opendnssec-2.0.4/ 0000755 0001750 0001750 00000000000 13036124774 010666 5 0000000 0000000 opendnssec-2.0.4/config.guess 0000755 0001750 0001750 00000125644 13036124712 013132 0000000 0000000 #! /bin/sh
# Attempt to guess a canonical system name.
# Copyright 1992-2016 Free Software Foundation, Inc.
timestamp='2016-10-02'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see .
me=`echo "$0" | sed -e 's,.*/,,'`
usage="\
Usage: $0 [OPTION]
Output the configuration name of the system \`$me' is run on.
Operation modes:
-h, --help print this help, then exit
-t, --time-stamp print date of last modification, then exit
-v, --version print version number, then exit
Report bugs and patches to ."
version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
Copyright 1992-2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
help="
Try \`$me --help' for more information."
# Parse command line
while test $# -gt 0 ; do
case $1 in
--time-stamp | --time* | -t )
echo "$timestamp" ; exit ;;
--version | -v )
echo "$version" ; exit ;;
--help | --h* | -h )
echo "$usage"; exit ;;
-- ) # Stop option processing
shift; break ;;
- ) # Use stdin as input.
break ;;
-* )
echo "$me: invalid option $1$help" >&2
exit 1 ;;
* )
break ;;
esac
done
if test $# != 0; then
echo "$me: too many arguments$help" >&2
exit 1
fi
trap 'exit 1' 1 2 15
# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
# compiler to aid in system detection is discouraged as it requires
# temporary files to be created and, as you can see below, it is a
# headache to deal with in a portable fashion.
# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
# use `HOST_CC' if defined, but it is deprecated.
# Portable tmp directory creation inspired by the Autoconf team.
set_cc_for_build='
trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
: ${TMPDIR=/tmp} ;
{ tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
{ test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
{ tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
{ echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
dummy=$tmp/dummy ;
tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
case $CC_FOR_BUILD,$HOST_CC,$CC in
,,) echo "int x;" > $dummy.c ;
for c in cc gcc c89 c99 ; do
if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
CC_FOR_BUILD="$c"; break ;
fi ;
done ;
if test x"$CC_FOR_BUILD" = x ; then
CC_FOR_BUILD=no_compiler_found ;
fi
;;
,,*) CC_FOR_BUILD=$CC ;;
,*,*) CC_FOR_BUILD=$HOST_CC ;;
esac ; set_cc_for_build= ;'
# This is needed to find uname on a Pyramid OSx when run in the BSD universe.
# (ghazi@noc.rutgers.edu 1994-08-24)
if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
PATH=$PATH:/.attbin ; export PATH
fi
UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
case "${UNAME_SYSTEM}" in
Linux|GNU|GNU/*)
# If the system lacks a compiler, then just pick glibc.
# We could probably try harder.
LIBC=gnu
eval $set_cc_for_build
cat <<-EOF > $dummy.c
#include
#if defined(__UCLIBC__)
LIBC=uclibc
#elif defined(__dietlibc__)
LIBC=dietlibc
#else
LIBC=gnu
#endif
EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
;;
esac
# Note: order is significant - the case branches are not exclusive.
case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
*:NetBSD:*:*)
# NetBSD (nbsd) targets should (where applicable) match one or
# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
# *-*-netbsdecoff* and *-*-netbsd*. For targets that recently
# switched to ELF, *-*-netbsd* would select the old
# object file format. This provides both forward
# compatibility and a consistent mechanism for selecting the
# object file format.
#
# Note: NetBSD doesn't particularly care about the vendor
# portion of the name. We always set it to "unknown".
sysctl="sysctl -n hw.machine_arch"
UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
/sbin/$sysctl 2>/dev/null || \
/usr/sbin/$sysctl 2>/dev/null || \
echo unknown)`
case "${UNAME_MACHINE_ARCH}" in
armeb) machine=armeb-unknown ;;
arm*) machine=arm-unknown ;;
sh3el) machine=shl-unknown ;;
sh3eb) machine=sh-unknown ;;
sh5el) machine=sh5le-unknown ;;
earmv*)
arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'`
machine=${arch}${endian}-unknown
;;
*) machine=${UNAME_MACHINE_ARCH}-unknown ;;
esac
# The Operating System including object format, if it has switched
# to ELF recently (or will in the future) and ABI.
case "${UNAME_MACHINE_ARCH}" in
earm*)
os=netbsdelf
;;
arm*|i386|m68k|ns32k|sh3*|sparc|vax)
eval $set_cc_for_build
if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
| grep -q __ELF__
then
# Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
# Return netbsd for either. FIX?
os=netbsd
else
os=netbsdelf
fi
;;
*)
os=netbsd
;;
esac
# Determine ABI tags.
case "${UNAME_MACHINE_ARCH}" in
earm*)
expr='s/^earmv[0-9]/-eabi/;s/eb$//'
abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"`
;;
esac
# The OS release
# Debian GNU/NetBSD machines have a different userland, and
# thus, need a distinct triplet. However, they do not need
# kernel version information, so it can be replaced with a
# suitable tag, in the style of linux-gnu.
case "${UNAME_VERSION}" in
Debian*)
release='-gnu'
;;
*)
release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
;;
esac
# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
# contains redundant information, the shorter form:
# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
echo "${machine}-${os}${release}${abi}"
exit ;;
*:Bitrig:*:*)
UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
exit ;;
*:OpenBSD:*:*)
UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
exit ;;
*:LibertyBSD:*:*)
UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
exit ;;
*:ekkoBSD:*:*)
echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
exit ;;
*:SolidBSD:*:*)
echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
exit ;;
macppc:MirBSD:*:*)
echo powerpc-unknown-mirbsd${UNAME_RELEASE}
exit ;;
*:MirBSD:*:*)
echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
exit ;;
*:Sortix:*:*)
echo ${UNAME_MACHINE}-unknown-sortix
exit ;;
alpha:OSF1:*:*)
case $UNAME_RELEASE in
*4.0)
UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
;;
*5.*)
UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
;;
esac
# According to Compaq, /usr/sbin/psrinfo has been available on
# OSF/1 and Tru64 systems produced since 1995. I hope that
# covers most systems running today. This code pipes the CPU
# types through head -n 1, so we only detect the type of CPU 0.
ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1`
case "$ALPHA_CPU_TYPE" in
"EV4 (21064)")
UNAME_MACHINE=alpha ;;
"EV4.5 (21064)")
UNAME_MACHINE=alpha ;;
"LCA4 (21066/21068)")
UNAME_MACHINE=alpha ;;
"EV5 (21164)")
UNAME_MACHINE=alphaev5 ;;
"EV5.6 (21164A)")
UNAME_MACHINE=alphaev56 ;;
"EV5.6 (21164PC)")
UNAME_MACHINE=alphapca56 ;;
"EV5.7 (21164PC)")
UNAME_MACHINE=alphapca57 ;;
"EV6 (21264)")
UNAME_MACHINE=alphaev6 ;;
"EV6.7 (21264A)")
UNAME_MACHINE=alphaev67 ;;
"EV6.8CB (21264C)")
UNAME_MACHINE=alphaev68 ;;
"EV6.8AL (21264B)")
UNAME_MACHINE=alphaev68 ;;
"EV6.8CX (21264D)")
UNAME_MACHINE=alphaev68 ;;
"EV6.9A (21264/EV69A)")
UNAME_MACHINE=alphaev69 ;;
"EV7 (21364)")
UNAME_MACHINE=alphaev7 ;;
"EV7.9 (21364A)")
UNAME_MACHINE=alphaev79 ;;
esac
# A Pn.n version is a patched version.
# A Vn.n version is a released version.
# A Tn.n version is a released field test version.
# A Xn.n version is an unreleased experimental baselevel.
# 1.2 uses "1.2" for uname -r.
echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
exitcode=$?
trap '' 0
exit $exitcode ;;
Alpha\ *:Windows_NT*:*)
# How do we know it's Interix rather than the generic POSIX subsystem?
# Should we change UNAME_MACHINE based on the output of uname instead
# of the specific Alpha model?
echo alpha-pc-interix
exit ;;
21064:Windows_NT:50:3)
echo alpha-dec-winnt3.5
exit ;;
Amiga*:UNIX_System_V:4.0:*)
echo m68k-unknown-sysv4
exit ;;
*:[Aa]miga[Oo][Ss]:*:*)
echo ${UNAME_MACHINE}-unknown-amigaos
exit ;;
*:[Mm]orph[Oo][Ss]:*:*)
echo ${UNAME_MACHINE}-unknown-morphos
exit ;;
*:OS/390:*:*)
echo i370-ibm-openedition
exit ;;
*:z/VM:*:*)
echo s390-ibm-zvmoe
exit ;;
*:OS400:*:*)
echo powerpc-ibm-os400
exit ;;
arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
echo arm-acorn-riscix${UNAME_RELEASE}
exit ;;
arm*:riscos:*:*|arm*:RISCOS:*:*)
echo arm-unknown-riscos
exit ;;
SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
echo hppa1.1-hitachi-hiuxmpp
exit ;;
Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
if test "`(/bin/universe) 2>/dev/null`" = att ; then
echo pyramid-pyramid-sysv3
else
echo pyramid-pyramid-bsd
fi
exit ;;
NILE*:*:*:dcosx)
echo pyramid-pyramid-svr4
exit ;;
DRS?6000:unix:4.0:6*)
echo sparc-icl-nx6
exit ;;
DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
case `/usr/bin/uname -p` in
sparc) echo sparc-icl-nx7; exit ;;
esac ;;
s390x:SunOS:*:*)
echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
sun4H:SunOS:5.*:*)
echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
echo i386-pc-auroraux${UNAME_RELEASE}
exit ;;
i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
eval $set_cc_for_build
SUN_ARCH=i386
# If there is a compiler, see if it is configured for 64-bit objects.
# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
# This test works for both compilers.
if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
grep IS_64BIT_ARCH >/dev/null
then
SUN_ARCH=x86_64
fi
fi
echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
sun4*:SunOS:6*:*)
# According to config.sub, this is the proper way to canonicalize
# SunOS6. Hard to guess exactly what SunOS6 will be like, but
# it's likely to be more like Solaris than SunOS4.
echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
sun4*:SunOS:*:*)
case "`/usr/bin/arch -k`" in
Series*|S4*)
UNAME_RELEASE=`uname -v`
;;
esac
# Japanese Language versions have a version number like `4.1.3-JL'.
echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
exit ;;
sun3*:SunOS:*:*)
echo m68k-sun-sunos${UNAME_RELEASE}
exit ;;
sun*:*:4.2BSD:*)
UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
case "`/bin/arch`" in
sun3)
echo m68k-sun-sunos${UNAME_RELEASE}
;;
sun4)
echo sparc-sun-sunos${UNAME_RELEASE}
;;
esac
exit ;;
aushp:SunOS:*:*)
echo sparc-auspex-sunos${UNAME_RELEASE}
exit ;;
# The situation for MiNT is a little confusing. The machine name
# can be virtually everything (everything which is not
# "atarist" or "atariste" at least should have a processor
# > m68000). The system name ranges from "MiNT" over "FreeMiNT"
# to the lowercase version "mint" (or "freemint"). Finally
# the system name "TOS" denotes a system which is actually not
# MiNT. But MiNT is downward compatible to TOS, so this should
# be no problem.
atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
echo m68k-atari-mint${UNAME_RELEASE}
exit ;;
atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
echo m68k-atari-mint${UNAME_RELEASE}
exit ;;
*falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
echo m68k-atari-mint${UNAME_RELEASE}
exit ;;
milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
echo m68k-milan-mint${UNAME_RELEASE}
exit ;;
hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
echo m68k-hades-mint${UNAME_RELEASE}
exit ;;
*:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
echo m68k-unknown-mint${UNAME_RELEASE}
exit ;;
m68k:machten:*:*)
echo m68k-apple-machten${UNAME_RELEASE}
exit ;;
powerpc:machten:*:*)
echo powerpc-apple-machten${UNAME_RELEASE}
exit ;;
RISC*:Mach:*:*)
echo mips-dec-mach_bsd4.3
exit ;;
RISC*:ULTRIX:*:*)
echo mips-dec-ultrix${UNAME_RELEASE}
exit ;;
VAX*:ULTRIX*:*:*)
echo vax-dec-ultrix${UNAME_RELEASE}
exit ;;
2020:CLIX:*:* | 2430:CLIX:*:*)
echo clipper-intergraph-clix${UNAME_RELEASE}
exit ;;
mips:*:*:UMIPS | mips:*:*:RISCos)
eval $set_cc_for_build
sed 's/^ //' << EOF >$dummy.c
#ifdef __cplusplus
#include /* for printf() prototype */
int main (int argc, char *argv[]) {
#else
int main (argc, argv) int argc; char *argv[]; {
#endif
#if defined (host_mips) && defined (MIPSEB)
#if defined (SYSTYPE_SYSV)
printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
#endif
#if defined (SYSTYPE_SVR4)
printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
#endif
#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
#endif
#endif
exit (-1);
}
EOF
$CC_FOR_BUILD -o $dummy $dummy.c &&
dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
SYSTEM_NAME=`$dummy $dummyarg` &&
{ echo "$SYSTEM_NAME"; exit; }
echo mips-mips-riscos${UNAME_RELEASE}
exit ;;
Motorola:PowerMAX_OS:*:*)
echo powerpc-motorola-powermax
exit ;;
Motorola:*:4.3:PL8-*)
echo powerpc-harris-powermax
exit ;;
Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
echo powerpc-harris-powermax
exit ;;
Night_Hawk:Power_UNIX:*:*)
echo powerpc-harris-powerunix
exit ;;
m88k:CX/UX:7*:*)
echo m88k-harris-cxux7
exit ;;
m88k:*:4*:R4*)
echo m88k-motorola-sysv4
exit ;;
m88k:*:3*:R3*)
echo m88k-motorola-sysv3
exit ;;
AViiON:dgux:*:*)
# DG/UX returns AViiON for all architectures
UNAME_PROCESSOR=`/usr/bin/uname -p`
if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
then
if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
[ ${TARGET_BINARY_INTERFACE}x = x ]
then
echo m88k-dg-dgux${UNAME_RELEASE}
else
echo m88k-dg-dguxbcs${UNAME_RELEASE}
fi
else
echo i586-dg-dgux${UNAME_RELEASE}
fi
exit ;;
M88*:DolphinOS:*:*) # DolphinOS (SVR3)
echo m88k-dolphin-sysv3
exit ;;
M88*:*:R3*:*)
# Delta 88k system running SVR3
echo m88k-motorola-sysv3
exit ;;
XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
echo m88k-tektronix-sysv3
exit ;;
Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
echo m68k-tektronix-bsd
exit ;;
*:IRIX*:*:*)
echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
exit ;;
????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id
exit ;; # Note that: echo "'`uname -s`'" gives 'AIX '
i*86:AIX:*:*)
echo i386-ibm-aix
exit ;;
ia64:AIX:*:*)
if [ -x /usr/bin/oslevel ] ; then
IBM_REV=`/usr/bin/oslevel`
else
IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
fi
echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
exit ;;
*:AIX:2:3)
if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
eval $set_cc_for_build
sed 's/^ //' << EOF >$dummy.c
#include
main()
{
if (!__power_pc())
exit(1);
puts("powerpc-ibm-aix3.2.5");
exit(0);
}
EOF
if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
then
echo "$SYSTEM_NAME"
else
echo rs6000-ibm-aix3.2.5
fi
elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
echo rs6000-ibm-aix3.2.4
else
echo rs6000-ibm-aix3.2
fi
exit ;;
*:AIX:*:[4567])
IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
IBM_ARCH=rs6000
else
IBM_ARCH=powerpc
fi
if [ -x /usr/bin/lslpp ] ; then
IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc |
awk -F: '{ print $3 }' | sed s/[0-9]*$/0/`
else
IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
fi
echo ${IBM_ARCH}-ibm-aix${IBM_REV}
exit ;;
*:AIX:*:*)
echo rs6000-ibm-aix
exit ;;
ibmrt:4.4BSD:*|romp-ibm:BSD:*)
echo romp-ibm-bsd4.4
exit ;;
ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and
echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to
exit ;; # report: romp-ibm BSD 4.3
*:BOSX:*:*)
echo rs6000-bull-bosx
exit ;;
DPX/2?00:B.O.S.:*:*)
echo m68k-bull-sysv3
exit ;;
9000/[34]??:4.3bsd:1.*:*)
echo m68k-hp-bsd
exit ;;
hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
echo m68k-hp-bsd4.4
exit ;;
9000/[34678]??:HP-UX:*:*)
HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
case "${UNAME_MACHINE}" in
9000/31? ) HP_ARCH=m68000 ;;
9000/[34]?? ) HP_ARCH=m68k ;;
9000/[678][0-9][0-9])
if [ -x /usr/bin/getconf ]; then
sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
case "${sc_cpu_version}" in
523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
532) # CPU_PA_RISC2_0
case "${sc_kernel_bits}" in
32) HP_ARCH=hppa2.0n ;;
64) HP_ARCH=hppa2.0w ;;
'') HP_ARCH=hppa2.0 ;; # HP-UX 10.20
esac ;;
esac
fi
if [ "${HP_ARCH}" = "" ]; then
eval $set_cc_for_build
sed 's/^ //' << EOF >$dummy.c
#define _HPUX_SOURCE
#include
#include
int main ()
{
#if defined(_SC_KERNEL_BITS)
long bits = sysconf(_SC_KERNEL_BITS);
#endif
long cpu = sysconf (_SC_CPU_VERSION);
switch (cpu)
{
case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
case CPU_PA_RISC2_0:
#if defined(_SC_KERNEL_BITS)
switch (bits)
{
case 64: puts ("hppa2.0w"); break;
case 32: puts ("hppa2.0n"); break;
default: puts ("hppa2.0"); break;
} break;
#else /* !defined(_SC_KERNEL_BITS) */
puts ("hppa2.0"); break;
#endif
default: puts ("hppa1.0"); break;
}
exit (0);
}
EOF
(CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
test -z "$HP_ARCH" && HP_ARCH=hppa
fi ;;
esac
if [ ${HP_ARCH} = hppa2.0w ]
then
eval $set_cc_for_build
# hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
# 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler
# generating 64-bit code. GNU and HP use different nomenclature:
#
# $ CC_FOR_BUILD=cc ./config.guess
# => hppa2.0w-hp-hpux11.23
# $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
# => hppa64-hp-hpux11.23
if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) |
grep -q __LP64__
then
HP_ARCH=hppa2.0w
else
HP_ARCH=hppa64
fi
fi
echo ${HP_ARCH}-hp-hpux${HPUX_REV}
exit ;;
ia64:HP-UX:*:*)
HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
echo ia64-hp-hpux${HPUX_REV}
exit ;;
3050*:HI-UX:*:*)
eval $set_cc_for_build
sed 's/^ //' << EOF >$dummy.c
#include
int
main ()
{
long cpu = sysconf (_SC_CPU_VERSION);
/* The order matters, because CPU_IS_HP_MC68K erroneously returns
true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct
results, however. */
if (CPU_IS_PA_RISC (cpu))
{
switch (cpu)
{
case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break;
case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break;
case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break;
default: puts ("hppa-hitachi-hiuxwe2"); break;
}
}
else if (CPU_IS_HP_MC68K (cpu))
puts ("m68k-hitachi-hiuxwe2");
else puts ("unknown-hitachi-hiuxwe2");
exit (0);
}
EOF
$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
{ echo "$SYSTEM_NAME"; exit; }
echo unknown-hitachi-hiuxwe2
exit ;;
9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
echo hppa1.1-hp-bsd
exit ;;
9000/8??:4.3bsd:*:*)
echo hppa1.0-hp-bsd
exit ;;
*9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
echo hppa1.0-hp-mpeix
exit ;;
hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
echo hppa1.1-hp-osf
exit ;;
hp8??:OSF1:*:*)
echo hppa1.0-hp-osf
exit ;;
i*86:OSF1:*:*)
if [ -x /usr/sbin/sysversion ] ; then
echo ${UNAME_MACHINE}-unknown-osf1mk
else
echo ${UNAME_MACHINE}-unknown-osf1
fi
exit ;;
parisc*:Lites*:*:*)
echo hppa1.1-hp-lites
exit ;;
C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
echo c1-convex-bsd
exit ;;
C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
if getsysinfo -f scalar_acc
then echo c32-convex-bsd
else echo c2-convex-bsd
fi
exit ;;
C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
echo c34-convex-bsd
exit ;;
C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
echo c38-convex-bsd
exit ;;
C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
echo c4-convex-bsd
exit ;;
CRAY*Y-MP:*:*:*)
echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
CRAY*[A-Z]90:*:*:*)
echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
-e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
-e 's/\.[^.]*$/.X/'
exit ;;
CRAY*TS:*:*:*)
echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
CRAY*T3E:*:*:*)
echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
CRAY*SV1:*:*:*)
echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
*:UNICOS/mp:*:*)
echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
exit ;;
F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
exit ;;
5000:UNIX_System_V:4.*:*)
FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
exit ;;
i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
exit ;;
sparc*:BSD/OS:*:*)
echo sparc-unknown-bsdi${UNAME_RELEASE}
exit ;;
*:BSD/OS:*:*)
echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
exit ;;
*:FreeBSD:*:*)
UNAME_PROCESSOR=`/usr/bin/uname -p`
case ${UNAME_PROCESSOR} in
amd64)
echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
*)
echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
esac
exit ;;
i*:CYGWIN*:*)
echo ${UNAME_MACHINE}-pc-cygwin
exit ;;
*:MINGW64*:*)
echo ${UNAME_MACHINE}-pc-mingw64
exit ;;
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
*:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
# uname -m includes "-pc" on this system.
echo ${UNAME_MACHINE}-mingw32
exit ;;
i*:PW*:*)
echo ${UNAME_MACHINE}-pc-pw32
exit ;;
*:Interix*:*)
case ${UNAME_MACHINE} in
x86)
echo i586-pc-interix${UNAME_RELEASE}
exit ;;
authenticamd | genuineintel | EM64T)
echo x86_64-unknown-interix${UNAME_RELEASE}
exit ;;
IA64)
echo ia64-unknown-interix${UNAME_RELEASE}
exit ;;
esac ;;
[345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
echo i${UNAME_MACHINE}-pc-mks
exit ;;
8664:Windows_NT:*)
echo x86_64-pc-mks
exit ;;
i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
# How do we know it's Interix rather than the generic POSIX subsystem?
# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
# UNAME_MACHINE based on the output of uname instead of i386?
echo i586-pc-interix
exit ;;
i*:UWIN*:*)
echo ${UNAME_MACHINE}-pc-uwin
exit ;;
amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
echo x86_64-unknown-cygwin
exit ;;
p*:CYGWIN*:*)
echo powerpcle-unknown-cygwin
exit ;;
prep*:SunOS:5.*:*)
echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
exit ;;
*:GNU:*:*)
# the GNU system
echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
exit ;;
*:GNU/*:*:*)
# other systems with GNU libc and userland
echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
exit ;;
i*86:Minix:*:*)
echo ${UNAME_MACHINE}-pc-minix
exit ;;
aarch64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
aarch64_be:Linux:*:*)
UNAME_MACHINE=aarch64_be
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
alpha:Linux:*:*)
case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
EV5) UNAME_MACHINE=alphaev5 ;;
EV56) UNAME_MACHINE=alphaev56 ;;
PCA56) UNAME_MACHINE=alphapca56 ;;
PCA57) UNAME_MACHINE=alphapca56 ;;
EV6) UNAME_MACHINE=alphaev6 ;;
EV67) UNAME_MACHINE=alphaev67 ;;
EV68*) UNAME_MACHINE=alphaev68 ;;
esac
objdump --private-headers /bin/sh | grep -q ld.so.1
if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
arc:Linux:*:* | arceb:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
arm*:Linux:*:*)
eval $set_cc_for_build
if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
| grep -q __ARM_EABI__
then
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
else
if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
| grep -q __ARM_PCS_VFP
then
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
else
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
fi
fi
exit ;;
avr32*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
cris:Linux:*:*)
echo ${UNAME_MACHINE}-axis-linux-${LIBC}
exit ;;
crisv32:Linux:*:*)
echo ${UNAME_MACHINE}-axis-linux-${LIBC}
exit ;;
e2k:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
frv:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
hexagon:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
i*86:Linux:*:*)
echo ${UNAME_MACHINE}-pc-linux-${LIBC}
exit ;;
ia64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
k1om:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
m32r*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
m68*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
mips:Linux:*:* | mips64:Linux:*:*)
eval $set_cc_for_build
sed 's/^ //' << EOF >$dummy.c
#undef CPU
#undef ${UNAME_MACHINE}
#undef ${UNAME_MACHINE}el
#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
CPU=${UNAME_MACHINE}el
#else
#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
CPU=${UNAME_MACHINE}
#else
CPU=
#endif
#endif
EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
mips64el:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
openrisc*:Linux:*:*)
echo or1k-unknown-linux-${LIBC}
exit ;;
or32:Linux:*:* | or1k*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
echo sparc-unknown-linux-${LIBC}
exit ;;
parisc64:Linux:*:* | hppa64:Linux:*:*)
echo hppa64-unknown-linux-${LIBC}
exit ;;
parisc:Linux:*:* | hppa:Linux:*:*)
# Look for CPU level
case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
*) echo hppa-unknown-linux-${LIBC} ;;
esac
exit ;;
ppc64:Linux:*:*)
echo powerpc64-unknown-linux-${LIBC}
exit ;;
ppc:Linux:*:*)
echo powerpc-unknown-linux-${LIBC}
exit ;;
ppc64le:Linux:*:*)
echo powerpc64le-unknown-linux-${LIBC}
exit ;;
ppcle:Linux:*:*)
echo powerpcle-unknown-linux-${LIBC}
exit ;;
riscv32:Linux:*:* | riscv64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
s390:Linux:*:* | s390x:Linux:*:*)
echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
exit ;;
sh64*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
sh*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
sparc:Linux:*:* | sparc64:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
tile*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
vax:Linux:*:*)
echo ${UNAME_MACHINE}-dec-linux-${LIBC}
exit ;;
x86_64:Linux:*:*)
echo ${UNAME_MACHINE}-pc-linux-${LIBC}
exit ;;
xtensa*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
i*86:DYNIX/ptx:4*:*)
# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
# earlier versions are messed up and put the nodename in both
# sysname and nodename.
echo i386-sequent-sysv4
exit ;;
i*86:UNIX_SV:4.2MP:2.*)
# Unixware is an offshoot of SVR4, but it has its own version
# number series starting with 2...
# I am not positive that other SVR4 systems won't match this,
# I just have to hope. -- rms.
# Use sysv4.2uw... so that sysv4* matches it.
echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
exit ;;
i*86:OS/2:*:*)
# If we were able to find `uname', then EMX Unix compatibility
# is probably installed.
echo ${UNAME_MACHINE}-pc-os2-emx
exit ;;
i*86:XTS-300:*:STOP)
echo ${UNAME_MACHINE}-unknown-stop
exit ;;
i*86:atheos:*:*)
echo ${UNAME_MACHINE}-unknown-atheos
exit ;;
i*86:syllable:*:*)
echo ${UNAME_MACHINE}-pc-syllable
exit ;;
i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
echo i386-unknown-lynxos${UNAME_RELEASE}
exit ;;
i*86:*DOS:*:*)
echo ${UNAME_MACHINE}-pc-msdosdjgpp
exit ;;
i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
else
echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
fi
exit ;;
i*86:*:5:[678]*)
# UnixWare 7.x, OpenUNIX and OpenServer 6.
case `/bin/uname -X | grep "^Machine"` in
*486*) UNAME_MACHINE=i486 ;;
*Pentium) UNAME_MACHINE=i586 ;;
*Pent*|*Celeron) UNAME_MACHINE=i686 ;;
esac
echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
exit ;;
i*86:*:3.2:*)
if test -f /usr/options/cb.name; then
UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then
UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
&& UNAME_MACHINE=i586
(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
&& UNAME_MACHINE=i686
(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
&& UNAME_MACHINE=i686
echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
else
echo ${UNAME_MACHINE}-pc-sysv32
fi
exit ;;
pc:*:*:*)
# Left here for compatibility:
# uname -m prints for DJGPP always 'pc', but it prints nothing about
# the processor, so we play safe by assuming i586.
# Note: whatever this is, it MUST be the same as what config.sub
# prints for the "djgpp" host, or else GDB configure will decide that
# this is a cross-build.
echo i586-pc-msdosdjgpp
exit ;;
Intel:Mach:3*:*)
echo i386-pc-mach3
exit ;;
paragon:*:*:*)
echo i860-intel-osf1
exit ;;
i860:*:4.*:*) # i860-SVR4
if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
else # Add other i860-SVR4 vendors below as they are discovered.
echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4
fi
exit ;;
mini*:CTIX:SYS*5:*)
# "miniframe"
echo m68010-convergent-sysv
exit ;;
mc68k:UNIX:SYSTEM5:3.51m)
echo m68k-convergent-sysv
exit ;;
M680?0:D-NIX:5.3:*)
echo m68k-diab-dnix
exit ;;
M68*:*:R3V[5678]*:*)
test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
OS_REL=''
test -r /etc/.relid \
&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
&& { echo i486-ncr-sysv4.3${OS_REL}; exit; }
/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
&& { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
&& { echo i486-ncr-sysv4; exit; } ;;
NCR*:*:4.2:* | MPRAS*:*:4.2:*)
OS_REL='.3'
test -r /etc/.relid \
&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
&& { echo i486-ncr-sysv4.3${OS_REL}; exit; }
/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
&& { echo i586-ncr-sysv4.3${OS_REL}; exit; }
/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
&& { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
echo m68k-unknown-lynxos${UNAME_RELEASE}
exit ;;
mc68030:UNIX_System_V:4.*:*)
echo m68k-atari-sysv4
exit ;;
TSUNAMI:LynxOS:2.*:*)
echo sparc-unknown-lynxos${UNAME_RELEASE}
exit ;;
rs6000:LynxOS:2.*:*)
echo rs6000-unknown-lynxos${UNAME_RELEASE}
exit ;;
PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
echo powerpc-unknown-lynxos${UNAME_RELEASE}
exit ;;
SM[BE]S:UNIX_SV:*:*)
echo mips-dde-sysv${UNAME_RELEASE}
exit ;;
RM*:ReliantUNIX-*:*:*)
echo mips-sni-sysv4
exit ;;
RM*:SINIX-*:*:*)
echo mips-sni-sysv4
exit ;;
*:SINIX-*:*:*)
if uname -p 2>/dev/null >/dev/null ; then
UNAME_MACHINE=`(uname -p) 2>/dev/null`
echo ${UNAME_MACHINE}-sni-sysv4
else
echo ns32k-sni-sysv
fi
exit ;;
PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
# says
echo i586-unisys-sysv4
exit ;;
*:UNIX_System_V:4*:FTX*)
# From Gerald Hewes .
# How about differentiating between stratus architectures? -djm
echo hppa1.1-stratus-sysv4
exit ;;
*:*:*:FTX*)
# From seanf@swdc.stratus.com.
echo i860-stratus-sysv4
exit ;;
i*86:VOS:*:*)
# From Paul.Green@stratus.com.
echo ${UNAME_MACHINE}-stratus-vos
exit ;;
*:VOS:*:*)
# From Paul.Green@stratus.com.
echo hppa1.1-stratus-vos
exit ;;
mc68*:A/UX:*:*)
echo m68k-apple-aux${UNAME_RELEASE}
exit ;;
news*:NEWS-OS:6*:*)
echo mips-sony-newsos6
exit ;;
R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
if [ -d /usr/nec ]; then
echo mips-nec-sysv${UNAME_RELEASE}
else
echo mips-unknown-sysv${UNAME_RELEASE}
fi
exit ;;
BeBox:BeOS:*:*) # BeOS running on hardware made by Be, PPC only.
echo powerpc-be-beos
exit ;;
BeMac:BeOS:*:*) # BeOS running on Mac or Mac clone, PPC only.
echo powerpc-apple-beos
exit ;;
BePC:BeOS:*:*) # BeOS running on Intel PC compatible.
echo i586-pc-beos
exit ;;
BePC:Haiku:*:*) # Haiku running on Intel PC compatible.
echo i586-pc-haiku
exit ;;
x86_64:Haiku:*:*)
echo x86_64-unknown-haiku
exit ;;
SX-4:SUPER-UX:*:*)
echo sx4-nec-superux${UNAME_RELEASE}
exit ;;
SX-5:SUPER-UX:*:*)
echo sx5-nec-superux${UNAME_RELEASE}
exit ;;
SX-6:SUPER-UX:*:*)
echo sx6-nec-superux${UNAME_RELEASE}
exit ;;
SX-7:SUPER-UX:*:*)
echo sx7-nec-superux${UNAME_RELEASE}
exit ;;
SX-8:SUPER-UX:*:*)
echo sx8-nec-superux${UNAME_RELEASE}
exit ;;
SX-8R:SUPER-UX:*:*)
echo sx8r-nec-superux${UNAME_RELEASE}
exit ;;
SX-ACE:SUPER-UX:*:*)
echo sxace-nec-superux${UNAME_RELEASE}
exit ;;
Power*:Rhapsody:*:*)
echo powerpc-apple-rhapsody${UNAME_RELEASE}
exit ;;
*:Rhapsody:*:*)
echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
exit ;;
*:Darwin:*:*)
UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
eval $set_cc_for_build
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
grep IS_64BIT_ARCH >/dev/null
then
case $UNAME_PROCESSOR in
i386) UNAME_PROCESSOR=x86_64 ;;
powerpc) UNAME_PROCESSOR=powerpc64 ;;
esac
fi
fi
elif test "$UNAME_PROCESSOR" = i386 ; then
# Avoid executing cc on OS X 10.9, as it ships with a stub
# that puts up a graphical alert prompting to install
# developer tools. Any system running Mac OS X 10.7 or
# later (Darwin 11 and later) is required to have a 64-bit
# processor. This is not true of the ARM version of Darwin
# that Apple uses in portable devices.
UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
*:procnto*:*:* | *:QNX:[0123456789]*:*)
UNAME_PROCESSOR=`uname -p`
if test "$UNAME_PROCESSOR" = x86; then
UNAME_PROCESSOR=i386
UNAME_MACHINE=pc
fi
echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
exit ;;
*:QNX:*:4*)
echo i386-pc-qnx
exit ;;
NEO-?:NONSTOP_KERNEL:*:*)
echo neo-tandem-nsk${UNAME_RELEASE}
exit ;;
NSE-*:NONSTOP_KERNEL:*:*)
echo nse-tandem-nsk${UNAME_RELEASE}
exit ;;
NSR-?:NONSTOP_KERNEL:*:*)
echo nsr-tandem-nsk${UNAME_RELEASE}
exit ;;
*:NonStop-UX:*:*)
echo mips-compaq-nonstopux
exit ;;
BS2000:POSIX*:*:*)
echo bs2000-siemens-sysv
exit ;;
DS/*:UNIX_System_V:*:*)
echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
exit ;;
*:Plan9:*:*)
# "uname -m" is not consistent, so use $cputype instead. 386
# is converted to i386 for consistency with other x86
# operating systems.
if test "$cputype" = 386; then
UNAME_MACHINE=i386
else
UNAME_MACHINE="$cputype"
fi
echo ${UNAME_MACHINE}-unknown-plan9
exit ;;
*:TOPS-10:*:*)
echo pdp10-unknown-tops10
exit ;;
*:TENEX:*:*)
echo pdp10-unknown-tenex
exit ;;
KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
echo pdp10-dec-tops20
exit ;;
XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
echo pdp10-xkl-tops20
exit ;;
*:TOPS-20:*:*)
echo pdp10-unknown-tops20
exit ;;
*:ITS:*:*)
echo pdp10-unknown-its
exit ;;
SEI:*:*:SEIUX)
echo mips-sei-seiux${UNAME_RELEASE}
exit ;;
*:DragonFly:*:*)
echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
exit ;;
*:*VMS:*:*)
UNAME_MACHINE=`(uname -p) 2>/dev/null`
case "${UNAME_MACHINE}" in
A*) echo alpha-dec-vms ; exit ;;
I*) echo ia64-dec-vms ; exit ;;
V*) echo vax-dec-vms ; exit ;;
esac ;;
*:XENIX:*:SysV)
echo i386-pc-xenix
exit ;;
i*86:skyos:*:*)
echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
exit ;;
i*86:rdos:*:*)
echo ${UNAME_MACHINE}-pc-rdos
exit ;;
i*86:AROS:*:*)
echo ${UNAME_MACHINE}-pc-aros
exit ;;
x86_64:VMkernel:*:*)
echo ${UNAME_MACHINE}-unknown-esx
exit ;;
amd64:Isilon\ OneFS:*:*)
echo x86_64-unknown-onefs
exit ;;
esac
cat >&2 </dev/null || echo unknown`
uname -r = `(uname -r) 2>/dev/null || echo unknown`
uname -s = `(uname -s) 2>/dev/null || echo unknown`
uname -v = `(uname -v) 2>/dev/null || echo unknown`
/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null`
/bin/uname -X = `(/bin/uname -X) 2>/dev/null`
hostinfo = `(hostinfo) 2>/dev/null`
/bin/universe = `(/bin/universe) 2>/dev/null`
/usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null`
/bin/arch = `(/bin/arch) 2>/dev/null`
/usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null`
/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
UNAME_MACHINE = ${UNAME_MACHINE}
UNAME_RELEASE = ${UNAME_RELEASE}
UNAME_SYSTEM = ${UNAME_SYSTEM}
UNAME_VERSION = ${UNAME_VERSION}
EOF
exit 1
# Local variables:
# eval: (add-hook 'write-file-hooks 'time-stamp)
# time-stamp-start: "timestamp='"
# time-stamp-format: "%:y-%02m-%02d"
# time-stamp-end: "'"
# End:
opendnssec-2.0.4/NEWS 0000644 0001750 0001750 00000154514 13036124634 011312 0000000 0000000 OpenDNSSEC 2.0.4 - 2017-01-13
* Enforcer crash fix.
* OpenSSL 1.1 support.
OpenDNSSEC 2.0.3 - 2016-10-17
* OpenDNSSEC-839: update all no longer deletes zones or policies. Policy import
now has a --remove-missing-policies option. (thanks David Peall)
* OpenDNSSEC-840: Fix migration script to correcttly interpret SOA serial
strategy.
* OPENDNSSEC-843: MaxZoneTTL defaults to 0 instead of 1 day.
* Migration script can handle converting a database with zones in rollover better.
* Fixed incorrect behaviour when more than 2 ZSKs involved in roll.
* SUPPORT-201: Remove old keys from converted DB.
* OPENDNSSEC-845: Memory leak on IXFR out.
OpenDNSSEC 2.0.1 - 2016-07-21
* Fixed crash and linking issue in ods-migrate.
* Fixed case where 2.0.0 could not read backup files from 1.4.10.
* Fixed bug in migration script where key state wasn't transformed properly.
OpenDNSSEC 2.0.0-1
* include db creation scripts in dist tarball needed for migration from 1.4.
OpenDNSSEC 2.0.0
* OpenDNSSEC-99: Skip "are you sure" messages. Add --force and -f flag to
ods-enforcer-db-setup and hsmutil purge
* OPENDNSSEC-808: Crash on query with empty query section (thanks HÃ¥vard Eidnes)
* OpenDNSSEC-771: Signer. Do not log warning on deleting a missing
NSEC3PARAM RR.
* OPENDNSSEC-801: Set AA flag on outgoing AXFR.
* SUPPORT-191: Regression, Must accept notify without SOA (thanks Christos Trochalakis)
OpenDNSSEC 2.0b1 - 2016-04-14
First public release of OpenDNSSEC. Initial pre-releases have been
made to a smaller audience, this pre-release is explicitly made available
to all. At this moment, there are no known functional bugs. There are
naturally issues, especially to make working with OpenDNSSEC easier, however
none should prevent you to use OpenDNSSEC in production for the average
case, even though this is a pre-release. Which is because of the still
limited documentation, and is not being run in production yet.
* The enforcer can no longer be run on a single policy at a time
anymore. An enforce run will always process all zones.
* The key generate method is at this time not available.
* The key export method will not allow you to export keys for all zones
at once (--all flag) or for a particular type of key (--keystate).
It will not export ZSK keys.
* The zonelist.xml in etc/opendnssec is no longer updated automatically,
and by default works as if the --no-xml flag was specified. Use
--xml to the zone add command to update the zonelist.xml. If updating
the zonelist fails, the zone will still be added and not updated in
the xml with future zone adds.
* Plugins directory renamed to contrib.
* Default signer working directory renamed from tmp to signer.
* Configure option --with-database-backend renamed --with-enforcer-database
* Zones on a manual rollover policy will not get a key assigned to them
immediately.
OpenDNSSEC 2.0.0a5
Project transfer to NLnetLabs, performing code drop as-is for evaluation
purposes only.
OpenDNSSEC 2.0.0a4 (EnforcerNG branch)
* SUPPORT-72: Improve logging when failed to increment serial in case
of key rollover and serial value "keep" [OPENDNSSEC-461].
* SUPPORT-114: libhsm: Optimize storage in HSM by deleting the public
key directly if SkipPublicKey is used [OPENDNSSEC-573].
* OPENDNSSEC-106: Add 'ods-enforcerd -p ' option. This prompts the
enforcer to run once and only process the specified policy and associated
zones.
* OPENDNSSEC-330: NSEC3PARAM TTL can now be optionally configured in kasp.xml.
Default value remains PT0S.
* OPENDNSSEC-390: ods-ksmutil: Add an option to the 'ods-ksmutil key ds-seen'
command so the user can choose not to notify the enforcer.
* OPENDNSSEC-430: ods-ksmutil: Improve 'zone add' - Zone add command
could warn if a specified zone file or adapter file does not exits.
* OPENDNSSEC-431: ods-ksmutil: Improve 'zone add' - Support default values for DNS adapters.
* OPENDNSSEC-454: ods-ksmutil: Add option for 'ods-ksmutil key import' to
check if there is a matching key in the repository before import.
* OPENDNSSEC-281: Enforcer NG: Commandhandler sometimes unresponsive.
* OPENDNSSEC-276, Enforcer NG: HSM initialized after fork().
* OPENDNSSEC-330: Signer Engine: NSEC3PARAM TTL is default TTL again, to
prevent bad caching effects on resolvers.
* OPENDNSSEC-428: Add option for 'ods-ksmutil key generate' to take
number of zones as a parameter
* OPENDNSSEC-515: Signer Engine: Don't replace tabs in RR with whitespace.
Bugfixes:
* OPENDNSSEC-435: Signer Engine: Fix a serious memory leak in signature
cleanup.
* OPENDNSSEC-463: Signer Engine: Duration PT0S is now printed correctly.
* OPENDNSSEC-466: Signer Engine: Created bad TSIG signature when falling back
to AXFR.
* OPENDNSSEC-467: Signer Engine: After ods-signer clear, signer should not use
inbound serial.
OpenDNSSEC 2.0.0a3 (EnforcerNG branch) - 2012-06-18
Bugfixes:
* SUPPORT-66: Signer Engine: Fix file descriptor leak in case of TCP write
error [OPENDNSSEC-427].
* SUPPORT-71: Signer Engine: Fix double free crash in case of HSM connection
error during signing [OPENDNSSEC-444].
