TSIG with dns.query.inbound_xfr

[peterthomassen]

I am trying to perform a zone transfer using dns.query.inbound_xfr:

zone = dns.zone.Zone(domain_name)
dns.query.inbound_xfr(ns_ip, zone)

Now, I'd like to add TSIG. dns.query.xfr has keyring and keyname arguments, but it deprecated. Those arguments don't seem to exist for dns.query.inbound_xfr.

Does dns.query.inbound_xfr support TSIG, and if so, how is it done?

[rthalley]

You use dns.xfr.make_query() and pass the query in.

zone = dns.zone.Zone(domain_name)
query = dns.xfr.make_query(zone, keyring=keyring, keyname=keyname)
dns.query.inbound_xfr(ns_ip, zone, query)

If you're going to try a UDP xfr, you should probably turn EDNS0 on too.

[peterthomassen]

Thanks, that seems to be going the right direction! - Would you mind doing a release with 6f9464d in the meantime? (I'm now running into this.)

[peterthomassen]

Marked as answer. (There's a typo: make_query returns a tuple, so I used query, _ as the lhs.)

[rthalley]

In the meantime, you can pass a serial to dns.xfr.make_query(). Also, it is smart and by default will try to do an IXFR using the serial number from the zone.

[rthalley]

Actually, I didn't merge that patch as I went for making dns.xfr.make_query() smarter, so just delete "In the meantime" from my reply above. :)

[peterthomassen]

The inbound_xfr() code in dnspython 2.1.0 does not have the branch to extract the serial from the query.

[rthalley]

ah, got it. It's still going to be a while before we do a release as we've got some open stuff to sort out first, but I expect we'll have one before the end of 2021.