39 static const char* sc_str =
"signconf";
91 const char* rngfile = ODS_SE_RNGDIR
"/signconf.rng";
92 ods_status status = ODS_STATUS_OK;
95 if (!scfile || !signconf) {
96 return ODS_STATUS_ASSERT_ERR;
98 ods_log_debug(
"[%s] read signconf file %s", sc_str, scfile);
100 if (status != ODS_STATUS_OK) {
101 ods_log_error(
"[%s] unable to read signconf: parse error in " 102 "file %s (%s)", sc_str, scfile, ods_status2str(status));
105 fd = ods_fopen(scfile, NULL,
"r");
107 signconf->
filename = strdup(scfile);
117 if (signconf->
nsec_type == LDNS_RR_TYPE_NSEC3) {
124 (uint8_t) signconf->
nsec3_algo, (uint8_t) signconf->nsec3_optout,
125 (uint16_t)signconf->nsec3_iterations, signconf->nsec3_salt);
126 if (!signconf->nsec3params) {
127 ods_log_error(
"[%s] unable to read signconf %s: " 128 "nsec3params_create() failed", sc_str, scfile);
130 return ODS_STATUS_MALLOC_ERR;
141 return ODS_STATUS_OK;
143 ods_log_error(
"[%s] unable to read signconf: failed to open file %s",
145 return ODS_STATUS_ERR;
155 time_t last_modified)
159 ods_status status = ODS_STATUS_OK;
161 if (!scfile || !signconf) {
162 return ODS_STATUS_UNCHANGED;
165 st_mtime = ods_file_lastmodified(scfile);
166 if (st_mtime <= last_modified) {
167 return ODS_STATUS_UNCHANGED;
172 ods_log_error(
"[%s] unable to update signconf: signconf_create() " 174 return ODS_STATUS_ERR;
176 status = signconf_read(new_sc, scfile);
177 if (status == ODS_STATUS_OK) {
180 ods_log_error(
"[%s] unable to update signconf: signconf %s has " 181 "errors", sc_str, scfile);
183 return ODS_STATUS_CFG_ERR;
187 ods_log_error(
"[%s] unable to update signconf: failed to read file " 188 "%s (%s)", sc_str, scfile, ods_status2str(status));
200 signconf_backup_duration(FILE* fd,
const char* opt, duration_type* duration)
202 char* str = (duration == NULL ? NULL : duration2string(duration));
203 fprintf(fd,
"%s %s ", opt, (str?str:
"0"));
219 fprintf(fd,
";;Signconf: lastmod %u ", (
unsigned) sc->
last_modified);
220 if (strcmp(version, ODS_SE_FILE_MAGIC_V2) &&
221 strcmp(version, ODS_SE_FILE_MAGIC_V1)) {
223 fprintf(fd,
"maxzonettl 0 ");
230 signconf_backup_duration(fd,
"jitter", sc->
sig_jitter);
232 fprintf(fd,
"nsec %u ", (
unsigned) sc->
nsec_type);
233 signconf_backup_duration(fd,
"dnskeyttl", sc->
dnskey_ttl);
234 signconf_backup_duration(fd,
"soattl", sc->
soa_ttl);
235 signconf_backup_duration(fd,
"soamin", sc->
soa_min);
237 if (strcmp(version, ODS_SE_FILE_MAGIC_V2) == 0) {
238 fprintf(fd,
"audit 0");
249 signconf_soa_serial_check(
const char* serial) {
254 if (strlen(serial) == 4 && strncmp(serial,
"keep", 4) == 0) {
257 if (strlen(serial) == 7 && strncmp(serial,
"counter", 7) == 0) {
260 if (strlen(serial) == 8 && strncmp(serial,
"unixtime", 8) == 0) {
263 if (strlen(serial) == 11 && strncmp(serial,
"datecounter", 11) == 0) {
277 ods_status status = ODS_STATUS_OK;
280 ods_log_error(
"[%s] check failed: no signature resign interval found",
282 status = ODS_STATUS_CFG_ERR;
285 ods_log_error(
"[%s] check failed: no signature resign interval found",
287 status = ODS_STATUS_CFG_ERR;
290 ods_log_error(
"[%s] check failed: no signature default validity found",
292 status = ODS_STATUS_CFG_ERR;
295 ods_log_error(
"[%s] check failed: no signature denial validity found",
297 status = ODS_STATUS_CFG_ERR;
300 ods_log_error(
"[%s] check failed: no signature jitter found", sc_str);
301 status = ODS_STATUS_CFG_ERR;
304 ods_log_error(
"[%s] check failed: no signature inception offset found",
306 status = ODS_STATUS_CFG_ERR;
308 if (sc->
nsec_type == LDNS_RR_TYPE_NSEC3) {
310 ods_log_error(
"[%s] check failed: invalid nsec3 algorithm",
312 status = ODS_STATUS_CFG_ERR;
317 }
else if (sc->
nsec_type != LDNS_RR_TYPE_NSEC) {
318 ods_log_error(
"[%s] check failed: wrong nsec type %i", sc_str,
320 status = ODS_STATUS_CFG_ERR;
323 ods_log_error(
"[%s] check failed: no keys found", sc_str);
324 status = ODS_STATUS_CFG_ERR;
327 ods_log_error(
"[%s] check failed: no dnskey ttl found", sc_str);
328 status = ODS_STATUS_CFG_ERR;
331 ods_log_error(