* OPENDNSSEC-401: 'ods-signer sign --serial ' command produces seg
fault when run directly on command line (i.e. not via interactive mode)
* OPENDNSSEC-440: 'ods-ksmutil key generate' and the enforcer can create
too many keys if there are keys already available and the KSK and ZSK use
same algorithm and length
* OPENDNSSEC-424: Signer Engine: Respond to SOA queries from file instead
of memory. Makes response non-blocking.
* OPENDNSSEC-425 Change "hsmutil list" output so that the table header goes
to stdout not stderr
* OPENDNSSEC-438: 'ods-ksmutil key generate' and the enforcer can create
too many keys for .
* Enforcer: MySQL database backend implemented.
* Enforcer: New directive to make safe assumptions about
zonefile.
* Enforcer: New zone add command, allow specifying adapters.
* Enforcer: New zone del command, use --force for still signed zones.
* Enforcer: Pre-generate keys on the HSM.
* Enforcer: SQLite database backend implemented.
OpenDNSSEC 2.0.0-trunk
* OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA
Minimum change.
Bugfixes:
* OPENDNSSEC-481: libhsm: Fix an off-by-one length check error.
* OPENDNSSEC-482: libhsm: Improved cleanup for C_FindObjects.
OpenDNSSEC 1.4.1 - 2013-06-27
* SUPPORT-58: Extend ods-signer sign with --serial so that the user
can specify the SOA serial to use in the signed zone [OPENDNSSEC-401].
* OPENDNSSEC-91: Make the keytype flag required when rolling keys
Bugfixes:
* SUPPORT-60: Fix datecounter in case inbound serial is higher than outbound
serial [OPENDNSSEC-420].
* OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA
Minimum change.
* OPENDNSSEC-421: Signer Engine: Fix assertion error in case NSEC3 hash
algorithm in signconf is not SHA1.
* OPENDNSSEC-421: ods-kaspcheck: Check whether NSEC3 hash algorithm in kasp
is valid.
* Bugfix: The time when inbound serial is acquired was reset invalidly,
could cause OpenDNSSEC wanting AXFR responses while requesting IXFR (thanks
Stuart Lau).
* Bugfix: Fix malform in Outbound IXFR/TCP subsequent packet (thanks Stuart
Lau).
* OPENDNSSEC-398: The ods-ksmutil key rollover command does not work correctly
when rolling all keys using the --policy option
OpenDNSSEC 1.4.0 - 2013-04-22
* Production release of 1.4
* Versioning scheme and release support policies updated
* Summary of changes in 1.4 can be found on the wiki:
http://wiki.opendnssec.org/display/DOCS
OpenDNSSEC 1.4.0rc3 - 2013-03-15
* Further testing of OPENDNSSEC-387 completed, release returned to rc status.
OpenDNSSEC 1.4.0b3 - 2013-02-20
Note: This release is marked as a beta release (rather than rc3) due to
OPENDNSSEC-387, which is a significant functional change compared to rc2.
* OPENDNSSEC-387: Rollback of multi-threaded enforcer. Due to key allocation
issues the usefulness of the threaded enforcer is outweighed by the code
complications. The option still remains in conf.xml for compatibility with
existing use; but it will now be silently ignored.
Bugfixes:
* OPENDNSSEC-183: Enforcer: If no DNSKEYs use negative TTL as TTL(DNSKEY).
* OPENDNSSEC-185: Enforcer: Used wrong value for negative caching.
* OPENDNSSEC-206: Enforcer: Notify Signer on generating new signer
configuration.
* OPENDNSSEC-224: Enforcer: Fix rolling simultaneous keys.
(e.g. emergency roll)
* OPENDNSSEC-271: Enforcer: Signer configurations w/o keys are now accepted.
* Enforcer: Handle cases where negative cache > positive cache.
* Enforcer: Take resign interval into account when signer does smooth
rollover.
* OPENDNSSEC-388: Signer Engine: Internal serial should take into account
the inbound serial.
* SUPPORT-50/51: Signer Engine: Inbound DNS Adapter incorrectly updates
NSEC3PARAM and DNSKEY RRset [OPENDNSSEC-389]
* OPENDNSSEC-389: Input DNS Adapter incorrectly updating NSEC3PARAM and DNSKEY RRsets
Known Issues:
* Enforcer: Key material not always reused when using .
* Enforcer: Lacking documentation.
* Enforcer: No migration tools.
OpenDNSSEC EnforcerNG branch alpha2 - 2011-10-18
* Enforcer: Automatic introduce keys marked as manual, like other enforcer.
* Enforcer: Automatically retract never submitted DS records.
* Enforcer: CSK is now configurable.
* Enforcer: Do not allow lifetime of key to be shorter than TTL.
* Enforcer: Support for RollOverType in kasp.xml
Bugfixes:
* Enforcer: Fixed concurrency related crashes.
* Enforcer: Remove some scheduling when waiting for user input.
* Enforcer: Schedule the purging of keys.
OpenDNSSEC EnforcerNG branch alpha1 - 2011-09-23
HIGH-LEVEL DESIGN GOALS:
* Support for a large number of zones. The enforcer should reasonably be
useable with many zones. Think order of magnitude 50.000 concurrent zones.
* Allow for future rollover strategies. Provide a generic framework to
implement other kinds of rollovers in the future.
* Drop in replacement. Should replace the current enforcer but keep the same
interface and provide migration scripts from earlier installs.
Trunk
Bugfixes:
OpenDNSSEC 1.4.0rc2 - 2013-01-25
* OPENDNSSEC-350: Signer Engine: Better log message when IXFR is not ready for
reading.
* OPENDNSSEC-367: ods-ksmutil: Require user confirmation if the algorithm for
a key is changed in a policy (as this rollover is not handled cleanly)
Bugfixes:
* SUPPORT-44: Signer Engine: Drop privileges after binding to socket
[OPENDNSSEC-364].
* Signer Engine: XFR not ready should not be a fatal status for task read
(thanks Ville Mattila).
* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired.
OpenDNSSEC 1.4.0rc1 - 2013-01-10
* OPENDNSSEC-359: Remove eppclient
OpenDNSSEC 1.4.0b2 - 2012-12-17
* OPENDNSSEC-292: Provide scripts to convert database between different
supported formats
* OPENDNSSEC-299: ods-ksmutil: ods-ksmutil now includes policy import
* OPENDNSSEC-300: ods-ksmutil: policy purge documented with a warning
* OPENDNSSEC-315: "ods-hsmutil logout" will delete any credentials in the
shared memory.
* OPENDNSSEC-330: Signer Engine: NSEC3PARAM TTL should be set to zero.
* OPENDNSSEC-338: ods-ksmutil: fix zone delete on MySQL (broken by SUPPORT-27)
* OPENDNSSEC-345: ods-ksmutil: use ods-control to HUP the enforcerd process
* ods-ksmutil: Deprecate the one-step key backup command
Bugfixes:
* SUPPORT-40: Signer Engine: Keep occluded data in signed zone files/transfers.
* OPENDNSSEC-349: Enforcer: Fix some memory leaks in the enforcer found by
valgrind.
* OPENDNSSEC-353: Signer Engine: Add/remove NSEC3s for empty non-terminals
between apex and delegation when DS is added/removed.
* Signer Engine: Fixed locking and notification on the drudge work queue,
signals could be missed so that drudgers would stall when there was work to
be done.
* libhsm: Fixed PIN handling on OpenBSD.
* Enforcer: If enabled enforcer workers and configured number of workers is 1,
make sure that enforcer runs the signer update command after signer
configuration change.
* Signer Engine: Don't add double RRSIGs generated by the same key for the
DNSKEY RRset.
* Signer Engine: Rollback incompleted zone transfers on disk (could happen
if a connection was reset during transfer).
* Multi-threaded enforcer: various minor fixes including deadlock problems.
OpenDNSSEC 1.4.0b1 - 2012-09-06
* OPENDNSSEC-130: libhsm: The PIN is now optional in conf.xml. The PIN can be
entered using "ods-hsmutil login" and is stored in shared memory. The daemons
will not start until this has been done by the user.
* OPENDNSSEC-297: Enforcer: Multi-threaded option available for the enforcer to
improve performance (MySQL only).
* OPENDNSSEC-320: Signer Engine: The , ,
and elements are now optional, but if provided they require
one or more or elements.
Bugfixes:
* OPENDNSSEC-255: Signer Engine: OpenDNSSEC 1.4.0a1 writes out mangled RRSIG
record.
* OPENDNSSEC-261: Signer Engine: Ldns fails to parse RR that seems
syntactically correct.
* OPENDNSSEC-269: Signer Engine: Crash when multiple threads access ixfr
struct.
* OPENDNSSEC-281: Commandhandler sometimes unresponsive.
* OPENDNSSEC-318: Signer Engine: Don't stop dns and xfr handlers if these
threads have not yet been started.
* OPENDNSSEC-319: Signer Engine: Fix TSIG segfault on signer shutdown.
* OPENDNSSEC-325: Signer Engine: Don't include RRSIG records when DO bit is
not set.
* OPENDNSSEC-326: Signer Engine: Stop serving a zone that could not be
transferred from master and has been expired.
OpenDNSSEC 1.4.0a3 - 2012-08-08
* OPENDNSSEC-258: Optionally include cka_id in output to
DelegationSignerSubmitCommand.
Bugfixes:
* SUPPORT-27: ods-ksmutil: simplify zone delete so that it only marks keys
as dead (rather than actually removing them). Leave the key removal to purge
jobs.
* SUPPORT-29: Signer Engine: Fix ods-signer clear command exits
prematurely [OPENDNSSEC-289].
* SUPPORT-30: Signer Engine: RRSIGs are left in the signed zone when
authoritative RRsets become glue [OPENDNSSEC-282].
* OPENDNSSEC-278: ods-ksmutil processes waiting forever to get DB lock
* OPENDNSSEC-290: Signer Engine: Fix false conflict when changing CNAME into
other RRtype.
* OPENDNSSEC-298: Enforcer: Only unlink existing pidfile on exit if we wrote it.
* OPENDNSSEC-304: Signer Engine: Check pidfile on startup, if pidfile exists
and corresponding process is running, then complain and exit.
* OPENDNSSEC-306: Can't delete zone until Enforcer made signconf.
* Fix assertion error when printing signed zone with empty non-terminals and
NSEC.
* Make setting QUERY ID in XFR requests more random.
OpenDNSSEC 1.4.0a2 - 2012-05-24
* OPENDNSSEC-226: Change in conf.xml: Configure the DNS listener IP address
with /Listener/Interface/Address instead of /Listener/Interface/IPv{4,6}.
* OPENDNSSEC-228: Signer Engine: Make 'ods-signer update' reload signconfs
even if zonelist has not changed.
* OPENDNSSEC-231: Signer Engine: Allow for Classless IN-ADDR.ARPA names
(RFC 2317).
* OPENDNSSEC-249: ods-ksmutil: If key export finds nothing to do then say so
rather than display nothing which might be misinterpreted.
* OPENDNSSEC-262: Signer Engine: Make DNS Adapter ACL optional.
* OPENDNSSEC-263: Signer Engine: Added EDNS0 support, so that zone transfers
and SOA requests with OPT RRs are possible.
* Enforcer: Add indexes for foreign keys. (sqlite only, MySQL already has them.)
Bugfixes:
* OPENDNSSEC-247: Signer Engine: TTL on NSEC(3) was not updated on SOA
Minimum change.
* OPENDNSSEC-252: Signer Engine: Mark xfrhandler started, so that we don't
try to join a non-existing thread on exit.
* OPENDNSSEC-259: Signer Engine: Fix assertion failure for outbound AXFR for
large zones.
* OPENDNSSEC-264: Signer Engine: Fix assertion error on reading IXFR from
backup.
* OPENDNSSEC-265: Signer Engine: Fix crash in corner cases when signing zone
with NSEC3 and Opt-out.
* OPENDNSSEC-267: Signer Engine: Sign NOTIFY OK response with TSIG, if present
in the query and ACL.
OpenDNSSEC 1.4.0a1 - 2012-03-15
* Auditor: The Auditor has been removed.
* Enforcer: Key label logging upon deletion (#192 Sebastian Castro)
* Enforcer: Stop multiple instances of the Enforcer running by checking for
the pidfile at startup. If you want to run multiple instances then a
different pidfile will need to be specified with the -P flag.
* Enforcer/ods-ksmutil: Use TTLs from KASP when generating DNSKEY and DS
records for output.
* Enforcer/ods-ksmutil: Give a more descriptive error message if the
tag in conf.xml does not match the database-backend set at
compile time.
* ods-ksmutil: Add warnings on "key export --ds" if no active or ready keys
were seen, or if both were seen (so a key rollover is happening).
* ods-ksmutil: Prevent MySQL username or password being interpreted by the
shell when running "ods-ksmutil setup"
* ods-ksmutil: "zone delete" renames the signconf file; so that if the zone is
put back the signer will not pick up the old file.
* ods-ksmutil: "key delete" added. It allows keys that are not currently in
use to be deleted from the database and HSM.
* OPENDNSSEC-1: Enforcer: Check DelegationSignerSubmitCommand exists and can
be executed by ods-enforcerd.
* OPENDNSSEC-10: ods-ksmutil: Include key size and algorithm in "key list"
with -v flag.
* OPENDNSSEC-28: ods-ksmutil: "key list" shows next state with -v flag.
* OPENDNSSEC-35: ods-ksmutil: "rollover list -v" now includes more information
on the KSKs waiting for the ds-seen command.
* OPENDNSSEC-83: ods-ksmutil: "key generate" now displays how many keys will
be generated and presents the user with the opportunity to stop the
operation.
* OPENDNSSEC-124: ods-ksmutil: Suppress database connection information when
no -v flag is given.
* Signer Engine: Input and Output DNS Adapters.
* Signer Engine: Zonefetcher has been removed.
Known issues:
* Signer Engine: The backup files do not work correctly in this alpha release.
Bugfixes:
* Bugfix #246: Less confusing text for XML validation in ods-kaspcheck.
* ods-ksmutil: "update kasp" now reflects changes in policy descriptions.
* ods-ksmutil: Policy descriptions now have special characters quoted.
* ods-ksmutil: Fix typo in policy export with NSEC3.
OpenDNSSEC 1.3.13 - 2013-02-20
Bugfixes:
* OPENDNSSEC-388: Signer Engine: Internal serial should take into account
the inbound serial.
* OPENDNSSEC-242: Signer Engine: Could get stuck on load signconf while
signconf was not changed.
* Signer Engine: Fixed locking and notification on the drudge work queue,
signals could be missed so that drudgers would stall when there was work to
be done.
OpenDNSSEC 1.3.12 - 2012-12-03
Bugfixes:
* SUPPORT-42: ./configure fails on FreeBSD (or if ldns is not installed in a
directory in the default search path of the complier).
* OpenDNSSEC does not compile against ldns 1.6.16 on platforms that rely on
the OpenDNSSEC implementation of strlcpy/cat
OpenDNSSEC 1.3.11 - 2012-11-13
* OPENDNSSEC-330: NSEC3PARAM TTL should be set to zero.
Bugfixes:
* OPENDNSSEC-306: Cant delete zone until Enforcer made signerconf.
* OPENDNSSEC-281: Commandhandler sometimes unresponsive.
* OPENDNSSEC-299: ods-ksmutil now includes policy import
* OPENDNSSEC-300: ods-ksmutil policy purge documented with a warning
* OPENDNSSEC-338: ods-ksmutil: fix zone delete on MySQL (broken by SUPPORT-27)
* OPENDNSSEC-342: Auditor comparisons made case-insensitive
* OPENDNSSEC-345: ods-ksmutil: use ods-control to HUP the enforcerd process
OpenDNSSEC 1.3.10 - 2012-08-10
Bugfixes:
* SUPPORT-30: RRSIGs are left in the signed zone when authoritative RRsets
become glue [OPENDNSSEC-282].
* OPENDNSSEC-261: Ldns fails to parse RR that seems syntactically correct.
Was due to memory allocation issues. Provided better log message.
* OPENDNSSEC-285: Signer segfault for 6 or more -v options
* OPENDNSSEC-298: Only unlink existing pidfile on exit if we wrote it.
* OPENDNSSEC-303: Return if open/parse of zonelist.xml fails in ksmutil.c
update_zones() and cmd_listzone().
* OPENDNSSEC-304: Signer Engine: Check pidfile on startup, if pidfile exists
and corresponding process is running, then complain and exit.
* Signer seems to hang on a ods-signer command. Shutdown client explicitly
with shutdown().
* opendnssec.spec file removed
OpenDNSSEC 1.3.9 - 2012-06-15
* OPENDNSSEC-277: Enforcer: Performance optimisation of database access.
Bugfixes:
* SUPPORT-27: ods-ksmutil: simplify zone delete so that it only marks keys as
dead (rather than actually removing them). Leave the key removal to purge
jobs.
OpenDNSSEC 1.3.8 - 2012-05-09
* OPENDNSSEC-228: Signer Engine: Make 'ods-signer update' reload signconfs
even if zonelist has not changed.
* OPENDNSSEC-231: Signer Engine: Allow for Classless IN-ADDR.ARPA names
(RFC 2317).
* OPENDNSSEC-234: Enforcer: Add indexes for foreign keys in kasp DB. (sqlite
only, MySQL already has them.)
* OPENDNSSEC-246: Signer Engine: Warn if is PT0S means that refresh equals signtime.
* Signer Engine: Defense in depth in signer for duplicate keys.
* Signer Engine: Make sure that all required zonelist elements exist,
otherwise error.
* Signer Engine: Warn the user if the serial is b0rk, and you can not
use the serial from the signconf.
* Signer Engine: Log Auditor exit code.
* Fix a similar bug like #257: Error in ods-signerd, where a corrupted
backup file results in an invalid pointer free().
OpenDNSSEC 1.3.2 - 2011-09-13
Bugfixes:
* Bugfix #257: Error in ods-signerd, where a corrupted backup file results
in an invalid pointer free().
* Signer Engine: Mark that a zone has a valid signer configuration, after
recovering the zone from the backup files.
OpenDNSSEC 1.3.1 - 2011-09-07
Bugfixes:
* Auditor: Fix 'ZSK in use too long' message to handle new signer behaviour.
* Bugfix #255: RHEL6 patch to contrib/opendnssec.spec. (Rick van Rein)
* Bugfix #256: Make sure argument in "ods-control signer" is not stripped off.
* Bugfix #259: ods-ksmutil: Prevent MySQL username or password being
interpreted by the shell when running "ods-ksmutil setup".
* Bugfix #260: "ods-ksmutil zone list" now handles empty zonelists.
* Enforcer: Unsigned comparison resulting in wrong error message.
* ods-ksmutil: fixed issue where first ds-seen command run on a zone would
work, but return an error code and not send a HUP to the enforcerd.
* Signer Engine: A threading issue occasionally puts the default validity
on NSEC(3) RRs and the denial validity on other RRs.
* Signer Engine: An update command could interrupt the signing process and the
zone would get missing signatures.
* Signer Engine: Fix an issue where some systems could not copy the zone file.
* Zonefetcher: Check inbound serial in transferred file, to prevent
redundant zone transfers.
OpenDNSSEC 1.3.0 - 2011-07-12
* Include simple-dnskey-mailer-plugin in dist.
* Enforcer: Change message about KSK retirement to make it less confusing.
Bugfixes:
* ods-control: If the Enforcer did not close down, you entered an infinite
loop.
* Signer Engine: Fix log message typos.
* Signer Engine: Fix crash where ods-signer update
* Signer Engine: Also replace DNSKEYs if has changed in policy.
* Zonefetcher: Sometimes invalid 'Address already in use' occurred.
* Bugfix #247: Fixes bug introduced by bugfix #242.
OpenDNSSEC 1.3.0rc3 - 2011-06-12
* Do not distribute trang.
Bugfixes:
* Fix test for java executable and others.
* Auditor: Fix delegation checks.
* Bugfix #242: Race condition when receiving multiple NOTIFIES for a zone.
* ods-kaspcheck: Do not expect resalt in NSEC policy.
* Signer Engine: Ifdef a header file.
* Signer Engine: The default working directory was not specified.
* Signer Engine: Handle stdout console output throttling that would
truncate daemon output intermittently.
OpenDNSSEC 1.3.0.rc2 - 2011-05-18
* Match the names of the signer pidfile and enforcer pidfile.
* Include check for resign < resalt in ods-kaspcheck.
Bugfixes:
* Bugfix #231: Fix MySQL version check.
* ods-ksmutil: Update now sends a HUP to the enforcerd.
* Signer Engine: Fix assertion failure if zone was just added.
* Signer Engine: Don't hsm_close() on setup error.
* Signer Engine: Fix race condition bug when doing a single run.
* Signer Engine: In case of failure, also mark zone processed (single run).
* Signer Engine: Don't leak backup file descriptor.
* signconf.rnc now allows NSEC3 Iterations of 0
OpenDNSSEC 1.3.0rc1 - 2011-04-21
* tag in conf.xml.
* Include check for resign < resalt in ods-kaspcheck.
Bugfixes:
* Bugfix #221: Segmentation Fault on schedule.c:232
* Enforcer: 'make check' now works.
* Enforcer: Fixed some memory leaks in the tests.
* Signer Engine: Coverity report fixes some leaks and thread issues.
* Signer Engine: Now logs to the correct facility again.
OpenDNSSEC 1.3.0b1 - 2011-03-23
* Support for signing the root. Use the zone name "."
* Enforcer: Stop import of policy if it is not consistent.
* ods-signer: The queue command will now also show what tasks the workers
are working on.
* Signer Engine: Just warn if occluded zone data was found, don't stop signing
process.
* Signer Engine: Simpler serial maintenance, reduces the number of conflicts.
Less chance to hit a 'cannot update: serial too small' error message.
* Signer Engine: Simpler NSEC(3) maintenance.
* Signer Engine: Temperate the number of backup files.
* Signer Engine: Set number of in conf.xml to
get peak performance from HSMs that can handle multiple threads.
Bugfixes:
* Bugreport #139: ods-auditor fails on root zone.
* Bugreport #198: Zone updates ignored?
* Replace tab with white-space when writing to syslog.
* Signer Engine: Do not block update command while signing.
OpenDNSSEC 1.2.1 - 2011-03-18
* ldns 1.6.9 is required for bugfixes.
* dnsruby-1.52 required for bugfixes.
Bugfixes:
* Auditor: 'make check' now works when srcdir != builddir.
* Auditor: Include the 'make check' files in the tarball.
* Enforcer: Fix the migration script for SQLite.
* Enforcer: Increase size of keypairs(id) field in MySQL to allow more than
32767 keys; see MIGRATION for details.
* Enforcer: Minor change to NOT_READY_KEY error message.
* libhsm: Increase the maximum number of attached HSM:s from 10 to 100.
* ods-ksmutil: Send trivial MySQL messages to stdout when exporting zonelist
etc. Otherwise the resulting XML needs to be edited by hand.
* ods-control: Fix for Bourne shell.
* Signer Engine: Prevent race condition when setting up the workers and
the command handler.
* Signer Engine: Check if the signature exists before recycling it.
* Signer Engine: Quit when there are errors in the configuration.
* Signer Engine: Enable core dump on failure.
* Signer Engine: Explicitly close down log msg with null.
* Signer Engine: Backup state after writing output.
* Signer Engine: Allow update of serial if internal structure is not
initialized.
* Signer Engine: NSEC chain could become broken if the predecessor domain
of a deleted domain was a glue domain.
OpenDNSSEC 1.2.0 - 2011-01-13
Bugfixes:
* Enforcer: Fixed a number of build warnings.
OpenDNSSEC 1.2.0rc3 - 2010-12-27
* Moved migration instructions to the file MIGRATION
Bugfixes:
* Bugreport #199: The previous DB schema change made the zone removal broken.
* Enforcer: When retiring old KSK, use TTL(ds) and not TTL(ksk).
* Enforcer: Minimize the set of DS RRs sent to DelegationSignerSubmitCommand.
* Enforcer: Replace tab with a space character in the DNSKEY printed to syslog.
* Enforcer: Fixed pontential format string bug.
* ods-ksmutil: Log to syslog when ds-seen changes a key to active/standby.
* Signer Engine: Don't be smart with RRSIG TTLs, the hsm will set them for you.
* Signer Engine: Set notify command for zone when receiving ods-signer update.
* Signer Engine: Update TTL of NSEC(3) records if SOA Minimum has changed
in KASP.
* Signer Engine: Now logs to the correct facility.
* Signer Engine: Also remove NSEC records when detecting changes in
signconf
* Signer Engine: Dropped privileges before starting Zonefetcher.
OpenDNSSEC 1.2.0rc2 - 2010-11-24
Bugfixes:
* Signer Engine: Use the correct TTL for RRs after the $INCLUDE directive.
* Signer Engine: Also create new signature if TTL of RR has changed.
* Signer Engine: Drop old NSEC/NSEC3 records.
* ods-ksmutil: Fixed some memory leaks.
OpenDNSSEC 1.2.0rc1 - 2010-11-17
* New commandline option for the signer: ods-signer running.
* Allow connection to different MySQL ports in the Enforcer.
* Tone down and explain warning when converting M or Y to seconds
* ldns 1.6.7 is required for bugfixes
* dnsruby 1.51 is required for bugfixes
Bugfixes:
* Bugreport #187: ods-control signer start will return non-zero if start up
failed (uses ods-signer running).
* Narrow glue at the zone cut is allowed, do not consider it as occluded.
* Move zone fetcher output to correct input adapter file.
* Enforcer shared keys on zones with ShareKeys disabled.
* Make names of key states consistent.
* Signer Engine file descriptor leak fix on engine.sock.
* Set explicit "unlimited" repository capacity to prevent random integer being
read. Requires "ods-ksmutil update conf" to be run if using an existing
database.
* Fix issue with key generation creating too many keys Ticket #194.
* Bugreport #189: Auditor did not handle white-space-seperated substrings
for base64 text
* Bugreport #190: Auditor (and signer) does not handle case correctly
* Signer now silence stdout-output from the notify command
OpenDNSSEC 1.2.0b1 - 2010-10-18
* A new signer engine, written in c. Zones are maintained in memory, instead of
in files on disk.
* Signer Engine: Check if the signature exists before recycling it.
* Removed the python and python-4suite-xml dependencies.
* Remove separate autoconf for libhsm/conf/enforcer.
* Add option to disable building the signer.
* Signer logs statistics just after outputting a new signed zone.
* libhsm will skip processing (and not create) any public keys if the
per repository option tag added to automatically delete keys that have been dead
for some interval.
* Rename all OpenDNSSEC command line tools and daemons to ods-XXX (e.g.
ksmutil becomes ods-ksmutil).
* kasp_check command added to check the conf.xml and kasp.xml configuration
files for sanity and consistency.
* communicated and keygend combined to form "ods-enforcerd".
* ksmutil command line changes. Most commands have changed slightly, but
there are some significant changes (see
http://svn.opendnssec.org/docs/command-tools-syntax.txt for details.)
* Enforcer database now has a version number. If it differs from the version
number in the code (specified via a #define statement), the software will
issue an error message and not connect to the database.
* "ksmutil list keys" now displays the keytag if the -l flag is passed to it.
* "Emergency Keys" renamed to "Standby Keys" as this better reflects their
role in OpenDNSSEC.
* The behaviour of SOA Serial value 'counter' has changed according to
Ticket #31.
* The directory "xml" and been renamed to "conf". (This is part of repository
clean.)
* There are changes to the KASP DB:
* Zone fetcher added, that will do AXFR from the master.
If want to use your old database, use the following commands to upgrade:
sqlite3 < enforcer/utils/migrate_090922_1.sqlite3
sqlite3 < enforcer/utils/migrate_090930_1.sqlite3
sqlite3 < enforcer/utils/migrate_091002_1.sqlite3
Or, to start a new (with loss of information), remove old keys from the HSM
and issue the command:
ksmutil setup
Bugfixes:
* Make sure that parenthesis in zonefiles don't concatenate rdata fields.
Known issues:
* TCP-support for LDNS on Solaris is currently broken due to an issue with
SO_RCVTIMEO. The result is that the zonefetcher doesn't work. No other
parts of OpenDNSSEC is affected by this bug.
There is currently no workaround.
OpenDNSSEC 1.0a5 - 2009-09-21
Features:
* support %zonefile expansion in the signer engine NotifyCommand
Bugfixes:
* Read < enforcer/utils/migrate_090901_1.sqlite3
Or start fresh (with loss of information. User should remove old keys
from the HSM):
ksmutil setup
Bugfixes:
* "signer_engine_cli clear " dont crash on missing files anymore
and removes all internal files now
* Bugreport #18, #19: Fix segfault at nseccer, nsec3er or finalizer when
handling large zones.
* Signer Engine starts correctly (problem was python 2.4, not RHEL5).
OpenDNSSEC 1.0a3 - 2009-08-26
Features:
* ksmutil import key implemented for importing key ID of existing keys
* "hsmspeed" will test the speed of the HSM.
* "hsmutil test" will test the HSM against OpenDNSSEC.
* Changes to the KASP DB, please apply:
If want to use your old DB:
sqlite3 < enforcer/utils/migrate_090820_1.sqlite3
Or start fresh (with loss of information. User should remove old keys
from the HSM):
ksmutil setup
Bugfixes:
* Better display of null backups (i.e. backup required) in ksmutil list
* Don't show historical rollovers in ksmutil list
* Fix key counting routines so that they all agree
* Missing SQLite includes in the Enforcer
Known bugs:
* Signer Engine not starting correctly in RHEL5.
Use "signer_engine -d" for now
* "signer_engine_cli clear " crashes on missing files
OpenDNSSEC 1.0a2 - 2009-08-14
Features:
* conf.xml format changed
* Read the default path to kasp.xml from conf.xml
* libksm integrated into enforcer (and no longer installed)
* Dropping privileges as specified
* Option to specify that a key from a specific repository
should not be used if it has not been backed up
* ksmutil backup done, to signal that the keys are backed up
* KASP Auditor should now function properly
* A quick start script is available
* XSLT to translate KASP into readable text (HTML)
* Changes to the KASP DB, please apply:
If want to use your old DB:
sqlite3 < enforcer/utils/migrate_090812_1.sqlite3
sqlite3 < enforcer/utils/migrate_090813_1.sqlite3
Or start fresh (with loss of information):
ksmutil setup
Bugfixes:
* Signer Engine can now read standard bind format correctly
* make install creates an incorrectly named directory
* ksmutil addzone defaults to wrong path
* SoftHSM links libsofthsm to build directory
* libksm install problem when builddir == srcdir
* Missing include of header file in SoftHSM
* Text about a problem with Botan on some systems.
OpenDNSSEC 1.0a1 - 2009-07-30
* Initial release (aka "Technology Preview")
opendnssec-2.0.4/Makefile.am 0000644 0001750 0001750 00000002666 13036123713 012644 0000000 0000000 ACLOCAL_AMFLAGS = -I m4
MAINTAINERCLEANFILES = \
config.log config.status \
$(srcdir)/Makefile.in \
$(srcdir)/common/config.h.in $(srcdir)/common/config.h.in~ \
$(srcdir)/configure \
$(srcdir)/install-sh $(srcdir)/ltmain.sh $(srcdir)/missing \
$(srcdir)/depcomp $(srcdir)/aclocal.m4 $(srcdir)/compile \
$(srcdir)/config.guess $(srcdir)/config.sub
SUBDIRS = common libhsm conf tools
if ENABLE_SIGNER
SUBDIRS += signer
endif
if ENABLE_ENFORCER
SUBDIRS += enforcer
endif
EXTRA_DIST = $(srcdir)/LICENSE \
$(srcdir)/MIGRATION \
$(srcdir)/README.md \
$(srcdir)/contrib/ods-sequencer/ods-sequencer \
$(srcdir)/contrib/ods-sequencer/ods-sequencer.md \
$(srcdir)/contrib/ods-sequencer/ods-sequencer-submit.sh \
$(srcdir)/contrib/simple-dnskey-mailer/simple-dnskey-mailer.sh
install-data-hook:
$(INSTALL) -d $(DESTDIR)$(localstatedir)
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signer
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/enforcer
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
docs:
(cd libhsm; $(MAKE) doxygen)
if ENABLE_ENFORCER
(cd enforcer; $(MAKE) doxygen)
endif
if ENABLE_SIGNER
(cd signer; $(MAKE) doxygen)
endif
opendnssec-2.0.4/tools/ 0000755 0001750 0001750 00000000000 13036124773 012025 5 0000000 0000000 opendnssec-2.0.4/tools/Makefile.am 0000644 0001750 0001750 00000000320 13036123676 013775 0000000 0000000 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
SUBDIRS = solaris
sbin_SCRIPTS = ods-control
bin_SCRIPTS = ods-kasp2html
man5_MANS = ods-timing.5 ods-kasp.5
man7_MANS = opendnssec.7
man8_MANS = ods-control.8
opendnssec-2.0.4/tools/opendnssec.7.in 0000644 0001750 0001750 00000007541 13036123713 014603 0000000 0000000 .TH "opendnssec" "7" "February 2010" "OpenDNSSEC" "OpenDNSSEC overview"
.SH "NAME"
.LP
.B OpenDNSSEC
\- making DNSSEC easy for DNS administrators
.SH "SYNOPSIS"
.LP
.B ods-control start | stop
.LP
.B ods-enforcer
.RB \fIsubcommand...\fB
.LP
.B ods-signer
.RB [\fIsubcommand...\fB]
.SH "DESCRIPTION"
.LP
OpenDNSSEC is a complete DNSSEC zone signing system which maintains stability and security of signed domains. DNSSEC adds many cryptographic concerns to DNS; OpenDNSSEC automates those to allow current DNS administrators to adopt DNSSEC.
.PP
Domain signing is done by placing OpenDNSSEC between the place where the
zone files are edited and where they are published. The current version
of OpenDNSSEC supports files and AXFR to communicate the zone data;
effectively, OpenDNSSEC acts as a "bump in the wire" between editing and
publishing a zone.
.PP
OpenDNSSEC has two daemons, which are unitedly started and stopped through
the
.I ods\-control(8)
command.
The two daemons in turn invoke other programs to get their work done.
.PP
One of the daemons is the KASP Enforcer, which enforces policies that define
security and timing requirements for each individual zone. Operators tend
to interact with the KASP Enforcer a lot, through the
.I ods\-ksmutil(1)
command.
.PP
The other daemon is the Signer Engine, which in turn signs the zone content.
It retrieves that content from a file or through AXFR, and publishes a signed
version of the zone into a file or through AXFR. Direct interaction with the
Signer Engine, although not normally necessary, is possible through the
.I ods\-signer(8)
command.
.PP
The keys that sign the zones are managed by an independent repository, which
is accessed over a PKCS #11 interface. The principle idea of this interface
being to unleash access to cryptographic hardware, there are implementations
in software. Also, implementations range from open to commercial, and from
very simple to highly secure. By default, OpenDNSSEC is configured to run on
top of a SoftHSM, but a few other commands exist to test any
Hardware Security Module that may sit under the PKCS #11 API.
.SH "OPERATIONAL PRACTICES"
The approach used by OpenDNSSEC follows the best current practice of
two kinds of key per zone:
.TP
.B KSK\fR or \fBKey Signing Key
This key belongs in the apex of a zone, and is referenced in the parent
zone (quite possibly a registry) in the form of DS records alongside
NS records. These parent references function as trust delegations.
The KSK is usually a longer key, and it could harm the efficiency of
secure resolvers if all individual resource records were signed with it.
This is why it is advisable to use the KSK only to sign the ZSK.
In DNS records, the KSK can usually be recognised by having its SEP
(Secure Entry Point) flag set.
.TP
.B ZSK\fR or \fBZone Signing Key
This key also belongs in the apex of a zone, and
is actually used to sign the resource records in a zone.
It is a shorter key for reasons of efficiency, that is rolled over
on a fairly regular basis. To detach these rollovers from the parent,
the ZSK is not directly trusted by the parent zone, but instead its
trust is established by way of a signature by the KSK on the ZSK.
.PP
OpenDNSSEC is mindful about the period of validity of each key, and will
rollover in time to keep the domain signed, with new keys, without any
downtime for the secure domain. The only thing that is not standardised,
and thus cannot be automated at the moment is the interface between a zone
and its parent, so this has to be done manually, or scripted around
OpenDNSSEC.
.SH "SEE ALSO"
.LP
ods\-control(8), ods\-enforcerd(8), ods\-enforcer(8), ods\-hsmspeed(1),
ods\-hsmutil(1), ods\-kaspcheck(1), ods\-kasp(5), ods\-ksmutil(1), ods\-signer(8),
ods\-signerd(8), ods\-timing(5),
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B OpenDNSSEC
was made by the OpenDNSSEC project, to be found on
.B http://www.opendnssec.org/
opendnssec-2.0.4/tools/ods-kasp2html.in 0000644 0001750 0001750 00000003715 13036123676 014774 0000000 0000000 #!/bin/sh
#
# Copyright (c) 2010 Kirei AB. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
XMLLINT=@XMLLINT@
XSLTPROC=@XSLTPROC@
if [ ! -x "$XMLLINT" ]; then
XMLLINT=$(find ${PATH//:/ } -maxdepth 1 -name xmllint -print -quit)
if [ ! -x "$XMLLINT" ]; then
echo "error: xmllint required, but not found"
exit 1
fi
fi
if [ ! -x "$XSLTPROC" ]; then
XSLTPROC=$(find ${PATH//:/ } -maxdepth 1 -name xsltproc -print -quit)
if [ ! -x "$XSLTPROC" ]; then
echo "error: xsltproc required, but not found"
exit 1
fi
fi
KASP_SCHEMA=@OPENDNSSEC_DATA_DIR@/kasp.rng
KASP_XSL=@OPENDNSSEC_DATA_DIR@/kasp2html.xsl
KASP_XML=$1
if [ -f "$KASP_XML" ]; then
$XMLLINT --noout --relaxng $KASP_SCHEMA $KASP_XML && \
$XSLTPROC $KASP_XSL $KASP_XML
else
echo "usage: $0 [kasp.xml]"
fi
opendnssec-2.0.4/tools/ods-kasp.5.in 0000644 0001750 0001750 00000026041 13036123676 014165 0000000 0000000 .TH "ods-kasp" "5" "April 2016" OpenDNSSEC "OpenDNSSEC KASP"
.SH "NAME"
.LP
.B ods-kasp
\- OpenDNSSEC kasp specification
.SH "SYNOPSIS"
.LP
.B @OPENDNSSEC_CONFIG_DIR@/kasp.xml
.SH "DESCRIPTION"
.LP
The kasp file describes the parameters of the DNSSEC Key and Signing Policy
(KASP), the policy used to sign zones. Each policy comprises a series of
parameters that define the way the zone is signed.
.TP
.B KASP Parameters
A policy has a set of common parameters to identify the policy.
.TP
.B Policy Name
The name is used to link a policy to a zone that needs to be signed. Each
policy must have a unique name. The policy named "default" is special, as
it is associated with all zones that do not have a policy explicitly associated
with them.
.TP
.B Policy Description
A policy can have a description associated with it.
.TP
.B Signatures Parameters
This section lists the parameters for the signatures created using the policy.
.TP
.B Signature Resign Interval
This is the interval between runs of the signer. For example, a zone that
has a Re-sign Interval of PT2H (2 hours) is handled by the signer every
2 hours.
.TP
.B Signature Refresh Interval
The Refresh Interval is describing when a signature should be refreshed.
As signatures are typically valid for much longer than the interval between
runs of the signer, there is no need to regenerate the signatures each time
the signer is running. This means that the Re-sign Interval must be smaller
than the Refresh Interval.
In order to make refreshing signatures possible, the Re-sign Interval should
be at least half of the Refresh Interval. In the case a signer runs and detects
that there is no change to the data being signed, signatures may be refreshed.
A signature will be refreshed when the time until the signature expiration is
closer than the Refresh Interval.
.TP
.B Signature Validity
The Signature Validity describes how long the signatures are valid for.
This parameter groups two elements of information. The Default Signature
Validity is the validity interval for all RRSIG records except those related
to NSEC or NSEC3 records. For these records, the validity period is given by
the value of the Denial Signature Validity.
.TP
.B Signature Jitter
The Signature Jitter (j) is the value added to or subtracted from the expiration
time of signatures to ensure that not all signatures expire at the same time.
The actual value of the jitter is a random value, uniformly ranging between
Minus Signature Jitter and Signature Jitter [-j...j]. This value is added to
Signature Validity to determine the signature expiration time.
.TP
.B Signature Inception Offset
This is a duration subtracted from the time at which a record is signed to give
the inception time of the RRSIG record. This is required to allow for clock skew
between the signing system and the system on which the signature is checked. Without
it, the possibility exists that the checking system could retrieve a signature
whose start time is later than the current time. The relationship between these
elements is shown below in Figure 1.
Inception Signing Expiration
time time time
| | | | |
|---------------------|---------------------------|.......|.......|
| | | | |
[ +/- Jitter ]
| Inception offset | |
|<------------------->| Validity Interval |
| |<--------------------------------->|
Inception Signing reuse reuse new Expiration
time time signature time
| | | | | |
|---------------------|-----------------------------------|
| | | | | |
<-----> <-----> <----->
Re-sign Interval
|Refresh Interval|
|<-------------->|
| |
Figure 1: Signature Timing Parameters
.TP
.B Authenticated Denial of Existence Parameters
Authenticated denial of existence - proving that domain names do not exist in the zone
- is discussed in this section. Below, the list of the parameters is given for creating
NSEC or NSEC3 records using the policy.
.TP
.B NSEC or NSEC3
If the NSEC scheme is used to implement authenticated denial of existence, there are no
record elements we can tune. If NSEC3 [RFC5155] is used, there are some more options.
.TP
.B NSEC3 Opt-Out
Whether to enable or disable "opt-out". This is an optimisation that means that NSEC3
records are only created for authoritative data or for secure delegations; insecure
delegations have no NSEC3 records. For zones where a majority of the entries are
delegations that are not signed - typically TLDs during the take-up phase of DNSSEC -
this reduces the number of DNSSEC records in the zone.
.TP
.B NSEC3 Re-salt Interval
The is the interval between generating new salt values for the hashing algorithm.
.TP
.B NSEC3 Hash Parameters
The NSEC3 Hash Parameters tells parameters related to NSEC3.
.TP
.B NSEC3 Hash Algorithm
The NSEC3 Hash Algorithm tells what hashing algorithm should be used to create the
NSEC3 records.
.TP
.B NSEC3 Hash Iterations
The NSEC3 Hash Iterations shows how many iterations of the hash function should be performed
over the original owner name.
.TP
.B NSEC3 Hash Salt Length
The NSEC3 Hash Salt Length provides the length of the salt value to be generated.
.TP
.B Key Parameters
This section covers parameters related to keys.
There are a number of parameters relating to both zone-signing keys (ZSK) and key-signing
keys (KSK).
.TP
.B DNSKEY TTL
This is the time-to-live value for the DNSKEY resource records.
.TP
.B Key Retire Safety
The Key Retire Safety is the retire safety margin for the keys. This interval is a safety
margin added to calculated timing values to ensure that keys are retired without there being
a chance of signatures created with the keys being considered invalid.
.TP
.B Key Publish Safety
The Key Publish is the publish safety margins for the keys. This interval is the safety
margin added to calculated timing values to ensure that keys are published and without
there being a chance of signatures created with the keys being considered invalid.
.TP
.B Key Sharing
If multiple zones are associated with a policy, a key may be shared between zones. For
example, if you have 100 zones then you will only use one set of keys instead of 100 sets.
This will safe space in your HSM.
.TP
.B Key Purging Interval
Key Purging is the event where keys marked as dead (as defined by draft-ietf-dnsop-dnssec-
key-timing [key-timing]) will be automatically purged from the key database. The Key Purging
Interval is the interval of when Key Purging is done.
