Cascade 0.1.0-beta7 `Gezellig` released

Cascade
1

We released beta7 of our #DNSSEC signer Cascade, named “Gezellig”.

We can now read TSIG key data from a file, supporting the NSD, BIND, and Knot formats. There are various bug fixes and improvements for using Cascade with an HSM.

Starting today Cascade is being included in the AI-assisted security scanning that has been performed on most of our other #DNS, #BGP and RPKI projects since last year. This means even the very first production release will be very solid.

This is a breaking release, it is NOT backward compatible with 0.1.0-beta6. The invocation of cascaded and the configuration file syntax have changed. State files generated by earlier versions must be removed before starting the beta7 daemon.

Breaking changes

  • Information about HSMs (previously stored in one file per HSM in
    kmip-server-state-dir) is now stored in the global state file.
    (#967 by @bal-e)

    The kmip-server-state-dir configuration option has been removed and the
    default value for kmip-credentials-store-path has changed.

  • The --state option to cascaded has been removed, and replaced by a
    state-file = option in the configuration file. (#989 by @bal-e)

  • cascade tsig add now reads TSIG key data from a file, supporting the NSD,
    BIND, and Knot formats. (#938 by @withjannisNLnetLabs)

  • Zone removal is now only allowed on passive zones in maintenance mode. (#968
    by @bal-e)

New

  • Allow omitting NSEC3 opt-out setting in policy. (#972 by @bal-e)

Bug fixes

  • Fixed bugs that on reload a policy could refer to a non-existant HSM and
    the changes in default HSM to use were not propagated to the key manager.
    (#964 by @Philip-NLnetLabs)
  • In Debian and RPM packages, don’t set a home directory for the cascade user.
    (#976 by @ximon18)
  • Fix and centralize access control for incoming DNS requests.
    (#971 by @Philip-NLnetLabs)

Other changes

Documentation improvements

  • Update tsig add documentation on the “NSD” page. (#983 by
    @withjannisNLnetLabs)
  • Update HSM support table. (#981 by @thgoebel)
  • Miscellaneous fixes related to HSM documentation. (#987 by @ximon18)
  • Add a “Creating a Test Zone” section in the “Quick Start” page. (#980 by
    @thgoebel)
  • Add warnings that KMIP client/server cert arguments are stubs. (#985 by
    @thgoebel)

Acknowledgements

Thanks to @jpmens, @bortzmeyer and @gryphius for testing Cascade and providing
valuable feedback, and thanks to @thgoebel for his contributions!