"[%s] check failed: no soa ttl found", sc_str);
332 status = ODS_STATUS_CFG_ERR;
335 ods_log_error(
"[%s] check failed: no soa minimum found", sc_str);
336 status = ODS_STATUS_CFG_ERR;
339 ods_log_error(
"[%s] check failed: no soa serial type found", sc_str);
340 status = ODS_STATUS_CFG_ERR;
341 }
else if (signconf_soa_serial_check(sc->
soa_serial) != 0) {
342 ods_log_error(
"[%s] check failed: wrong soa serial type %s", sc_str,
344 status = ODS_STATUS_CFG_ERR;
357 task_id new_task = TASK_NONE;
365 new_task = TASK_NSECIFY;
367 new_task = TASK_NSECIFY;
368 }
else if (a->
nsec_type == LDNS_RR_TYPE_NSEC3) {
374 new_task = TASK_NSECIFY;
376 new_task = TASK_READ;
391 char* refresh = NULL;
392 char* validity = NULL;
397 char* dnskeyttl = NULL;
400 char* paramttl = NULL;
414 soattl = duration2string(sc->
soa_ttl);
415 soamin = duration2string(sc->
soa_min);
417 ods_log_info(
"[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] " 418 "%sVALIDITY[%s] DENIAL[%s] KEYSET[%s] JITTER[%s] OFFSET[%s] NSEC[%i] " 419 "DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s]",
422 resign?resign:
"(null)",
423 refresh?refresh:
"(null)",
425 validity?validity:
"(null)",
426 denial?denial:
"(null)",
427 keyset?keyset:
"(null)",
428 jitter?jitter:
"(null)",
429 offset?offset:
"(null)",
431 dnskeyttl?dnskeyttl:
"(null)",
432 soattl?soattl:
"(null)",
433 soamin?soamin:
"(null)",
436 if (sc->
nsec_type == LDNS_RR_TYPE_NSEC3) {
437 ods_log_debug(
"[%s] zone %s nsec3: PARAMTTL[%s] OPTOUT[%i] " 438 "ALGORITHM[%u] ITERATIONS[%u] SALT[%s]",
441 paramttl?paramttl:
"PT0S",
451 free((
void*)refresh);
452 free((
void*)validity);
457 free((
void*)dnskeyttl);
458 free((
void*)paramttl);
signconf_type * signconf_create(void)
void keylist_cleanup(keylist_type *kl)
duration_type * parse_sc_sig_validity_default(const char *cfgfile)
uint32_t nsec3_iterations
duration_type * parse_sc_sig_validity_denial(const char *cfgfile)
duration_type * sig_inception_offset
task_id signconf_compare_denial(signconf_type *a, signconf_type *b)
uint32_t parse_sc_nsec3_algorithm(const char *cfgfile)
void signconf_backup(FILE *fd, signconf_type *sc, const char *version)
void keylist_log(keylist_type *kl, const char *name)
duration_type * parse_sc_soa_ttl(const char *cfgfile)
ods_status signconf_check(signconf_type *sc)
duration_type * sig_validity_default
void signconf_cleanup(signconf_type *sc)
duration_type * sig_validity_denial
duration_type * nsec3param_ttl
ods_status parse_file_check(const char *cfgfile, const char *rngfile)
duration_type * parse_sc_sig_inception_offset(const char *cfgfile)
const char * parse_sc_soa_serial(const char *cfgfile)
const char * parse_sc_nsec3_salt(const char *cfgfile)
duration_type * parse_sc_sig_validity_keyset(const char *cfgfile)
duration_type * parse_sc_dnskey_ttl(const char *cfgfile)
duration_type * parse_sc_sig_jitter(const char *cfgfile)
nsec3params_type * nsec3params_create(void *sc, uint8_t algo, uint8_t flags, uint16_t iter, const char *salt)
int parse_sc_passthrough(const char *cfgfile)
duration_type * sig_refresh_interval
duration_type * sig_validity_keyset
duration_type * parse_sc_max_zone_ttl(const char *cfgfile)
const char ** dnskey_signature
const char ** parse_sc_dnskey_sigrrs(const char *cfgfile)
duration_type * max_zone_ttl
duration_type * parse_sc_nsec3param_ttl(const char *cfgfile)
duration_type * parse_sc_sig_refresh_interval(const char *cfgfile)
int parse_sc_nsec3_optout(const char *cfgfile)
duration_type * parse_sc_soa_min(const char *cfgfile)
nsec3params_type * nsec3params
keylist_type * parse_sc_keys(void *sc, const char *cfgfile)
duration_type * dnskey_ttl
void signconf_log(signconf_type *sc, const char *name)
duration_type * sig_jitter
duration_type * sig_resign_interval
ldns_rr_type parse_sc_nsec_type(const char *cfgfile)
void nsec3params_cleanup(nsec3params_type *nsec3params)
duration_type * parse_sc_sig_resign_interval(const char *cfgfile)
uint32_t parse_sc_nsec3_iterations(const char *cfgfile)
ods_status signconf_update(signconf_type **signconf, const char *scfile, time_t last_modified)