.TP
.B KSK Parameters
There are parameters specific for the KSK.
.TP
.B KSK Algorithm
The KSK Algorithm determines the algorithm used for KSKs.
.TP
.B KSK Lifetime
The KSK Lifetime determines how long the KSK is used for before it is must be rolled.
.TP
.B KSK Repository
The KSK Repository determines the location of the KSKs.
.TP
.B Manual KSK Rollover
It may be desirable to force that a key rollover will only be initiated on the command by the
operator. Note that if KSK rollover is done automatically, there is currently still a step for
the KSK that needs manual intervention, where the corresponding DS record for the key needs to
be published to the parent before the rollover is completed.
.TP
.B ZSK Parameters
The same parameters for the KSK are available for the ZSK. The split between the series of
parameters is that with a ZSK/KSK Split Signing Scheme, the values for the parameters may be
different.
.TP
.B ZSK Algorithm
The ZSK Algorithm determines the algorithm used for ZSKs.
.TP
.B ZSK Lifetime
The ZSK Lifetime determines how long the ZSK is used for before it is must be rolled.
.TP
.B ZSK Repository
The ZSK Repository determines the location of the ZSKs.
.TP
.B Manual ZSK Rollover
The ZSK rollover will be fully automatic if Manual ZSK Rollover is disabled.
.TP
.B Zone Parameters
General information concerning the zones is described here.
.TP
.B Propagation Delay
The Propagation Delay is the amount of time needed for information changes at the master
server for the zone to work its way through to all the secondary nameservers.
.TP
.B SOA Parameters
These parameters are necessary for maintaining the SOA record in the signed zone.
These values will override values set for the SOA record in the input zone.
.TP
.B SOA TTL
This is the time-to-live of the SOA record.
.TP
.B SOA MINIUM
This is value for the MINIMUM RDATA element in the SOA record.
.TP
.B SOA Serial
This represents the format of the serial number in the signed zone.
This is one of the following:
counter: Use an increasing counter (but use the serial from the unsigned zone
if possible).
datecounter: Use increasing counter in YYYYMMDDxx format (xx is the number of
increments within each day, starting at 00).
unixtime: The serial number is set to the "Unix time" (seconds since 00:00 on
1 January 1970 (UTC)) at which the signer is run.
keep: Keep the serial from the unsigned zone (do not re-sign unless it has been
incremented). This way, no signed zone is created unless the zone operator
explicitly initiated a zone update.
.TP
.B Parent Zone Parameters
If a DNSSEC zone is in a chain of trust, digest information about the KSKs used in the
zone will be stored in DS records in the parent zone. To properly roll keys, timing
information about the parent zone must be configured.
.TP
.B Propagation Delay
The Propagation Delay parameter related to the parent zone is the interval between the
time a new KSK is published in the zone and the time that the DS record appears in the
parent zone. In reality, this is a variable value. The value for the Propagation Delay
in the policy should be a estimate.
.TP
.B DS TTL
This represents the DS time-to-live. The DS TTL should be set to the TTL of the DS record
in the parent zone.
.TP
.B SOA Parameters
The SOA Parameters related to the parent zone gives information about the parent's SOA record.
These are necessary to calculate the timings in particular rollover scenarios.
.TP
.B SOA TTL
This should be set to the time-to-live of the parent zone SOA record.
.TP
.B SOA MINIUM
This should be set to the value of the MINIMUM RDATA element in the parent zone SOA record.
.SH "SEE ALSO"
.LP
ods\-control(8), ods\-enforcerd(8), ods\-enforcer(8),
ods\-signerd(8), pds\-signer(8), ods\-ksmutil(1),
ods\-kaspcheck(1), ods\-timing(5), ods\-hsmutil(1),
ods\-hsmspeed(1), opendnssec(7),
ISO 8601,
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B OpenDNSSEC
was written by NLnet Labs as part of the OpenDNSSEC project.
.B http://www.opendnssec.org/
opendnssec-2.0.4/tools/ods-control.in 0000644 0001750 0001750 00000005452 13036123676 014547 0000000 0000000 #!/bin/sh
#
# Copyright (c) 2009 .SE (The Internet Infrastructure Foundation)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
progname="ods-control"
bindir="@OPENDNSSEC_BIN_DIR@"
sbindir="@OPENDNSSEC_SBIN_DIR@"
enforcer_pid_file="@OPENDNSSEC_ENFORCER_PIDFILE@"
signer_pid_file="@OPENDNSSEC_SIGNER_PIDFILE@"
case "$1" in
'hsm')
shift
"$bindir/ods-hsmutil" $@
;;
'signer')
case "$2" in
'start')
echo "Starting signer engine..."
"$sbindir/ods-signer" start
RETVAL=$?
if [ $RETVAL = 0 ]; then
i=0
while [ ! -r "$signer_pid_file" ]; do
sleep 1
i=`expr $i + 1`
if [ $i -ge 5 ]; then
RETVAL=1
echo "Could not start signer"
exit $RETVAL
fi
done
sleep 1
"$sbindir/ods-signer" running
RETVAL=$?
fi
exit $RETVAL
;;
*)
shift
"$sbindir/ods-signer" "$@"
;;
esac
;;
'enforcer')
case "$2" in
'start')
echo "Starting enforcer..."
"$sbindir/ods-enforcer" start
RETVAL=$?
if [ $RETVAL = 0 ]; then
i=0
while [ ! -r "$enforcer_pid_file" ]; do
sleep 1
i=`expr $i + 1`
if [ $i -ge 5 ]; then
RETVAL=1
echo "Could not start enforcer"
exit $RETVAL
fi
done
sleep 1
"$sbindir/ods-enforcer" running
RETVAL=$?
fi
exit $RETVAL
;;
*)
shift
"$sbindir/ods-enforcer" "$@"
;;
esac
;;
'start')
"$0" enforcer start
RETVAL=$?
if [ $RETVAL != 0 ]
then
exit $RETVAL
fi
"$0" signer start
RETVAL=$?
exit $RETVAL
;;
'stop')
echo "Stopping enforcer.."
"$0" enforcer stop
echo "Stopping signer engine..."
"$0" signer stop
;;
*)
echo "usage: $progname hsm|signer|enforcer|start|stop ..."
;;
esac
opendnssec-2.0.4/tools/ods-timing.5.in 0000644 0001750 0001750 00000005561 13036123713 014512 0000000 0000000 .TH "ods-timing" "5" "February 2010" OpenDNSSEC "OpenDNSSEC timinig"
.SH "NAME"
.LP
.B ods-timing
\- OpenDNSSEC timing specification
.SH "SYNOPSIS"
.LP
.B @OPENDNSSEC_CONFIG_DIR@/conf.xml
.br
.B @OPENDNSSEC_CONFIG_DIR@/kasp.xml
.br
.B @OPENDNSSEC_CONFIG_DIR@/zonelist.xml
.SH "DESCRIPTION"
.LP
The configuration files of OpenDNSSEC need to have timing descriptions,
notably for periods. These descriptions follow ISO 8601 with exceptions
for the duration of a month and a year, as these periods would be allowed
to vary if ISO 8601 were strictly adhered to.
.PP
Durations are represented by the format \fBP[n]Y[n]M[n]DT[n]H[n]M[n]S\fR.
In these representations, the \fB[n]\fR is replaced by the value for each
of the date and time elements that follow the \fB[n]\fR. Leading zeros are
not required. The capital letters \fBP\fR, \fBY\fR, \fBM\fR, \fBW\fR,
\fBD\fR, \fBT\fR, \fBH\fR, \fBM\fR and \fBS\fR are designators for each of
the date and time elements and are not replaced
.TP
.B P
is the duration designator (historically called "period") placed at the start of the duration representation.
.TP
.B Y
is the year designator that follows the value for the number of years.
.TP
.B M
is the month designator that follows the value for the number of months.
.TP
.B W
is the week designator that follows the value for the number of weeks.
.TP
.B D
is the day designator that follows the value for the number of days.
.TP
.B T
is the time designator that precedes the time components of the representation.
.TP
.B H
is the hour designator that follows the value for the number of hours.
.TP
.B M
is the minute designator that follows the value for the number of minutes.
.TP
.B S
is the second designator that follows the value for the number of seconds.
.PP
For example,
.B P3Y6M4DT12H30M5S
represents a duration of "three years, six months, four days, twelve hours, thirty minutes, and five seconds". Date and time elements including their designator may be omitted if their value is zero, and lower order elements may also be omitted for reduced precision. For example,
.B P23DT23H
and
.B P4Y
are both acceptable duration representations.
.SH "EXCEPTION"
.LP
A year or month vary in duration depending on the current date. For OpenDNSSEC, we assume fixed values.
.TP
.B One month
is assumed to be 31 days.
.TP
.B One year
is assumed to be 365 days.
.PP
This exception may or may not change in future releases of OpenDNSSEC.
The reason for making this exception is to avoid complicating this
software in a way that may not meet any practical need.
.SH "SEE ALSO"
.LP
ods\-control(8), ods\-enforcerd(8), ods\-enforcer(8),
ods\-signerd(8), ods\-signer(8), ods\-ksmutil(1),
ods\-kasp(5), ods\-kaspcheck(1), ods\-timing(5),
ods\-hsmspeed(1), ods\-hsmutil(1), opendnssec(7),
ISO 8601,
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B OpenDNSSEC
was made by the OpenDNSSEC project, to be found on
.B http://www.opendnssec.org/
opendnssec-2.0.4/tools/solaris/ 0000755 0001750 0001750 00000000000 13036124773 013501 5 0000000 0000000 opendnssec-2.0.4/tools/solaris/ods-enforcerd-smf.xml 0000644 0001750 0001750 00000003734 13036123676 017470 0000000 0000000
OpenDNSSEC
opendnssec-2.0.4/tools/solaris/Makefile.am 0000644 0001750 0001750 00000000664 13036123676 015464 0000000 0000000 MAINTAINERCLEANFILES = \
config.log config.status \
$(srcdir)/Makefile.in \
$(srcdir)/config.h.in $(srcdir)/config.h.in~ \
$(srcdir)/configure \
$(srcdir)/install-sh $(srcdir)/ltmain.sh $(srcdir)/missing \
$(srcdir)/depcomp $(srcdir)/aclocal.m4 $(srcdir)/compile \
$(srcdir)/config.guess $(srcdir)/config.sub
EXTRA_DIST = \
README \
ods-enforcerd-smf.xml \
ods-signerd-smf.xml \
ods-enforcerd.init.in \
ods-signerd.init.in
opendnssec-2.0.4/tools/solaris/ods-signerd.init.in 0000644 0001750 0001750 00000004770 13036123676 017142 0000000 0000000 #!/bin/sh
#
# Copyright (c) 2009 Nominet UK. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# export SOFTHSM_CONF=/etc/softhsm.conf
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:@OPENDNSSEC_LIB_DIR@
signer_bin_file="@OPENDNSSEC_SBIN_DIR@/ods-signerd"
signer_cli_file="@OPENDNSSEC_SBIN_DIR@/ods-signer"
signer_pid_file="@OPENDNSSEC_PID_DIR@/signerd.pid"
case "$1" in
'start')
# Check program is not running
ps -ef | grep '\' | grep -v grep
if [ $? -eq 0 ]
then
echo "signer_engine is already running"
exit 0
fi
# Start program up
if [ -x $signer_bin_file ]
then
echo "Starting signer engine"
$signer_bin_file &
fi
;;
'stop')
# Stop program
if [ -x $signer_cli_file ]
then
echo "Stopping signer engine"
$signer_cli_file stop
else
if [ -x $signer_pid_file ]
then
echo "Stopping signer engine via pid_file"
kill -TERM `cat $signer_pid_file`
else
echo "Stopping signer engine via pid"
PID=`ps -ef | grep '\' | grep -v grep | awk '{ print $2 }'`
if [ ! -z "$PID" ]
then
kill $PID
fi
fi
fi
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
exit 0
opendnssec-2.0.4/tools/solaris/ods-enforcerd.init.in 0000644 0001750 0001750 00000004436 13036123676 017455 0000000 0000000 #!/bin/sh
#
# Copyright (c) 2009 Nominet UK. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# export SOFTHSM_CONF=/etc/softhsm.conf
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:@OPENDNSSEC_LIB_DIR@
enforcer_bin_file="@OPENDNSSEC_SBIN_DIR@/ods-enforcerd"
enforcer_pid_file="@OPENDNSSEC_PID_DIR@/enforcerd.pid"
case "$1" in
'start')
# Check program is not running
ps -ef | grep '$enforcer_bin_file' | grep -v grep
if [ $? -eq 0 ]
then
echo "ods-enforcerd is already running"
exit 0
fi
# Start program up
if [ -x $enforcer_bin_file ]
then
echo "Starting enforcer"
$enforcer_bin_file &
fi
;;
'stop')
# Stop programs
if [ -x $enforcer_pid_file ]
then
echo "Stopping ods-enforcerd via pid_file"
kill -TERM `cat $enforcer_pid_file`
else
PID=`ps -ef | grep '$enforcer_bin_file' | grep -v grep | awk '{ print $2 }'`
if [ ! -z "$PID" ]
then
echo "Stopping ods-enforcerd via pid"
kill $PID
fi
fi
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
exit 0
opendnssec-2.0.4/tools/solaris/Makefile.in 0000644 0001750 0001750 00000041261 13036124713 015464 0000000 0000000 # Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
*) echo "am__make_running_with_option: internal error: invalid" \
"target option '$${target_option-}' specified" >&2; \
exit 1;; \
esac; \
has_opt=no; \
sane_makeflags=$$MAKEFLAGS; \
if $(am__is_gnu_make); then \
sane_makeflags=$$MFLAGS; \
else \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
bs=\\; \
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
esac; \
fi; \
skip_next=no; \
strip_trailopt () \
{ \
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
}; \
for flg in $$sane_makeflags; do \
test $$skip_next = yes && { skip_next=no; continue; }; \
case $$flg in \
*=*|--*) continue;; \
-*I) strip_trailopt 'I'; skip_next=yes;; \
-*I?*) strip_trailopt 'I';; \
-*O) strip_trailopt 'O'; skip_next=yes;; \
-*O?*) strip_trailopt 'O';; \
-*l) strip_trailopt 'l'; skip_next=yes;; \
-*l?*) strip_trailopt 'l';; \
-[dEDm]) skip_next=yes;; \
-[JT]) skip_next=yes;; \
esac; \
case $$flg in \
*$$target_option*) has_opt=yes; break;; \
esac; \
done; \
test $$has_opt = yes
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = tools/solaris
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/acx_broken_setres.m4 \
$(top_srcdir)/m4/acx_check_strptime.m4 \
$(top_srcdir)/m4/acx_cunit.m4 $(top_srcdir)/m4/acx_dlopen.m4 \
$(top_srcdir)/m4/acx_enforcer_database.m4 \
$(top_srcdir)/m4/acx_ldns.m4 $(top_srcdir)/m4/acx_libc.m4 \
$(top_srcdir)/m4/acx_libreadline.m4 \
$(top_srcdir)/m4/acx_libxml2.m4 \
$(top_srcdir)/m4/acx_pedantic.m4 \
$(top_srcdir)/m4/acx_pkcs11_modules.m4 \
$(top_srcdir)/m4/acx_prefixhack.m4 \
$(top_srcdir)/m4/acx_rpath.m4 $(top_srcdir)/m4/acx_rt.m4 \
$(top_srcdir)/m4/acx_ssl.m4 \
$(top_srcdir)/m4/ax_append_compile_flags.m4 \
$(top_srcdir)/m4/ax_append_flag.m4 \
$(top_srcdir)/m4/ax_c___attribute__.m4 \
$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
$(top_srcdir)/m4/ax_check_compile_flag.m4 \
$(top_srcdir)/m4/ax_compiler_flags_cflags.m4 \
$(top_srcdir)/m4/ax_lib_mysql.m4 \
$(top_srcdir)/m4/ax_lib_sqlite3.m4 \
$(top_srcdir)/m4/ax_prog_doxygen.m4 \
$(top_srcdir)/m4/ax_pthread.m4 \
$(top_srcdir)/m4/ax_require_defined.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
$(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \
$(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/opendnssec_common.m4 $(top_srcdir)/version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/common/config.h
CONFIG_CLEAN_FILES = ods-enforcerd.init ods-signerd.init
CONFIG_CLEAN_VPATH_FILES =
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
am__v_P_1 = :
AM_V_GEN = $(am__v_GEN_@AM_V@)
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
am__v_GEN_0 = @echo " GEN " $@;
am__v_GEN_1 =
AM_V_at = $(am__v_at_@AM_V@)
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
am__v_at_0 = @
am__v_at_1 =
SOURCES =
DIST_SOURCES =
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
am__DIST_COMMON = $(srcdir)/Makefile.in \
$(srcdir)/ods-enforcerd.init.in $(srcdir)/ods-signerd.init.in \
README
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CP = @CP@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CUNIT_INCLUDES = @CUNIT_INCLUDES@
CUNIT_LIBS = @CUNIT_LIBS@
CXX = @CXX@
CXXCPP = @CXXCPP@
CXXDEPMODE = @CXXDEPMODE@
CXXFLAGS = @CXXFLAGS@
CYGPATH_W = @CYGPATH_W@
C_LIBS = @C_LIBS@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLTOOL = @DLLTOOL@
DOXYGEN_PAPER_SIZE = @DOXYGEN_PAPER_SIZE@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
DX_CONFIG = @DX_CONFIG@
DX_DOCDIR = @DX_DOCDIR@
DX_DOT = @DX_DOT@
DX_DOXYGEN = @DX_DOXYGEN@
DX_DVIPS = @DX_DVIPS@
DX_EGREP = @DX_EGREP@
DX_ENV = @DX_ENV@
DX_FLAG_chi = @DX_FLAG_chi@
DX_FLAG_chm = @DX_FLAG_chm@
DX_FLAG_doc = @DX_FLAG_doc@
DX_FLAG_dot = @DX_FLAG_dot@
DX_FLAG_html = @DX_FLAG_html@
DX_FLAG_man = @DX_FLAG_man@
DX_FLAG_pdf = @DX_FLAG_pdf@
DX_FLAG_ps = @DX_FLAG_ps@
DX_FLAG_rtf = @DX_FLAG_rtf@
DX_FLAG_xml = @DX_FLAG_xml@
DX_HHC = @DX_HHC@
DX_LATEX = @DX_LATEX@
DX_MAKEINDEX = @DX_MAKEINDEX@
DX_PDFLATEX = @DX_PDFLATEX@
DX_PERL = @DX_PERL@
DX_PROJECT = @DX_PROJECT@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
ENFORCER_DB_DATABASE = @ENFORCER_DB_DATABASE@
ENFORCER_DB_HOST = @ENFORCER_DB_HOST@
ENFORCER_DB_INCLUDES = @ENFORCER_DB_INCLUDES@
ENFORCER_DB_LIBS = @ENFORCER_DB_LIBS@
ENFORCER_DB_PASSWORD = @ENFORCER_DB_PASSWORD@
ENFORCER_DB_PORT = @ENFORCER_DB_PORT@
ENFORCER_DB_PORT_TEXT = @ENFORCER_DB_PORT_TEXT@
ENFORCER_DB_USERNAME = @ENFORCER_DB_USERNAME@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GREP = @GREP@
HAVE_SSL = @HAVE_SSL@
HAVE_SSL_NEW_HMAC = @HAVE_SSL_NEW_HMAC@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
JAVA = @JAVA@
LD = @LD@
LDFLAGS = @LDFLAGS@
LDNS_CONFIG = @LDNS_CONFIG@
LDNS_INCLUDES = @LDNS_INCLUDES@
LDNS_LIBS = @LDNS_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MYSQL_CFLAGS = @MYSQL_CFLAGS@
MYSQL_CONFIG = @MYSQL_CONFIG@
MYSQL_LDFLAGS = @MYSQL_LDFLAGS@
MYSQL_VERSION = @MYSQL_VERSION@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
OPENDNSSEC_BIN_DIR = @OPENDNSSEC_BIN_DIR@
OPENDNSSEC_CONFIG_DIR = @OPENDNSSEC_CONFIG_DIR@
OPENDNSSEC_CONFIG_FILE = @OPENDNSSEC_CONFIG_FILE@
OPENDNSSEC_DATA_DIR = @OPENDNSSEC_DATA_DIR@
OPENDNSSEC_ENFORCER_PIDFILE = @OPENDNSSEC_ENFORCER_PIDFILE@
OPENDNSSEC_ENFORCER_SOCKETFILE = @OPENDNSSEC_ENFORCER_SOCKETFILE@
OPENDNSSEC_FETCH_PIDFILE = @OPENDNSSEC_FETCH_PIDFILE@
OPENDNSSEC_LIBEXEC_DIR = @OPENDNSSEC_LIBEXEC_DIR@
OPENDNSSEC_LIB_DIR = @OPENDNSSEC_LIB_DIR@
OPENDNSSEC_LOCALSTATE_DIR = @OPENDNSSEC_LOCALSTATE_DIR@
OPENDNSSEC_PID_DIR = @OPENDNSSEC_PID_DIR@
OPENDNSSEC_SBIN_DIR = @OPENDNSSEC_SBIN_DIR@
OPENDNSSEC_SCHEMA_DIR = @OPENDNSSEC_SCHEMA_DIR@
OPENDNSSEC_SIGNER_CLI = @OPENDNSSEC_SIGNER_CLI@
OPENDNSSEC_SIGNER_ENGINE = @OPENDNSSEC_SIGNER_ENGINE@
OPENDNSSEC_SIGNER_PIDFILE = @OPENDNSSEC_SIGNER_PIDFILE@
OPENDNSSEC_SIGNER_SOCKET = @OPENDNSSEC_SIGNER_SOCKET@
OPENDNSSEC_STATE_DIR = @OPENDNSSEC_STATE_DIR@
OPENDNSSEC_SYSCONF_DIR = @OPENDNSSEC_SYSCONF_DIR@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PTHREAD_CC = @PTHREAD_CC@
PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
PTHREAD_LIBS = @PTHREAD_LIBS@
RANLIB = @RANLIB@
READLINE_LIBS = @READLINE_LIBS@
RT_LIBS = @RT_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SQLITE3_CFLAGS = @SQLITE3_CFLAGS@
SQLITE3_LDFLAGS = @SQLITE3_LDFLAGS@
SQLITE3_VERSION = @SQLITE3_VERSION@
SSL_INCLUDES = @SSL_INCLUDES@
SSL_LIBS = @SSL_LIBS@
STRIP = @STRIP@
VERSION = @VERSION@
WARN_CFLAGS = @WARN_CFLAGS@
XML2_CONFIG = @XML2_CONFIG@
XML2_INCLUDES = @XML2_INCLUDES@
XML2_LIBS = @XML2_LIBS@
XMLLINT = @XMLLINT@
XSLTPROC = @XSLTPROC@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_CXX = @ac_ct_CXX@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
ax_pthread_config = @ax_pthread_config@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkcs11_aepkeyper_module = @pkcs11_aepkeyper_module@
pkcs11_etoken_module = @pkcs11_etoken_module@
pkcs11_ncipher_module = @pkcs11_ncipher_module@
pkcs11_opensc_module = @pkcs11_opensc_module@
pkcs11_sca6000_module = @pkcs11_sca6000_module@
pkcs11_softhsm_module = @pkcs11_softhsm_module@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
runstatedir = @runstatedir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
MAINTAINERCLEANFILES = \
config.log config.status \
$(srcdir)/Makefile.in \
$(srcdir)/config.h.in $(srcdir)/config.h.in~ \
$(srcdir)/configure \
$(srcdir)/install-sh $(srcdir)/ltmain.sh $(srcdir)/missing \
$(srcdir)/depcomp $(srcdir)/aclocal.m4 $(srcdir)/compile \
$(srcdir)/config.guess $(srcdir)/config.sub
EXTRA_DIST = \
README \
ods-enforcerd-smf.xml \
ods-signerd-smf.xml \
ods-enforcerd.init.in \
ods-signerd.init.in
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
&& { if test -f $@; then exit 0; else break; fi; }; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tools/solaris/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign tools/solaris/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
ods-enforcerd.init: $(top_builddir)/config.status $(srcdir)/ods-enforcerd.init.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-signerd.init: $(top_builddir)/config.status $(srcdir)/ods-signerd.init.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
tags TAGS:
ctags CTAGS:
cscope cscopelist:
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
dist_files=`for file in $$list; do echo $$file; done | \
sed -e "s|^$$srcdirstrip/||;t" \
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
case $$dist_files in \
*/*) $(MKDIR_P) `echo "$$dist_files" | \
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
sort -u` ;; \
esac; \
for file in $$dist_files; do \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
if test -d "$(distdir)/$$file"; then \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
test -f "$(distdir)/$$file" \
|| cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
all-am: Makefile
installdirs:
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-am
install-strip:
if test -z '$(STRIP)'; then \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
install; \
else \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
fi
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
distclean: distclean-am
-rm -f Makefile
distclean-am: clean-am distclean-generic
dvi: dvi-am
dvi-am:
html: html-am
html-am:
info: info-am
info-am:
install-data-am:
install-dvi: install-dvi-am
install-dvi-am:
install-exec-am:
install-html: install-html-am
install-html-am:
install-info: install-info-am
install-info-am:
install-man:
install-pdf: install-pdf-am
install-pdf-am:
install-ps: install-ps-am
install-ps-am:
installcheck-am:
maintainer-clean: maintainer-clean-am
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
pdf: pdf-am
pdf-am:
ps: ps-am
ps-am:
uninstall-am:
.MAKE: install-am install-strip
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
cscopelist-am ctags-am distclean distclean-generic \
distclean-libtool distdir dvi dvi-am html html-am info info-am \
install install-am install-data install-data-am install-dvi \
install-dvi-am install-exec install-exec-am install-html \
install-html-am install-info install-info-am install-man \
install-pdf install-pdf-am install-ps install-ps-am \
install-strip installcheck installcheck-am installdirs \
maintainer-clean maintainer-clean-generic mostlyclean \
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags-am uninstall uninstall-am
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
opendnssec-2.0.4/tools/solaris/README 0000644 0001750 0001750 00000002233 13036123676 014302 0000000 0000000 Solaris scripts to control OpenDNSSEC processes:
Any package for solaris should probably include something like the following:
In the prototype:
...
i preremove
i postinstall
d none /lib/svc/method/opendnssec 0755 root root
d none /var/svc/manifest/site/opendnssec 0755 root root
d none /lib/svc/method/opendnssec/ods-signerd.init=ods-signerd.init 0555 root root
d none /lib/svc/method/opendnssec/ods-enforcerd.init=ods-enforcerd.init 0555 root root
f none /var/svc/manifest/site/opendnssec/ods-signerd-smf.xml=ods-signerd-smf.xml 0555 root root
f none /var/svc/manifest/site/opendnssec/ods-enforcerd-smf.xml=ods-enforcerd-smf.xml 0555 root root
...
In the preremove
...
/usr/sbin/svcadm disable enforcer
/usr/sbin/svccfg -v delete svc:/site/opendnssec/enforcer:default
/usr/sbin/svcadm disable signer
/usr/sbin/svccfg -v delete svc:/site/opendnssec/signer:default
...
In the postinstall
...
/usr/sbin/svccfg -v import /var/svc/manifest/site/opendnssec/ods-signerd-smf.xml
/usr/sbin/svccfg -v import /var/svc/manifest/site/opendnssec/ods-enforcerd-smf.xml
...
Then you can use:
svcadm [enable|disable] signer
svcadm [enable|disable] enforcer
to control the processes
opendnssec-2.0.4/tools/solaris/ods-signerd-smf.xml 0000644 0001750 0001750 00000003724 13036123676 017153 0000000 0000000
OpenDNSSEC
opendnssec-2.0.4/tools/Makefile.in 0000644 0001750 0001750 00000101166 13036124713 014011 0000000 0000000 # Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
*) echo "am__make_running_with_option: internal error: invalid" \
"target option '$${target_option-}' specified" >&2; \
exit 1;; \
esac; \
has_opt=no; \
sane_makeflags=$$MAKEFLAGS; \
if $(am__is_gnu_make); then \
sane_makeflags=$$MFLAGS; \
else \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
bs=\\; \
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
esac; \
fi; \
skip_next=no; \
strip_trailopt () \
{ \
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
}; \
for flg in $$sane_makeflags; do \
test $$skip_next = yes && { skip_next=no; continue; }; \
case $$flg in \
*=*|--*) continue;; \
-*I) strip_trailopt 'I'; skip_next=yes;; \
-*I?*) strip_trailopt 'I';; \
-*O) strip_trailopt 'O'; skip_next=yes;; \
-*O?*) strip_trailopt 'O';; \
-*l) strip_trailopt 'l'; skip_next=yes;; \
-*l?*) strip_trailopt 'l';; \
-[dEDm]) skip_next=yes;; \
-[JT]) skip_next=yes;; \
esac; \
case $$flg in \
*$$target_option*) has_opt=yes; break;; \
esac; \
done; \
test $$has_opt = yes
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = tools
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/acx_broken_setres.m4 \
$(top_srcdir)/m4/acx_check_strptime.m4 \
$(top_srcdir)/m4/acx_cunit.m4 $(top_srcdir)/m4/acx_dlopen.m4 \
$(top_srcdir)/m4/acx_enforcer_database.m4 \
$(top_srcdir)/m4/acx_ldns.m4 $(top_srcdir)/m4/acx_libc.m4 \
$(top_srcdir)/m4/acx_libreadline.m4 \
$(top_srcdir)/m4/acx_libxml2.m4 \
$(top_srcdir)/m4/acx_pedantic.m4 \
$(top_srcdir)/m4/acx_pkcs11_modules.m4 \
$(top_srcdir)/m4/acx_prefixhack.m4 \
$(top_srcdir)/m4/acx_rpath.m4 $(top_srcdir)/m4/acx_rt.m4 \
$(top_srcdir)/m4/acx_ssl.m4 \
$(top_srcdir)/m4/ax_append_compile_flags.m4 \
$(top_srcdir)/m4/ax_append_flag.m4 \
$(top_srcdir)/m4/ax_c___attribute__.m4 \
$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
$(top_srcdir)/m4/ax_check_compile_flag.m4 \
$(top_srcdir)/m4/ax_compiler_flags_cflags.m4 \
$(top_srcdir)/m4/ax_lib_mysql.m4 \
$(top_srcdir)/m4/ax_lib_sqlite3.m4 \
$(top_srcdir)/m4/ax_prog_doxygen.m4 \
$(top_srcdir)/m4/ax_pthread.m4 \
$(top_srcdir)/m4/ax_require_defined.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
$(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \
$(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/opendnssec_common.m4 $(top_srcdir)/version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/common/config.h
CONFIG_CLEAN_FILES = ods-control ods-timing.5 ods-kasp.5 opendnssec.7 \
ods-control.8 ods-kasp2html
CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
for p in $$list; do echo "$$p $$p"; done | \
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
if (++n[$$2] == $(am__install_max)) \
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
END { for (dir in files) print dir, files[dir] }'
am__base_list = \
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
test -z "$$files" \
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(sbindir)" \
"$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man7dir)" \
"$(DESTDIR)$(man8dir)"
SCRIPTS = $(bin_SCRIPTS) $(sbin_SCRIPTS)
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
am__v_P_1 = :
AM_V_GEN = $(am__v_GEN_@AM_V@)
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
am__v_GEN_0 = @echo " GEN " $@;
am__v_GEN_1 =
AM_V_at = $(am__v_at_@AM_V@)
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
am__v_at_0 = @
am__v_at_1 =
SOURCES =
DIST_SOURCES =
RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
ctags-recursive dvi-recursive html-recursive info-recursive \
install-data-recursive install-dvi-recursive \
install-exec-recursive install-html-recursive \
install-info-recursive install-pdf-recursive \
install-ps-recursive install-recursive installcheck-recursive \
installdirs-recursive pdf-recursive ps-recursive \
tags-recursive uninstall-recursive
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
man5dir = $(mandir)/man5
man7dir = $(mandir)/man7
man8dir = $(mandir)/man8
NROFF = nroff
MANS = $(man5_MANS) $(man7_MANS) $(man8_MANS)
RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \
distclean-recursive maintainer-clean-recursive
am__recursive_targets = \
$(RECURSIVE_TARGETS) \
$(RECURSIVE_CLEAN_TARGETS) \
$(am__extra_recursive_targets)
AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
distdir
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
# Read a list of newline-separated strings from the standard input,
# and print each of them once, without duplicates. Input order is
# *not* preserved.
am__uniquify_input = $(AWK) '\
BEGIN { nonempty = 0; } \
{ items[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in items) print i; }; } \
'
# Make sure the list of sources is unique. This is necessary because,
# e.g., the same source file might be shared among _SOURCES variables
# for different programs/libraries.
am__define_uniq_tagged_files = \
list='$(am__tagged_files)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | $(am__uniquify_input)`
ETAGS = etags
CTAGS = ctags
DIST_SUBDIRS = $(SUBDIRS)
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/ods-control.8.in \
$(srcdir)/ods-control.in $(srcdir)/ods-kasp.5.in \
$(srcdir)/ods-kasp2html.in $(srcdir)/ods-timing.5.in \
$(srcdir)/opendnssec.7.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
am__relativize = \
dir0=`pwd`; \
sed_first='s,^\([^/]*\)/.*$$,\1,'; \
sed_rest='s,^[^/]*/*,,'; \
sed_last='s,^.*/\([^/]*\)$$,\1,'; \
sed_butlast='s,/*[^/]*$$,,'; \
while test -n "$$dir1"; do \
first=`echo "$$dir1" | sed -e "$$sed_first"`; \
if test "$$first" != "."; then \
if test "$$first" = ".."; then \
dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
else \
first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
if test "$$first2" = "$$first"; then \
dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
else \
dir2="../$$dir2"; \
fi; \
dir0="$$dir0"/"$$first"; \
fi; \
fi; \
dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
done; \
reldir="$$dir2"
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CP = @CP@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CUNIT_INCLUDES = @CUNIT_INCLUDES@
CUNIT_LIBS = @CUNIT_LIBS@
CXX = @CXX@
CXXCPP = @CXXCPP@
CXXDEPMODE = @CXXDEPMODE@
CXXFLAGS = @CXXFLAGS@
CYGPATH_W = @CYGPATH_W@
C_LIBS = @C_LIBS@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLTOOL = @DLLTOOL@
DOXYGEN_PAPER_SIZE = @DOXYGEN_PAPER_SIZE@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
DX_CONFIG = @DX_CONFIG@
DX_DOCDIR = @DX_DOCDIR@
DX_DOT = @DX_DOT@
DX_DOXYGEN = @DX_DOXYGEN@
DX_DVIPS = @DX_DVIPS@
DX_EGREP = @DX_EGREP@
DX_ENV = @DX_ENV@
DX_FLAG_chi = @DX_FLAG_chi@
DX_FLAG_chm = @DX_FLAG_chm@
DX_FLAG_doc = @DX_FLAG_doc@
DX_FLAG_dot = @DX_FLAG_dot@
DX_FLAG_html = @DX_FLAG_html@
DX_FLAG_man = @DX_FLAG_man@
DX_FLAG_pdf = @DX_FLAG_pdf@
DX_FLAG_ps = @DX_FLAG_ps@
DX_FLAG_rtf = @DX_FLAG_rtf@
DX_FLAG_xml = @DX_FLAG_xml@
DX_HHC = @DX_HHC@
DX_LATEX = @DX_LATEX@
DX_MAKEINDEX = @DX_MAKEINDEX@
DX_PDFLATEX = @DX_PDFLATEX@
DX_PERL = @DX_PERL@
DX_PROJECT = @DX_PROJECT@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
ENFORCER_DB_DATABASE = @ENFORCER_DB_DATABASE@
ENFORCER_DB_HOST = @ENFORCER_DB_HOST@
ENFORCER_DB_INCLUDES = @ENFORCER_DB_INCLUDES@
ENFORCER_DB_LIBS = @ENFORCER_DB_LIBS@
ENFORCER_DB_PASSWORD = @ENFORCER_DB_PASSWORD@
ENFORCER_DB_PORT = @ENFORCER_DB_PORT@
ENFORCER_DB_PORT_TEXT = @ENFORCER_DB_PORT_TEXT@
ENFORCER_DB_USERNAME = @ENFORCER_DB_USERNAME@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GREP = @GREP@
HAVE_SSL = @HAVE_SSL@
HAVE_SSL_NEW_HMAC = @HAVE_SSL_NEW_HMAC@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
JAVA = @JAVA@
LD = @LD@
LDFLAGS = @LDFLAGS@
LDNS_CONFIG = @LDNS_CONFIG@
LDNS_INCLUDES = @LDNS_INCLUDES@
LDNS_LIBS = @LDNS_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MYSQL_CFLAGS = @MYSQL_CFLAGS@
MYSQL_CONFIG = @MYSQL_CONFIG@
MYSQL_LDFLAGS = @MYSQL_LDFLAGS@
MYSQL_VERSION = @MYSQL_VERSION@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
OPENDNSSEC_BIN_DIR = @OPENDNSSEC_BIN_DIR@
OPENDNSSEC_CONFIG_DIR = @OPENDNSSEC_CONFIG_DIR@
OPENDNSSEC_CONFIG_FILE = @OPENDNSSEC_CONFIG_FILE@
OPENDNSSEC_DATA_DIR = @OPENDNSSEC_DATA_DIR@
OPENDNSSEC_ENFORCER_PIDFILE = @OPENDNSSEC_ENFORCER_PIDFILE@
OPENDNSSEC_ENFORCER_SOCKETFILE = @OPENDNSSEC_ENFORCER_SOCKETFILE@
OPENDNSSEC_FETCH_PIDFILE = @OPENDNSSEC_FETCH_PIDFILE@
OPENDNSSEC_LIBEXEC_DIR = @OPENDNSSEC_LIBEXEC_DIR@
OPENDNSSEC_LIB_DIR = @OPENDNSSEC_LIB_DIR@
OPENDNSSEC_LOCALSTATE_DIR = @OPENDNSSEC_LOCALSTATE_DIR@
OPENDNSSEC_PID_DIR = @OPENDNSSEC_PID_DIR@
OPENDNSSEC_SBIN_DIR = @OPENDNSSEC_SBIN_DIR@
OPENDNSSEC_SCHEMA_DIR = @OPENDNSSEC_SCHEMA_DIR@
OPENDNSSEC_SIGNER_CLI = @OPENDNSSEC_SIGNER_CLI@
OPENDNSSEC_SIGNER_ENGINE = @OPENDNSSEC_SIGNER_ENGINE@
OPENDNSSEC_SIGNER_PIDFILE = @OPENDNSSEC_SIGNER_PIDFILE@
OPENDNSSEC_SIGNER_SOCKET = @OPENDNSSEC_SIGNER_SOCKET@
OPENDNSSEC_STATE_DIR = @OPENDNSSEC_STATE_DIR@
OPENDNSSEC_SYSCONF_DIR = @OPENDNSSEC_SYSCONF_DIR@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PTHREAD_CC = @PTHREAD_CC@
PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
PTHREAD_LIBS = @PTHREAD_LIBS@
RANLIB = @RANLIB@
READLINE_LIBS = @READLINE_LIBS@
RT_LIBS = @RT_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SQLITE3_CFLAGS = @SQLITE3_CFLAGS@
SQLITE3_LDFLAGS = @SQLITE3_LDFLAGS@
SQLITE3_VERSION = @SQLITE3_VERSION@
SSL_INCLUDES = @SSL_INCLUDES@
SSL_LIBS = @SSL_LIBS@
STRIP = @STRIP@
VERSION = @VERSION@
WARN_CFLAGS = @WARN_CFLAGS@
XML2_CONFIG = @XML2_CONFIG@
XML2_INCLUDES = @XML2_INCLUDES@
XML2_LIBS = @XML2_LIBS@
XMLLINT = @XMLLINT@
XSLTPROC = @XSLTPROC@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_CXX = @ac_ct_CXX@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
ax_pthread_config = @ax_pthread_config@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkcs11_aepkeyper_module = @pkcs11_aepkeyper_module@
pkcs11_etoken_module = @pkcs11_etoken_module@
pkcs11_ncipher_module = @pkcs11_ncipher_module@
pkcs11_opensc_module = @pkcs11_opensc_module@
pkcs11_sca6000_module = @pkcs11_sca6000_module@
pkcs11_softhsm_module = @pkcs11_softhsm_module@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
runstatedir = @runstatedir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
SUBDIRS = solaris
sbin_SCRIPTS = ods-control
bin_SCRIPTS = ods-kasp2html
man5_MANS = ods-timing.5 ods-kasp.5
man7_MANS = opendnssec.7
man8_MANS = ods-control.8
all: all-recursive
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
&& { if test -f $@; then exit 0; else break; fi; }; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tools/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign tools/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
ods-control: $(top_builddir)/config.status $(srcdir)/ods-control.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-timing.5: $(top_builddir)/config.status $(srcdir)/ods-timing.5.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-kasp.5: $(top_builddir)/config.status $(srcdir)/ods-kasp.5.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
opendnssec.7: $(top_builddir)/config.status $(srcdir)/opendnssec.7.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-control.8: $(top_builddir)/config.status $(srcdir)/ods-control.8.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-kasp2html: $(top_builddir)/config.status $(srcdir)/ods-kasp2html.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
install-binSCRIPTS: $(bin_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(bin_SCRIPTS)'; test -n "$(bindir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \
$(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \
fi; \
for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
done | \
sed -e 'p;s,.*/,,;n' \
-e 'h;s|.*|.|' \
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
if (++n[d] == $(am__install_max)) { \
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
else { print "f", d "/" $$4, $$1 } } \
END { for (d in files) print "f", d, files[d] }' | \
while read type dir files; do \
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
test -z "$$files" || { \
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(bindir)$$dir'"; \
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \
} \
; done
uninstall-binSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(bin_SCRIPTS)'; test -n "$(bindir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(bindir)'; $(am__uninstall_files_from_dir)
install-sbinSCRIPTS: $(sbin_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(sbindir)'"; \
$(MKDIR_P) "$(DESTDIR)$(sbindir)" || exit 1; \
fi; \
for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
done | \
sed -e 'p;s,.*/,,;n' \
-e 'h;s|.*|.|' \
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
if (++n[d] == $(am__install_max)) { \
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
else { print "f", d "/" $$4, $$1 } } \
END { for (d in files) print "f", d, files[d] }' | \
while read type dir files; do \
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
test -z "$$files" || { \
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(sbindir)$$dir'"; \
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(sbindir)$$dir" || exit $$?; \
} \
; done
uninstall-sbinSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(sbindir)'; $(am__uninstall_files_from_dir)
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
install-man5: $(man5_MANS)
@$(NORMAL_INSTALL)
@list1='$(man5_MANS)'; \
list2=''; \
test -n "$(man5dir)" \
&& test -n "`echo $$list1$$list2`" \
|| exit 0; \
echo " $(MKDIR_P) '$(DESTDIR)$(man5dir)'"; \
$(MKDIR_P) "$(DESTDIR)$(man5dir)" || exit 1; \
{ for i in $$list1; do echo "$$i"; done; \
if test -n "$$list2"; then \
for i in $$list2; do echo "$$i"; done \
| sed -n '/\.5[a-z]*$$/p'; \
fi; \
} | while read p; do \
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
echo "$$d$$p"; echo "$$p"; \
done | \
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
sed 'N;N;s,\n, ,g' | { \
list=; while read file base inst; do \
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst" || exit $$?; \
fi; \
done; \
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
while read files; do \
test -z "$$files" || { \
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man5dir)'"; \
$(INSTALL_DATA) $$files "$(DESTDIR)$(man5dir)" || exit $$?; }; \
done; }
uninstall-man5:
@$(NORMAL_UNINSTALL)
@list='$(man5_MANS)'; test -n "$(man5dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
dir='$(DESTDIR)$(man5dir)'; $(am__uninstall_files_from_dir)
install-man7: $(man7_MANS)
@$(NORMAL_INSTALL)
@list1='$(man7_MANS)'; \
list2=''; \
test -n "$(man7dir)" \
&& test -n "`echo $$list1$$list2`" \
|| exit 0; \
echo " $(MKDIR_P) '$(DESTDIR)$(man7dir)'"; \
$(MKDIR_P) "$(DESTDIR)$(man7dir)" || exit 1; \
{ for i in $$list1; do echo "$$i"; done; \
if test -n "$$list2"; then \
for i in $$list2; do echo "$$i"; done \
| sed -n '/\.7[a-z]*$$/p'; \
fi; \
} | while read p; do \
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
echo "$$d$$p"; echo "$$p"; \
done | \
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^7][0-9a-z]*$$,7,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
sed 'N;N;s,\n, ,g' | { \
list=; while read file base inst; do \
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man7dir)/$$inst'"; \
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man7dir)/$$inst" || exit $$?; \
fi; \
done; \
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
while read files; do \
test -z "$$files" || { \
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man7dir)'"; \
$(INSTALL_DATA) $$files "$(DESTDIR)$(man7dir)" || exit $$?; }; \
done; }
uninstall-man7:
@$(NORMAL_UNINSTALL)
@list='$(man7_MANS)'; test -n "$(man7dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^7][0-9a-z]*$$,7,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
dir='$(DESTDIR)$(man7dir)'; $(am__uninstall_files_from_dir)
install-man8: $(man8_MANS)
@$(NORMAL_INSTALL)
@list1='$(man8_MANS)'; \
list2=''; \
test -n "$(man8dir)" \
&& test -n "`echo $$list1$$list2`" \
|| exit 0; \
echo " $(MKDIR_P) '$(DESTDIR)$(man8dir)'"; \
$(MKDIR_P) "$(DESTDIR)$(man8dir)" || exit 1; \
{ for i in $$list1; do echo "$$i"; done; \
if test -n "$$list2"; then \
for i in $$list2; do echo "$$i"; done \
| sed -n '/\.8[a-z]*$$/p'; \
fi; \
} | while read p; do \
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
echo "$$d$$p"; echo "$$p"; \
done | \
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
sed 'N;N;s,\n, ,g' | { \
list=; while read file base inst; do \
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
fi; \
done; \
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
while read files; do \
test -z "$$files" || { \
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
$(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
done; }
uninstall-man8:
@$(NORMAL_UNINSTALL)
@list='$(man8_MANS)'; test -n "$(man8dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)
