIND

Base64 encoded public key data

validate_flags pydantic-validator

validate_flags(v: integer_BIND) -> integer_BIND

Validate DNSKEY flags.

validate_protocol pydantic-validator

validate_protocol(v: integer_BIND) -> integer_BIND

Validate DNSKEY protocol.

validate_algorithm pydantic-validator

validate_algorithm(v: integer_BIND) -> integer_BIND

Validate DNSSEC algorithm.

validate_key_data pydantic-validator

validate_key_data(
    v: quoted_string_BIND,
) -> quoted_string_BIND

Validate that the DNSKEY public key data is valid base64.

named-checkconf rejects a malformed value with "bad base64 encoding".

DSTrustAnchor pydantic-model

Bases: BaseTrustAnchor

Trust anchor entry for DS format (static-ds or initial-ds).

Format: static-ds|initial-ds

Show JSON schema:

{
  "description": "Trust anchor entry for DS format (static-ds or initial-ds).\n\nFormat: <domain> static-ds|initial-ds <key_tag> <algorithm> <digest_type> <digest>",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "domain": {
      "description": "Domain name for the trust anchor",
      "title": "Domain",
      "type": "string"
    },
    "anchor_type": {
      "description": "Type of DS trust anchor",
      "enum": [
        "static-ds",
        "initial-ds"
      ],
      "title": "Anchor Type",
      "type": "string"
    },
    "key_tag": {
      "description": "Key tag value",
      "maximum": 65535,
      "minimum": 0,
      "title": "Key Tag",
      "type": "integer"
    },
    "algorithm": {
      "description": "DNSSEC algorithm number",
      "title": "Algorithm",
      "type": "integer"
    },
    "digest_type": {
      "description": "Digest type (1=SHA1, 2=SHA256, 3=SHA384, 4=SHA512)",
      "title": "Digest Type",
      "type": "integer"
    },
    "digest": {
      "description": "Hexadecimal digest value",
      "title": "Digest",
      "type": "string"
    }
  },
  "required": [
    "domain",
    "anchor_type",
    "key_tag",
    "algorithm",
    "digest_type",
    "digest"
  ],
  "title": "DSTrustAnchor",
  "type": "object"
}

Fields:

• comment (string_BIND | None)
• domain (string_BIND)
• anchor_type (Literal[STATIC_DS, INITIAL_DS])
• key_tag (integer_BIND)
• algorithm (integer_BIND)
• digest_type (integer_BIND)
• digest (quoted_string_BIND)

Validators:

• validate_digest_type → digest_type
• validate_digest → digest

anchor_type pydantic-field

anchor_type: Literal[STATIC_DS, INITIAL_DS]

Type of DS trust anchor

key_tag pydantic-field

key_tag: integer_BIND

Key tag value

algorithm pydantic-field

algorithm: integer_BIND

DNSSEC algorithm number

digest_type pydantic-field

digest_type: integer_BIND

Digest type (1=SHA1, 2=SHA256, 3=SHA384, 4=SHA512)

digest pydantic-field

digest: quoted_string_BIND

Hexadecimal digest value

validate_digest_type pydantic-validator

validate_digest_type(v: integer_BIND) -> integer_BIND

Validate digest type.

validate_digest pydantic-validator

validate_digest(
    v: quoted_string_BIND,
) -> quoted_string_BIND

Validate hexadecimal digest.

AnchorTypeEnum

Bases: str, Enum

Типы DNSSEC trust anchors.