# This directory's subdirectories are mostly independent; you can cd
# into them and run 'make' without going through this Makefile.
# To change the values of 'make' variables: instead of editing Makefiles,
# (1) if the variable is set in 'config.status', edit 'config.status'
# (which will cause the Makefiles to be regenerated when you run 'make');
# (2) otherwise, pass the desired values on the 'make' command line.
$(am__recursive_targets):
@fail=; \
if $(am__make_keepgoing); then \
failcom='fail=yes'; \
else \
failcom='exit 1'; \
fi; \
dot_seen=no; \
target=`echo $@ | sed s/-recursive//`; \
case "$@" in \
distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
*) list='$(SUBDIRS)' ;; \
esac; \
for subdir in $$list; do \
echo "Making $$target in $$subdir"; \
if test "$$subdir" = "."; then \
dot_seen=yes; \
local_target="$$target-am"; \
else \
local_target="$$target"; \
fi; \
($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
|| eval $$failcom; \
done; \
if test "$$dot_seen" = "no"; then \
$(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
fi; test -z "$$fail"
ID: $(am__tagged_files)
$(am__define_uniq_tagged_files); mkid -fID $$unique
tags: tags-recursive
TAGS: tags
tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
set x; \
here=`pwd`; \
if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
include_option=--etags-include; \
empty_fix=.; \
else \
include_option=--include; \
empty_fix=; \
fi; \
list='$(SUBDIRS)'; for subdir in $$list; do \
if test "$$subdir" = .; then :; else \
test ! -f $$subdir/TAGS || \
set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
fi; \
done; \
$(am__define_uniq_tagged_files); \
shift; \
if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
if test $$# -gt 0; then \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
"$$@" $$unique; \
else \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
$$unique; \
fi; \
fi
ctags: ctags-recursive
CTAGS: ctags
ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
$(am__define_uniq_tagged_files); \
test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
$$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
&& $(am__cd) $(top_srcdir) \
&& gtags -i $(GTAGS_ARGS) "$$here"
cscopelist: cscopelist-recursive
cscopelist-am: $(am__tagged_files)
list='$(am__tagged_files)'; \
case "$(srcdir)" in \
[\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
*) sdir=$(subdir)/$(srcdir) ;; \
esac; \
for i in $$list; do \
if test -f "$$i"; then \
echo "$(subdir)/$$i"; \
else \
echo "$$sdir/$$i"; \
fi; \
done >> $(top_builddir)/cscope.files
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
dist_files=`for file in $$list; do echo $$file; done | \
sed -e "s|^$$srcdirstrip/||;t" \
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
case $$dist_files in \
*/*) $(MKDIR_P) `echo "$$dist_files" | \
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
sort -u` ;; \
esac; \
for file in $$dist_files; do \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
if test -d "$(distdir)/$$file"; then \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
test -f "$(distdir)/$$file" \
|| cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
if test "$$subdir" = .; then :; else \
$(am__make_dryrun) \
|| test -d "$(distdir)/$$subdir" \
|| $(MKDIR_P) "$(distdir)/$$subdir" \
|| exit 1; \
dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
$(am__relativize); \
new_distdir=$$reldir; \
dir1=$$subdir; dir2="$(top_distdir)"; \
$(am__relativize); \
new_top_distdir=$$reldir; \
echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
($(am__cd) $$subdir && \
$(MAKE) $(AM_MAKEFLAGS) \
top_distdir="$$new_top_distdir" \
distdir="$$new_distdir" \
am__remove_distdir=: \
am__skip_length_check=: \
am__skip_mode_fix=: \
distdir) \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-recursive
all-am: Makefile $(SCRIPTS) $(MANS)
installdirs: installdirs-recursive
installdirs-am:
for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man7dir)" "$(DESTDIR)$(man8dir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-recursive
install-exec: install-exec-recursive
install-data: install-data-recursive
uninstall: uninstall-recursive
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-recursive
install-strip:
if test -z '$(STRIP)'; then \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
install; \
else \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
fi
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-recursive
clean-am: clean-generic clean-libtool mostlyclean-am
distclean: distclean-recursive
-rm -f Makefile
distclean-am: clean-am distclean-generic distclean-tags
dvi: dvi-recursive
dvi-am:
html: html-recursive
html-am:
info: info-recursive
info-am:
install-data-am: install-man
install-dvi: install-dvi-recursive
install-dvi-am:
install-exec-am: install-binSCRIPTS install-sbinSCRIPTS
install-html: install-html-recursive
install-html-am:
install-info: install-info-recursive
install-info-am:
install-man: install-man5 install-man7 install-man8
install-pdf: install-pdf-recursive
install-pdf-am:
install-ps: install-ps-recursive
install-ps-am:
installcheck-am:
maintainer-clean: maintainer-clean-recursive
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-recursive
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
pdf: pdf-recursive
pdf-am:
ps: ps-recursive
ps-am:
uninstall-am: uninstall-binSCRIPTS uninstall-man uninstall-sbinSCRIPTS
uninstall-man: uninstall-man5 uninstall-man7 uninstall-man8
.MAKE: $(am__recursive_targets) install-am install-strip
.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
check-am clean clean-generic clean-libtool cscopelist-am ctags \
ctags-am distclean distclean-generic distclean-libtool \
distclean-tags distdir dvi dvi-am html html-am info info-am \
install install-am install-binSCRIPTS install-data \
install-data-am install-dvi install-dvi-am install-exec \
install-exec-am install-html install-html-am install-info \
install-info-am install-man install-man5 install-man7 \
install-man8 install-pdf install-pdf-am install-ps \
install-ps-am install-sbinSCRIPTS install-strip installcheck \
installcheck-am installdirs installdirs-am maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
uninstall-am uninstall-binSCRIPTS uninstall-man uninstall-man5 \
uninstall-man7 uninstall-man8 uninstall-sbinSCRIPTS
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
opendnssec-2.0.4/tools/ods-control.8.in 0000644 0001750 0001750 00000002436 13036123713 014704 0000000 0000000 .TH "ods-control" "8" "February 2010" "OpenDNSSEC" "OpenDNSSEC ods-control"
.SH "NAME"
.LP
.B ods\-control
\- OpenDNSSEC control utility
.SH "SYNOPSIS"
.LP
.B ods\-control hsm ...
.br
.B ods\-control enforcer ...
.br
.B ods\-control signer ...
.br
.B ods\-control start
.br
.B ods\-control stop
.SH "DESCRIPTION"
.LP
ods\-control is a helper utility which gives a combined interface for different
command utilities within OpenDNSSEC. It can also start and stop OpenDNSSEC by
controlling the two daemons.
.SH "OPTIONS"
.LP
.TP
\fBhsm\fR
The remainder of the command line will be sent to the ods\-hsmutil utility
.TP
\fBenforcer\fR
The remainder of the command line will be sent to the ods\-enforcer utility
.TP
\fBsigner\fR
The remainder of the command line will be sent to the ods\-signer utility
.TP
\fBstart\fR
Will start the two daemons of OpenDNSSEC, ods\-enforcerd and ods\-signerd
.TP
\fBstop\fR
Will stop the two daemons of OpenDNSSEC, ods\-enforcerd and ods\-signerd
.SH "SEE ALSO"
.LP
ods\-enforcer(8), ods\-enforcerd(8), ods\-signer(8),
ods\-signerd(8), ods\-ksmutil(1), ods\-kasp(5),
ods\-kaspcheck(1), ods\-timing(5), ods\-hsmspeed(1),
ods\-hsmutil(1), opendnssec(7),
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B ods\-control
was written by Jakob Schlyter as part of the OpenDNSSEC project.
opendnssec-2.0.4/signer/ 0000755 0001750 0001750 00000000000 13036124774 012155 5 0000000 0000000 opendnssec-2.0.4/signer/Makefile.am 0000644 0001750 0001750 00000000451 13036123676 014131 0000000 0000000 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
SUBDIRS = src man
doxygen:
rm -fr $(top_builddir)/signer/doxygen-doc
env $(DX_ENV) \
PROJECT_NAME="OpenDNSSEC-signer" \
SRCDIR=$(top_srcdir)/signer \
OUTPUTDIR=$(top_builddir)/signer/doxygen-doc \
$(DX_DOXYGEN) $(top_builddir)/$(DX_CONFIG)
opendnssec-2.0.4/signer/man/ 0000755 0001750 0001750 00000000000 13036124774 012730 5 0000000 0000000 opendnssec-2.0.4/signer/man/Makefile.am 0000644 0001750 0001750 00000000126 13036123676 014703 0000000 0000000 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
man8_MANS = ods-signer.8 ods-signerd.8
opendnssec-2.0.4/signer/man/ods-signer.8.in 0000644 0001750 0001750 00000002052 13036123713 015407 0000000 0000000 .TH "ods-signer" "22" "February 2012" "OpenDNSSEC" "OpenDNSSEC ods-signer"
.SH "NAME"
.B ods\-signer
\- OpenDNSSEC Signer Engine client
.LP
.SH "SYNOPSIS"
.B ods\-signer
.RB [ \-h ]
.I clear
.IR
|
.I flush
|
.I queue
|
.I reload
|
.I running
|
.I sign
.IR [ \-\-serial ]
|
.I sign \-\-all
|
.I start
|
.I stop
|
.I update
.RB [ \-\-all ]
|
.I update
.IR
|
.I verbosity
.IR
|
.I zones
.LP
.SH "DESCRIPTION"
ods\-signer is part of the OpenDNSSEC software. With this tool, you can send
commands to the signer engine daemon. For more information, go to
.B http://www.opendnssec.org
and visit the Documentation page.
.LP
.SH "OPTIONS"
.LP
.TP
.B \-h
Show this help.
.P
.SH "DIAGNOSTICS"
.LP
will log all the problems via stderr.
.SH "SEE ALSO"
.LP
ods\-control(8), ods\-enforcerd(8), ods\-hsmspeed(1),
ods\-hsmutil(1), ods\-kaspcheck(1), ods\-ksmutil(1),
ods\-signerd(8), ods\-timing(5), opendnssec(7),
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B ods\-signer
was written by NLnet Labs as part of the OpenDNSSEC project.
opendnssec-2.0.4/signer/man/Makefile.in 0000644 0001750 0001750 00000046371 13036124713 014721 0000000 0000000 # Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
*) echo "am__make_running_with_option: internal error: invalid" \
"target option '$${target_option-}' specified" >&2; \
exit 1;; \
esac; \
has_opt=no; \
sane_makeflags=$$MAKEFLAGS; \
if $(am__is_gnu_make); then \
sane_makeflags=$$MFLAGS; \
else \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
bs=\\; \
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
esac; \
fi; \
skip_next=no; \
strip_trailopt () \
{ \
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
}; \
for flg in $$sane_makeflags; do \
test $$skip_next = yes && { skip_next=no; continue; }; \
case $$flg in \
*=*|--*) continue;; \
-*I) strip_trailopt 'I'; skip_next=yes;; \
-*I?*) strip_trailopt 'I';; \
-*O) strip_trailopt 'O'; skip_next=yes;; \
-*O?*) strip_trailopt 'O';; \
-*l) strip_trailopt 'l'; skip_next=yes;; \
-*l?*) strip_trailopt 'l';; \
-[dEDm]) skip_next=yes;; \
-[JT]) skip_next=yes;; \
esac; \
case $$flg in \
*$$target_option*) has_opt=yes; break;; \
esac; \
done; \
test $$has_opt = yes
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = signer/man
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/acx_broken_setres.m4 \
$(top_srcdir)/m4/acx_check_strptime.m4 \
$(top_srcdir)/m4/acx_cunit.m4 $(top_srcdir)/m4/acx_dlopen.m4 \
$(top_srcdir)/m4/acx_enforcer_database.m4 \
$(top_srcdir)/m4/acx_ldns.m4 $(top_srcdir)/m4/acx_libc.m4 \
$(top_srcdir)/m4/acx_libreadline.m4 \
$(top_srcdir)/m4/acx_libxml2.m4 \
$(top_srcdir)/m4/acx_pedantic.m4 \
$(top_srcdir)/m4/acx_pkcs11_modules.m4 \
$(top_srcdir)/m4/acx_prefixhack.m4 \
$(top_srcdir)/m4/acx_rpath.m4 $(top_srcdir)/m4/acx_rt.m4 \
$(top_srcdir)/m4/acx_ssl.m4 \
$(top_srcdir)/m4/ax_append_compile_flags.m4 \
$(top_srcdir)/m4/ax_append_flag.m4 \
$(top_srcdir)/m4/ax_c___attribute__.m4 \
$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
$(top_srcdir)/m4/ax_check_compile_flag.m4 \
$(top_srcdir)/m4/ax_compiler_flags_cflags.m4 \
$(top_srcdir)/m4/ax_lib_mysql.m4 \
$(top_srcdir)/m4/ax_lib_sqlite3.m4 \
$(top_srcdir)/m4/ax_prog_doxygen.m4 \
$(top_srcdir)/m4/ax_pthread.m4 \
$(top_srcdir)/m4/ax_require_defined.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
$(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \
$(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/opendnssec_common.m4 $(top_srcdir)/version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/common/config.h
CONFIG_CLEAN_FILES = ods-signer.8 ods-signerd.8
CONFIG_CLEAN_VPATH_FILES =
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
am__v_P_1 = :
AM_V_GEN = $(am__v_GEN_@AM_V@)
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
am__v_GEN_0 = @echo " GEN " $@;
am__v_GEN_1 =
AM_V_at = $(am__v_at_@AM_V@)
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
am__v_at_0 = @
am__v_at_1 =
SOURCES =
DIST_SOURCES =
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
for p in $$list; do echo "$$p $$p"; done | \
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
if (++n[$$2] == $(am__install_max)) \
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
END { for (dir in files) print dir, files[dir] }'
am__base_list = \
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
test -z "$$files" \
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
man8dir = $(mandir)/man8
am__installdirs = "$(DESTDIR)$(man8dir)"
NROFF = nroff
MANS = $(man8_MANS)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/ods-signer.8.in \
$(srcdir)/ods-signerd.8.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CP = @CP@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CUNIT_INCLUDES = @CUNIT_INCLUDES@
CUNIT_LIBS = @CUNIT_LIBS@
CXX = @CXX@
CXXCPP = @CXXCPP@
CXXDEPMODE = @CXXDEPMODE@
CXXFLAGS = @CXXFLAGS@
CYGPATH_W = @CYGPATH_W@
C_LIBS = @C_LIBS@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLTOOL = @DLLTOOL@
DOXYGEN_PAPER_SIZE = @DOXYGEN_PAPER_SIZE@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
DX_CONFIG = @DX_CONFIG@
DX_DOCDIR = @DX_DOCDIR@
DX_DOT = @DX_DOT@
DX_DOXYGEN = @DX_DOXYGEN@
DX_DVIPS = @DX_DVIPS@
DX_EGREP = @DX_EGREP@
DX_ENV = @DX_ENV@
DX_FLAG_chi = @DX_FLAG_chi@
DX_FLAG_chm = @DX_FLAG_chm@
DX_FLAG_doc = @DX_FLAG_doc@
DX_FLAG_dot = @DX_FLAG_dot@
DX_FLAG_html = @DX_FLAG_html@
DX_FLAG_man = @DX_FLAG_man@
DX_FLAG_pdf = @DX_FLAG_pdf@
DX_FLAG_ps = @DX_FLAG_ps@
DX_FLAG_rtf = @DX_FLAG_rtf@
DX_FLAG_xml = @DX_FLAG_xml@
DX_HHC = @DX_HHC@
DX_LATEX = @DX_LATEX@
DX_MAKEINDEX = @DX_MAKEINDEX@
DX_PDFLATEX = @DX_PDFLATEX@
DX_PERL = @DX_PERL@
DX_PROJECT = @DX_PROJECT@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
ENFORCER_DB_DATABASE = @ENFORCER_DB_DATABASE@
ENFORCER_DB_HOST = @ENFORCER_DB_HOST@
ENFORCER_DB_INCLUDES = @ENFORCER_DB_INCLUDES@
ENFORCER_DB_LIBS = @ENFORCER_DB_LIBS@
ENFORCER_DB_PASSWORD = @ENFORCER_DB_PASSWORD@
ENFORCER_DB_PORT = @ENFORCER_DB_PORT@
ENFORCER_DB_PORT_TEXT = @ENFORCER_DB_PORT_TEXT@
ENFORCER_DB_USERNAME = @ENFORCER_DB_USERNAME@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GREP = @GREP@
HAVE_SSL = @HAVE_SSL@
HAVE_SSL_NEW_HMAC = @HAVE_SSL_NEW_HMAC@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
JAVA = @JAVA@
LD = @LD@
LDFLAGS = @LDFLAGS@
LDNS_CONFIG = @LDNS_CONFIG@
LDNS_INCLUDES = @LDNS_INCLUDES@
LDNS_LIBS = @LDNS_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MYSQL_CFLAGS = @MYSQL_CFLAGS@
MYSQL_CONFIG = @MYSQL_CONFIG@
MYSQL_LDFLAGS = @MYSQL_LDFLAGS@
MYSQL_VERSION = @MYSQL_VERSION@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
OPENDNSSEC_BIN_DIR = @OPENDNSSEC_BIN_DIR@
OPENDNSSEC_CONFIG_DIR = @OPENDNSSEC_CONFIG_DIR@
OPENDNSSEC_CONFIG_FILE = @OPENDNSSEC_CONFIG_FILE@
OPENDNSSEC_DATA_DIR = @OPENDNSSEC_DATA_DIR@
OPENDNSSEC_ENFORCER_PIDFILE = @OPENDNSSEC_ENFORCER_PIDFILE@
OPENDNSSEC_ENFORCER_SOCKETFILE = @OPENDNSSEC_ENFORCER_SOCKETFILE@
OPENDNSSEC_FETCH_PIDFILE = @OPENDNSSEC_FETCH_PIDFILE@
OPENDNSSEC_LIBEXEC_DIR = @OPENDNSSEC_LIBEXEC_DIR@
OPENDNSSEC_LIB_DIR = @OPENDNSSEC_LIB_DIR@
OPENDNSSEC_LOCALSTATE_DIR = @OPENDNSSEC_LOCALSTATE_DIR@
OPENDNSSEC_PID_DIR = @OPENDNSSEC_PID_DIR@
OPENDNSSEC_SBIN_DIR = @OPENDNSSEC_SBIN_DIR@
OPENDNSSEC_SCHEMA_DIR = @OPENDNSSEC_SCHEMA_DIR@
OPENDNSSEC_SIGNER_CLI = @OPENDNSSEC_SIGNER_CLI@
OPENDNSSEC_SIGNER_ENGINE = @OPENDNSSEC_SIGNER_ENGINE@
OPENDNSSEC_SIGNER_PIDFILE = @OPENDNSSEC_SIGNER_PIDFILE@
OPENDNSSEC_SIGNER_SOCKET = @OPENDNSSEC_SIGNER_SOCKET@
OPENDNSSEC_STATE_DIR = @OPENDNSSEC_STATE_DIR@
OPENDNSSEC_SYSCONF_DIR = @OPENDNSSEC_SYSCONF_DIR@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PTHREAD_CC = @PTHREAD_CC@
PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
PTHREAD_LIBS = @PTHREAD_LIBS@
RANLIB = @RANLIB@
READLINE_LIBS = @READLINE_LIBS@
RT_LIBS = @RT_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SQLITE3_CFLAGS = @SQLITE3_CFLAGS@
SQLITE3_LDFLAGS = @SQLITE3_LDFLAGS@
SQLITE3_VERSION = @SQLITE3_VERSION@
SSL_INCLUDES = @SSL_INCLUDES@
SSL_LIBS = @SSL_LIBS@
STRIP = @STRIP@
VERSION = @VERSION@
WARN_CFLAGS = @WARN_CFLAGS@
XML2_CONFIG = @XML2_CONFIG@
XML2_INCLUDES = @XML2_INCLUDES@
XML2_LIBS = @XML2_LIBS@
XMLLINT = @XMLLINT@
XSLTPROC = @XSLTPROC@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_CXX = @ac_ct_CXX@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
ax_pthread_config = @ax_pthread_config@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkcs11_aepkeyper_module = @pkcs11_aepkeyper_module@
pkcs11_etoken_module = @pkcs11_etoken_module@
pkcs11_ncipher_module = @pkcs11_ncipher_module@
pkcs11_opensc_module = @pkcs11_opensc_module@
pkcs11_sca6000_module = @pkcs11_sca6000_module@
pkcs11_softhsm_module = @pkcs11_softhsm_module@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
runstatedir = @runstatedir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
man8_MANS = ods-signer.8 ods-signerd.8
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
&& { if test -f $@; then exit 0; else break; fi; }; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign signer/man/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign signer/man/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
ods-signer.8: $(top_builddir)/config.status $(srcdir)/ods-signer.8.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
ods-signerd.8: $(top_builddir)/config.status $(srcdir)/ods-signerd.8.in
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
install-man8: $(man8_MANS)
@$(NORMAL_INSTALL)
@list1='$(man8_MANS)'; \
list2=''; \
test -n "$(man8dir)" \
&& test -n "`echo $$list1$$list2`" \
|| exit 0; \
echo " $(MKDIR_P) '$(DESTDIR)$(man8dir)'"; \
$(MKDIR_P) "$(DESTDIR)$(man8dir)" || exit 1; \
{ for i in $$list1; do echo "$$i"; done; \
if test -n "$$list2"; then \
for i in $$list2; do echo "$$i"; done \
| sed -n '/\.8[a-z]*$$/p'; \
fi; \
} | while read p; do \
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
echo "$$d$$p"; echo "$$p"; \
done | \
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
sed 'N;N;s,\n, ,g' | { \
list=; while read file base inst; do \
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
fi; \
done; \
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
while read files; do \
test -z "$$files" || { \
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
$(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
done; }
uninstall-man8:
@$(NORMAL_UNINSTALL)
@list='$(man8_MANS)'; test -n "$(man8dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)
tags TAGS:
ctags CTAGS:
cscope cscopelist:
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
dist_files=`for file in $$list; do echo $$file; done | \
sed -e "s|^$$srcdirstrip/||;t" \
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
case $$dist_files in \
*/*) $(MKDIR_P) `echo "$$dist_files" | \
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
sort -u` ;; \
esac; \
for file in $$dist_files; do \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
if test -d "$(distdir)/$$file"; then \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
test -f "$(distdir)/$$file" \
|| cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
all-am: Makefile $(MANS)
installdirs:
for dir in "$(DESTDIR)$(man8dir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-am
install-strip:
if test -z '$(STRIP)'; then \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
install; \
else \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
fi
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
distclean: distclean-am
-rm -f Makefile
distclean-am: clean-am distclean-generic
dvi: dvi-am
dvi-am:
html: html-am
html-am:
info: info-am
info-am:
install-data-am: install-man
install-dvi: install-dvi-am
install-dvi-am:
install-exec-am:
install-html: install-html-am
install-html-am:
install-info: install-info-am
install-info-am:
install-man: install-man8
install-pdf: install-pdf-am
install-pdf-am:
install-ps: install-ps-am
install-ps-am:
installcheck-am:
maintainer-clean: maintainer-clean-am
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
pdf: pdf-am
pdf-am:
ps: ps-am
ps-am:
uninstall-am: uninstall-man
uninstall-man: uninstall-man8
.MAKE: install-am install-strip
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
cscopelist-am ctags-am distclean distclean-generic \
distclean-libtool distdir dvi dvi-am html html-am info info-am \
install install-am install-data install-data-am install-dvi \
install-dvi-am install-exec install-exec-am install-html \
install-html-am install-info install-info-am install-man \
install-man8 install-pdf install-pdf-am install-ps \
install-ps-am install-strip installcheck installcheck-am \
installdirs maintainer-clean maintainer-clean-generic \
mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
ps ps-am tags-am uninstall uninstall-am uninstall-man \
uninstall-man8
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
opendnssec-2.0.4/signer/man/ods-signerd.8.in 0000644 0001750 0001750 00000002354 13036123713 015560 0000000 0000000 .TH "ods-signerd" "22" "February 2012" "OpenDNSSEC" "OpenDNSSEC ods-signerd"
.SH "NAME"
.LP
.B ods\-signerd
\- OpenDNSSEC Signer Engine daemon
.SH "SYNOPSIS"
.LP
.B ods\-signerd
.RB [ \-1 ]
.RB [ \-c
.IR FILE ]
.RB [ \-d ]
.RB [ \-h ]
.RB [ \-i ]
.RB [ \-v ]
.RB [ \-V ]
.P
.SH "DESCRIPTION"
.LP
ods\-signerd is part of the OpenDNSSEC software. It will keep your DNS zones
continuous signed. For more information, go to
.B http://www.opendnssec.org
and visit the Documentation page.
.P
.SH "OPTIONS"
.LP
.TP
.B \-1
Run signer engine once, then exit (for debugging purposes).
.TP
.B \-c\fI FILE
Read configuration from file, instead of using the default.
.TP
.B \-d
Run daemon in foreground.
.TP
.B \-h
Show this help.
.TP
.B \-i
Print configuration and exit (for debugging purposes).
.TP
.B \-v
Increase verbosity.
.TP
.B \-V
Show version and exit.
.P
.SH "DIAGNOSTICS"
.LP
will log all the problems via standard syslog(8).
.SH "SEE ALSO"
.LP
ods\-control(8), ods\-enforcerd(8), ods\-enforcer(8),
ods\-hsmspeed(1), ods\-hsmutil(1), ods\-kaspcheck(1),
ods\-ksmutil(1), ods\-signer(8), ods\-timing(5),
ods\-kasp(5), opendnssec(7),
.B http://www.opendnssec.org/
.SH "AUTHORS"
.LP
.B ods\-signerd
was written by NLnet Labs as part of the OpenDNSSEC project.
opendnssec-2.0.4/signer/src/ 0000755 0001750 0001750 00000000000 13036124774 012744 5 0000000 0000000 opendnssec-2.0.4/signer/src/hsm.h 0000644 0001750 0001750 00000004501 13036123713 013614 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Hardware Security Module support.
*
*/
#ifndef SHARED_HSM_H
#define SHARED_HSM_H
#include "config.h"
#include "status.h"
#include "signer/keys.h"
#include "libhsm.h"
#include
#include
#include
#include
/**
* Get key from one of the HSMs, store the DNSKEY and HSM key.
* \param[in] ctx HSM context
* \param[in] owner the zone owner name
* \param[in] key_id key credentials
* \return ods_status status
*
*/
ods_status lhsm_get_key(hsm_ctx_t* ctx, ldns_rdf* owner, key_type* key_id);
/**
* Get RRSIG from one of the HSMs, given a RRset and a key.
* \param[in] ctx HSM context
* \param[in] rrset RRset to be signed
* \param[in] key_id key credentials
* \param[in] owner owner of the keys
* \param[in] inception signature inception
* \param[in] expiration signature expiration
* \return ldns_rr* RRSIG record
*
*/
ldns_rr* lhsm_sign(hsm_ctx_t* ctx, ldns_rr_list* rrset, key_type* key_id,
ldns_rdf* owner, time_t inception, time_t expiration);
#endif /* SHARED_HSM_H */
opendnssec-2.0.4/signer/src/Makefile.am 0000644 0001750 0001750 00000004741 13036123713 014716 0000000 0000000 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
LIBHSM = ${top_builddir}/libhsm/src/lib/libhsm.a
LIBCOMPAT = ${top_builddir}/common/libcompat.a
AM_CPPFLAGS = \
-I$(top_srcdir)/common \
-I$(top_builddir)/common \
-I$(top_srcdir)/libhsm/src/lib \
@SSL_INCLUDES@ \
@XML2_INCLUDES@ \
@LDNS_INCLUDES@
signerdir = @libdir@/opendnssec/signer
sbin_PROGRAMS = ods-signerd ods-signer
# man8_MANS = man/ods-signer.8 man/ods-signerd.8
ods_signerd_SOURCES= ods-signerd.c \
adapter/adapi.c adapter/adapi.h \
adapter/adapter.c adapter/adapter.h \
adapter/addns.c adapter/addns.h \
adapter/adfile.c adapter/adfile.h \
adapter/adutil.c adapter/adutil.h \
daemon/cfg.c daemon/cfg.h \
daemon/cmdhandler.c daemon/cmdhandler.h \
daemon/dnshandler.c daemon/dnshandler.h \
daemon/xfrhandler.c daemon/xfrhandler.h \
daemon/engine.c daemon/engine.h \
daemon/signal.c daemon/signal.h \
daemon/worker.c daemon/worker.h \
parser/addnsparser.c parser/addnsparser.h \
parser/confparser.c parser/confparser.h \
parser/signconfparser.c parser/signconfparser.h \
parser/zonelistparser.c parser/zonelistparser.h \
scheduler/fifoq.c scheduler/fifoq.h \
scheduler/schedule.c scheduler/schedule.h \
scheduler/task.c scheduler/task.h \
signer/backup.c signer/backup.h \
hsm.c hsm.h \
signer/denial.c signer/denial.h \
signer/domain.c signer/domain.h \
signer/ixfr.c signer/ixfr.h \
signer/keys.c signer/keys.h \
signer/namedb.c signer/namedb.h \
signer/nsec3params.c signer/nsec3params.h \
signer/rrset.c signer/rrset.h \
signer/signconf.c signer/signconf.h \
signer/stats.c signer/stats.h \
signer/tools.c signer/tools.h \
signer/zone.c signer/zone.h \
signer/zonelist.c signer/zonelist.h \
wire/acl.c wire/acl.h \
wire/axfr.c wire/axfr.h \
wire/buffer.c wire/buffer.h \
wire/edns.c wire/edns.h \
wire/listener.c wire/listener.h \
wire/netio.c wire/netio.h \
wire/notify.c wire/notify.h \
wire/query.c wire/query.h \
wire/sock.c wire/sock.h \
wire/tcpset.c wire/tcpset.h \
wire/tsig.c wire/tsig.h \
wire/tsig-openssl.c wire/tsig-openssl.h \
wire/xfrd.c wire/xfrd.h
ods_signerd_LDADD= $(LIBHSM)
ods_signerd_LDADD+= $(LIBCOMPAT)
ods_signerd_LDADD+= @LDNS_LIBS@ @XML2_LIBS@ @PTHREAD_LIBS@ @RT_LIBS@ @SSL_LIBS@ @C_LIBS@
ods_signer_SOURCES= ods-signer.c
ods_signer_LDADD= $(LIBHSM)
ods_signer_LDADD+= $(LIBCOMPAT)
ods_signer_LDADD+= @LDNS_LIBS@ @XML2_LIBS@
opendnssec-2.0.4/signer/src/ods-signerd.c 0000644 0001750 0001750 00000012725 13036123713 015245 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* OpenDNSSEC signer engine daemon.
*
*/
#include "config.h"
#include "daemon/engine.h"
#include
#include
#include
#include
#define AUTHOR_NAME "Matthijs Mekking"
#define COPYRIGHT_STR "Copyright (C) 2008-2010 NLnet Labs OpenDNSSEC"
/**
* Prints usage.
*
*/
static void
usage(FILE* out)
{
fprintf(out, "Usage: %s [OPTIONS]\n", "ods-signerd");
fprintf(out, "Start the OpenDNSSEC signer engine daemon.\n\n");
fprintf(out, "Supported options:\n");
fprintf(out, " -c | --config Read configuration from file.\n");
fprintf(out, " -d | --no-daemon Do not daemonize the signer "
"engine.\n");
fprintf(out, " -1 | --single-run Run once, then exit.\n");
fprintf(out, " -h | --help Show this help and exit.\n");
fprintf(out, " -i | --info Print configuration and exit.\n");
fprintf(out, " -v | --verbose Increase verbosity.\n");
fprintf(out, " -V | --version Show version and exit.\n");
fprintf(out, "\nBSD licensed, see LICENSE in source package for "
"details.\n");
fprintf(out, "Version %s. Report bugs to <%s>.\n",
PACKAGE_VERSION, PACKAGE_BUGREPORT);
}
/**
* Prints version.
*
*/
static void
version(FILE* out)
{
fprintf(out, "%s version %s\n", PACKAGE_NAME, PACKAGE_VERSION);
fprintf(out, "Written by %s.\n\n", AUTHOR_NAME);
fprintf(out, "%s. This is free software.\n", COPYRIGHT_STR);
fprintf(out, "See source files for more license information\n");
exit(0);
}
static void
program_setup(int cmdline_verbosity)
{
ods_log_init("ods-signerd", 0, NULL, cmdline_verbosity);
ods_log_verbose("[engine] starting signer");
/* initialize */
xmlInitGlobals();
xmlInitParser();
xmlInitThreads();
tzset(); /* for portability */
}
static void
program_teardown()
{
xmlCleanupParser();
xmlCleanupGlobals();
xmlCleanupThreads();
ods_log_close();
}
/**
* Main. start engine and run it.
*
*/
int
main(int argc, char* argv[])
{
int c, returncode;
int options_index = 0;
int info = 0;
int single_run = 0;
int daemonize = 1;
int cmdline_verbosity = 0;
char *time_arg = NULL;
const char* cfgfile = ODS_SE_CFGFILE;
static struct option long_options[] = {
{"single-run", no_argument, 0, '1'},
{"config", required_argument, 0, 'c'},
{"no-daemon", no_argument, 0, 'd'},
{"help", no_argument, 0, 'h'},
{"info", no_argument, 0, 'i'},
{"verbose", no_argument, 0, 'v'},
{"version", no_argument, 0, 'V'},
{"set-time", required_argument, 0, 256},
{ 0, 0, 0, 0}
};
/* parse the commandline */
while ((c=getopt_long(argc, argv, "1c:dhivV",
long_options, &options_index)) != -1) {
switch (c) {
case '1':
single_run = 1;
break;
case 'c':
cfgfile = optarg;
break;
case 'd':
daemonize = 0;
break;
case 'h':
usage(stdout);
exit(0);
break;
case 'i':
info = 1;
break;
case 'v':
cmdline_verbosity++;
break;
case 'V':
version(stdout);
exit(0);
break;
case 256:
time_arg = optarg;
break;
default:
usage(stderr);
exit(2);
break;
}
}
argc -= optind;
argv += optind;
if (argc != 0) {
usage(stderr);
exit(2);
}
if (time_arg) {
if(set_time_now_str(time_arg)) {
fprintf(stderr, "Error: Failed to interpret start time argument. Daemon not started.\n");
return 1;
}
}
/* main stuff */
fprintf(stdout, "OpenDNSSEC signer engine version %s\n", PACKAGE_VERSION);
program_setup(cmdline_verbosity);
returncode = engine_start(cfgfile, cmdline_verbosity, daemonize,
info, single_run);
program_teardown();
return returncode;
}
opendnssec-2.0.4/signer/src/signer/ 0000755 0001750 0001750 00000000000 13036124774 014233 5 0000000 0000000 opendnssec-2.0.4/signer/src/signer/keys.c 0000644 0001750 0001750 00000015274 13036123713 015273 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signing keys.
*
*/
#include "file.h"
#include "log.h"
#include "util.h"
#include "signer/backup.h"
#include "signer/keys.h"
#include "signer/signconf.h"
#include "status.h"
static const char* key_str = "keys";
/**
* Create a new key list.
*
*/
keylist_type*
keylist_create(signconf_type* signconf)
{
keylist_type* kl = NULL;
if (!signconf) {
return NULL;
}
CHECKALLOC(kl = (keylist_type*) malloc((sizeof(keylist_type))));
if (!kl) {
ods_log_error("[%s] create list failed: allocator_alloc() failed",
key_str);
return NULL;
}
kl->sc = signconf;
kl->count = 0;
kl->keys = NULL;
return kl;
}
/**
* Lookup a key in the key list by locator.
*
*/
key_type*
keylist_lookup_by_locator(keylist_type* kl, const char* locator)
{
uint16_t i = 0;
if (!kl || !locator || kl->count <= 0) {
return NULL;
}
for (i=0; i < kl->count; i++) {
if (&kl->keys[i] && kl->keys[i].locator) {
if (ods_strcmp(kl->keys[i].locator, locator) == 0) {
return &kl->keys[i];
}
}
}
return NULL;
}
/**
* Push a key to the key list.
*
*/
key_type*
keylist_push(keylist_type* kl, const char* locator, const char* resourcerecord,
uint8_t algorithm, uint32_t flags, int publish, int ksk, int zsk)
{
key_type* keys_old = NULL;
ods_log_assert(kl);
keys_old = kl->keys;
CHECKALLOC(kl->keys = (key_type*) malloc((kl->count + 1) * sizeof(key_type)));
if (!kl->keys) {
ods_fatal_exit("[%s] unable to add key: allocator_alloc() failed",
key_str);
}
if (keys_old) {
memcpy(kl->keys, keys_old, (kl->count) * sizeof(key_type));
}
free(keys_old);
kl->count++;
kl->keys[kl->count -1].locator = locator;
kl->keys[kl->count -1].resourcerecord = resourcerecord;
kl->keys[kl->count -1].algorithm = algorithm;
kl->keys[kl->count -1].flags = flags;
kl->keys[kl->count -1].publish = publish;
kl->keys[kl->count -1].ksk = ksk;
kl->keys[kl->count -1].zsk = zsk;
kl->keys[kl->count -1].dnskey = NULL;
kl->keys[kl->count -1].params = NULL;
return &kl->keys[kl->count -1];
}
/**
* Log key.
*
*/
static void
key_log(key_type* key, const char* name)
{
if (!key) {
return;
}
ods_log_debug("[%s] zone %s key: LOCATOR[%s] FLAGS[%u] ALGORITHM[%u] "
"KSK[%i] ZSK[%i] PUBLISH[%i]", key_str, name?name:"(null)", key->locator,
key->flags, key->algorithm, key->ksk, key->zsk, key->publish);
}
/**
* Log key list.
*
*/
void
keylist_log(keylist_type* kl, const char* name)
{
uint16_t i = 0;
if (!kl || kl->count <= 0) {
return;
}
for (i=0; i < kl->count; i++) {
key_log(&kl->keys[i], name);
}
}
/**
* Clean up key.
*
*/
static void
key_delfunc(key_type* key)
{
if (!key) {
return;
}
/* ldns_rr_free(key->dnskey); */
hsm_sign_params_free(key->params);
free((void*) key->locator);
}
/**
* Clean up key list.
*
*/
void
keylist_cleanup(keylist_type* kl)
{
uint16_t i = 0;
if (!kl) {
return;
}
for (i=0; i < kl->count; i++) {
key_delfunc(&kl->keys[i]);
}
free(kl->keys);
free(kl);
}
/**
* Backup key.
*
*/
static void
key_backup(FILE* fd, key_type* key, const char* version)
{
if (!fd || !key) {
return;
}
fprintf(fd, ";;Key: locator %s algorithm %u flags %u publish %i ksk %i zsk %i keytag %d\n", key->locator, (unsigned) key->algorithm,
(unsigned) key->flags, key->publish, key->ksk, key->zsk, ldns_calc_keytag(key->dnskey));
if (strcmp(version, ODS_SE_FILE_MAGIC_V2) == 0) {
if (key->dnskey) {
(void)util_rr_print(fd, key->dnskey);
}
fprintf(fd, ";;Keydone\n");
}
}
/**
* Recover key from backup.
*
*/
key_type*
key_recover2(FILE* fd, keylist_type* kl)
{
const char* locator = NULL;
const char* resourcerecord = NULL;
uint8_t algorithm = 0;
uint32_t flags = 0;
int publish = 0;
int ksk = 0;
int zsk = 0;
int keytag = 0; /* We are not actually interested but we must
parse it to continue correctly in the stream.
When reading 1.4.8 or later version backup file, the real value of keytag is
rfc5011, but not importat due to not using it.*/
ods_log_assert(fd);
if (!backup_read_check_str(fd, "locator") ||
!backup_read_str(fd, &locator) ||
!backup_read_check_str(fd, "algorithm") ||
!backup_read_uint8_t(fd, &algorithm) ||
!backup_read_check_str(fd, "flags") ||
!backup_read_uint32_t(fd, &flags) ||
!backup_read_check_str(fd, "publish") ||
!backup_read_int(fd, &publish) ||
!backup_read_check_str(fd, "ksk") ||
!backup_read_int(fd, &ksk) ||
!backup_read_check_str(fd, "zsk") ||
!backup_read_int(fd, &zsk) ||
!backup_read_check_str(fd, "keytag") ||
!backup_read_int(fd, &keytag)) {
if (locator) {
free((void*)locator);
locator = NULL;
}
return NULL;
}
/* key ok */
return keylist_push(kl, locator, resourcerecord, algorithm, flags, publish, ksk, zsk);
}
/**
* Backup key list.
*
*/
void
keylist_backup(FILE* fd, keylist_type* kl, const char* version)
{
uint16_t i = 0;
if (!fd || !kl || kl->count <= 0) {
return;
}
for (i=0; i < kl->count; i++) {
key_backup(fd, &kl->keys[i], version);
}
}
opendnssec-2.0.4/signer/src/signer/backup.h 0000644 0001750 0001750 00000007332 13036123676 015576 0000000 0000000 /*
* Copyright (c) 2006-2010 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Recover from backup.
*
*/
#ifndef SIGNER_BACKUP_H
#define SIGNER_BACKUP_H
#include "config.h"
#include "duration.h"
#include "file.h"
#include "status.h"
#include
/**
* Read token from backup file.
* \param[in] in input file descriptor
* \return char* read token
*
*/
char* backup_read_token(FILE* in);
/**
* Read and match a string from backup file.
* \param[in] in input file descriptor
* \param[in] str string to match
* \return 1 if string was read and matched, 0 otherwise
*
*/
int backup_read_check_str(FILE* in, const char* str);
/**
* Read a string from backup file.
* \param[in] in input file descriptor
* \param[out] string storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_str(FILE* in, const char** str);
/**
* Read time from backup file.
* \param[in] in input file descriptor
* \param[out] v time_t storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_time_t(FILE* in, time_t* v);
/**
* Read duration from backup file.
* \param[in] in input file descriptor
* \param[out] v duration storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_duration(FILE* in, duration_type** v);
/**
* Read rr type from backup file.
* \param[in] in input file descriptor
* \param[out] v rr type storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_rr_type(FILE* in, ldns_rr_type* v);
/**
* Read integer from backup file.
* \param[in] in input file descriptor
* \param[out] v integer storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_int(FILE* in, int* v);
/**
* Read 8bit unsigned integer from backup file.
* \param[in] in input file descriptor
* \param[out] v uint8_t storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_uint8_t(FILE* in, uint8_t* v);
/**
* Read 32bit unsigned integer from backup file.
* \param[in] in input file descriptor
* \param[out] v uint32_t storage
* \return int 1 on success, 0 otherwise
*
*/
int backup_read_uint32_t(FILE* in, uint32_t* v);
/**
* Read namedb from backup file.
* \param[in] in input file descriptor
* \param[in] zone zone reference
* \return ods_status status
*
*/
ods_status backup_read_namedb(FILE* in, void* zone);
/**
* Read ixfr journal from file.
* \param[in] in input file descriptor
* \param[in] zone zone reference
* \return ods_status status
*
*/
ods_status backup_read_ixfr(FILE* in, void* zone);
#endif /* SIGNER_BACKUP_H */
opendnssec-2.0.4/signer/src/signer/zone.c 0000644 0001750 0001750 00000113736 13036123713 015275 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone.
*
*/
#include "adapter/adapter.h"
#include "file.h"
#include "hsm.h"
#include "locks.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/backup.h"
#include "signer/zone.h"
#include "wire/netio.h"
#include "compat.h"
#include
static const char* zone_str = "zone";
/**
* Create a new zone.
*
*/
zone_type*
zone_create(char* name, ldns_rr_class klass)
{
zone_type* zone = NULL;
int err;
if (!name || !klass) {
return NULL;
}
CHECKALLOC(zone = (zone_type*) calloc(1, sizeof(zone_type)));
/* [start] PS 9218653: Drop trailing dot in domain name */
if (strlen(name) > 1 && name[strlen(name)-1] == '.') {
name[strlen(name)-1] = '\0';
}
/* [end] PS 9218653 */
if (pthread_mutex_init(&zone->zone_lock, NULL)) {
free(zone);
return NULL;
}
if (pthread_mutex_init(&zone->xfr_lock, NULL)) {
(void)pthread_mutex_destroy(&zone->zone_lock);
free(zone);
return NULL;
}
zone->name = strdup(name);
if (!zone->name) {
ods_log_error("[%s] unable to create zone %s: allocator_strdup() "
"failed", zone_str, name);
zone_cleanup(zone);
return NULL;
}
zone->klass = klass;
zone->default_ttl = 3600; /* TODO: configure --default-ttl option? */
zone->apex = ldns_dname_new_frm_str(name);
/* check zone->apex? */
zone->notify_command = NULL;
zone->notify_ns = NULL;
zone->notify_args = NULL;
zone->policy_name = NULL;
zone->signconf_filename = NULL;
zone->adinbound = NULL;
zone->adoutbound = NULL;
zone->zl_status = ZONE_ZL_OK;
zone->task = NULL;
zone->xfrd = NULL;
zone->notify = NULL;
zone->db = namedb_create((void*)zone);
if (!zone->db) {
ods_log_error("[%s] unable to create zone %s: namedb_create() "
"failed", zone_str, name);
zone_cleanup(zone);
return NULL;
}
zone->ixfr = ixfr_create((void*)zone);
if (!zone->ixfr) {
ods_log_error("[%s] unable to create zone %s: ixfr_create() "
"failed", zone_str, name);
zone_cleanup(zone);
return NULL;
}
zone->signconf = signconf_create();
if (!zone->signconf) {
ods_log_error("[%s] unable to create zone %s: signconf_create() "
"failed", zone_str, name);
zone_cleanup(zone);
return NULL;
}
zone->stats = stats_create();
zone->rrstore = rrset_store_initialize();
return zone;
}
/**
* Load signer configuration for zone.
*
*/
ods_status
zone_load_signconf(zone_type* zone, signconf_type** new_signconf)
{
ods_status status = ODS_STATUS_OK;
signconf_type* signconf = NULL;
char* datestamp = NULL;
if (!zone || !zone->name || !zone->signconf) {
return ODS_STATUS_ASSERT_ERR;
}
if (!zone->signconf_filename) {
ods_log_warning("[%s] zone %s has no signconf filename, treat as "
"insecure?", zone_str, zone->name);
return ODS_STATUS_INSECURE;
}
status = signconf_update(&signconf, zone->signconf_filename,
zone->signconf->last_modified);
if (status == ODS_STATUS_OK) {
if (!signconf) {
/* this is unexpected */
ods_log_alert("[%s] unable to load signconf for zone %s: signconf "
"status ok but no signconf stored", zone_str, zone->name);
return ODS_STATUS_ASSERT_ERR;
}
(void)time_datestamp(signconf->last_modified, "%Y-%m-%d %T",
&datestamp);
ods_log_debug("[%s] zone %s signconf file %s is modified since %s",
zone_str, zone->name, zone->signconf_filename,
datestamp?datestamp:"Unknown");
free((void*)datestamp);
*new_signconf = signconf;
} else if (status == ODS_STATUS_UNCHANGED) {
/* OPENDNSSEC-686: changes happening within one second will not be
* seen
*/
(void)time_datestamp(zone->signconf->last_modified,
"%Y-%m-%d %T", &datestamp);
ods_log_verbose("[%s] zone %s signconf file %s is unchanged since "
"%s", zone_str, zone->name, zone->signconf_filename,
datestamp?datestamp:"Unknown");
free((void*)datestamp);
} else {
ods_log_error("[%s] unable to load signconf for zone %s: signconf %s "
"%s", zone_str, zone->name, zone->signconf_filename,
ods_status2str(status));
}
return status;
}
/**
* Reschedule task for zone.
*
*/
ods_status
zone_reschedule_task(zone_type* zone, schedule_type* taskq, task_id what)
{
task_type* task = NULL;
ods_status status = ODS_STATUS_OK;
ods_log_assert(taskq);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->task);
ods_log_debug("[%s] reschedule task for zone %s", zone_str, zone->name);
lock_basic_lock(&taskq->schedule_lock);
task = unschedule_task(taskq, zone->task);
if (task != NULL) {
if (task->what != what) {
task->halted = task->what;
task->halted_when = task->when;
task->interrupt = what;
}
/** Only reschedule if what to do is lower than what was scheduled. */
if (task->what > what) {
task->what = what;
}
task->when = time_now();
status = schedule_task(taskq, task, 0);
} else {
/* task not queued, being worked on? */
ods_log_verbose("[%s] unable to reschedule task for zone %s now: "
"task is not queued (task will be rescheduled when it is put "
"back on the queue)", zone_str, zone->name);
task = zone->task;
task->interrupt = what;
/* task->halted(_when) set by worker */
}
lock_basic_unlock(&taskq->schedule_lock);
zone->task = task;
return status;
}
/**
* Publish the keys as indicated by the signer configuration.
*
*/
ods_status
zone_publish_dnskeys(zone_type* zone)
{
hsm_ctx_t* ctx = NULL;
uint32_t ttl = 0;
unsigned int i;
ods_status status = ODS_STATUS_OK;
rrset_type* rrset = NULL;
rr_type* dnskey = NULL;
if (!zone || !zone->db || !zone->signconf || !zone->signconf->keys) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_assert(zone->name);
/* hsm access */
ctx = hsm_create_context();
if (ctx == NULL) {
ods_log_error("[%s] unable to publish keys for zone %s: "
"error creating libhsm context", zone_str, zone->name);
return ODS_STATUS_HSM_ERR;
}
ttl = zone->default_ttl;
/* dnskey ttl */
if (zone->signconf->dnskey_ttl) {
ttl = (uint32_t) duration2time(zone->signconf->dnskey_ttl);
}
/* publish keys */
for (i=0; i < zone->signconf->keys->count; i++) {
if (!zone->signconf->keys->keys[i].publish) {
continue;
}
if (!zone->signconf->keys->keys[i].dnskey) {
/* get dnskey */
if (zone->signconf->keys->keys[i].resourcerecord) {
if ((status = rrset_getliteralrr(&zone->signconf->keys->keys[i].dnskey, zone->signconf->keys->keys[i].resourcerecord, ttl, zone->apex)) != ODS_STATUS_OK) {
ods_log_error("[%s] unable to publish dnskeys for zone %s: "
"error decoding literal dnskey", zone_str, zone->name);
hsm_destroy_context(ctx);
return status;
}
} else {
status = lhsm_get_key(ctx, zone->apex,
&zone->signconf->keys->keys[i]);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to publish dnskeys for zone %s: "
"error creating dnskey", zone_str, zone->name);
break;
}
}
}
ods_log_debug("[%s] publish %s DNSKEY locator %s", zone_str,
zone->name, zone->signconf->keys->keys[i].locator);
ods_log_assert(zone->signconf->keys->keys[i].dnskey);
ldns_rr_set_ttl(zone->signconf->keys->keys[i].dnskey, ttl);
ldns_rr_set_class(zone->signconf->keys->keys[i].dnskey, zone->klass);
status = zone_add_rr(zone, zone->signconf->keys->keys[i].dnskey, 0);
if (status == ODS_STATUS_UNCHANGED) {
/* rr already exists, adjust pointer */
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_DNSKEY);
ods_log_assert(rrset);
dnskey = rrset_lookup_rr(rrset,
zone->signconf->keys->keys[i].dnskey);
ods_log_assert(dnskey);
if (dnskey->rr != zone->signconf->keys->keys[i].dnskey) {
ldns_rr_free(zone->signconf->keys->keys[i].dnskey);
}
zone->signconf->keys->keys[i].dnskey = dnskey->rr;
status = ODS_STATUS_OK;
} else if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to publish dnskeys for zone %s: "
"error adding dnskey", zone_str, zone->name);
break;
}
}
/* done */
hsm_destroy_context(ctx);
return status;
}
/**
* Unlink DNSKEY RRs.
*
*/
void
zone_rollback_dnskeys(zone_type* zone)
{
uint16_t i = 0;
rrset_type* rrset = NULL;
rr_type* dnskey = NULL;
if (!zone || !zone->signconf || !zone->signconf->keys) {
return;
}
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_DNSKEY);
/* unlink dnskey rrs */
for (i=0; i < zone->signconf->keys->count; i++) {
if (rrset && zone->signconf->keys->keys[i].dnskey) {
dnskey = rrset_lookup_rr(rrset,
zone->signconf->keys->keys[i].dnskey);
if (dnskey && !dnskey->exists &&
dnskey->rr == zone->signconf->keys->keys[i].dnskey) {
zone->signconf->keys->keys[i].dnskey = NULL;
}
}
}
}
/**
* Publish the NSEC3 parameters as indicated by the signer configuration.
*
*/
ods_status
zone_publish_nsec3param(zone_type* zone)
{
rrset_type* rrset = NULL;
rr_type* n3prr = NULL;
ldns_rr* rr = NULL;
ods_status status = ODS_STATUS_OK;
if (!zone || !zone->name || !zone->db || !zone->signconf) {
return ODS_STATUS_ASSERT_ERR;
}
if (!zone->signconf->nsec3params) {
/* NSEC */
ods_log_assert(zone->signconf->nsec_type == LDNS_RR_TYPE_NSEC);
return ODS_STATUS_OK;
}
if (!zone->signconf->nsec3params->rr) {
uint32_t paramttl =
(uint32_t) duration2time(zone->signconf->nsec3param_ttl);
rr = ldns_rr_new_frm_type(LDNS_RR_TYPE_NSEC3PARAMS);
if (!rr) {
ods_log_error("[%s] unable to publish nsec3params for zone %s: "
"error creating rr (%s)", zone_str, zone->name,
ods_status2str(status));
return ODS_STATUS_MALLOC_ERR;
}
ldns_rr_set_class(rr, zone->klass);
ldns_rr_set_ttl(rr, paramttl);
ldns_rr_set_owner(rr, ldns_rdf_clone(zone->apex));
ldns_nsec3_add_param_rdfs(rr,
zone->signconf->nsec3params->algorithm, 0,
zone->signconf->nsec3params->iterations,
zone->signconf->nsec3params->salt_len,
zone->signconf->nsec3params->salt_data);
/**
* Always set bit 7 of the flags to zero,
* according to rfc5155 section 11
*/
ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(rr, 1)), 7, 0);
zone->signconf->nsec3params->rr = rr;
}
/* Delete all nsec3param rrs. */
(void) zone_del_nsec3params(zone);
ods_log_assert(zone->signconf->nsec3params->rr);
status = zone_add_rr(zone, zone->signconf->nsec3params->rr, 0);
if (status == ODS_STATUS_UNCHANGED) {
/* rr already exists, adjust pointer */
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_NSEC3PARAMS);
ods_log_assert(rrset);
n3prr = rrset_lookup_rr(rrset, zone->signconf->nsec3params->rr);
ods_log_assert(n3prr);
if (n3prr->rr != zone->signconf->nsec3params->rr) {
ldns_rr_free(zone->signconf->nsec3params->rr);
}
zone->signconf->nsec3params->rr = n3prr->rr;
status = ODS_STATUS_OK;
} else if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to publish nsec3params for zone %s: "
"error adding nsec3params (%s)", zone_str,
zone->name, ods_status2str(status));
}
return status;
}
/**
* Unlink NSEC3PARAM RR.
*
*/
void
zone_rollback_nsec3param(zone_type* zone)
{
rrset_type* rrset = NULL;
rr_type* n3prr = NULL;
if (!zone || !zone->signconf || !zone->signconf->nsec3params) {
return;
}
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_NSEC3PARAMS);
if (rrset && zone->signconf->nsec3params->rr) {
n3prr = rrset_lookup_rr(rrset, zone->signconf->nsec3params->rr);
if (n3prr && !n3prr->exists &&
n3prr->rr == zone->signconf->nsec3params->rr) {
zone->signconf->nsec3params->rr = NULL;
}
}
}
/**
* Prepare keys for signing.
*
*/
ods_status
zone_prepare_keys(zone_type* zone)
{
hsm_ctx_t* ctx = NULL;
uint16_t i = 0;
ods_status status = ODS_STATUS_OK;
if (!zone || !zone->db || !zone->signconf || !zone->signconf->keys) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_assert(zone->name);
/* hsm access */
ctx = hsm_create_context();
if (ctx == NULL) {
ods_log_error("[%s] unable to prepare signing keys for zone %s: "
"error creating libhsm context", zone_str, zone->name);
return ODS_STATUS_HSM_ERR;
}
/* prepare keys */
for (i=0; i < zone->signconf->keys->count; i++) {
if(zone->signconf->dnskey_signature != NULL && zone->signconf->keys->keys[i].ksk)
continue;
/* get dnskey */
status = lhsm_get_key(ctx, zone->apex, &zone->signconf->keys->keys[i]);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to prepare signing keys for zone %s: "
"error getting dnskey", zone_str, zone->name);
break;
}
ods_log_assert(zone->signconf->keys->keys[i].dnskey);
ods_log_assert(zone->signconf->keys->keys[i].params);
}
/* done */
hsm_destroy_context(ctx);
return status;
}
/**
* Update serial.
*
*/
ods_status
zone_update_serial(zone_type* zone)
{
ods_status status = ODS_STATUS_OK;
rrset_type* rrset = NULL;
rr_type* soa = NULL;
ldns_rr* rr = NULL;
ldns_rdf* soa_rdata = NULL;
ods_log_assert(zone);
ods_log_assert(zone->apex);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
if (zone->db->serial_updated) {
/* already done, unmark and return ok */
ods_log_debug("[%s] zone %s soa serial already up to date",
zone_str, zone->name);
zone->db->serial_updated = 0;
return ODS_STATUS_OK;
}
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_SOA);
if (!rrset || !rrset->rrs || !rrset->rrs[0].rr) {
ods_log_error("[%s] unable to update zone %s soa serial: failed to "
"find soa rrset", zone_str, zone->name);
return ODS_STATUS_ERR;
}
ods_log_assert(rrset);
ods_log_assert(rrset->rrs);
ods_log_assert(rrset->rrs[0].rr);
rr = ldns_rr_clone(rrset->rrs[0].rr);
if (!rr) {
ods_log_error("[%s] unable to update zone %s soa serial: failed to "
"clone soa rr", zone_str, zone->name);
return ODS_STATUS_ERR;
}
status = namedb_update_serial(zone->db, zone->name,
zone->signconf->soa_serial, zone->db->inbserial);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to update zone %s soa serial: %s",
zone_str, zone->name, ods_status2str(status));
if (status == ODS_STATUS_CONFLICT_ERR) {
ods_log_error("[%s] If this is the result of a key rollover, "
"please increment the serial in the unsigned zone %s",
zone_str, zone->name);
}
ldns_rr_free(rr);
return status;
}
ods_log_verbose("[%s] zone %s set soa serial to %u", zone_str,
zone->name, zone->db->intserial);
soa_rdata = ldns_rr_set_rdf(rr,
ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
zone->db->intserial), SE_SOA_RDATA_SERIAL);
if (soa_rdata) {
ldns_rdf_deep_free(soa_rdata);
soa_rdata = NULL;
} else {
ods_log_error("[%s] unable to update zone %s soa serial: failed to "
"replace soa serial rdata", zone_str, zone->name);
ldns_rr_free(rr);
return ODS_STATUS_ERR;
}
soa = rrset_add_rr(rrset, rr);
ods_log_assert(soa);
rrset_diff(rrset, 0, 0);
zone->db->serial_updated = 0;
return ODS_STATUS_OK;
}
/**
* Lookup RRset.
*
*/
rrset_type*
zone_lookup_rrset(zone_type* zone, ldns_rdf* owner, ldns_rr_type type)
{
domain_type* domain = NULL;
if (!zone || !owner || !type) {
return NULL;
}
domain = namedb_lookup_domain(zone->db, owner);
if (!domain) {
return NULL;
}
return domain_lookup_rrset(domain, type);
}
/**
* Add RR.
*
*/
ods_status
zone_add_rr(zone_type* zone, ldns_rr* rr, int do_stats)
{
domain_type* domain = NULL;
rrset_type* rrset = NULL;
rr_type* record = NULL;
ods_status status = ODS_STATUS_OK;
char* str = NULL;
int i;
ods_log_assert(rr);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
/* If we already have this RR, return ODS_STATUS_UNCHANGED */
domain = namedb_lookup_domain(zone->db, ldns_rr_owner(rr));
if (!domain) {
domain = namedb_add_domain(zone->db, ldns_rr_owner(rr));
if (!domain) {
ods_log_error("[%s] unable to add RR to zone %s: "
"failed to add domain", zone_str, zone->name);
return ODS_STATUS_ERR;
}
if (ldns_dname_compare(domain->dname, zone->apex) == 0) {
domain->is_apex = 1;
} else {
status = namedb_domain_entize(zone->db, domain, zone->apex);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to add RR to zone %s: "
"failed to entize domain", zone_str, zone->name);
return ODS_STATUS_ERR;
}
}
}
rrset = domain_lookup_rrset(domain, ldns_rr_get_type(rr));
if (!rrset) {
rrset = rrset_create(domain->zone, ldns_rr_get_type(rr));
if (!rrset) {
ods_log_error("[%s] unable to add RR to zone %s: "
"failed to add RRset", zone_str, zone->name);
return ODS_STATUS_ERR;
}
domain_add_rrset(domain, rrset);
}
record = rrset_lookup_rr(rrset, rr);
if (record && ldns_rr_ttl(rr) != ldns_rr_ttl(record->rr))
record = NULL;
if (record) {
record->is_added = 1; /* already exists, just mark added */
record->is_removed = 0; /* unset is_removed */
return ODS_STATUS_UNCHANGED;
} else {
record = rrset_add_rr(rrset, rr);
ods_log_assert(record);
ods_log_assert(record->rr);
ods_log_assert(record->is_added);
if (ldns_rr_ttl(rr) != ldns_rr_ttl(rrset->rrs[0].rr)) {
str = ldns_rr2str(rr);
str[(strlen(str)) - 1] = '\0';
for (i = 0; i < strlen(str); i++) {
if (str[i] == '\t') {
str[i] = ' ';
}
}
ods_log_error("In zone file %s: TTL for the record '%s' set to %d", zone->name, str, ldns_rr_ttl(rrset->rrs[0].rr));
LDNS_FREE(str);
}
}
/* update stats */
if (do_stats && zone->stats) {
zone->stats->sort_count += 1;
}
return ODS_STATUS_OK;
}
/**
* Delete RR.
*
*/
ods_status
zone_del_rr(zone_type* zone, ldns_rr* rr, int do_stats)
{
domain_type* domain = NULL;
rrset_type* rrset = NULL;
rr_type* record = NULL;
ods_log_assert(rr);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
domain = namedb_lookup_domain(zone->db, ldns_rr_owner(rr));
if (!domain) {
ods_log_warning("[%s] unable to delete RR from zone %s: "
"domain not found", zone_str, zone->name);
return ODS_STATUS_UNCHANGED;
}
rrset = domain_lookup_rrset(domain, ldns_rr_get_type(rr));
if (!rrset) {
ods_log_warning("[%s] unable to delete RR from zone %s: "
"RRset not found", zone_str, zone->name);
return ODS_STATUS_UNCHANGED;
}
record = rrset_lookup_rr(rrset, rr);
if (!record) {
ods_log_error("[%s] unable to delete RR from zone %s: "
"RR not found", zone_str, zone->name);
return ODS_STATUS_UNCHANGED;
}
record->is_removed = 1;
record->is_added = 0; /* unset is_added */
/* update stats */
if (do_stats && zone->stats) {
zone->stats->sort_count -= 1;
}
return ODS_STATUS_OK;
}
/**
* Delete NSEC3PARAM RRs.
*
* Marks all NSEC3PARAM records as removed.
*/
ods_status
zone_del_nsec3params(zone_type* zone)
{
domain_type* domain = NULL;
rrset_type* rrset = NULL;
int i;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
domain = namedb_lookup_domain(zone->db, zone->apex);
if (!domain) {
ods_log_verbose("[%s] unable to delete RR from zone %s: "
"domain not found", zone_str, zone->name);
return ODS_STATUS_UNCHANGED;
}
rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_NSEC3PARAMS);
if (!rrset) {
ods_log_verbose("[%s] NSEC3PARAM in zone %s not found: "
"skipping delete", zone_str, zone->name);
return ODS_STATUS_UNCHANGED;
}
/* We don't actually delete the record as we still need the
* information in the IXFR. Just set it as removed. The code
* inserting the new record may flip this flag when the record
* hasn't changed. */
for (i=0; i < rrset->rr_count; i++) {
rrset->rrs[i].is_removed = 1;
}
return ODS_STATUS_OK;
}
/**
* Merge zones.
*
*/
void
zone_merge(zone_type* z1, zone_type* z2)
{
const char* str;
adapter_type* adtmp = NULL;
if (!z1 || !z2) {
return;
}
/* policy name */
if (ods_strcmp(z2->policy_name, z1->policy_name) != 0) {
if (z2->policy_name) {
str = strdup(z2->policy_name);
if (!str) {
ods_log_error("[%s] failed to merge policy %s name to zone "
"%s", zone_str, z2->policy_name, z1->name);
} else {
free((void*)z1->policy_name);
z1->policy_name = str;
z1->zl_status = ZONE_ZL_UPDATED;
}
} else {
free((void*)z1->policy_name);
z1->policy_name = NULL;
z1->zl_status = ZONE_ZL_UPDATED;
}
}
/* signconf filename */
if (ods_strcmp(z2->signconf_filename, z1->signconf_filename) != 0) {
if (z2->signconf_filename) {
str = strdup(z2->signconf_filename);
if (!str) {
ods_log_error("[%s] failed to merge signconf filename %s to "
"zone %s", zone_str, z2->policy_name, z1->name);
} else {
free((void*)z1->signconf_filename);
z1->signconf_filename = str;
z1->zl_status = ZONE_ZL_UPDATED;
}
} else {
free((void*)z1->signconf_filename);
z1->signconf_filename = NULL;
z1->zl_status = ZONE_ZL_UPDATED;
}
}
/* adapters */
if (adapter_compare(z2->adinbound, z1->adinbound) != 0) {
adtmp = z2->adinbound;
z2->adinbound = z1->adinbound;
z1->adinbound = adtmp;
adtmp = NULL;
}
if (adapter_compare(z2->adoutbound, z1->adoutbound) != 0) {
adtmp = z2->adoutbound;
z2->adoutbound = z1->adoutbound;
z1->adoutbound = adtmp;
adtmp = NULL;
}
}
/**
* Clean up zone.
*
*/
void
zone_cleanup(zone_type* zone)
{
if (!zone) {
return;
}
ldns_rdf_deep_free(zone->apex);
adapter_cleanup(zone->adinbound);
adapter_cleanup(zone->adoutbound);
namedb_cleanup(zone->db);
ixfr_cleanup(zone->ixfr);
xfrd_cleanup(zone->xfrd, 1);
notify_cleanup(zone->notify);
signconf_cleanup(zone->signconf);
stats_cleanup(zone->stats);
free(zone->notify_command);
free(zone->notify_args);
free((void*)zone->policy_name);
free((void*)zone->signconf_filename);
free((void*)zone->name);
collection_class_destroy(&zone->rrstore);
lock_basic_destroy(&zone->xfr_lock);
lock_basic_destroy(&zone->zone_lock);
free(zone);
}
/**
* Recover zone from backup.
*
*/
ods_status
zone_recover2(zone_type* zone)
{
char* filename = NULL;
FILE* fd = NULL;
const char* token = NULL;
time_t when = 0;
task_type* task = NULL;
ods_status status = ODS_STATUS_OK;
/* zone part */
int klass = 0;
uint32_t inbound = 0, internal = 0, outbound = 0;
/* signconf part */
time_t lastmod = 0;
/* nsec3params part */
const char* salt = NULL;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->signconf);
ods_log_assert(zone->db);
filename = ods_build_path(zone->name, ".backup2", 0, 1);
if (!filename) {
return ODS_STATUS_MALLOC_ERR;
}
fd = ods_fopen(filename, NULL, "r");
if (fd) {
/* start recovery */
if (!backup_read_check_str(fd, ODS_SE_FILE_MAGIC_V3)) {
ods_log_error("[%s] corrupted backup file zone %s: read magic "
"error", zone_str, zone->name);
goto recover_error2;
}
if (!backup_read_check_str(fd, ";;Time:") |
!backup_read_time_t(fd, &when)) {
ods_log_error("[%s] corrupted backup file zone %s: read time "
"error", zone_str, zone->name);
goto recover_error2;
}
/* zone stuff */
if (!backup_read_check_str(fd, ";;Zone:") |
!backup_read_check_str(fd, "name") |
!backup_read_check_str(fd, zone->name)) {
ods_log_error("[%s] corrupted backup file zone %s: read name "
"error", zone_str, zone->name);
goto recover_error2;
}
if (!backup_read_check_str(fd, "class") |
!backup_read_int(fd, &klass)) {
ods_log_error("[%s] corrupted backup file zone %s: read class "
"error", zone_str, zone->name);
goto recover_error2;
}
if (!backup_read_check_str(fd, "inbound") |
!backup_read_uint32_t(fd, &inbound) |
!backup_read_check_str(fd, "internal") |
!backup_read_uint32_t(fd, &internal) |
!backup_read_check_str(fd, "outbound") |
!backup_read_uint32_t(fd, &outbound)) {
ods_log_error("[%s] corrupted backup file zone %s: read serial "
"error", zone_str, zone->name);
goto recover_error2;
}
zone->klass = (ldns_rr_class) klass;
zone->db->inbserial = inbound;
zone->db->intserial = internal;
zone->db->outserial = outbound;
/* signconf part */
if (!backup_read_check_str(fd, ";;Signconf:") |
!backup_read_check_str(fd, "lastmod") |
!backup_read_time_t(fd, &lastmod) |
!backup_read_check_str(fd, "maxzonettl") |
!backup_read_check_str(fd, "0") |
!backup_read_check_str(fd, "resign") |
!backup_read_duration(fd, &zone->signconf->sig_resign_interval) |
!backup_read_check_str(fd, "refresh") |
!backup_read_duration(fd, &zone->signconf->sig_refresh_interval) |
!backup_read_check_str(fd, "valid") |
!backup_read_duration(fd, &zone->signconf->sig_validity_default) |
!backup_read_check_str(fd, "denial") |
!backup_read_duration(fd,&zone->signconf->sig_validity_denial) |
!backup_read_check_str(fd, "keyset") |
!backup_read_duration(fd,&zone->signconf->sig_validity_keyset) |
!backup_read_check_str(fd, "jitter") |
!backup_read_duration(fd, &zone->signconf->sig_jitter) |
!backup_read_check_str(fd, "offset") |
!backup_read_duration(fd, &zone->signconf->sig_inception_offset) |
!backup_read_check_str(fd, "nsec") |
!backup_read_rr_type(fd, &zone->signconf->nsec_type) |
!backup_read_check_str(fd, "dnskeyttl") |
!backup_read_duration(fd, &zone->signconf->dnskey_ttl) |
!backup_read_check_str(fd, "soattl") |
!backup_read_duration(fd, &zone->signconf->soa_ttl) |
!backup_read_check_str(fd, "soamin") |
!backup_read_duration(fd, &zone->signconf->soa_min) |
!backup_read_check_str(fd, "serial") |
!backup_read_str(fd, &zone->signconf->soa_serial)) {
ods_log_error("[%s] corrupted backup file zone %s: read signconf "
"error", zone_str, zone->name);
goto recover_error2;
}
/* nsec3params part */
if (zone->signconf->nsec_type == LDNS_RR_TYPE_NSEC3) {
if (!backup_read_check_str(fd, ";;Nsec3parameters:") |
!backup_read_check_str(fd, "salt") |
!backup_read_str(fd, &salt) |
!backup_read_check_str(fd, "algorithm") |
!backup_read_uint32_t(fd, &zone->signconf->nsec3_algo) |
!backup_read_check_str(fd, "optout") |
!backup_read_int(fd, &zone->signconf->nsec3_optout) |
!backup_read_check_str(fd, "iterations") |
!backup_read_uint32_t(fd, &zone->signconf->nsec3_iterations)) {
ods_log_error("[%s] corrupted backup file zone %s: read "
"nsec3parameters error", zone_str, zone->name);
goto recover_error2;
}
zone->signconf->nsec3_salt = strdup(salt);
free((void*) salt);
salt = NULL;
zone->signconf->nsec3params = nsec3params_create(
(void*) zone->signconf,
(uint8_t) zone->signconf->nsec3_algo,
(uint8_t) zone->signconf->nsec3_optout,
(uint16_t) zone->signconf->nsec3_iterations,
zone->signconf->nsec3_salt);
if (!zone->signconf->nsec3params) {
ods_log_error("[%s] corrupted backup file zone %s: unable to "
"create nsec3param", zone_str, zone->name);
goto recover_error2;
}
}
zone->signconf->last_modified = lastmod;
zone->default_ttl = (uint32_t) duration2time(zone->signconf->soa_min);
/* keys part */
zone->signconf->keys = keylist_create((void*) zone->signconf);
while (backup_read_str(fd, &token)) {
if (ods_strcmp(token, ";;Key:") == 0) {
if (!key_recover2(fd, zone->signconf->keys)) {
ods_log_error("[%s] corrupted backup file zone %s: read "
"key error", zone_str, zone->name);
goto recover_error2;
}
} else if (ods_strcmp(token, ";;") == 0) {
/* keylist done */
free((void*) token);
token = NULL;
break;
} else {
/* keylist corrupted */
goto recover_error2;
}
free((void*) token);
token = NULL;
}
/* publish dnskeys */
status = zone_publish_dnskeys(zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] corrupted backup file zone %s: unable to "
"publish dnskeys (%s)", zone_str, zone->name,
ods_status2str(status));
goto recover_error2;
}
/* publish nsec3param */
if (!zone->signconf->passthrough)
status = zone_publish_nsec3param(zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] corrupted backup file zone %s: unable to "
"publish nsec3param (%s)", zone_str, zone->name,
ods_status2str(status));
goto recover_error2;
}
/* publish other records */
status = backup_read_namedb(fd, zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] corrupted backup file zone %s: unable to "
"read resource records (%s)", zone_str, zone->name,
ods_status2str(status));
goto recover_error2;
}
/* task */
task = task_create(TASK_SIGN, when, (void*) zone);
if (!task) {
ods_log_error("[%s] failed to restore zone %s: unable to "
"create task", zone_str, zone->name);
goto recover_error2;
}
zone->task = (void*) task;
free((void*)filename);
ods_fclose(fd);
zone->db->is_initialized = 1;
zone->db->have_serial = 1;
/* journal */
filename = ods_build_path(zone->name, ".ixfr", 0, 1);
if (filename) {
fd = ods_fopen(filename, NULL, "r");
}
if (fd) {
status = backup_read_ixfr(fd, zone);
if (status != ODS_STATUS_OK) {
ods_log_warning("[%s] corrupted journal file zone %s, "
"skipping (%s)", zone_str, zone->name,
ods_status2str(status));
(void)unlink(filename);
ixfr_cleanup(zone->ixfr);
zone->ixfr = ixfr_create((void*)zone);
}
}
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_purge(zone->ixfr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
/* all ok */
free((void*)filename);
if (fd) {
ods_fclose(fd);
}
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
stats_clear(zone->stats);
lock_basic_unlock(&zone->stats->stats_lock);
}
return ODS_STATUS_OK;
}
free(filename);
return ODS_STATUS_UNCHANGED;
recover_error2:
free((void*)filename);
ods_fclose(fd);
/* signconf cleanup */
free((void*)salt);
salt = NULL;
signconf_cleanup(zone->signconf);
zone->signconf = signconf_create();
ods_log_assert(zone->signconf);
/* namedb cleanup */
namedb_cleanup(zone->db);
zone->db = namedb_create((void*)zone);
ods_log_assert(zone->db);
/* stats reset */
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
stats_clear(zone->stats);
lock_basic_unlock(&zone->stats->stats_lock);
}
return ODS_STATUS_ERR;
}
/**
* Backup zone.
*
*/
ods_status
zone_backup2(zone_type* zone)
{
char* filename = NULL;
char* tmpfile = NULL;
FILE* fd = NULL;
task_type* task = NULL;
int ret = 0;
ods_status status = ODS_STATUS_OK;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
ods_log_assert(zone->task);
tmpfile = ods_build_path(zone->name, ".backup2.tmp", 0, 1);
filename = ods_build_path(zone->name, ".backup2", 0, 1);
if (!tmpfile || !filename) {
free(tmpfile);
free(filename);
return ODS_STATUS_MALLOC_ERR;
}
fd = ods_fopen(tmpfile, NULL, "w");
if (fd) {
fprintf(fd, "%s\n", ODS_SE_FILE_MAGIC_V3);
task = zone->task;
fprintf(fd, ";;Time: %u\n", (unsigned) task->when);
/** Backup zone */
fprintf(fd, ";;Zone: name %s class %i inbound %u internal %u "
"outbound %u\n", zone->name, (int) zone->klass,
(unsigned) zone->db->inbserial,
(unsigned) zone->db->intserial,
(unsigned) zone->db->outserial);
/** Backup signconf */
signconf_backup(fd, zone->signconf, ODS_SE_FILE_MAGIC_V3);
/** Backup NSEC3 parameters */
if (zone->signconf->nsec3params) {
nsec3params_backup(fd,
zone->signconf->nsec3_algo,
zone->signconf->nsec3_optout,
zone->signconf->nsec3_iterations,
zone->signconf->nsec3_salt,
zone->signconf->nsec3params->rr,
ODS_SE_FILE_MAGIC_V3);
}
/** Backup keylist */
keylist_backup(fd, zone->signconf->keys, ODS_SE_FILE_MAGIC_V3);
fprintf(fd, ";;\n");
/** Backup domains and stuff */
namedb_backup2(fd, zone->db);
/** Done */
fprintf(fd, "%s\n", ODS_SE_FILE_MAGIC_V3);
ods_fclose(fd);
ret = rename(tmpfile, filename);
if (ret != 0) {
ods_log_error("[%s] unable to rename zone %s backup %s to %s: %s",
zone_str, zone->name, tmpfile, filename, strerror(errno));
status = ODS_STATUS_RENAME_ERR;
}
} else {
status = ODS_STATUS_FOPEN_ERR;
}
free((void*) tmpfile);
free((void*) filename);
return status;
}
opendnssec-2.0.4/signer/src/signer/tools.h 0000644 0001750 0001750 00000003642 13036123676 015471 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_TOOLS_H
#define SIGNER_TOOLS_H
#include "config.h"
#include "daemon/engine.h"
#include "status.h"
#include "signer/zone.h"
/**
* Load zone signconf.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status tools_signconf(zone_type* zone);
/**
* Read zone from input adapter.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status tools_input(zone_type* zone);
/**
* Write zone to output adapter.
* \param[in] zone zone
* \param[in] engine signer engine
* \return ods_status status
*
*/
ods_status tools_output(zone_type* zone, engine_type* engine);
#endif /* SIGNER_TOOLS_H */
opendnssec-2.0.4/signer/src/signer/tools.c 0000644 0001750 0001750 00000022463 13036123713 015456 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone signing tools.
*
*/
#include "config.h"
#include "daemon/dnshandler.h"
#include "adapter/adapter.h"
#include "log.h"
#include "signer/tools.h"
#include "signer/zone.h"
#include
#include
#include
#include
static const char* tools_str = "tools";
/**
* Load zone signconf.
*
*/
ods_status
tools_signconf(zone_type* zone)
{
ods_status status = ODS_STATUS_OK;
signconf_type* new_signconf = NULL;
ods_log_assert(zone);
ods_log_assert(zone->name);
status = zone_load_signconf(zone, &new_signconf);
if (status == ODS_STATUS_OK) {
ods_log_assert(new_signconf);
/* Denial of Existence Rollover? */
if (signconf_compare_denial(zone->signconf, new_signconf)
== TASK_NSECIFY) {
/**
* Or NSEC -> NSEC3, or NSEC3 -> NSEC, or NSEC3 params changed.
* All NSEC(3)s become invalid.
*/
namedb_wipe_denial(zone->db);
namedb_cleanup_denials(zone->db);
namedb_init_denials(zone->db);
}
/* all ok, switch signer configuration */
signconf_cleanup(zone->signconf);
ods_log_debug("[%s] zone %s switch to new signconf", tools_str,
zone->name);
zone->signconf = new_signconf;
signconf_log(zone->signconf, zone->name);
zone->default_ttl = (uint32_t) duration2time(zone->signconf->soa_min);
} else if (status != ODS_STATUS_UNCHANGED) {
ods_log_error("[%s] unable to load signconf for zone %s: %s",
tools_str, zone->name, ods_status2str(status));
}
return status;
}
/**
* Read zone from input adapter.
*
*/
ods_status
tools_input(zone_type* zone)
{
ods_status status = ODS_STATUS_OK;
time_t start = 0;
time_t end = 0;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->adinbound);
ods_log_assert(zone->signconf);
/* Key Rollover? */
status = zone_publish_dnskeys(zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read zone %s: failed to "
"publish dnskeys (%s)", tools_str, zone->name,
ods_status2str(status));
zone_rollback_dnskeys(zone);
zone_rollback_nsec3param(zone);
namedb_rollback(zone->db, 0);
return status;
}
/* Denial of Existence Rollover? */
if (!zone->signconf->passthrough)
status = zone_publish_nsec3param(zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read zone %s: failed to "
"publish nsec3param (%s)", tools_str, zone->name,
ods_status2str(status));
zone_rollback_dnskeys(zone);
zone_rollback_nsec3param(zone);
namedb_rollback(zone->db, 0);
return status;
}
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->sort_done = 0;
zone->stats->sort_count = 0;
zone->stats->sort_time = 0;
lock_basic_unlock(&zone->stats->stats_lock);
}
/* Input Adapter */
start = time(NULL);
status = adapter_read((void*)zone);
if (status != ODS_STATUS_OK && status != ODS_STATUS_UNCHANGED) {
if (status == ODS_STATUS_XFRINCOMPLETE) {
ods_log_info("[%s] read zone %s: xfr in progress",
tools_str, zone->name);
} else {
ods_log_error("[%s] unable to read zone %s: adapter failed (%s)",
tools_str, zone->name, ods_status2str(status));
}
zone_rollback_dnskeys(zone);
zone_rollback_nsec3param(zone);
namedb_rollback(zone->db, 0);
}
end = time(NULL);
if ((status == ODS_STATUS_OK || status == ODS_STATUS_UNCHANGED)
&& zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->start_time = start;
zone->stats->sort_time = (end-start);
zone->stats->sort_done = 1;
lock_basic_unlock(&zone->stats->stats_lock);
}
return status;
}
/**
* Close file descriptors.
*
*/
static void
ods_closeall(int fd)
{
int fdlimit = sysconf(_SC_OPEN_MAX);
while (fd < fdlimit) {
close(fd++);
}
}
/**
* Write zone to output adapter.
*
*/
ods_status
tools_output(zone_type* zone, engine_type* engine)
{
ods_status status = ODS_STATUS_OK;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_assert(zone);
ods_log_assert(zone->db);
ods_log_assert(zone->name);
ods_log_assert(zone->signconf);
ods_log_assert(zone->adoutbound);
/* prepare */
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
if (zone->stats->sort_done == 0 &&
(zone->stats->sig_count <= zone->stats->sig_soa_count)) {
ods_log_verbose("[%s] skip write zone %s serial %u (zone not "
"changed)", tools_str, zone->name?zone->name:"(null)",
zone->db->intserial);
stats_clear(zone->stats);
lock_basic_unlock(&zone->stats->stats_lock);
zone->db->intserial =
zone->db->outserial;
return ODS_STATUS_OK;
}
lock_basic_unlock(&zone->stats->stats_lock);
}
/* Output Adapter */
status = adapter_write((void*)zone);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to write zone %s: adapter failed (%s)",
tools_str, zone->name, ods_status2str(status));
return status;
}
zone->db->outserial = zone->db->intserial;
zone->db->is_initialized = 1;
zone->db->have_serial = 1;
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_purge(zone->ixfr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
/* kick the nameserver */
if (zone->notify_ns) {
int pid_status;
pid_t pid, wpid;
ods_log_verbose("[%s] notify nameserver: %s", tools_str,
zone->notify_ns);
/** fork */
switch ((pid = fork())) {
case -1: /* error */
ods_log_error("[%s] notify nameserver failed: unable to fork "
"(%s)", tools_str, strerror(errno));
return ODS_STATUS_FORK_ERR;
case 0: /* child */
/** close fds */
ods_closeall(0);
/** execv */
execvp(zone->notify_ns, zone->notify_args);
/** error */
ods_log_error("[%s] notify nameserver failed: execv() failed "
"(%s)", tools_str, strerror(errno));
exit(1);
break;
default: /* parent */
ods_log_debug("[%s] notify nameserver process forked",
tools_str);
/** wait for completion */
while((wpid = waitpid(pid, &pid_status, 0)) <= 0) {
if (errno != EINTR) {
break;
}
}
if (wpid == -1) {
ods_log_error("[%s] notify nameserver failed: waitpid() "
"failed (%s)", tools_str, strerror(errno));
} else if (!WIFEXITED(pid_status)) {
ods_log_error("[%s] notify nameserver failed: notify "
"command did not terminate normally", tools_str);
} else {
ods_log_verbose("[%s] notify nameserver ok", tools_str);
}
break;
}
}
/* log stats */
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->end_time = time(NULL);
ods_log_debug("[%s] log stats for zone %s serial %u", tools_str,
zone->name?zone->name:"(null)", (unsigned) zone->db->outserial);
stats_log(zone->stats, zone->name, zone->db->outserial,
zone->signconf->nsec_type);
stats_clear(zone->stats);
lock_basic_unlock(&zone->stats->stats_lock);
}
if (engine->dnshandler) {
ods_log_debug("[%s] forward a notify", tools_str);
dnshandler_fwd_notify(engine->dnshandler, (uint8_t*) ODS_SE_NOTIFY_CMD,
strlen(ODS_SE_NOTIFY_CMD));
}
return status;
}
opendnssec-2.0.4/signer/src/signer/domain.c 0000644 0001750 0001750 00000032572 13036123713 015567 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Domain.
*
*/
#include "config.h"
#include "log.h"
#include "signer/backup.h"
#include "signer/denial.h"
#include "signer/domain.h"
#include "signer/ixfr.h"
#include "signer/zone.h"
static const char* dname_str = "domain";
/**
* Log domain name.
*
*/
void
log_dname(ldns_rdf *rdf, const char* pre, int level)
{
char* str = NULL;
if (ods_log_get_level() < level) {
return;
}
str = ldns_rdf2str(rdf);
if (!str) {
return;
}
if (level == LOG_EMERG) {
ods_fatal_exit("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_ALERT) {
ods_log_alert("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_CRIT) {
ods_log_crit("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_ERR) {
ods_log_error("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_WARNING) {
ods_log_warning("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_NOTICE) {
ods_log_info("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_INFO) {
ods_log_verbose("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_DEBUG) {
ods_log_debug("[%s] %s: %s", dname_str, pre?pre:"", str);
} else if (level == LOG_DEEEBUG) {
ods_log_deeebug("[%s] %s: %s", dname_str, pre?pre:"", str);
} else {
ods_log_deeebug("[%s] %s: %s", dname_str, pre?pre:"", str);
}
free((void*)str);
}
/**
* Create domain.
*
*/
domain_type*
domain_create(zone_type* zone, ldns_rdf* dname)
{
domain_type* domain = NULL;
if (!dname || !zone) {
return NULL;
}
CHECKALLOC(domain = (domain_type*) malloc(sizeof(domain_type)));
domain->dname = ldns_rdf_clone(dname);
if (!domain->dname) {
ods_log_error("[%s] unable to create domain: ldns_rdf_clone() "
"failed", dname_str);
free(domain);
return NULL;
}
domain->zone = zone;
domain->denial = NULL; /* no reference yet */
domain->node = NULL; /* not in db yet */
domain->rrsets = NULL;
domain->parent = NULL;
domain->is_apex = 0;
domain->is_new = 0;
return domain;
}
/**
* Count the number of RRsets at this domain with RRs that have is_added.
*
*/
size_t
domain_count_rrset_is_added(domain_type* domain)
{
rrset_type* rrset = NULL;
size_t count = 0;
if (!domain) {
return 0;
}
rrset = domain->rrsets;
while (rrset) {
if (rrset_count_rr_is_added(rrset)) {
count++;
}
rrset = rrset->next;
}
return count;
}
/**
* Look up RRset at this domain.
*
*/
rrset_type*
domain_lookup_rrset(domain_type* domain, ldns_rr_type rrtype)
{
rrset_type* rrset = NULL;
if (!domain || !domain->rrsets || !rrtype) {
return NULL;
}
rrset = domain->rrsets;
while (rrset && rrset->rrtype != rrtype) {
rrset = rrset->next;
}
return rrset;
}
/**
* Add RRset to domain.
*
*/
void
domain_add_rrset(domain_type* domain, rrset_type* rrset)
{
rrset_type** p = NULL;
denial_type* denial = NULL;
ods_log_assert(domain);
ods_log_assert(rrset);
if (!domain->rrsets) {
domain->rrsets = rrset;
} else {
p = &domain->rrsets;
while(*p) {
p = &((*p)->next);
}
*p = rrset;
rrset->next = NULL;
}
log_rrset(domain->dname, rrset->rrtype, "+RRSET", LOG_DEEEBUG);
rrset->domain = (void*) domain;
if (domain->denial) {
denial = (denial_type*) domain->denial;
denial->bitmap_changed = 1;
}
}
/**
* Apply differences at domain.
*
*/
void
domain_diff(domain_type* domain, unsigned is_ixfr, unsigned more_coming)
{
denial_type* denial = NULL;
rrset_type* rrset = NULL;
rrset_type* prev_rrset = NULL;
if (!domain) {
return;
}
rrset = domain->rrsets;
while (rrset) {
if (rrset->rrtype == LDNS_RR_TYPE_NSEC3PARAMS ||
rrset->rrtype == LDNS_RR_TYPE_DNSKEY) {
/* always do full diff on NSEC3PARAMS | DNSKEY RRset */
rrset_diff(rrset, 0, more_coming);
} else {
rrset_diff(rrset, is_ixfr, more_coming);
}
if (rrset->rr_count <= 0) {
/* delete entire rrset */
if (!prev_rrset) {
domain->rrsets = rrset->next;
} else {
prev_rrset->next = rrset->next;
}
rrset->next = NULL;
log_rrset(domain->dname, rrset->rrtype, "-RRSET", LOG_DEEEBUG);
rrset_cleanup(rrset);
if (!prev_rrset) {
rrset = domain->rrsets;
} else {
rrset = prev_rrset->next;
}
if (domain->denial) {
denial = (denial_type*) domain->denial;
denial->bitmap_changed = 1;
}
} else {
/* just go to next rrset */
prev_rrset = rrset;
rrset = rrset->next;
}
}
}
/**
* Rollback differences at domain.
*
*/
void
domain_rollback(domain_type* domain, int keepsc)
{
denial_type* denial = NULL;
rrset_type* rrset = NULL;
rrset_type* prev_rrset = NULL;
ldns_rr* del_rr = NULL;
int del_rrset = 0;
uint16_t i = 0;
if (!domain) {
return;
}
rrset = domain->rrsets;
while (rrset) {
if (keepsc) {
/* skip rollback for NSEC3PARAM and DNSKEY RRset */
if (rrset->rrtype == LDNS_RR_TYPE_NSEC3PARAMS ||
rrset->rrtype == LDNS_RR_TYPE_DNSKEY) {
prev_rrset = rrset;
rrset = rrset->next;
continue;
}
}
/* walk rrs */
for (i=0; i < rrset->rr_count; i++) {
rrset->rrs[i].is_added = 0;
rrset->rrs[i].is_removed = 0;
if (!rrset->rrs[i].exists) {
/* can we delete the RRset? */
if(rrset->rr_count == 1) {
del_rrset = 1;
}
del_rr = rrset->rrs[i].rr;
rrset_del_rr(rrset, i);
ldns_rr_free(del_rr);
del_rr = NULL;
i--;
}
}
/* next rrset */
if (del_rrset) {
/* delete entire rrset */
if (!prev_rrset) {
domain->rrsets = rrset->next;
} else {
prev_rrset->next = rrset->next;
}
rrset->next = NULL;
log_rrset(domain->dname, rrset->rrtype, "-RRSET", LOG_DEEEBUG);
rrset_cleanup(rrset);
if (!prev_rrset) {
rrset = domain->rrsets;
} else {
rrset = prev_rrset->next;
}
if (domain->denial) {
denial = (denial_type*) domain->denial;
denial->bitmap_changed = 0;
}
del_rrset = 0;
} else {
/* just go to next rrset */
prev_rrset = rrset;
rrset = rrset->next;
}
}
}
/**
* Check whether a domain is an empty non-terminal to unsigned delegation.
*
*/
int
domain_ent2unsignedns(domain_type* domain)
{
ldns_rbnode_t* n = LDNS_RBTREE_NULL;
domain_type* d = NULL;
ods_log_assert(domain);
if (domain->rrsets) {
return 0; /* not an empty non-terminal */
}
n = ldns_rbtree_next(domain->node);
while (n && n != LDNS_RBTREE_NULL) {
d = (domain_type*) n->data;
if (!ldns_dname_is_subdomain(d->dname, domain->dname)) {
break;
}
if (d->rrsets) {
if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS &&
domain_is_occluded(d) == LDNS_RR_TYPE_SOA) {
/* domain has signed delegation/auth */
return 0;
}
}
/* maybe there is data at the next domain */
n = ldns_rbtree_next(n);
}
return 1;
}
/**
* Check whether the domain is a delegation point.
*
*/
ldns_rr_type
domain_is_delegpt(domain_type* domain)
{
ods_log_assert(domain);
if (domain->is_apex) {
return LDNS_RR_TYPE_SOA;
}
if (domain_lookup_rrset(domain, LDNS_RR_TYPE_NS)) {
if (domain_lookup_rrset(domain, LDNS_RR_TYPE_DS)) {
/* Signed delegation */
return LDNS_RR_TYPE_DS;
} else {
/* Unsigned delegation */
return LDNS_RR_TYPE_NS;
}
}
/* Authoritative */
return LDNS_RR_TYPE_SOA;
}
/**
* Check whether the domain is occluded.
*
*/
ldns_rr_type
domain_is_occluded(domain_type* domain)
{
domain_type* parent = NULL;
ods_log_assert(domain);
if (domain->is_apex) {
return LDNS_RR_TYPE_SOA;
}
parent = domain->parent;
while (parent && !parent->is_apex) {
if (domain_lookup_rrset(parent, LDNS_RR_TYPE_NS)) {
/* Glue / Empty non-terminal to Glue */
return LDNS_RR_TYPE_A;
}
if (domain_lookup_rrset(parent, LDNS_RR_TYPE_DNAME)) {
/* Occluded data / Empty non-terminal to Occluded data */
return LDNS_RR_TYPE_DNAME;
}
parent = parent->parent;
}
/* Authoritative or delegation */
return LDNS_RR_TYPE_SOA;
}
/**
* Print domain.
*
*/
void
domain_print(FILE* fd, domain_type* domain, ods_status* status)
{
char* str = NULL;
rrset_type* rrset = NULL;
rrset_type* soa_rrset = NULL;
rrset_type* cname_rrset = NULL;
if (!domain || !fd) {
if (status) {
ods_log_crit("[%s] unable to print domain: domain or fd missing",
dname_str);
*status = ODS_STATUS_ASSERT_ERR;
}
return;
}
/* empty non-terminal? */
if (!domain->rrsets) {
str = ldns_rdf2str(domain->dname);
fprintf(fd, ";;Empty non-terminal %s\n", str);
free((void*)str);
/* Denial of Existence */
if (domain->denial) {
denial_print(fd, (denial_type*) domain->denial, status);
}
return;
}
/* no other data may accompany a CNAME */
cname_rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_CNAME);
if (cname_rrset) {
rrset_print(fd, cname_rrset, 0, status);
} else {
/* if SOA, print soa first */
if (domain->is_apex) {
soa_rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_SOA);
if (soa_rrset) {
rrset_print(fd, soa_rrset, 0, status);
if (status && *status != ODS_STATUS_OK) {
return;
}
}
}
/* print other RRsets */
rrset = domain->rrsets;
while (rrset) {
/* skip SOA RRset */
if (rrset->rrtype != LDNS_RR_TYPE_SOA) {
rrset_print(fd, rrset, 0, status);
}
if (status && *status != ODS_STATUS_OK) {
ods_log_crit("[%s] failed to print one or more RRsets: %s",
dname_str, ods_status2str(*status));
return;
}
rrset = rrset->next;
}
}
/* Denial of Existence */
if (domain->denial) {
denial_print(fd, (denial_type*) domain->denial, status);
}
}
/**
* Clean up domain.
*
*/
void
domain_cleanup(domain_type* domain)
{
if (!domain) {
return;
}
ldns_rdf_deep_free(domain->dname);
rrset_cleanup(domain->rrsets);
free(domain);
}
/**
* Backup domain.
*
*/
void
domain_backup2(FILE* fd, domain_type* domain, int sigs)
{
rrset_type* rrset = NULL;
if (!domain || !fd) {
return;
}
/* if SOA, print soa first */
if (domain->is_apex) {
rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_SOA);
if (rrset) {
if (sigs) {
rrset_backup2(fd, rrset);
} else {
rrset_print(fd, rrset, 1, NULL);
}
}
}
rrset = domain->rrsets;
while (rrset) {
/* skip SOA RRset */
if (rrset->rrtype != LDNS_RR_TYPE_SOA) {
if (sigs) {
rrset_backup2(fd, rrset);
} else {
rrset_print(fd, rrset, 1, NULL);
}
}
rrset = rrset->next;
}
}
opendnssec-2.0.4/signer/src/signer/keys.h 0000644 0001750 0001750 00000007205 13036123676 015303 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_KEYS_H
#define SIGNER_KEYS_H
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#ifdef HAVE_UNISTD_H
# include
#endif
#include
typedef struct key_struct key_type;
typedef struct keylist_struct keylist_type;
#include "status.h"
#include "libhsm.h"
#include "libhsmdns.h"
#include "signconf.h"
/**
* Key.
*
*/
struct key_struct {
ldns_rr* dnskey;
hsm_sign_params_t* params;
const char* locator;
const char* resourcerecord;
uint8_t algorithm;
uint32_t flags;
int publish;
int ksk;
int zsk;
};
/**
* Key list.
*
*/
struct keylist_struct {
signconf_type* sc;
key_type* keys;
size_t count;
};
/**
* Create a new key list.
* \param[in] sc signer configuration reference
* \return keylist_type* key list
*
*/
keylist_type* keylist_create(signconf_type* sc);
/**
* Lookup a key in the key list by locator.
* \param[in] kl key list
* \param[in] locator key locator
* \return key_type* key if it exists, NULL otherwise
*
*/
key_type* keylist_lookup_by_locator(keylist_type* kl, const char* locator);
/**
* Push a key to the keylist.
* \param[in] kl key list
* \param[in] locator string that identifies location of key
* \param[in] algorithm DNSKEY algorithm field value
* \param[in] flags DNSKEY flags field value
* \param[in] publish if true, publish key as a DNSKEY
* \param[in] ksk if true, sign DNSKEY RRset with this key
* \param[in] zsk if true, sign all but DNSKEY RRset with this key
* \return key_type* key
*
*/
key_type* keylist_push(keylist_type* kl, const char* locator, const char* resourcerecord,
uint8_t algorithm, uint32_t flags, int publish, int ksk, int zsk);
/**
* Log key list.
* \param[in] kl key list to print
* \param[in] name zone name
*
*/
void keylist_log(keylist_type* kl, const char* name);
/**
* Clean up key list.
* \param[in] kl key list to clean up
*
*/
void keylist_cleanup(keylist_type* kl);
/**
* Recover key from backup.
* \param[in] fd file descriptor of key backup file
* \param[in] kl key list to print
* \return key_type* key
*
*/
key_type* key_recover2(FILE* fd, keylist_type* kl);
/**
* Backup key list.
* \param[in] fd file descriptor
* \param[in] kl key list to print
* \param[in] version version string
*
*/
void keylist_backup(FILE* fd, keylist_type* kl, const char* version);
#endif /* SIGNER_KEYS_H */
opendnssec-2.0.4/signer/src/signer/ixfr.h 0000644 0001750 0001750 00000005155 13036123713 015272 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Domain name database.
*
*/
#ifndef SIGNER_IXFR_H
#define SIGNER_IXFR_H
#include "config.h"
#include
typedef struct part_struct part_type;
typedef struct ixfr_struct ixfr_type;
#include "locks.h"
#include "zone.h"
#define IXFR_MAX_PARTS 3
/**
* Part of IXFR Journal.
*
*/
struct part_struct {
ldns_rr* soamin;
ldns_rr_list* min;
ldns_rr* soaplus;
ldns_rr_list* plus;
};
/**
* IXFR Journal.
*
*/
struct ixfr_struct {
zone_type* zone;
part_type* part[IXFR_MAX_PARTS];
lock_basic_type ixfr_lock;
};
/**
* Create a new ixfr journal.
* \param[in] zone zone reference
* \return ixfr_type* ixfr
*
*/
ixfr_type* ixfr_create(zone_type* zone);
/**
* Add +RR to ixfr journal.
* \param[in] ixfr journal
* \param[in] rr +RR
*
*/
void ixfr_add_rr(ixfr_type* ixfr, ldns_rr* rr);
/**
* Add -RR to ixfr journal.
* \param[in] ixfr journal
* \param[in] rr -RR
*
*/
void ixfr_del_rr(ixfr_type* ixfr, ldns_rr* rr);
/**
* Print the ixfr journal.
* \param[in] fd file descriptor
* \param[in] ixfr journal
*
*/
void ixfr_print(FILE* fd, ixfr_type* ixfr);
/**
* Purge the ixfr journal.
* \param[in] ixfr journal
*
*/
void ixfr_purge(ixfr_type* ixfr);
/**
* Cleanup the ixfr journal.
* \param[in] ixfr journal
*
*/
void ixfr_cleanup(ixfr_type* ixfr);
#endif /* SIGNER_IXFR_H */
opendnssec-2.0.4/signer/src/signer/signconf.h 0000644 0001750 0001750 00000007743 13036123676 016145 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_SIGNCONF_H
#define SIGNER_SIGNCONF_H
#include
#include
typedef struct signconf_struct signconf_type;
#include "scheduler/task.h"
#include "status.h"
#include "duration.h"
#include "signer/keys.h"
#include "signer/nsec3params.h"
struct signconf_struct {
/* Zone */
const char* name;
int passthrough;
/* Signatures */
duration_type* sig_resign_interval;
duration_type* sig_refresh_interval;
duration_type* sig_validity_default;
duration_type* sig_validity_denial;
duration_type* sig_validity_keyset;
duration_type* sig_jitter;
duration_type* sig_inception_offset;
/* Denial of existence */
duration_type* nsec3param_ttl;
ldns_rr_type nsec_type;
int nsec3_optout;
uint32_t nsec3_algo;
uint32_t nsec3_iterations;
const char* nsec3_salt;
nsec3params_type* nsec3params;
/* Keys */
duration_type* dnskey_ttl;
const char** dnskey_signature; /* may be NULL and must be NULL terminated */
keylist_type* keys;
/* Source of authority */
duration_type* soa_ttl;
duration_type* soa_min;
const char* soa_serial;
/* Other useful information */
duration_type* max_zone_ttl;
const char* filename;
time_t last_modified;
};
/**
* Create a new signer configuration with the 'empty' settings.
* \return signconf_type* signer configuration
*
*/
signconf_type* signconf_create(void);
/**
* Update signer configuration.
* \param[out] signconf signer configuration
* \param[in] scfile signer configuration file name
* \param[in] last_modified last known modification
* \return ods_status status
*
*/
ods_status signconf_update(signconf_type** signconf, const char* scfile,
time_t last_modified);
/**
* Backup signer configuration.
* \param[in] fd file descriptor
* \param[in] sc signer configuration settings
* \param[in] version version string
*
*/
void signconf_backup(FILE* fd, signconf_type* sc, const char* version);
/**
* Check signer configuration.
* \param signconf signer configuration
* \return ods_status status
*
*/
ods_status signconf_check(signconf_type* signconf);
/**
* Compare signer configurations on denial of existence material.
* \param[in] a a signer configuration
* \param[in] b another signer configuration
* \return task_id what task needs to be scheduled
*
*/
task_id signconf_compare_denial(signconf_type* a, signconf_type* b);
/**
* Log signer configuration.
* \param[in] sc signconf to log
* \param[in] name zone name
*
*/
void signconf_log(signconf_type* sc, const char* name);
/**
* Clean up signer configuration.
* \param[in] sc signconf to cleanup
*
*/
void signconf_cleanup(signconf_type* sc);
#endif /* SIGNER_SIGNCONF_H */
opendnssec-2.0.4/signer/src/signer/rrset.h 0000644 0001750 0001750 00000012770 13036123676 015472 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_RRSET_H
#define SIGNER_RRSET_H
#include "config.h"
#include
typedef struct rrsig_struct rrsig_type;
typedef struct rr_struct rr_type;
typedef struct rrset_struct rrset_type;
#include "status.h"
#include "signer/stats.h"
#include "libhsm.h"
#include "domain.h"
#include "zone.h"
#include "datastructure.h"
struct rrsig_struct {
ldns_rr* rr;
domain_type* owner;
const char* key_locator;
uint32_t key_flags;
};
struct rr_struct {
ldns_rr* rr;
domain_type* owner;
unsigned exists : 1;
unsigned is_added : 1;
unsigned is_removed : 1;
};
struct rrset_struct {
rrset_type* next;
zone_type* zone;
domain_type* domain;
ldns_rr_type rrtype;
rr_type* rrs;
size_t rr_count;
collection_t rrsigs;
unsigned needs_signing : 1;
};
/**
* Log RR.
* \param[in] rr RR
* \param[in] pre log message
* \param[in] level log level
*
*/
void log_rr(ldns_rr* rr, const char* pre, int level);
/**
* Log RRset.
* \param[in] dname domain name
* \param[in] type RRtype
* \param[in] pre log message
* \param[in] level log level
*
*/
void log_rrset(ldns_rdf* dname, ldns_rr_type type, const char* pre, int level);
/**
* Get the string-format of RRtype.
* \param[in] type RRtype
* \return const char* string-format of RRtype
*
*/
const char* rrset_type2str(ldns_rr_type type);
/**
* Create RRset.
* \param[in] zoneptr zone reference
* \param[in] type RRtype
* \return rrset_type* RRset
*
*/
rrset_type* rrset_create(zone_type* zone, ldns_rr_type type);
/**
* Lookup RR in RRset.
* \param[in] rrset RRset
* \param[in] rr RR
* \return rr_type* RR if found
*
*/
rr_type* rrset_lookup_rr(rrset_type* rrset, ldns_rr* rr);
/**
* Count the number of RRs in this RRset that have is_added.
* \param[in] rrset RRset
* \return size_t number of RRs
*
*/
size_t rrset_count_rr_is_added(rrset_type* rrset);
/**
* Add RR to RRset.
* \param[in] rrset RRset
* \param[in] rr RR
* \return rr_type* added RR
*
*/
rr_type* rrset_add_rr(rrset_type* rrset, ldns_rr* rr);
/**
* Delete RR from RRset.
* \param[in] rrset RRset
* \param[in] rrnum position of RR
*
*/
void rrset_del_rr(rrset_type* rrset, uint16_t rrnum);
/**
* Add RRSIG to RRset.
* \param[in] rrset RRset
* \param[in] rr RRSIG
* \param[in] locator key locator
* \param[in] flags key flags
*
*/
void rrset_add_rrsig(rrset_type* rrset, ldns_rr* rr,
const char* locator, uint32_t flags);
/**
* Delete all RRSIG from RRset and add then to the zone's outgoing IXFR as change.
* \param[in] rrset RRset
* \param[in] rrnum position of RRSIG
*
*/
void rrset_drop_rrsigs(zone_type* zone, rrset_type* rrset);
/**
* Apply differences at RRset.
* \param[in] rrset RRset
* \param[in] is_ixfr true if incremental change
* \param[in] more_coming more transactions possible
*
*/
void rrset_diff(rrset_type* rrset, unsigned is_ixfr, unsigned more_coming);
/**
* Sign RRset.
* \param[in] ctx HSM context
* \param[in] rrset RRset
* \param[in] signtime time when the zone is being signed
* \return ods_status status
*
*/
ods_status rrset_sign(hsm_ctx_t* ctx, rrset_type* rrset, time_t signtime);
/**
* Obtain a resource record (containing a signature of a dnskeyset or
* a dnskeyset, but that is not a hard requirement), from a raw string
* \param[out] dnskey the resulting resource record
* \param[in] resourcerecord the string representation of the resource record
* \param[in] ttl the time-to-live to use if non is specified
* \param[in] apex the owner domain is none can be determined from input string
*/
ods_status rrset_getliteralrr(ldns_rr** dnskey, const char *resourcerecord, uint32_t ttl, ldns_rdf* apex);
/**
* Print RRset.
* \param[in] fd file descriptor
* \param[in] rrset RRset to be printed
* \param[in] skip_rrsigs if true, don't print RRSIG records
* \param[out] status status
*
*/
void rrset_print(FILE* fd, rrset_type* rrset, int skip_rrsigs,
ods_status* status);
/**
* Clean up RRset.
* \param[in] rrset RRset to be cleaned up
*
*/
void rrset_cleanup(rrset_type* rrset);
/**
* Backup RRset.
* \param[in] fd file descriptor
* \param[in] rrset RRset
*
*/
void rrset_backup2(FILE* fd, rrset_type* rrset);
collection_class rrset_store_initialize(void);
#endif /* SIGNER_RRSET_H */
opendnssec-2.0.4/signer/src/signer/namedb.h 0000644 0001750 0001750 00000012703 13036123713 015545 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Domain name database.
*
*/
#ifndef SIGNER_NAMEDB_H
#define SIGNER_NAMEDB_H
#include "config.h"
#include
typedef struct namedb_struct namedb_type;
#include "signer/denial.h"
#include "signer/domain.h"
#include "signer/zone.h"
#include "signer/nsec3params.h"
/**
* Domain name database.
*
*/
struct namedb_struct {
zone_type* zone;
ldns_rbtree_t* domains;
ldns_rbtree_t* denials;
uint32_t inbserial;
uint32_t intserial;
uint32_t outserial;
uint32_t altserial;
unsigned is_initialized : 1;
unsigned is_processed : 1;
unsigned serial_updated : 1;
unsigned force_serial : 1;
unsigned have_serial : 1;
};
/**
* Initialize denial of existence chain.
* \param[in] db namedb
*
*/
void namedb_init_denials(namedb_type* db);
/**
* Create a new namedb.
* \param[in] zone zone reference
* \return namedb_type* namedb
*
*/
namedb_type* namedb_create(void* zone);
/**
* Determine new SOA SERIAL.
* \param[in] db namedb
* \param[in] zone_name zone name
* \param[in] format format from signer configuration
* \param[in] inbound_serial inbound serial
* \return ods_status status
*
*/
ods_status namedb_update_serial(namedb_type* db, const char* zone_name,
const char* format, uint32_t inbound_serial);
/**
* Add empty non-terminals for domain.
* \param[in] db namedb
* \param[in] domain domain
* \param[in] apex apex domain name
* \return ods_status status
*
*/
ods_status namedb_domain_entize(namedb_type* db, domain_type* domain,
ldns_rdf* apex);
/**
* Look up domain.
* \param[in] db namedb
* \param[in] dname domain name
* \return domain_type* domain, if found
*
*/
domain_type* namedb_lookup_domain(namedb_type* db, ldns_rdf* dname);
/**
* Add domain to namedb.
* \param[in] db namedb
* \param[in] dname domain name
* \return domain_type* added domain
*
*/
domain_type* namedb_add_domain(namedb_type* db, ldns_rdf* dname);
/**
* Delete domain from namedb
* \param[in] db namedb
* \param[in] domain domain
* \return domain_type* deleted domain
*
*/
domain_type* namedb_del_domain(namedb_type* db, domain_type* domain);
/**
* Lookup denial.
* \param[in] db namedb
* \param[in] dname domain name
* \return denial_type* denial, if found
*
*/
denial_type* namedb_lookup_denial(namedb_type* db, ldns_rdf* dname);
/**
* Add denial to namedb.
* \param[in] db namedb
* \param[in] dname domain name
* \param[in] n3p NSEC3 parameters, NULL if we do NSEC
* \return denial_type* added denial
*
*/
denial_type* namedb_add_denial(namedb_type* db, ldns_rdf* dname,
nsec3params_type* n3p);
/**
* Delete denial from namedb
* \param[in] db namedb
* \param[in] denial denial
* \return denial_type* deleted denial
*
*/
denial_type* namedb_del_denial(namedb_type* db, denial_type* denial);
/**
* Examine updates to namedb.
* \param[in] db namedb
* \return ods_status status
*
*/
ods_status namedb_examine(namedb_type* db);
/**
* Apply differences in db.
* \param[in] db namedb
* \param[in] is_ixfr true if incremental change
* \param[in] more_coming more transactions possible
*
*/
void namedb_diff(namedb_type* db, unsigned is_ixfr, unsigned more_coming);
/**
* Rollback differences in db.
* \param[in] db namedb
* \param[in] keepsc keep RRs that did not came from the adapter.
*
*/
void namedb_rollback(namedb_type* db, unsigned keepsc);
/**
* Nsecify db.
* \param[in] db namedb
* \param[out] num_added number of NSEC RRs added
*
*/
void namedb_nsecify(namedb_type* db, uint32_t* num_added);
/**
* Export db to file.
* \param[in] fd file descriptor
* \param[in] namedb namedb
* \param[out] status status
*
*/
void namedb_export(FILE* fd, namedb_type* db, ods_status* status);
/**
* Wipe out all NSEC(3) RRsets.
* \param[in] db namedb
*
*/
void namedb_wipe_denial(namedb_type* db);
/**
* Clean up denial of existence chain.
* \param[in] db namedb
*
*/
void namedb_cleanup_denials(namedb_type* db);
/**
* Clean up namedb.
* \param[in] namedb namedb
*
*/
void namedb_cleanup(namedb_type* db);
/**
* Backup namedb.
* \param[in] fd output file descriptor
* \param[in] zd zone data
*
*/
void namedb_backup2(FILE* fd, namedb_type* db);
#endif /* SIGNER_NAMEDB_H */
opendnssec-2.0.4/signer/src/signer/signconf.c 0000644 0001750 0001750 00000037324 13036123676 016136 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signer configuration.
*
*/
#include "parser/signconfparser.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "signer/signconf.h"
static const char* sc_str = "signconf";
/**
* Create a new signer configuration with the 'empty' settings.
*
*/
signconf_type*
signconf_create(void)
{
signconf_type* sc = NULL;
CHECKALLOC(sc = (signconf_type*) malloc(sizeof(signconf_type)));
sc->filename = NULL;
sc->passthrough = 0;
/* Signatures */
sc->sig_resign_interval = NULL;
sc->sig_refresh_interval = NULL;
sc->sig_validity_default = NULL;
sc->sig_validity_denial = NULL;
sc->sig_validity_keyset = NULL;
sc->sig_jitter = NULL;
sc->sig_inception_offset = NULL;
/* Denial of existence */
sc->nsec3param_ttl = NULL;
sc->nsec_type = 0;
sc->nsec3_optout = 0;
sc->nsec3_algo = 0;
sc->nsec3_iterations = 0;
sc->nsec3_salt = NULL;
sc->nsec3params = NULL;
/* Keys */
sc->dnskey_ttl = NULL;
sc->dnskey_signature = NULL;
sc->keys = NULL;
/* Source of authority */
sc->soa_ttl = NULL;
sc->soa_min = NULL;
sc->soa_serial = NULL;
/* Other useful information */
sc->max_zone_ttl = NULL;
sc->last_modified = 0;
return sc;
}
/**
* Read signer configuration.
*
*/
static ods_status
signconf_read(signconf_type* signconf, const char* scfile)
{
const char* rngfile = ODS_SE_RNGDIR "/signconf.rng";
ods_status status = ODS_STATUS_OK;
FILE* fd = NULL;
if (!scfile || !signconf) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_debug("[%s] read signconf file %s", sc_str, scfile);
status = parse_file_check(scfile, rngfile);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read signconf: parse error in "
"file %s (%s)", sc_str, scfile, ods_status2str(status));
return status;
}
fd = ods_fopen(scfile, NULL, "r");
if (fd) {
signconf->filename = strdup(scfile);
signconf->passthrough = parse_sc_passthrough(scfile);
signconf->sig_resign_interval = parse_sc_sig_resign_interval(scfile);
signconf->sig_refresh_interval = parse_sc_sig_refresh_interval(scfile);
signconf->sig_validity_default = parse_sc_sig_validity_default(scfile);
signconf->sig_validity_denial = parse_sc_sig_validity_denial(scfile);
signconf->sig_validity_keyset = parse_sc_sig_validity_keyset(scfile);
signconf->sig_jitter = parse_sc_sig_jitter(scfile);
signconf->sig_inception_offset = parse_sc_sig_inception_offset(scfile);
signconf->nsec_type = parse_sc_nsec_type(scfile);
if (signconf->nsec_type == LDNS_RR_TYPE_NSEC3) {
signconf->nsec3param_ttl = parse_sc_nsec3param_ttl(scfile);
signconf->nsec3_optout = parse_sc_nsec3_optout(scfile);
signconf->nsec3_algo = parse_sc_nsec3_algorithm(scfile);
signconf->nsec3_iterations = parse_sc_nsec3_iterations(scfile);
signconf->nsec3_salt = parse_sc_nsec3_salt(scfile);
signconf->nsec3params = nsec3params_create((void*) signconf,
(uint8_t) signconf->nsec3_algo, (uint8_t) signconf->nsec3_optout,
(uint16_t)signconf->nsec3_iterations, signconf->nsec3_salt);
if (!signconf->nsec3params) {
ods_log_error("[%s] unable to read signconf %s: "
"nsec3params_create() failed", sc_str, scfile);
ods_fclose(fd);
return ODS_STATUS_MALLOC_ERR;
}
}
signconf->keys = parse_sc_keys((void*) signconf, scfile);
signconf->dnskey_ttl = parse_sc_dnskey_ttl(scfile);
signconf->dnskey_signature = parse_sc_dnskey_sigrrs(scfile);
signconf->soa_ttl = parse_sc_soa_ttl(scfile);
signconf->soa_min = parse_sc_soa_min(scfile);
signconf->soa_serial = parse_sc_soa_serial(scfile);
signconf->max_zone_ttl = parse_sc_max_zone_ttl(scfile);
ods_fclose(fd);
return ODS_STATUS_OK;
}
ods_log_error("[%s] unable to read signconf: failed to open file %s",
sc_str, scfile);
return ODS_STATUS_ERR;
}
/**
* Update signer configuration.
*
*/
ods_status
signconf_update(signconf_type** signconf, const char* scfile,
time_t last_modified)
{
signconf_type* new_sc = NULL;
time_t st_mtime = 0;
ods_status status = ODS_STATUS_OK;
if (!scfile || !signconf) {
return ODS_STATUS_UNCHANGED;
}
/* is the file updated? */
st_mtime = ods_file_lastmodified(scfile);
if (st_mtime <= last_modified) {
return ODS_STATUS_UNCHANGED;
}
/* if so, read the new signer configuration */
new_sc = signconf_create();
if (!new_sc) {
ods_log_error("[%s] unable to update signconf: signconf_create() "
"failed", sc_str);
return ODS_STATUS_ERR;
}
status = signconf_read(new_sc, scfile);
if (status == ODS_STATUS_OK) {
new_sc->last_modified = st_mtime;
if (signconf_check(new_sc) != ODS_STATUS_OK) {
ods_log_error("[%s] unable to update signconf: signconf %s has "
"errors", sc_str, scfile);
signconf_cleanup(new_sc);
return ODS_STATUS_CFG_ERR;
}
*signconf = new_sc;
} else {
ods_log_error("[%s] unable to update signconf: failed to read file "
"%s (%s)", sc_str, scfile, ods_status2str(status));
signconf_cleanup(new_sc);
}
return status;
}
/**
* Backup duration.
*
*/
static void
signconf_backup_duration(FILE* fd, const char* opt, duration_type* duration)
{
char* str = (duration == NULL ? NULL : duration2string(duration));
fprintf(fd, "%s %s ", opt, (str?str:"0"));
free(str);
}
/**
* Backup signconf values.
*
*/
void
signconf_backup(FILE* fd, signconf_type* sc, const char* version)
{
if (!fd || !sc) {
return;
}
fprintf(fd, ";;Signconf: lastmod %u ", (unsigned) sc->last_modified);
if (strcmp(version, ODS_SE_FILE_MAGIC_V2) &&
strcmp(version, ODS_SE_FILE_MAGIC_V1)) {
/* version 3 and up */
fprintf(fd, "maxzonettl 0 "); /* prepare for enforcer ng */
}
signconf_backup_duration(fd, "resign", sc->sig_resign_interval);
signconf_backup_duration(fd, "refresh", sc->sig_refresh_interval);
signconf_backup_duration(fd, "valid", sc->sig_validity_default);
signconf_backup_duration(fd, "denial", sc->sig_validity_denial);
signconf_backup_duration(fd, "keyset", sc->sig_validity_keyset);
signconf_backup_duration(fd, "jitter", sc->sig_jitter);
signconf_backup_duration(fd, "offset", sc->sig_inception_offset);
fprintf(fd, "nsec %u ", (unsigned) sc->nsec_type);
signconf_backup_duration(fd, "dnskeyttl", sc->dnskey_ttl);
signconf_backup_duration(fd, "soattl", sc->soa_ttl);
signconf_backup_duration(fd, "soamin", sc->soa_min);
fprintf(fd, "serial %s ", sc->soa_serial?sc->soa_serial:"(null)");
if (strcmp(version, ODS_SE_FILE_MAGIC_V2) == 0) {
fprintf(fd, "audit 0");
}
fprintf(fd, "\n");
}
/**
* Check the SOA/Serial type.
*
*/
static int
signconf_soa_serial_check(const char* serial) {
if (!serial) {
return 1;
}
if (strlen(serial) == 4 && strncmp(serial, "keep", 4) == 0) {
return 0;
}
if (strlen(serial) == 7 && strncmp(serial, "counter", 7) == 0) {
return 0;
}
if (strlen(serial) == 8 && strncmp(serial, "unixtime", 8) == 0) {
return 0;
}
if (strlen(serial) == 11 && strncmp(serial, "datecounter", 11) == 0) {
return 0;
}
return 1;
}
/**
* Check signer configuration settings.
*
*/
ods_status
signconf_check(signconf_type* sc)
{
ods_status status = ODS_STATUS_OK;
if (!sc->sig_resign_interval) {
ods_log_error("[%s] check failed: no signature resign interval found",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->sig_refresh_interval) {
ods_log_error("[%s] check failed: no signature resign interval found",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->sig_validity_default) {
ods_log_error("[%s] check failed: no signature default validity found",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->sig_validity_denial) {
ods_log_error("[%s] check failed: no signature denial validity found",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->sig_jitter) {
ods_log_error("[%s] check failed: no signature jitter found", sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->sig_inception_offset) {
ods_log_error("[%s] check failed: no signature inception offset found",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
if (sc->nsec3_algo != LDNS_SHA1) {
ods_log_error("[%s] check failed: invalid nsec3 algorithm",
sc_str);
status = ODS_STATUS_CFG_ERR;
}
/* iterations */
/* salt */
/* optout */
} else if (sc->nsec_type != LDNS_RR_TYPE_NSEC) {
ods_log_error("[%s] check failed: wrong nsec type %i", sc_str,
sc->nsec_type);
status = ODS_STATUS_CFG_ERR;
}
if ((!sc->keys || sc->keys->count == 0) && !sc->passthrough) {
ods_log_error("[%s] check failed: no keys found", sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->dnskey_ttl) {
ods_log_error("[%s] check failed: no dnskey ttl found", sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->soa_ttl) {
ods_log_error("[%s] check failed: no soa ttl found", sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->soa_min) {
ods_log_error("[%s] check failed: no soa minimum found", sc_str);
status = ODS_STATUS_CFG_ERR;
}
if (!sc->soa_serial) {
ods_log_error("[%s] check failed: no soa serial type found", sc_str);
status = ODS_STATUS_CFG_ERR;
} else if (signconf_soa_serial_check(sc->soa_serial) != 0) {
ods_log_error("[%s] check failed: wrong soa serial type %s", sc_str,
sc->soa_serial);
status = ODS_STATUS_CFG_ERR;
}
return status;
}
/**
* Compare signer configurations on denial of existence material.
*
*/
task_id
signconf_compare_denial(signconf_type* a, signconf_type* b)
{
task_id new_task = TASK_NONE;
if (!a || !b) {
return TASK_NONE;
}
ods_log_assert(a);
ods_log_assert(b);
if (duration_compare(a->soa_min, b->soa_min)) {
new_task = TASK_NSECIFY;
} else if (a->nsec_type != b->nsec_type) {
new_task = TASK_NSECIFY;
} else if (a->nsec_type == LDNS_RR_TYPE_NSEC3) {
if ((ods_strcmp(a->nsec3_salt, b->nsec3_salt) != 0) ||
(a->nsec3_algo != b->nsec3_algo) ||
(a->nsec3_iterations != b->nsec3_iterations) ||
(a->nsec3_optout != b->nsec3_optout)) {
new_task = TASK_NSECIFY;
} else if (duration_compare(a->nsec3param_ttl, b->nsec3param_ttl)) {
new_task = TASK_READ;
}
}
return new_task;
}
/**
* Log sign configuration.
*
*/
void
signconf_log(signconf_type* sc, const char* name)
{
char* resign = NULL;
char* refresh = NULL;
char* validity = NULL;
char* denial = NULL;
char* keyset = NULL;
char* jitter = NULL;
char* offset = NULL;
char* dnskeyttl = NULL;
char* soattl = NULL;
char* soamin = NULL;
char* paramttl = NULL;
if (sc) {
resign = duration2string(sc->sig_resign_interval);
refresh = duration2string(sc->sig_refresh_interval);
validity = duration2string(sc->sig_validity_default);
denial = duration2string(sc->sig_validity_denial);
if (sc->sig_validity_keyset) {
keyset = duration2string(sc->sig_validity_keyset);
}
jitter = duration2string(sc->sig_jitter);
offset = duration2string(sc->sig_inception_offset);
dnskeyttl = duration2string(sc->dnskey_ttl);
paramttl = duration2string(sc->nsec3param_ttl);
soattl = duration2string(sc->soa_ttl);
soamin = duration2string(sc->soa_min);
/* signconf */
ods_log_info("[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] "
"%sVALIDITY[%s] DENIAL[%s] KEYSET[%s] JITTER[%s] OFFSET[%s] NSEC[%i] "
"DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s]",
sc_str,
name?name:"(null)",
resign?resign:"(null)",
refresh?refresh:"(null)",
sc->passthrough?"PASSTHROUGH ":"",
validity?validity:"(null)",
denial?denial:"(null)",
keyset?keyset:"(null)",
jitter?jitter:"(null)",
offset?offset:"(null)",
(int) sc->nsec_type,
dnskeyttl?dnskeyttl:"(null)",
soattl?soattl:"(null)",
soamin?soamin:"(null)",
sc->soa_serial?sc->soa_serial:"(null)");
/* nsec3 parameters */
if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
ods_log_debug("[%s] zone %s nsec3: PARAMTTL[%s] OPTOUT[%i] "
"ALGORITHM[%u] ITERATIONS[%u] SALT[%s]",
sc_str,
name?name:"(null)",
paramttl?paramttl:"PT0S",
sc->nsec3_optout,
sc->nsec3_algo,
sc->nsec3_iterations,
sc->nsec3_salt?sc->nsec3_salt:"(null)");
}
/* keys */
keylist_log(sc->keys, name);
/* cleanup */
free((void*)resign);
free((void*)refresh);
free((void*)validity);
free((void*)denial);
free((void*)keyset);
free((void*)jitter);
free((void*)offset);
free((void*)dnskeyttl);
free((void*)paramttl);
free((void*)soattl);
free((void*)soamin);
}
}
/**
* Clean up signer configuration.
*
*/
void
signconf_cleanup(signconf_type* sc)
{
if (!sc) {
return;
}
duration_cleanup(sc->sig_resign_interval);
duration_cleanup(sc->sig_refresh_interval);
duration_cleanup(sc->sig_validity_default);
duration_cleanup(sc->sig_validity_denial);
duration_cleanup(sc->sig_validity_keyset);
duration_cleanup(sc->sig_jitter);
duration_cleanup(sc->sig_inception_offset);
duration_cleanup(sc->dnskey_ttl);
duration_cleanup(sc->soa_ttl);
duration_cleanup(sc->soa_min);
duration_cleanup(sc->max_zone_ttl);
keylist_cleanup(sc->keys);
nsec3params_cleanup(sc->nsec3params);
free((void*)sc->filename);
free((void*)sc->nsec3_salt);
free((void*)sc->soa_serial);
free(sc);
}
opendnssec-2.0.4/signer/src/signer/nsec3params.h 0000644 0001750 0001750 00000006166 13036123676 016554 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_NSEC3PARAMS_H
#define SIGNER_NSEC3PARAMS_H
#include "config.h"
#include
#include
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#ifdef HAVE_UNISTD_H
# include
#endif
#include
typedef struct nsec3params_struct nsec3params_type;
#include "status.h"
#include "signconf.h"
struct nsec3params_struct {
signconf_type* sc;
uint8_t algorithm;
uint8_t flags;
uint16_t iterations;
uint8_t salt_len;
uint8_t* salt_data;
ldns_rr* rr;
};
/**
* Create NSEC3 salt.
* \param[in] salt_str the salt in string format
* \param[out] salt_len lenght of the salt data
* \param[out] salt salt in raw data format
* \return ods_status status
*
*/
ods_status nsec3params_create_salt(const char* salt_str, uint8_t* salt_len,
uint8_t** salt);
/**
* Create new NSEC3 parameters.
* \param[in] sc signer configuration reference
* \param[in] algo algorithm
* \param[in] flags flags, Opt-Out or Opt-In
* \param[in] iter number of iterations
* \param[in] salt salt
* \return nsec3params_type* the created nsec3params
*
*/
nsec3params_type* nsec3params_create(void* sc, uint8_t algo, uint8_t flags,
uint16_t iter, const char* salt);
/**
* Backup NSEC3 parameters.
* \param[in] fd file descriptor
* \param[in] algo algorithm
* \param[in] flags glags, Opt-Out or Opt-In
* \param[in] iter number of iterations
* \param[in] salt salt
* \param[in] rr NSEC3PARAM RR
* \param[in] version version string
*
*/
void nsec3params_backup(FILE* fd, uint8_t algo, uint8_t flags,
uint16_t iter, const char* salt, ldns_rr* rr, const char* version);
/**
* Clean up the NSEC3 parameters.
* \param[in] nsec3params the nsec3param to be deleted
*
*/
void nsec3params_cleanup(nsec3params_type* nsec3params);
#endif /* SIGNER_NSEC3PARAMS_H */
opendnssec-2.0.4/signer/src/signer/zonelist.c 0000644 0001750 0001750 00000027243 13036123713 016166 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
*
* The zonelist and all.
*/
#include "config.h"
#include "parser/confparser.h"
#include "parser/zonelistparser.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "signer/zone.h"
#include "signer/zonelist.h"
#include
#include
static const char* zl_str = "zonelist";
/**
* Compare two zones.
*
*/
static int
zone_compare(const void* a, const void* b)
{
zone_type* x = (zone_type*)a;
zone_type* y = (zone_type*)b;
ods_log_assert(x);
ods_log_assert(y);
if (x->klass != y->klass) {
if (x->klass < y->klass) {
return -1;
}
return 1;
}
return ldns_dname_compare(x->apex, y->apex);
}
/**
* Create a new zone list.
*
*/
zonelist_type*
zonelist_create()
{
zonelist_type* zlist = NULL;
CHECKALLOC(zlist = (zonelist_type*) malloc(sizeof(zonelist_type)));
if (!zlist) {
ods_log_error("[%s] unable to create zonelist: allocator_alloc() "
"failed", zl_str);
return NULL;
}
zlist->zones = ldns_rbtree_create(zone_compare);
if (!zlist->zones) {
ods_log_error("[%s] unable to create zonelist: ldns_rbtree_create() "
"failed", zl_str);
free(zlist);
return NULL;
}
zlist->last_modified = 0;
lock_basic_init(&zlist->zl_lock);
return zlist;
}
/**
* Read a zonelist file.
*
*/
static ods_status
zonelist_read(zonelist_type* zl, const char* zlfile)
{
const char* rngfile = ODS_SE_RNGDIR "/zonelist.rng";
ods_status status = ODS_STATUS_OK;
ods_log_assert(zlfile);
ods_log_verbose("[%s] read file %s", zl_str, zlfile);
status = parse_file_check(zlfile, rngfile);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read file: parse error in %s", zl_str,
zlfile);
return status;
}
return parse_zonelist_zones((struct zonelist_struct*) zl, zlfile);
}
/**
* Convert a zone to a tree node.
*
*/
static ldns_rbnode_t*
zone2node(zone_type* zone)
{
ldns_rbnode_t* node = (ldns_rbnode_t*) malloc(sizeof(ldns_rbnode_t));
if (!node) {
return NULL;
}
node->key = zone;
node->data = zone;
return node;
}
/**
* Lookup zone.
*
*/
static zone_type*
zonelist_lookup_zone(zonelist_type* zonelist, zone_type* zone)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
if (zonelist && zonelist->zones && zone) {
node = ldns_rbtree_search(zonelist->zones, zone);
if (node) {
return (zone_type*) node->data;
}
}
return NULL;
}
/**
* Lookup zone by name.
*
*/
zone_type*
zonelist_lookup_zone_by_name(zonelist_type* zonelist, const char* name,
ldns_rr_class klass)
{
zone_type* zone = NULL;
zone_type* result = NULL;
if (zonelist && zonelist->zones && name && klass) {
zone = zone_create((char*) name, klass);
if (!zone) {
ods_log_error("[%s] unable to lookup zone %s: "
"zone_create() failed", zl_str, name);
/* result stays NULL */
} else {
result = zonelist_lookup_zone(zonelist, zone);
zone_cleanup(zone);
}
}
return result;
}
/**
* Lookup zone by dname.
*
*/
zone_type*
zonelist_lookup_zone_by_dname(zonelist_type* zonelist, ldns_rdf* dname,
ldns_rr_class klass)
{
char* name = NULL;
zone_type* result = NULL;
if (zonelist && zonelist->zones && dname && klass) {
name = ldns_rdf2str(dname);
result = zonelist_lookup_zone_by_name(zonelist, name, klass);
free((void*)name);
}
return result;
}
/**
* Add zone.
*
*/
zone_type*
zonelist_add_zone(zonelist_type* zlist, zone_type* zone)
{
ldns_rbnode_t* new_node = NULL;
if (!zone) {
return NULL;
}
if (!zlist || !zlist->zones) {
zone_cleanup(zone);
return NULL;
}
/* look up */
if (zonelist_lookup_zone(zlist, zone) != NULL) {
ods_log_warning("[%s] unable to add zone %s: already present", zl_str,
zone->name);
zone_cleanup(zone);
return NULL;
}
/* add */
new_node = zone2node(zone);
if (ldns_rbtree_insert(zlist->zones, new_node) == NULL) {
ods_log_error("[%s] unable to add zone %s: ldns_rbtree_insert() "
"failed", zl_str, zone->name);
free((void*) new_node);
zone_cleanup(zone);
return NULL;
}
zone->zl_status = ZONE_ZL_ADDED;
zlist->just_added++;
return zone;
}
/**
* Delete zone.
*
*/
zone_type*
zonelist_del_zone(zonelist_type* zlist, zone_type* zone)
{
ldns_rbnode_t* old_node = LDNS_RBTREE_NULL;
if (!zone) {
return NULL;
}
if (!zlist || !zlist->zones) {
goto zone_not_present;
}
old_node = ldns_rbtree_delete(zlist->zones, zone);
if (!old_node) {
goto zone_not_present;
}
free((void*) old_node);
return zone;
zone_not_present:
ods_log_warning("[%s] unable to delete zone %s: not present", zl_str,
zone->name);
return zone;
}
/**
* Merge zone lists.
*
*/
static void
zonelist_merge(zonelist_type* zl1, zonelist_type* zl2)
{
zone_type* z1 = NULL;
zone_type* z2 = NULL;
ldns_rbnode_t* n1 = LDNS_RBTREE_NULL;
ldns_rbnode_t* n2 = LDNS_RBTREE_NULL;
int ret = 0;
ods_log_assert(zl1);
ods_log_assert(zl2);
ods_log_assert(zl1->zones);
ods_log_assert(zl2->zones);
ods_log_debug("[%s] merge two zone lists", zl_str);
n1 = ldns_rbtree_first(zl1->zones);
n2 = ldns_rbtree_first(zl2->zones);
while (n2 && n2 != LDNS_RBTREE_NULL) {
z2 = (zone_type*) n2->data;
if (n1 && n1 != LDNS_RBTREE_NULL) {
z1 = (zone_type*) n1->data;
} else {
z1 = NULL;
}
if (!z2) {
/* no more zones to merge into zl1 */
return;
} else if (!z1) {
/* just add remaining zones from zl2 */
z2 = zonelist_add_zone(zl1, z2);
if (!z2) {
ods_log_crit("[%s] merge failed: z2 not added", zl_str);
return;
}
n2 = ldns_rbtree_next(n2);
} else {
/* compare the zones z1 and z2 */
ret = zone_compare(z1, z2);
if (ret < 0) {
/* remove zone z1, it is not present in the new list zl2 */
z1->zl_status = ZONE_ZL_REMOVED;
zl1->just_removed++;
n1 = ldns_rbtree_next(n1);
} else if (ret > 0) {
/* add the new zone z2 */
z2 = zonelist_add_zone(zl1, z2);
if (!z2) {
ods_log_crit("[%s] merge failed: z2 not added", zl_str);
return;
}
n2 = ldns_rbtree_next(n2);
} else {
/* just update zone z1 */
n1 = ldns_rbtree_next(n1);
n2 = ldns_rbtree_next(n2);
zone_merge(z1, z2);
zone_cleanup(z2);
if (z1->zl_status == ZONE_ZL_UPDATED) {
zl1->just_updated++;
}
z1->zl_status = ZONE_ZL_UPDATED;
}
}
}
/* remove remaining zones from z1 */
while (n1 && n1 != LDNS_RBTREE_NULL) {
z1 = (zone_type*) n1->data;
z1->zl_status = ZONE_ZL_REMOVED;
zl1->just_removed++;
n1 = ldns_rbtree_next(n1);
}
zl1->last_modified = zl2->last_modified;
}
/**
* Update zone list.
*
*/
ods_status
zonelist_update(zonelist_type* zl, const char* zlfile)
{
zonelist_type* new_zlist = NULL;
time_t st_mtime = 0;
ods_status status = ODS_STATUS_OK;
char* datestamp = NULL;
ods_log_debug("[%s] update zone list", zl_str);
if (!zl|| !zl->zones || !zlfile) {
return ODS_STATUS_ASSERT_ERR;
}
/* is the file updated? */
/* OPENDNSSEC-686: changes happening within one second will not be
* seen
*/
st_mtime = ods_file_lastmodified(zlfile);
if (st_mtime <= zl->last_modified) {
(void)time_datestamp(zl->last_modified, "%Y-%m-%d %T", &datestamp);
ods_log_debug("[%s] zonelist file %s is unchanged since %s",
zl_str, zlfile, datestamp?datestamp:"Unknown");
free((void*)datestamp);
return ODS_STATUS_UNCHANGED;
}
/* create new zonelist */
new_zlist = zonelist_create();
if (!new_zlist) {
ods_log_error("[%s] unable to update zonelist: zonelist_create() "
"failed", zl_str);
return ODS_STATUS_ERR;
}
/* read zonelist */
status = zonelist_read(new_zlist, zlfile);
if (status == ODS_STATUS_OK) {
zl->just_removed = 0;
zl->just_added = 0;
zl->just_updated = 0;
new_zlist->last_modified = st_mtime;
zonelist_merge(zl, new_zlist);
(void)time_datestamp(zl->last_modified, "%Y-%m-%d %T", &datestamp);
ods_log_debug("[%s] file %s is modified since %s", zl_str, zlfile,
datestamp?datestamp:"Unknown");
free((void*)datestamp);
} else {
ods_log_error("[%s] unable to update zonelist: read file %s failed "
"(%s)", zl_str, zlfile, ods_status2str(status));
}
zonelist_free(new_zlist);
return status;
}
/**
* Internal zone cleanup function.
*
*/
static void
zone_delfunc(ldns_rbnode_t* elem)
{
zone_type* zone;
if (elem && elem != LDNS_RBTREE_NULL) {
zone = (zone_type*) elem->data;
zone_delfunc(elem->left);
zone_delfunc(elem->right);
ods_log_deeebug("[%s] cleanup zone %s", zl_str, zone->name);
zone_cleanup(zone);
free((void*)elem);
}
}
/**
* Internal node cleanup function.
*
*/
static void
node_delfunc(ldns_rbnode_t* elem)
{
if (elem && elem != LDNS_RBTREE_NULL) {
node_delfunc(elem->left);
node_delfunc(elem->right);
free((void*)elem);
}
}
/**
* Clean up a zonelist.
*
*/
void
zonelist_cleanup(zonelist_type* zl)
{
if (!zl) {
return;
}
ods_log_debug("[%s] cleanup zonelist", zl_str);
if (zl->zones) {
zone_delfunc(zl->zones->root);
ldns_rbtree_free(zl->zones);
zl->zones = NULL;
}
lock_basic_destroy(&zl->zl_lock);
free(zl);
}
/**
* Free zonelist.
*
*/
void
zonelist_free(zonelist_type* zl)
{
if (!zl) {
return;
}
if (zl->zones) {
node_delfunc(zl->zones->root);
ldns_rbtree_free(zl->zones);
zl->zones = NULL;
}
lock_basic_destroy(&zl->zl_lock);
free(zl);
}
opendnssec-2.0.4/signer/src/signer/backup.c 0000644 0001750 0001750 00000042651 13036123713 015564 0000000 0000000 /*
* Copyright (c) 2006-2010 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Recover from backup.
*
*/
#include "config.h"
#include "adapter/adapi.h"
#include "adapter/adutil.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/backup.h"
#include "signer/zone.h"
#include
static const char* backup_str = "backup";
/**
* Read token from backup file.
*
*/
char*
backup_read_token(FILE* in)
{
static char buf[4000];
buf[sizeof(buf)-1]=0;
while (1) {
if (fscanf(in, "%3990s", buf) != 1) {
return 0;
}
if (buf[0] != '#') {
return buf;
}
if (!fgets(buf, sizeof(buf), in)) {
return 0;
}
}
return 0;
}
/**
* Read and match a string from backup file.
*
*/
int
backup_read_check_str(FILE* in, const char* str)
{
char *p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read check string \'%s\'", backup_str, str);
return 0;
}
if (ods_strcmp(p, str) != 0) {
if (!strcmp(p, "rfc5011") && !strcmp(str, "keytag")) {
return 1;
}
if (!strcmp(p, "jitter") && !strcmp(str, "keyset")) {
fseek(in, -7, SEEK_CUR);
return 1;
}
ods_log_debug("[%s] \'%s\' does not match \'%s\'", backup_str, p, str);
return 0;
}
return 1;
}
/**
* Read a string from backup file.
*
*/
int
backup_read_str(FILE* in, const char** str)
{
char *p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read string", backup_str);
return 0;
}
*str = strdup(p);
return 1;
}
/**
* Read time from backup file.
*
*/
int
backup_read_time_t(FILE* in, time_t* v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read time", backup_str);
return 0;
}
*v=atol(p);
return 1;
}
/**
* Read duration from backup file.
*
*/
int
backup_read_duration(FILE* in, duration_type** v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read duration", backup_str);
return 0;
}
if (!strcmp(p, "jitter")) {
fseek(in, -7, SEEK_CUR);
return 1;
}
*v=duration_create_from_string((const char*) p);
return 1;
}
/**
* Read rr type from backup file.
*
*/
int
backup_read_rr_type(FILE* in, ldns_rr_type* v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read rr type", backup_str);
return 0;
}
*v=(ldns_rr_type) atoi(p);
return 1;
}
/**
* Read integer from backup file.
*
*/
int
backup_read_int(FILE* in, int* v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read integer", backup_str);
return 0;
}
*v=atoi(p);
return 1;
}
/**
* Read 8bit unsigned integer from backup file.
*
*/
int
backup_read_uint8_t(FILE* in, uint8_t* v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read uint8_t", backup_str);
return 0;
}
*v= (uint8_t)atoi(p);
return 1;
}
/**
* Read 32bit unsigned integer from backup file.
*
*/
int
backup_read_uint32_t(FILE* in, uint32_t* v)
{
char* p = backup_read_token(in);
if (!p) {
ods_log_debug("[%s] cannot read uint32_t", backup_str);
return 0;
}
*v= (uint32_t)atol(p);
return 1;
}
/**
* Read the next RR from the backup file.
*
*/
static ldns_rr*
backup_read_rr(FILE* in, zone_type* zone, char* line, ldns_rdf** orig,
ldns_rdf** prev, ldns_status* status, unsigned int* l)
{
ldns_rr* rr = NULL;
int len = 0;
backup_read_line:
len = adutil_readline_frm_file(in, line, l, 1);
if (len >= 0) {
switch (line[0]) {
case ';':
/* done */
*status = LDNS_STATUS_OK;
return NULL;
break;
case '\n':
case '\0':
goto backup_read_line; /* perhaps next line is rr */
break;
/* let's hope its a RR */
default:
*status = ldns_rr_new_frm_str(&rr, line, zone->default_ttl,
*orig, prev);
if (*status == LDNS_STATUS_OK) {
return rr;
} else if (*status == LDNS_STATUS_SYNTAX_EMPTY) {
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
*status = LDNS_STATUS_OK;
goto backup_read_line; /* perhaps next line is rr */
break;
} else {
ods_log_error("[%s] error parsing RR #%i (%s): %s",
backup_str, l&&*l?*l:0,
ldns_get_errorstr_by_id(*status), line);
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
return NULL;
}
break;
}
}
/* -1, EOF */
*status = LDNS_STATUS_OK;
return NULL;
}
/**
* Get locator from string.
*
*/
static char*
replace_space_with_nul(char* str)
{
int i = 0;
if (!str) {
return NULL;
}
i = strlen(str);
while (i>0) {
--i;
if (str[i] == ' ') {
str[i] = '\0';
}
}
return strdup(str);
}
/**
* Read namedb from backup file.
*
*/
ods_status
backup_read_namedb(FILE* in, void* zone)
{
zone_type* z = (zone_type*) zone;
denial_type* denial = NULL;
rrset_type* rrset = NULL;
ods_status result = ODS_STATUS_OK;
ldns_rr_type type_covered;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
ldns_rdf* dname = NULL;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
char* str = NULL;
char* locator = NULL;
uint32_t flags = 0;
unsigned int l = 0;
ods_log_assert(in);
ods_log_assert(z);
/* $ORIGIN */
dname = adapi_get_origin(z);
if (!dname) {
ods_log_error("[%s] error getting default value for $ORIGIN",
backup_str);
return ODS_STATUS_ERR;
}
orig = ldns_rdf_clone(dname);
if (!orig) {
ods_log_error("[%s] error setting default value for $ORIGIN",
backup_str);
return ODS_STATUS_ERR;
}
/* read RRs */
ods_log_debug("[%s] read RRs %s", backup_str, z->name);
while ((rr = backup_read_rr(in, z, line, &orig, &prev, &status, &l))
!= NULL) {
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
/* add to the database */
result = adapi_add_rr(z, rr, 1);
if (result == ODS_STATUS_UNCHANGED) {
ods_log_debug("[%s] skipping RR #%i (duplicate): %s",
backup_str, l, line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
continue;
} else if (result != ODS_STATUS_OK) {
ods_log_error("[%s] error adding RR #%i: %s",
backup_str, l, line);
ldns_rr_free(rr);
rr = NULL;
goto backup_namedb_done;
}
}
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
namedb_diff(z->db, 0, 0);
/* read NSEC(3)s */
ods_log_debug("[%s] read NSEC(3)s %s", backup_str, z->name);
l = 0;
while ((rr = backup_read_rr(in, z, line, &orig, &prev, &status, &l))
!= NULL) {
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading NSEC(3) #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_NSEC &&
ldns_rr_get_type(rr) != LDNS_RR_TYPE_NSEC3) {
ods_log_error("[%s] error NSEC(3) #%i is not NSEC(3): %s",
backup_str, l, line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
/* add to the denial chain */
denial = namedb_lookup_denial(z->db, ldns_rr_owner(rr));
if (!denial) {
ods_log_error("[%s] error adding NSEC(3) #%i: %s",
backup_str, l, line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
denial_add_rr(denial, rr);
}
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading NSEC(3) #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
/* read RRSIGs */
ods_log_debug("[%s] read RRSIGs %s", backup_str, z->name);
l = 0;
while ((rr = backup_read_rr(in, z, line, &orig, &prev, &status, &l))
!= NULL) {
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RRSIG #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_RRSIG) {
ods_log_error("[%s] error RRSIG #%i is not RRSIG: %s",
backup_str, l, line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
/* read locator and flags */
str = strstr(line, "flags");
if (str) {
flags = (uint32_t) atoi(str+6);
}
str = strstr(line, "locator");
if (str) {
locator = replace_space_with_nul(str+8);
}
/* add signatures */
type_covered = ldns_rdf2rr_type(ldns_rr_rrsig_typecovered(rr));
if (type_covered == LDNS_RR_TYPE_NSEC ||
type_covered == LDNS_RR_TYPE_NSEC3) {
denial = namedb_lookup_denial(z->db, ldns_rr_owner(rr));
if (!denial) {
ods_log_error("[%s] error restoring RRSIG #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
rrset = denial->rrset;
} else {
rrset = zone_lookup_rrset(z, ldns_rr_owner(rr), type_covered);
}
if (!rrset) {
ods_log_error("[%s] error restoring RRSIG #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_namedb_done;
}
rrset_add_rrsig(rrset, rr, locator, flags);
locator = NULL; /* Locator is owned by rrset now */
rrset->needs_signing = 0;
}
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RRSIG #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
}
backup_namedb_done:
if (orig) {
ldns_rdf_deep_free(orig);
orig = NULL;
}
if (prev) {
ldns_rdf_deep_free(prev);
prev = NULL;
}
free(locator); /* if everything went well this is NULL. otherwise
clean up. */
return result;
}
/**
* Read ixfr journal from file.
*
*
*/
ods_status
backup_read_ixfr(FILE* in, void* zone)
{
zone_type* z = (zone_type*) zone;
ods_status result = ODS_STATUS_OK;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
ldns_rdf* dname = NULL;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
uint32_t serial = 0;
unsigned l = 0;
unsigned first_soa = 0;
unsigned del_mode = 0;
ods_log_assert(in);
ods_log_assert(z);
/* $ORIGIN */
dname = adapi_get_origin(z);
if (!dname) {
ods_log_error("[%s] error getting default value for $ORIGIN",
backup_str);
return ODS_STATUS_ERR;
}
orig = ldns_rdf_clone(dname);
if (!orig) {
ods_log_error("[%s] error setting default value for $ORIGIN",
backup_str);
return ODS_STATUS_ERR;
}
/* read RRs */
while ((rr = backup_read_rr(in, z, line, &orig, &prev, &status, &l))
!= NULL) {
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
goto backup_ixfr_done;
}
if (first_soa == 2) {
ods_log_error("[%s] bad ixfr journal: trailing RRs after final "
"SOA", backup_str);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_ixfr_done;
}
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
serial = ldns_rdf2native_int32(
ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
if (!first_soa) {
ods_log_debug("[%s] ixfr first SOA: %s", backup_str,
ldns_rr2str(rr));
/* first SOA */
ldns_rr_free(rr);
rr = NULL;
if (z->db->outserial != serial) {
ods_log_error("[%s] bad ixfr journal: first SOA wrong "
"serial (was %u, expected %u)", backup_str,
serial, z->db->outserial);
result = ODS_STATUS_ERR;
goto backup_ixfr_done;
}
first_soa = 1;
continue;
}
ods_log_assert(first_soa);
if (!del_mode) {
if (z->db->outserial == serial) {
/* final SOA */
ods_log_debug("[%s] ixfr final SOA: %s", backup_str,
ldns_rr2str(rr));
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
first_soa = 2;
continue;
} else {
ods_log_debug("[%s] new part SOA: %s", backup_str,
ldns_rr2str(rr));
lock_basic_lock(&z->ixfr->ixfr_lock);
ixfr_purge(z->ixfr);
lock_basic_unlock(&z->ixfr->ixfr_lock);
}
} else {
ods_log_debug("[%s] second part SOA: %s", backup_str,
ldns_rr2str(rr));
}
del_mode = !del_mode;
}
/* ixfr add or del rr */
if (!first_soa) {
ods_log_error("[%s] bad ixfr journal: first RR not SOA",
backup_str);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
goto backup_ixfr_done;
}
ods_log_assert(first_soa);
lock_basic_lock(&z->ixfr->ixfr_lock);
if (del_mode) {
ods_log_deeebug("[%s] -IXFR: %s", backup_str, ldns_rr2str(rr));
ixfr_del_rr(z->ixfr, rr);
} else {
ods_log_deeebug("[%s] +IXFR: %s", backup_str, ldns_rr2str(rr));
ixfr_add_rr(z->ixfr, rr);
}
lock_basic_unlock(&z->ixfr->ixfr_lock);
}
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR #%i (%s): %s",
backup_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
}
backup_ixfr_done:
if (orig) {
ldns_rdf_deep_free(orig);
orig = NULL;
}
if (prev) {
ldns_rdf_deep_free(prev);
prev = NULL;
}
return result;
}
opendnssec-2.0.4/signer/src/signer/zonelist.h 0000644 0001750 0001750 00000006253 13036123713 016171 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_ZONELIST_H
#define SIGNER_ZONELIST_H
#include
#include
#include
typedef struct zonelist_struct zonelist_type;
#include "status.h"
#include "locks.h"
#include "signer/zone.h"
/**
* Zone list
*
*/
struct zonelist_struct {
ldns_rbtree_t* zones;
time_t last_modified;
int just_added;
int just_updated;
int just_removed;
lock_basic_type zl_lock;
};
/**
* Create zone list.
* \param[in] allocator memory allocator
* \return zonelist_type* created zone list
*
*/
zonelist_type* zonelist_create(void);
/**
* Lookup zone by name and class.
* \param[in] zl zone list
* \param[in] name zone name
* \param[in] klass zone class
* \return zone_type* found zone
*
*/
zone_type* zonelist_lookup_zone_by_name(zonelist_type* zonelist,
const char* name, ldns_rr_class klass);
/**
* Lookup zone by dname and class.
* \param[in] zl zone list
* \param[in] dname zone domain name
* \param[in] klass zone class
* \return zone_type* found zone
*
*/
zone_type* zonelist_lookup_zone_by_dname(zonelist_type* zonelist,
ldns_rdf* dname, ldns_rr_class klass);
/**
* Add zone.
* \param[in] zl zone list
* \param[in] zone zone
* \return zone_type* added zone
*
*/
zone_type* zonelist_add_zone(zonelist_type* zl, zone_type* zone);
/**
* Delete zone.
* \param[in] zl zone list
* \param[in] zone zone
* \return zone_type* deleted zone
*
*/
zone_type* zonelist_del_zone(zonelist_type* zlist, zone_type* zone);
/**
* Update zonelist.
* \param[in] zl zone list
* \param[in] zlfile zone list filename
* \return ods_status status
*
*/
ods_status zonelist_update(zonelist_type* zl, const char* zlfile);
/**
* Clean up zone list.
* \param[in] zl zone list
*
*/
void zonelist_cleanup(zonelist_type* zl);
/**
* Free zone list.
* \param[in] zl zone list
*
*/
void zonelist_free(zonelist_type* zl);
#endif /* SIGNER_ZONELIST_H */
opendnssec-2.0.4/signer/src/signer/stats.h 0000644 0001750 0001750 00000005164 13036123713 015460 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_STATS_H
#define SIGNER_STATS_H
#include "config.h"
#include
#include
#include
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#ifdef HAVE_UNISTD_H
# include
#endif
#include
typedef struct stats_struct stats_type;
#include "locks.h"
/**
* Statistics structure.
*/
struct stats_struct {
uint32_t sort_count;
time_t sort_time;
int sort_done;
uint32_t nsec_count;
time_t nsec_time;
uint32_t sig_count;
uint32_t sig_soa_count;
uint32_t sig_reuse;
time_t sig_time;
time_t audit_time;
time_t start_time;
time_t end_time;
lock_basic_type stats_lock;
};
/**
* Initialize statistics.
* \return the initialized stats;
*
*/
stats_type* stats_create(void);
/**
* Log statistics.
* \param[in] stats statistics
* \param[in] name zone name
* \param[in] serial serial
* \param[in] nsec_type NSEC or NSEC3
*
*/
void stats_log(stats_type* stats, const char* name, uint32_t serial,
ldns_rr_type nsec_type);
/**
* Clear statistics.
* \param[in] stats statistics to be cleared
*
*/
void stats_clear(stats_type* stats);
/**
* Clean up statistics.
* \param[in] stats statistics to be deleted
*
*/
void stats_cleanup(stats_type* stats);
#endif /* SIGNER_STATS_H */
opendnssec-2.0.4/signer/src/signer/stats.c 0000644 0001750 0001750 00000005734 13036123713 015456 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signer statistics.
*
*/
#include "log.h"
#include "signer/stats.h"
/**
* Initialize statistics.
*
*/
stats_type*
stats_create(void)
{
stats_type* stats = (stats_type*) malloc(sizeof(stats_type));
stats_clear(stats);
lock_basic_init(&stats->stats_lock);
return stats;
}
/**
* Clear statistics.
*
*/
void
stats_clear(stats_type* stats)
{
ods_log_assert(stats);
stats->sort_count = 0;
stats->sort_time = 0;
stats->sort_done = 0;
stats->nsec_count = 0;
stats->nsec_time = 0;
stats->sig_count = 0;
stats->sig_soa_count = 0;
stats->sig_reuse = 0;
stats->sig_time = 0;
stats->start_time = 0;
stats->end_time = 0;
}
/**
* Log statistics.
*
*/
void
stats_log(stats_type* stats, const char* name, uint32_t serial,
ldns_rr_type nsec_type)
{
uint32_t avsign = 0;
if (!stats) {
return;
}
ods_log_assert(stats);
if (stats->sig_time) {
avsign = (uint32_t) (stats->sig_count/stats->sig_time);
}
ods_log_info("[STATS] %s %u RR[count=%u time=%lu(sec)] "
"NSEC%s[count=%u time=%lu(sec)] "
"RRSIG[new=%u reused=%u time=%lu(sec) avg=%u(sig/sec)] "
"TOTAL[time=%u(sec)] ",
name?name:"(null)", (unsigned) serial,
stats->sort_count, (unsigned long)stats->sort_time,
nsec_type==LDNS_RR_TYPE_NSEC3?"3":"", stats->nsec_count,
(unsigned long)stats->nsec_time, stats->sig_count, stats->sig_reuse,
(unsigned long)stats->sig_time, avsign,
(uint32_t) (stats->end_time - stats->start_time));
}
/**
* Clean up statistics.
*
*/
void
stats_cleanup(stats_type* stats)
{
lock_basic_destroy(&stats->stats_lock);
free((void*) stats);
}
opendnssec-2.0.4/signer/src/signer/ixfr.c 0000644 0001750 0001750 00000016624 13036123713 015270 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* IXFR Journal.
*
*/
#include "config.h"
#include "util.h"
#include "signer/ixfr.h"
#include "signer/rrset.h"
#include "signer/zone.h"
static const char* ixfr_str = "journal";
/**
* Create a part of ixfr journal.
*
*/
static part_type*
part_create()
{
part_type* part = NULL;
CHECKALLOC(part = (part_type*) malloc(sizeof(part_type)));
part->soaplus = NULL;
part->soamin = NULL;
part->plus = ldns_rr_list_new();
if (!part->plus) {
ods_log_error("[%s] unable to create ixfr part: "
"ldns_rr_list_new() failed", ixfr_str);
free(part);
return NULL;
}
part->min = ldns_rr_list_new();
if (!part->min) {
ods_log_error("[%s] unable to create ixfr part: "
"ldns_rr_list_new() failed", ixfr_str);
ldns_rr_list_free(part->plus);
free(part);
return NULL;
}
return part;
}
/**
* Clean up a part of ixfr journal.
*
*/
static void
part_cleanup(part_type* part)
{
if (!part) {
return;
}
ldns_rr_list_deep_free(part->min);
ldns_rr_list_free(part->plus);
free(part);
}
/**
* Create a new ixfr journal.
*
*/
ixfr_type*
ixfr_create(zone_type* zone)
{
size_t i = 0;
ixfr_type* xfr = NULL;
ods_log_assert(zone);
ods_log_assert(zone->name);
CHECKALLOC(xfr = (ixfr_type*) malloc(sizeof(ixfr_type)));
if (!xfr) {
ods_log_error("[%s] unable to create ixfr for zone %s: "
"allocator_alloc() failed", ixfr_str, zone->name);
return NULL;
}
for (i=0; i < IXFR_MAX_PARTS; i++) {
xfr->part[i] = NULL;
}
xfr->zone = zone;
lock_basic_init(&xfr->ixfr_lock);
return xfr;
}
/**
* Add +RR to ixfr journal.
*
*/
void
ixfr_add_rr(ixfr_type* ixfr, ldns_rr* rr)
{
zone_type* zone = NULL;
if (!ixfr || !rr) {
return;
}
zone = (zone_type*) ixfr->zone;
ods_log_assert(zone);
ods_log_assert(zone->db);
if (!zone->db->is_initialized) {
/* no ixfr yet */
return;
}
ods_log_assert(ixfr->part[0]);
ods_log_assert(ixfr->part[0]->plus);
if (!ldns_rr_list_push_rr(ixfr->part[0]->plus, rr)) {
ods_fatal_exit("[%s] fatal unable to +RR: ldns_rr_list_push_rr() failed",
ixfr_str);
}
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
ixfr->part[0]->soaplus = rr;
}
}
/**
* Add -RR to ixfr journal.
*
*/
void
ixfr_del_rr(ixfr_type* ixfr, ldns_rr* rr)
{
zone_type* zone = NULL;
if (!ixfr || !rr) {
return;
}
zone = (zone_type*) ixfr->zone;
ods_log_assert(zone);
ods_log_assert(zone->db);
if (!zone->db->is_initialized) {
/* no ixfr yet */
return;
}
ods_log_assert(ixfr->part[0]);
ods_log_assert(ixfr->part[0]->min);
if (!ldns_rr_list_push_rr(ixfr->part[0]->min, rr)) {
ods_fatal_exit("[%s] fatal unable to -RR: ldns_rr_list_push_rr() failed",
ixfr_str);
}
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
ixfr->part[0]->soamin = rr;
}
}
/**
* Print all RRs in list, except SOA RRs.
*
*/
static int
part_rr_list_print_nonsoa(FILE* fd, ldns_rr_list* list)
{
size_t i = 0;
int error = 0;
if (!list || !fd) {
return 1;
}
for (i = 0; i < ldns_rr_list_rr_count(list); i++) {
if (ldns_rr_get_type(ldns_rr_list_rr(list, i)) != LDNS_RR_TYPE_SOA) {
if (util_rr_print(fd, ldns_rr_list_rr(list, i)) != ODS_STATUS_OK) {
error = 1;
}
}
}
return error;
}
/**
* Print part of the ixfr journal.
*
*/
static void
part_print(FILE* fd, ixfr_type* ixfr, size_t i)
{
zone_type* zone = NULL;
part_type* part = NULL;
int error = 0;
if (!ixfr || !fd) {
return;
}
zone = (zone_type*) ixfr->zone;
part = ixfr->part[i];
if (!part || !part->soamin || !part->soaplus) {
return;
}
ods_log_assert(part->min);
ods_log_assert(part->plus);
ods_log_assert(part->soamin);
ods_log_assert(part->soaplus);
if (util_rr_print(fd, part->soamin) != ODS_STATUS_OK) {
zone->adoutbound->error = 1;
}
error = part_rr_list_print_nonsoa(fd, part->min);
if (error) {
zone->adoutbound->error = 1;
}
if (util_rr_print(fd, part->soaplus) != ODS_STATUS_OK) {
zone->adoutbound->error = 1;
}
error = part_rr_list_print_nonsoa(fd, part->plus);
if (error) {
zone->adoutbound->error = 1;
}
}
/**
* Print the ixfr journal.
*
*/
void
ixfr_print(FILE* fd, ixfr_type* ixfr)
{
int i = 0;
if (!ixfr || !fd) {
return;
}
ods_log_debug("[%s] print ixfr", ixfr_str);
for (i = IXFR_MAX_PARTS - 1; i >= 0; i--) {
ods_log_deeebug("[%s] print ixfr part #%d", ixfr_str, i);
part_print(fd, ixfr, i);
}
}
/**
* Purge the ixfr journal.
*
*/
void
ixfr_purge(ixfr_type* ixfr)
{
int i = 0;
zone_type* zone = NULL;
if (!ixfr) {
return;
}
if (ixfr->part[0] &&
(!ixfr->part[0]->soamin || !ixfr->part[0]->soaplus))
{
/* Somehow the signer does a double purge without having used
* this part. There is no need to create a new one. In fact,
* we should not. It would cause an assertion later on when
* printing to file */
return;
}
zone = (zone_type*) ixfr->zone;
ods_log_assert(zone);
ods_log_debug("[%s] purge ixfr for zone %s", ixfr_str, zone->name);
for (i = IXFR_MAX_PARTS - 1; i >= 0; i--) {
if (i == (IXFR_MAX_PARTS - 1)) {
part_cleanup(ixfr->part[i]);
ixfr->part[i] = NULL;
} else {
ixfr->part[i+1] = ixfr->part[i];
ixfr->part[i] = NULL;
}
}
ixfr->part[0] = part_create();
if (!ixfr->part[0]) {
ods_fatal_exit("[%s] fatal unable to purge ixfr for zone %s: "
"part_create() failed", ixfr_str, zone->name);
}
}
/**
* Cleanup the ixfr journal.
*
*/
void
ixfr_cleanup(ixfr_type* ixfr)
{
int i = 0;
if (!ixfr) {
return;
}
for (i = IXFR_MAX_PARTS - 1; i >= 0; i--) {
part_cleanup(ixfr->part[i]);
}
lock_basic_destroy(&ixfr->ixfr_lock);
free(ixfr);
}
opendnssec-2.0.4/signer/src/signer/namedb.c 0000644 0001750 0001750 00000077143 13036123713 015551 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Domain name database.
*
*/
#include "config.h"
#include "status.h"
#include "file.h"
#include "log.h"
#include "util.h"
#include "signer/backup.h"
#include "signer/namedb.h"
#include "signer/zone.h"
const char* db_str = "namedb";
/**
* Convert a domain to a tree node.
*
*/
static ldns_rbnode_t*
domain2node(domain_type* domain)
{
ldns_rbnode_t* node = (ldns_rbnode_t*) malloc(sizeof(ldns_rbnode_t));
if (!node) {
return NULL;
}
node->key = domain->dname;
node->data = domain;
return node;
}
/**
* Convert a denial to a tree node.
*
*/
static ldns_rbnode_t*
denial2node(denial_type* denial)
{
ldns_rbnode_t* node = (ldns_rbnode_t*) malloc(sizeof(ldns_rbnode_t));
if (!node) {
return NULL;
}
node->key = denial->dname;
node->data = denial;
return node;
}
/**
* Compare domains.
*
*/
static int
domain_compare(const void* a, const void* b)
{
ldns_rdf* x = (ldns_rdf*)a;
ldns_rdf* y = (ldns_rdf*)b;
return ldns_dname_compare(x, y);
}
/**
* Initialize denials.
*
*/
void
namedb_init_denials(namedb_type* db)
{
if (db) {
db->denials = ldns_rbtree_create(domain_compare);
}
}
/**
* Initialize domains.
*
*/
static void
namedb_init_domains(namedb_type* db)
{
if (db) {
db->domains = ldns_rbtree_create(domain_compare);
}
}
/**
* Create a new namedb.
*
*/
namedb_type*
namedb_create(void* zone)
{
namedb_type* db = NULL;
zone_type* z = (zone_type*) zone;
ods_log_assert(z);
ods_log_assert(z->name);
CHECKALLOC(db = (namedb_type*) malloc(sizeof(namedb_type)));
if (!db) {
ods_log_error("[%s] unable to create namedb for zone %s: "
"allocator_alloc() failed", db_str, z->name);
return NULL;
}
db->zone = zone;
namedb_init_domains(db);
if (!db->domains) {
ods_log_error("[%s] unable to create namedb for zone %s: "
"init domains failed", db_str, z->name);
namedb_cleanup(db);
return NULL;
}
namedb_init_denials(db);
if (!db->denials) {
ods_log_error("[%s] unable to create namedb for zone %s: "
"init denials failed", db_str, z->name);
namedb_cleanup(db);
return NULL;
}
db->inbserial = 0;
db->intserial = 0;
db->outserial = 0;
db->altserial = 0;
db->is_initialized = 0;
db->have_serial = 0;
db->is_processed = 0;
db->serial_updated = 0;
db->force_serial = 0;
return db;
}
/**
* Internal lookup domain function.
*
*/
static void*
namedb_domain_search(ldns_rbtree_t* tree, ldns_rdf* dname)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
if (!tree || !dname) {
return NULL;
}
node = ldns_rbtree_search(tree, dname);
if (node && node != LDNS_RBTREE_NULL) {
return (void*) node->data;
}
return NULL;
}
static uint32_t
max(uint32_t a, uint32_t b)
{
return (aoutserial, inbound_serial);
if (!db->have_serial) {
prev = inbound_serial;
}
ods_log_debug("[%s] zone %s update serial: format=%s in=%u internal=%u "
"out=%u now=%u", db_str, zone_name, format, db->inbserial,
db->intserial, db->outserial, (uint32_t) time_now());
if (db->force_serial) {
soa = db->altserial;
if (!util_serial_gt(soa, prev)) {
ods_log_warning("[%s] zone %s unable to enforce serial: %u does not "
" increase %u. Serial set to %u", db_str, zone_name, soa, prev,
(prev+1));
soa = prev + 1;
} else {
ods_log_info("[%s] zone %s enforcing serial %u", db_str, zone_name,
soa);
}
db->force_serial = 0;
} else if (ods_strcmp(format, "unixtime") == 0) {
soa = (uint32_t) time_now();
if (!util_serial_gt(soa, prev)) {
if (!db->have_serial) {
ods_log_warning("[%s] zone %s unable to use unixtime as serial: "
"%u does not increase %u. Serial set to %u", db_str,
zone_name, soa, prev, (prev+1));
}
soa = prev + 1;
}
} else if (ods_strcmp(format, "datecounter") == 0) {
soa = (uint32_t) time_datestamp(0, "%Y%m%d", NULL) * 100;
if (!util_serial_gt(soa, prev)) {
if (!db->have_serial) {
ods_log_info("[%s] zone %s unable to use datecounter as "
"serial: %u does not increase %u. Serial set to %u", db_str,
zone_name, soa, prev, (prev+1));
}
soa = prev + 1;
}
} else if (ods_strcmp(format, "counter") == 0) {
soa = inbound_serial + 1;
if (db->have_serial && !util_serial_gt(soa, prev)) {
soa = prev + 1;
}
} else if (ods_strcmp(format, "keep") == 0) {
prev = db->outserial;
soa = inbound_serial;
if (db->have_serial && !util_serial_gt(soa, prev)) {
ods_log_error("[%s] zone %s cannot keep SOA SERIAL from input zone "
" (%u): previous output SOA SERIAL is %u", db_str, zone_name,
soa, prev);
return ODS_STATUS_CONFLICT_ERR;
}
} else {
ods_log_error("[%s] zone %s unknown serial type %s", db_str, zone_name,
format);
return ODS_STATUS_ERR;
}
/* serial is stored in 32 bits */
update = soa - prev;
if (update > 0x7FFFFFFF) {
update = 0x7FFFFFFF;
}
if (!db->have_serial) {
db->intserial = soa;
} else {
db->intserial = prev + update; /* automatically does % 2^32 */
}
ods_log_debug("[%s] zone %s update serial: %u + %u = %u", db_str, zone_name,
prev, update, db->intserial);
return ODS_STATUS_OK;
}
/**
* Add empty non-terminals for domain.
*
*/
ods_status
namedb_domain_entize(namedb_type* db, domain_type* domain, ldns_rdf* apex)
{
ldns_rdf* parent_rdf = NULL;
domain_type* parent_domain = NULL;
ods_log_assert(apex);
ods_log_assert(domain);
ods_log_assert(domain->dname);
ods_log_assert(db);
ods_log_assert(db->domains);
if (domain->parent) {
/* domain already has parent */
return ODS_STATUS_OK;
}
while (domain && ldns_dname_is_subdomain(domain->dname, apex) &&
ldns_dname_compare(domain->dname, apex) != 0) {
/**
* RFC5155:
* 4. If the difference in number of labels between the apex and
* the original owner name is greater than 1, additional NSEC3
* RRs need to be added for every empty non-terminal between
* the apex and the original owner name.
*/
parent_rdf = ldns_dname_left_chop(domain->dname);
if (!parent_rdf) {
ods_log_error("[%s] unable to entize domain: left chop failed",
db_str);
return ODS_STATUS_ERR;
}
parent_domain = namedb_lookup_domain(db, parent_rdf);
if (!parent_domain) {
parent_domain = namedb_add_domain(db, parent_rdf);
ldns_rdf_deep_free(parent_rdf);
if (!parent_domain) {
ods_log_error("[%s] unable to entize domain: failed to add "
"parent domain", db_str);
return ODS_STATUS_ERR;
}
domain->parent = parent_domain;
/* continue with the parent domain */
domain = parent_domain;
} else {
ldns_rdf_deep_free(parent_rdf);
domain->parent = parent_domain;
/* domain has parent, entize done */
domain = NULL;
}
}
return ODS_STATUS_OK;
}
/**
* Lookup domain.
*
*/
domain_type*
namedb_lookup_domain(namedb_type* db, ldns_rdf* dname)
{
if (!db) {
return NULL;
}
return (domain_type*) namedb_domain_search(db->domains, dname);
}
/**
* Add domain to namedb.
*
*/
domain_type*
namedb_add_domain(namedb_type* db, ldns_rdf* dname)
{
domain_type* domain = NULL;
ldns_rbnode_t* new_node = LDNS_RBTREE_NULL;
if (!dname || !db || !db->domains) {
return NULL;
}
domain = domain_create(db->zone, dname);
if (!domain) {
ods_log_error("[%s] unable to add domain: domain_create() failed",
db_str);
return NULL;
}
new_node = domain2node(domain);
if (!new_node) {
ods_log_error("[%s] unable to add domain: domain2node() failed",
db_str);
return NULL;
}
if (ldns_rbtree_insert(db->domains, new_node) == NULL) {
ods_log_error("[%s] unable to add domain: already present", db_str);
log_dname(domain->dname, "ERR +DOMAIN", LOG_ERR);
domain_cleanup(domain);
free((void*)new_node);
return NULL;
}
domain = (domain_type*) new_node->data;
domain->node = new_node;
domain->is_new = 1;
log_dname(domain->dname, "+DOMAIN", LOG_DEEEBUG);
return domain;
}
/**
* Delete domain from namedb
*
*/
domain_type*
namedb_del_domain(namedb_type* db, domain_type* domain)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
if (!domain || !db || !db->domains) {
ods_log_error("[%s] unable to delete domain: !db || !domain", db_str);
return NULL;
}
if (domain->rrsets || domain->denial) {
ods_log_error("[%s] unable to delete domain: domain in use", db_str);
log_dname(domain->dname, "ERR -DOMAIN", LOG_ERR);
return NULL;
}
node = ldns_rbtree_delete(db->domains, (const void*)domain->dname);
if (node) {
ods_log_assert(domain->node == node);
ods_log_assert(!domain->rrsets);
ods_log_assert(!domain->denial);
free((void*)node);
domain->node = NULL;
log_dname(domain->dname, "-DOMAIN", LOG_DEEEBUG);
return domain;
}
ods_log_error("[%s] unable to delete domain: not found", db_str);
log_dname(domain->dname, "ERR -DOMAIN", LOG_ERR);
return NULL;
}
/**
* Lookup denial.
*
*/
denial_type*
namedb_lookup_denial(namedb_type* db, ldns_rdf* dname)
{
if (!db) {
return NULL;
}
return (denial_type*) namedb_domain_search(db->denials, dname);
}
/**
* See if a domain is an empty terminal
*
*/
static int
domain_is_empty_terminal(domain_type* domain)
{
ldns_rbnode_t* n = LDNS_RBTREE_NULL;
domain_type* d = NULL;
ods_log_assert(domain);
if (domain->is_apex) {
return 0;
}
if (domain->rrsets) {
return 0;
}
n = ldns_rbtree_next(domain->node);
if (n) {
d = (domain_type*) n->data;
}
/* if it has children domains, do not delete it */
if(d && ldns_dname_is_subdomain(d->dname, domain->dname)) {
return 0;
}
return 1;
}
/**
* See if a domain can be deleted
*
*/
static int
domain_can_be_deleted(domain_type* domain)
{
ods_log_assert(domain);
return (domain_is_empty_terminal(domain) && !domain->denial);
}
/**
* Add NSEC data point.
*
*/
static void
namedb_add_nsec_trigger(namedb_type* db, domain_type* domain)
{
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
denial_type* denial = NULL;
ods_log_assert(db);
ods_log_assert(domain);
ods_log_assert(!domain->denial);
dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_DNAME || dstatus == LDNS_RR_TYPE_A) {
return; /* don't do occluded/glue domain */
}
if (!domain->rrsets) {
return; /* don't do empty domain */
}
/* ok, nsecify this domain */
denial = namedb_add_denial(db, domain->dname, NULL);
ods_log_assert(denial);
denial->domain = (void*) domain;
domain->denial = (void*) denial;
domain->is_new = 0;
}
/**
* Add NSEC3 data point.
*
*/
static void
namedb_add_nsec3_trigger(namedb_type* db, domain_type* domain,
nsec3params_type* n3p)
{
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
denial_type* denial = NULL;
ods_log_assert(db);
ods_log_assert(n3p);
ods_log_assert(domain);
ods_log_assert(!domain->denial);
dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_DNAME || dstatus == LDNS_RR_TYPE_A) {
return; /* don't do occluded/glue domain */
}
/* Opt-Out? */
if (n3p->flags) {
dstatus = domain_is_delegpt(domain);
/* If Opt-Out is being used, owner names of unsigned delegations
MAY be excluded. */
if (dstatus == LDNS_RR_TYPE_NS) {
return;
}
}
/* ok, nsecify3 this domain */
denial = namedb_add_denial(db, domain->dname, n3p);
ods_log_assert(denial);
denial->domain = (void*) domain;
domain->denial = (void*) denial;
domain->is_new = 0;
}
/**
* See if denials need to be added.
*
*/
static void
namedb_add_denial_trigger(namedb_type* db, domain_type* domain)
{
zone_type* zone = NULL;
ods_log_assert(db);
ods_log_assert(domain);
if (!domain->denial) {
zone = domain->zone;
ods_log_assert(zone);
ods_log_assert(zone->signconf);
if (!zone->signconf->passthrough) {
if (zone->signconf->nsec_type == LDNS_RR_TYPE_NSEC) {
namedb_add_nsec_trigger(db, domain);
} else {
ods_log_assert(zone->signconf->nsec_type == LDNS_RR_TYPE_NSEC3);
namedb_add_nsec3_trigger(db, domain, zone->signconf->nsec3params);
}
}
}
}
/**
* Delete NSEC data point.
*
*/
static void
namedb_del_nsec_trigger(namedb_type* db, domain_type* domain)
{
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
denial_type* denial = NULL;
ods_log_assert(db);
ods_log_assert(domain);
ods_log_assert(domain->denial);
dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_DNAME || dstatus == LDNS_RR_TYPE_A ||
domain_is_empty_terminal(domain) || !domain->rrsets) {
/* domain has become occluded/glue or empty non-terminal*/
denial_diff((denial_type*) domain->denial);
denial = namedb_del_denial(db, domain->denial);
denial_cleanup(denial);
domain->denial = NULL;
}
}
/**
* Delete NSEC3 data point.
*
*/
static void
namedb_del_nsec3_trigger(namedb_type* db, domain_type* domain,
nsec3params_type* n3p)
{
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
denial_type* denial = NULL;
ods_log_assert(db);
ods_log_assert(n3p);
ods_log_assert(domain);
ods_log_assert(domain->denial);
dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_DNAME || dstatus == LDNS_RR_TYPE_A ||
domain_is_empty_terminal(domain)) {
/* domain has become occluded/glue */
denial_diff((denial_type*) domain->denial);
denial = namedb_del_denial(db, domain->denial);
denial_cleanup(denial);
domain->denial = NULL;
} else if (n3p->flags) {
dstatus = domain_is_delegpt(domain);
/* If Opt-Out is being used, owner names of unsigned delegations
MAY be excluded. */
if (dstatus == LDNS_RR_TYPE_NS) {
denial_diff((denial_type*) domain->denial);
denial = namedb_del_denial(db, domain->denial);
denial_cleanup(denial);
domain->denial = NULL;
}
}
}
/**
* See if domains/denials can be deleted.
*
*/
static int
namedb_del_denial_trigger(namedb_type* db, domain_type* domain, int rollback)
{
domain_type* parent = NULL;
zone_type* zone = NULL;
unsigned is_deleted = 0;
ods_log_assert(db);
ods_log_assert(domain);
ods_log_assert(domain->dname);
zone = domain->zone;
ods_log_assert(zone);
ods_log_assert(zone->signconf);
while(domain) {
if (!rollback) {
if (domain->denial) {
if (zone->signconf->nsec_type == LDNS_RR_TYPE_NSEC) {
namedb_del_nsec_trigger(db, domain);
} else {
ods_log_assert(zone->signconf->nsec_type ==
LDNS_RR_TYPE_NSEC3);
namedb_del_nsec3_trigger(db, domain,
zone->signconf->nsec3params);
}
}
}
parent = domain->parent;
if (domain_can_be_deleted(domain)) {
/* -DOMAIN */
domain = namedb_del_domain(db, domain);
domain_cleanup(domain);
is_deleted = 1;
}
/* continue with parent */
domain = parent;
}
return is_deleted;
}
/**
* Hash domain name.
*
*/
static ldns_rdf*
dname_hash(ldns_rdf* dname, ldns_rdf* apex, nsec3params_type* nsec3params)
{
ldns_rdf* hashed_ownername = NULL;
ldns_rdf* hashed_label = NULL;
ods_log_assert(dname);
ods_log_assert(apex);
ods_log_assert(nsec3params);
/**
* The owner name of the NSEC3 RR is the hash of the original owner
* name, prepended as a single label to the zone name.
*/
hashed_label = ldns_nsec3_hash_name(dname, nsec3params->algorithm,
nsec3params->iterations, nsec3params->salt_len,
nsec3params->salt_data);
if (!hashed_label) {
return NULL;
}
hashed_ownername = ldns_dname_cat_clone((const ldns_rdf*) hashed_label,
(const ldns_rdf*) apex);
if (!hashed_ownername) {
return NULL;
}
ldns_rdf_deep_free(hashed_label);
return hashed_ownername;
}
/**
* Add denial to namedb.
*
*/
denial_type*
namedb_add_denial(namedb_type* db, ldns_rdf* dname, nsec3params_type* n3p)
{
zone_type* z = NULL;
ldns_rbnode_t* new_node = LDNS_RBTREE_NULL;
ldns_rbnode_t* pnode = LDNS_RBTREE_NULL;
ldns_rdf* owner = NULL;
denial_type* denial = NULL;
denial_type* pdenial = NULL;
ods_log_assert(db);
ods_log_assert(db->denials);
ods_log_assert(dname);
/* nsec or nsec3 */
if (n3p) {
z = (zone_type*) db->zone;
owner = dname_hash(dname, z->apex, n3p);
} else {
owner = ldns_rdf_clone(dname);
}
if (!owner) {
ods_log_error("[%s] unable to add denial: create owner failed",
db_str);
return NULL;
}
denial = denial_create(db->zone, owner);
if (!denial) {
ods_log_error("[%s] unable to add denial: denial_create() failed",
db_str);
return NULL;
}
new_node = denial2node(denial);
if (!new_node) {
ods_log_error("[%s] unable to add denial: denial2node() failed",
db_str);
return NULL;
}
if (!ldns_rbtree_insert(db->denials, new_node)) {
ods_log_error("[%s] unable to add denial: already present", db_str);
log_dname(denial->dname, "ERR +DENIAL", LOG_ERR);
denial_cleanup(denial);
free((void*)new_node);
return NULL;
}
/* denial of existence data point added */
denial = (denial_type*) new_node->data;
denial->node = new_node;
denial->nxt_changed = 1;
pnode = ldns_rbtree_previous(new_node);
if (!pnode || pnode == LDNS_RBTREE_NULL) {
pnode = ldns_rbtree_last(db->denials);
}
ods_log_assert(pnode);
pdenial = (denial_type*) pnode->data;
ods_log_assert(pdenial);
pdenial->nxt_changed = 1;
log_dname(denial->dname, "+DENIAL", LOG_DEEEBUG);
return denial;
}
/**
* Delete denial from namedb
*
*/
denial_type*
namedb_del_denial(namedb_type* db, denial_type* denial)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
ldns_rbnode_t* pnode = LDNS_RBTREE_NULL;
denial_type* pdenial = NULL;
if (!denial || !db || !db->denials) {
return NULL;
}
if (denial->rrset && denial->rrset->rr_count) {
ods_log_error("[%s] unable to delete denial: denial in use [#%lu]",
db_str, (unsigned long)denial->rrset->rr_count);
log_dname(denial->dname, "ERR -DENIAL", LOG_ERR);
return NULL;
}
pnode = ldns_rbtree_previous(denial->node);
if (!pnode || pnode == LDNS_RBTREE_NULL) {
pnode = ldns_rbtree_last(db->denials);
}
ods_log_assert(pnode);
pdenial = (denial_type*) pnode->data;
ods_log_assert(pdenial);
node = ldns_rbtree_delete(db->denials, (const void*)denial->dname);
if (!node) {
ods_log_error("[%s] unable to delete denial: not found", db_str);
log_dname(denial->dname, "ERR -DENIAL", LOG_ERR);
return NULL;
}
ods_log_assert(denial->node == node);
pdenial->nxt_changed = 1;
free((void*)node);
denial->domain = NULL;
denial->node = NULL;
log_dname(denial->dname, "-DENIAL", LOG_DEEEBUG);
return denial;
}
/**
* Apply differences in db.
*
*/
void
namedb_diff(namedb_type* db, unsigned is_ixfr, unsigned more_coming)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
if (!db || !db->domains) {
return;
}
node = ldns_rbtree_first(db->domains);
if (!node || node == LDNS_RBTREE_NULL) {
return;
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
node = ldns_rbtree_next(node);
domain_diff(domain, is_ixfr, more_coming);
}
node = ldns_rbtree_first(db->domains);
if (!node || node == LDNS_RBTREE_NULL) {
return;
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
node = ldns_rbtree_next(node);
if (!namedb_del_denial_trigger(db, domain, 0)) {
/* del_denial did not delete domain */
namedb_add_denial_trigger(db, domain);
}
}
}
/**
* Rollback differences in db.
*
*/
void
namedb_rollback(namedb_type* db, unsigned keepsc)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
if (!db || !db->domains) {
return;
}
node = ldns_rbtree_first(db->domains);
if (!node || node == LDNS_RBTREE_NULL) {
return;
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
node = ldns_rbtree_next(node);
domain_rollback(domain, keepsc);
(void) namedb_del_denial_trigger(db, domain, 1);
}
}
/**
* Nsecify db.
*
*/
void
namedb_nsecify(namedb_type* db, uint32_t* num_added)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
ldns_rbnode_t* nxt_node = LDNS_RBTREE_NULL;
denial_type* denial = NULL;
denial_type* nxt = NULL;
uint32_t nsec_added = 0;
ods_log_assert(db);
node = ldns_rbtree_first(db->denials);
while (node && node != LDNS_RBTREE_NULL) {
denial = (denial_type*) node->data;
nxt_node = ldns_rbtree_next(node);
if (!nxt_node || nxt_node == LDNS_RBTREE_NULL) {
nxt_node = ldns_rbtree_first(db->denials);
}
nxt = (denial_type*) nxt_node->data;
denial_nsecify(denial, nxt, &nsec_added);
node = ldns_rbtree_next(node);
}
if (num_added) {
*num_added = nsec_added;
}
}
/**
* Examine updates to db.
*
*/
ods_status
namedb_examine(namedb_type* db)
{
ods_status status = ODS_STATUS_OK;
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
rrset_type* rrset = NULL;
int soa_seen = 0;
/*
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
ldns_rr_type delegpt = LDNS_RR_TYPE_FIRST;
*/
if (!db || !db->domains) {
/* no db, no error */
return ODS_STATUS_OK;
}
if (db->domains->root != LDNS_RBTREE_NULL) {
node = ldns_rbtree_first(db->domains);
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_CNAME);
if (rrset) {
/* Thou shall not have other data next to CNAME */
if (domain_count_rrset_is_added(domain) > 1 &&
rrset_count_rr_is_added(rrset) > 0) {
log_rrset(domain->dname, rrset->rrtype,
"CNAME and other data at the same name", LOG_ERR);
return ODS_STATUS_CONFLICT_ERR;
}
/* Thou shall have at most one CNAME per name */
if (rrset_count_rr_is_added(rrset) > 1) {
log_rrset(domain->dname, rrset->rrtype,
"multiple CNAMEs at the same name", LOG_ERR);
return ODS_STATUS_CONFLICT_ERR;
}
}
rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_DNAME);
if (rrset) {
/* Thou shall have at most one DNAME per name */
if (rrset_count_rr_is_added(rrset) > 1) {
log_rrset(domain->dname, rrset->rrtype,
"multiple DNAMEs at the same name", LOG_ERR);
return ODS_STATUS_CONFLICT_ERR;
}
}
if (!soa_seen && domain->is_apex) {
rrset = domain_lookup_rrset(domain, LDNS_RR_TYPE_SOA);
if (rrset) {
/* Thou shall have one and only one SOA */
if (rrset_count_rr_is_added(rrset) != 1) {
log_rrset(domain->dname, rrset->rrtype,
"Wrong number of SOA records, should be 1", LOG_ERR);
return ODS_STATUS_CONFLICT_ERR;
}
} else {
log_rrset(domain->dname, LDNS_RR_TYPE_SOA, "missing SOA RRset",
LOG_ERR);
return ODS_STATUS_CONFLICT_ERR;
}
}
/*
dstatus = domain_is_occluded(domain);
delegpt = domain_is_delegpt(domain);
*/
/* Thou shall not have occluded data in your zone file */
node = ldns_rbtree_next(node);
}
return status;
}
/**
* Wipe out all NSEC RRsets.
*
*/
void
namedb_wipe_denial(namedb_type* db)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
denial_type* denial = NULL;
zone_type* zone = NULL;
size_t i = 0;
if (db && db->denials) {
zone = (zone_type*) db->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_debug("[%s] wipe denial of existence space zone %s", db_str,
zone->name);
node = ldns_rbtree_first(db->denials);
while (node && node != LDNS_RBTREE_NULL) {
denial = (denial_type*) node->data;
if (!denial->rrset) {
node = ldns_rbtree_next(node);
continue;
}
for (i=0; i < denial->rrset->rr_count; i++) {
if (denial->rrset->rrs[i].exists) {
/* ixfr -RR */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_del_rr(zone->ixfr, denial->rrset->rrs[i].rr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
}
denial->rrset->rrs[i].exists = 0;
rrset_del_rr(denial->rrset, i);
i--;
}
rrset_drop_rrsigs(zone, denial->rrset);
rrset_cleanup(denial->rrset);
denial->rrset = NULL;
node = ldns_rbtree_next(node);
}
}
}
/**
* Export db to file.
*
*/
void
namedb_export(FILE* fd, namedb_type* db, ods_status* status)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
if (!fd || !db || !db->domains) {
if (status) {
ods_log_error("[%s] unable to export namedb: file descriptor "
"or name database missing", db_str);
*status = ODS_STATUS_ASSERT_ERR;
}
return;
}
node = ldns_rbtree_first(db->domains);
if (!node || node == LDNS_RBTREE_NULL) {
fprintf(fd, "; empty zone\n");
if (status) {
*status = ODS_STATUS_OK;
}
return;
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
if (domain) {
domain_print(fd, domain, status);
}
node = ldns_rbtree_next(node);
}
}
/**
* Clean up domains in namedb.
*
*/
static void
domain_delfunc(ldns_rbnode_t* elem)
{
domain_type* domain = NULL;
if (elem && elem != LDNS_RBTREE_NULL) {
domain = (domain_type*) elem->data;
domain_delfunc(elem->left);
domain_delfunc(elem->right);
domain_cleanup(domain);
free((void*)elem);
}
}
/**
* Clean up denials.
*
*/
static void
denial_delfunc(ldns_rbnode_t* elem)
{
denial_type* denial = NULL;
domain_type* domain = NULL;
if (elem && elem != LDNS_RBTREE_NULL) {
denial = (denial_type*) elem->data;
denial_delfunc(elem->left);
denial_delfunc(elem->right);
domain = (domain_type*) denial->domain;
if (domain) {
domain->denial = NULL;
}
denial_cleanup(denial);
free((void*)elem);
}
}
/**
* Clean up domains.
*
*/
static void
namedb_cleanup_domains(namedb_type* db)
{
if (db && db->domains) {
domain_delfunc(db->domains->root);
ldns_rbtree_free(db->domains);
db->domains = NULL;
}
}
/**
* Clean up denials.
*
*/
void
namedb_cleanup_denials(namedb_type* db)
{
if (db && db->denials) {
denial_delfunc(db->denials->root);
ldns_rbtree_free(db->denials);
db->denials = NULL;
}
}
/**
* Clean up namedb.
*
*/
void
namedb_cleanup(namedb_type* db)
{
zone_type* z = NULL;
if (!db) {
return;
}
z = (zone_type*) db->zone;
if (!z) {
return;
}
namedb_cleanup_denials(db);
namedb_cleanup_domains(db);
free(db);
}
/**
* Backup namedb.
*
*/
void
namedb_backup2(FILE* fd, namedb_type* db)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
denial_type* denial = NULL;
if (!fd || !db) {
return;
}
node = ldns_rbtree_first(db->domains);
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
domain_backup2(fd, domain, 0);
node = ldns_rbtree_next(node);
}
fprintf(fd, ";\n");
node = ldns_rbtree_first(db->denials);
while (node && node != LDNS_RBTREE_NULL) {
denial = (denial_type*) node->data;
if (denial->rrset) {
rrset_print(fd, denial->rrset, 1, NULL);
}
node = ldns_rbtree_next(node);
}
fprintf(fd, ";\n");
/* signatures */
node = ldns_rbtree_first(db->domains);
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
domain_backup2(fd, domain, 1);
node = ldns_rbtree_next(node);
}
node = ldns_rbtree_first(db->denials);
while (node && node != LDNS_RBTREE_NULL) {
denial = (denial_type*) node->data;
if (denial->rrset) {
rrset_backup2(fd, denial->rrset);
}
node = ldns_rbtree_next(node);
}
fprintf(fd, ";\n");
}
opendnssec-2.0.4/signer/src/signer/denial.h 0000644 0001750 0001750 00000006132 13036123676 015562 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Denial of Existence.
*
*/
#ifndef SIGNER_DENIAL_H
#define SIGNER_DENIAL_H
#include "config.h"
#include
#include
typedef struct denial_struct denial_type;
#include "status.h"
#include "signer/nsec3params.h"
#include "signer/rrset.h"
#include "signer/domain.h"
/**
* Denial of Existence data point.
*
*/
struct denial_struct {
zone_type* zone;
domain_type* domain;
ldns_rbnode_t* node;
ldns_rdf* dname;
rrset_type* rrset;
unsigned bitmap_changed : 1;
unsigned nxt_changed : 1;
};
/**
* Create new Denial of Existence data point.
* \param[in] zoneptr zone reference
* \param[in] dname owner name
* \return denial_type* denial of existence data point
*
*/
denial_type* denial_create(zone_type* zoneptr, ldns_rdf* dname);
/**
* Apply differences at denial.
* \param[in] denial Denial of Existence data point
*
*/
void denial_diff(denial_type* denial);
/**
* Add NSEC(3) to the Denial of Existence data point.
* \param[in] denial Denial of Existence data point
* \param[in] rr NSEC(3) resource record
*
*/
void denial_add_rr(denial_type* denial, ldns_rr* rr);
/**
* Nsecify Denial of Existence data point.
* \param[in] denial Denial of Existence data point
* \param[in] nxt next Denial of Existence data point
* \param[out] num_added number of RRs added
*
*/
void denial_nsecify(denial_type* denial, denial_type* nxt, uint32_t* num_added);
/**
* Print Denial of Existence data point.
* \param[in] fd file descriptor
* \param[in] denial denial of existence data point
* \param[out] status status
*
*/
void denial_print(FILE* fd, denial_type* denial, ods_status* status);
/**
* Cleanup Denial of Existence data point.
* \param[in] denial denial of existence data point
*
*/
void denial_cleanup(denial_type* denial);
#endif /* SIGNER_DENIAL_H */
opendnssec-2.0.4/signer/src/signer/nsec3params.c 0000644 0001750 0001750 00000011526 13036123676 016543 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* NSEC3 Parameters.
*
*/
#include "status.h"
#include "log.h"
#include "util.h"
#include "signer/backup.h"
#include "signer/nsec3params.h"
#include "signer/signconf.h"
#include
#include
#include
#include
static const char* nsec3_str = "nsec3";
/**
* Create NSEC3 salt.
*
*/
ods_status
nsec3params_create_salt(const char* salt_str, uint8_t* salt_len,
uint8_t** salt)
{
uint8_t c;
uint8_t* salt_tmp;
if (!salt_str) {
*salt_len = 0;
*salt = NULL;
return ODS_STATUS_OK;
}
*salt_len = (uint8_t) strlen(salt_str);
if (*salt_len == 1 && salt_str[0] == '-') {
*salt_len = 0;
*salt = NULL;
return ODS_STATUS_OK;
} else if (*salt_len % 2 != 0) {
ods_log_error("[%s] invalid salt %s", nsec3_str, salt_str);
*salt = NULL;
return ODS_STATUS_ERR;
}
/* construct salt data */
salt_tmp = (uint8_t*) calloc(*salt_len / 2, sizeof(uint8_t));
if (!salt_tmp) {
ods_log_error("[%s] construct salt data for %s failed", nsec3_str,
salt_str);
*salt = NULL;
return ODS_STATUS_MALLOC_ERR;
}
for (c = 0; c < *salt_len; c += 2) {
if (isxdigit((int) salt_str[c]) && isxdigit((int) salt_str[c+1])) {
salt_tmp[c/2] = (uint8_t) ldns_hexdigit_to_int(salt_str[c]) * 16 +
ldns_hexdigit_to_int(salt_str[c+1]);
} else {
ods_log_error("[%s] invalid salt %s", nsec3_str, salt_str);
free((void*)salt_tmp);
*salt = NULL;
return ODS_STATUS_ERR;
}
}
*salt_len = *salt_len / 2; /* update length */
*salt = salt_tmp;
return ODS_STATUS_OK;
}
/**
* Create new NSEC3 parameters.
*
*/
nsec3params_type*
nsec3params_create(void* sc, uint8_t algo, uint8_t flags, uint16_t iter,
const char* salt)
{
nsec3params_type* nsec3params = NULL;
uint8_t salt_len; /* calculate salt len */
uint8_t* salt_data; /* calculate salt data */
if (!sc) {
return NULL;
}
CHECKALLOC(nsec3params = (nsec3params_type*) malloc(sizeof(nsec3params_type)));
if (!nsec3params) {
ods_log_error("[%s] unable to create: allocator_alloc() failed",
nsec3_str);
return NULL;
}
nsec3params->sc = sc;
nsec3params->algorithm = algo;
nsec3params->flags = flags;
nsec3params->iterations = iter;
/* construct the salt from the string */
if (nsec3params_create_salt(salt, &salt_len, &salt_data) != 0) {
ods_log_error("[%s] unable to create: create salt failed", nsec3_str);
free(nsec3params);
return NULL;
}
nsec3params->salt_len = salt_len;
nsec3params->salt_data = salt_data;
nsec3params->rr = NULL;
return nsec3params;
}
/**
* Backup NSEC3 parameters.
*
*/
void
nsec3params_backup(FILE* fd, uint8_t algo, uint8_t flags,
uint16_t iter, const char* salt, ldns_rr* rr, const char* version)
{
if (!fd) {
return;
}
fprintf(fd, ";;Nsec3parameters: salt %s algorithm %u optout %u "
"iterations %u\n", salt?salt:"-", (unsigned) algo,
(unsigned) flags, (unsigned) iter);
if (strcmp(version, ODS_SE_FILE_MAGIC_V2) == 0) {
if (rr) {
(void)util_rr_print(fd, rr);
}
fprintf(fd, ";;Nsec3done\n");
fprintf(fd, ";;\n");
}
}
/**
* Clean up NSEC3 parameters.
*
*/
void
nsec3params_cleanup(nsec3params_type* nsec3params)
{
if (!nsec3params) {
return;
}
free(nsec3params->salt_data);
free(nsec3params);
}
opendnssec-2.0.4/signer/src/signer/domain.h 0000644 0001750 0001750 00000011364 13036123713 015570 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_DOMAIN_H
#define SIGNER_DOMAIN_H
#include "config.h"
#include
#include
typedef struct domain_struct domain_type;
#include "status.h"
#include "signer/rrset.h"
#include "signer/signconf.h"
#define SE_NSEC_RDATA_NXT 0
#define SE_NSEC_RDATA_BITMAP 1
#define SE_NSEC3_RDATA_NSEC3PARAMS 4
#define SE_NSEC3_RDATA_NXT 4
#define SE_NSEC3_RDATA_BITMAP 5
/**
* Domain.
*
*/
struct domain_struct {
denial_type* denial;
zone_type* zone;
ldns_rbnode_t* node;
ldns_rdf* dname;
domain_type* parent;
rrset_type* rrsets;
unsigned is_new : 1;
unsigned is_apex : 1; /* apex */
};
/**
* Log domain name.
* \param[in] rdf domain name
* \param[in] pre log message
* \param[in] level log level
*
*/
void log_dname(ldns_rdf* rdf, const char* pre, int level);
/**
* Create domain.
* \param[in] zoneptr zone reference
* \param[in] dname owner name
* \return domain_type* domain
*
*/
domain_type* domain_create(zone_type* zone, ldns_rdf* dname);
/**
* Count the number of RRsets at this domain with RRs that have is_added.
* \param[in] domain domain
* \return size_t number of RRsets
*
*/
size_t domain_count_rrset_is_added(domain_type* domain);
/**
* Look up RRset at this domain.
* \param[in] domain the domain
* \param[in] rrtype RRtype
* \return rrset_type* RRset, if found
*
*/
rrset_type* domain_lookup_rrset(domain_type* domain, ldns_rr_type rrtype);
/**
* Add RRset to domain.
* \param[in] domain domain
* \param[in] rrset RRset
*
*/
void domain_add_rrset(domain_type* domain, rrset_type* rrset);
/**
* Apply differences at domain.
* \param[in] domain domain
* \param[in] is_ixfr true if incremental change
* \param[in] more_coming more transactions possible
*
*/
void domain_diff(domain_type* domain, unsigned is_ixfr, unsigned more_coming);
/**
* Rollback differences at domain.
* \param[in] domain domain
* \param[in] keepsc keep RRs that did not came from the adapter
*
*/
void domain_rollback(domain_type* domain, int keepsc);
/**
* Check whether a domain is an empty non-terminal to an unsigned delegation.
* \param[in] domain domain
* \return int yes or no
*
*/
int domain_ent2unsignedns(domain_type* domain);
/**
* Check whether a domain is a delegation, regardless of parent.
* \param[in] domain domain
* \return ldns_rr_type RRtype that hints whether the domain is occluded.
* LDNS_RR_TYPE_NS Unsigned delegation
* LDNS_RR_TYPE_DS Signed delegation
* LDNS_RR_TYPE_SOA Authoritative data (or signed delegation)
*
*/
ldns_rr_type domain_is_delegpt(domain_type* domain);
/**
* Check whether the domain is occluded.
* \param[in] domain domain
* \return ldns_rr_type RRtype that hints whether the domain is occluded.
* LDNS_RR_TYPE_DNAME Occluded
* LDNS_RR_TYPE_A Glue
* LDNS_RR_TYPE_SOA Authoritative data or delegation
*
*/
ldns_rr_type domain_is_occluded(domain_type* domain);
/**
* Print domain.
* \param[in] fd file descriptor
* \param[in] domain domain
* \param[out] status status
*
*/
void domain_print(FILE* fd, domain_type* domain, ods_status* status);
/**
* Clean up domain.
* \param[in] domain domain to cleanup
*
*/
void domain_cleanup(domain_type* domain);
/**
* Backup domain.
* \param[in] fd file descriptor
* \param[in] domain domain
* \param[in] sigs do RRSIGS if true, otherwise do RRset
*
*/
void domain_backup2(FILE* fd, domain_type* domain, int sigs);
#endif /* SIGNER_DOMAIN_H */
opendnssec-2.0.4/signer/src/signer/rrset.c 0000644 0001750 0001750 00000063235 13036123713 015457 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* RRset.
*
*/
#include "config.h"
#include "file.h"
#include "hsm.h"
#include "log.h"
#include "util.h"
#include "compat.h"
#include "signer/rrset.h"
#include "signer/zone.h"
static const char* rrset_str = "rrset";
/**
* Log RR.
*
*/
void
log_rr(ldns_rr* rr, const char* pre, int level)
{
char* str = NULL;
size_t i = 0;
if (ods_log_get_level() < level) {
return;
}
str = ldns_rr2str(rr);
if (!str) {
ods_log_error("[%s] %s: Error converting RR to string", rrset_str,
pre?pre:"");
return;
}
str[(strlen(str))-1] = '\0';
/* replace tabs with white space */
for (i=0; i < strlen(str); i++) {
if (str[i] == '\t') {
str[i] = ' ';
}
}
if (level == LOG_EMERG) {
ods_fatal_exit("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_ALERT) {
ods_log_alert("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_CRIT) {
ods_log_crit("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_ERR) {
ods_log_error("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_WARNING) {
ods_log_warning("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_NOTICE) {
ods_log_info("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_INFO) {
ods_log_verbose("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_DEBUG) {
ods_log_debug("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else if (level == LOG_DEEEBUG) {
ods_log_deeebug("[%s] %s: %s", rrset_str, pre?pre:"", str);
} else {
ods_log_deeebug("[%s] %s: %s", rrset_str, pre?pre:"", str);
}
free((void*)str);
}
/**
* Log RRset.
*
*/
void
log_rrset(ldns_rdf* dname, ldns_rr_type type, const char* pre, int level)
{
char* str = NULL;
size_t i = 0;
if (ods_log_get_level() < level) {
return;
}
str = ldns_rdf2str(dname);
if (!str) {
return;
}
str[(strlen(str))-1] = '\0';
/* replace tabs with white space */
for (i=0; i < strlen(str); i++) {
if (str[i] == '\t') {
str[i] = ' ';
}
}
if (level == LOG_EMERG) {
ods_fatal_exit("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_ALERT) {
ods_log_alert("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_CRIT) {
ods_log_crit("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_ERR) {
ods_log_error("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_WARNING) {
ods_log_warning("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_NOTICE) {
ods_log_info("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_INFO) {
ods_log_verbose("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_DEBUG) {
ods_log_debug("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else if (level == LOG_DEEEBUG) {
ods_log_deeebug("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
} else {
ods_log_deeebug("[%s] %s: <%s,%s>", rrset_str, pre?pre:"", str,
rrset_type2str(type));
}
free((void*)str);
}
/**
* Get the string-format of RRtype.
*
*/
const char*
rrset_type2str(ldns_rr_type type)
{
if (type == LDNS_RR_TYPE_IXFR) {
return "IXFR";
} else if (type == LDNS_RR_TYPE_AXFR) {
return "AXFR";
} else if (type == LDNS_RR_TYPE_MAILB) {
return "MAILB";
} else if (type == LDNS_RR_TYPE_MAILA) {
return "MAILA";
} else if (type == LDNS_RR_TYPE_ANY) {
return "ANY";
} else {
const ldns_rr_descriptor* descriptor = ldns_rr_descript(type);
if (descriptor && descriptor->_name) {
return descriptor->_name;
}
}
return "TYPE???";
}
static int
memberdestroy(void* dummy, void* member)
{
rrsig_type* sig = (rrsig_type*) member;
(void)dummy;
free((void*) sig->key_locator);
sig->key_locator = NULL;
/* The rrs may still be in use by IXFRs so cannot do ldns_rr_free(sig->rr); */
sig->owner = NULL;
sig->rr = NULL;
return 0;
}
/**
* Create RRset.
*
*/
rrset_type*
rrset_create(zone_type* zone, ldns_rr_type type)
{
rrset_type* rrset = NULL;
if (!type || !zone) {
return NULL;
}
CHECKALLOC(rrset = (rrset_type*) malloc(sizeof(rrset_type)));
if (!rrset) {
ods_log_error("[%s] unable to create RRset %u: allocator_alloc() "
"failed", rrset_str, (unsigned) type);
return NULL;
}
rrset->next = NULL;
rrset->rrs = NULL;
rrset->domain = NULL;
rrset->zone = zone;
rrset->rrtype = type;
rrset->rr_count = 0;
collection_create_array(&rrset->rrsigs, sizeof(rrsig_type), rrset->zone->rrstore);
rrset->needs_signing = 0;
return rrset;
}
collection_class
rrset_store_initialize()
{
collection_class klass;
collection_class_allocated(&klass, NULL, memberdestroy);
return klass;
}
/**
* Lookup RR in RRset.
*
*/
rr_type*
rrset_lookup_rr(rrset_type* rrset, ldns_rr* rr)
{
ldns_status lstatus = LDNS_STATUS_OK;
int cmp = 0;
size_t i = 0;
if (!rrset || !rr || rrset->rr_count <= 0) {
return NULL;
}
for (i=0; i < rrset->rr_count; i++) {
lstatus = util_dnssec_rrs_compare(rrset->rrs[i].rr, rr, &cmp);
if (lstatus != LDNS_STATUS_OK) {
ods_log_error("[%s] unable to lookup RR: compare failed (%s)",
rrset_str, ldns_get_errorstr_by_id(lstatus));
return NULL;
}
if (!cmp) { /* equal */
return &rrset->rrs[i];
}
}
return NULL;
}
/**
* Count the number of RRs in this RRset that have is_added.
*
*/
size_t
rrset_count_rr_is_added(rrset_type* rrset)
{
size_t i = 0;
size_t count = 0;
if (!rrset) {
return 0;
}
for (i=0; i < rrset->rr_count; i++) {
if (rrset->rrs[i].is_added) {
count++;
}
}
return count;
}
/**
* Add RR to RRset.
*
*/
rr_type*
rrset_add_rr(rrset_type* rrset, ldns_rr* rr)
{
rr_type* rrs_old = NULL;
ods_log_assert(rrset);
ods_log_assert(rr);
ods_log_assert(rrset->rrtype == ldns_rr_get_type(rr));
rrs_old = rrset->rrs;
CHECKALLOC(rrset->rrs = (rr_type*) malloc((rrset->rr_count + 1) * sizeof(rr_type)));
if (!rrset->rrs) {
ods_fatal_exit("[%s] fatal unable to add RR: allocator_alloc() failed",
rrset_str);
}
if (rrs_old) {
memcpy(rrset->rrs, rrs_old, (rrset->rr_count) * sizeof(rr_type));
}
free(rrs_old);
rrset->rr_count++;
rrset->rrs[rrset->rr_count - 1].owner = rrset->domain;
rrset->rrs[rrset->rr_count - 1].rr = rr;
rrset->rrs[rrset->rr_count - 1].exists = 0;
rrset->rrs[rrset->rr_count - 1].is_added = 1;
rrset->rrs[rrset->rr_count - 1].is_removed = 0;
rrset->needs_signing = 1;
log_rr(rr, "+RR", LOG_DEEEBUG);
return &rrset->rrs[rrset->rr_count -1];
}
/**
* Delete RR from RRset.
*
*/
void
rrset_del_rr(rrset_type* rrset, uint16_t rrnum)
{
rr_type* rrs_orig = NULL;
ods_log_assert(rrset);
ods_log_assert(rrnum < rrset->rr_count);
log_rr(rrset->rrs[rrnum].rr, "-RR", LOG_DEEEBUG);
rrset->rrs[rrnum].owner = NULL;
rrset->rrs[rrnum].rr = NULL;
while (rrnum < rrset->rr_count-1) {
rrset->rrs[rrnum] = rrset->rrs[rrnum+1];
rrnum++;
}
memset(&rrset->rrs[rrset->rr_count-1], 0, sizeof(rr_type));
rrs_orig = rrset->rrs;
CHECKALLOC(rrset->rrs = (rr_type*) malloc((rrset->rr_count - 1) * sizeof(rr_type)));
if(!rrset->rrs) {
ods_fatal_exit("[%s] fatal unable to delete RR: allocator_alloc() failed",
rrset_str);
}
memcpy(rrset->rrs, rrs_orig, (rrset->rr_count -1) * sizeof(rr_type));
free(rrs_orig);
rrset->rr_count--;
rrset->needs_signing = 1;
}
/**
* Apply differences at RRset.
*
*/
void
rrset_diff(rrset_type* rrset, unsigned is_ixfr, unsigned more_coming)
{
zone_type* zone = NULL;
uint16_t i = 0;
uint8_t del_sigs = 0;
if (!rrset) {
return;
}
zone = (zone_type*) rrset->zone;
for (i=0; i < rrset->rr_count; i++) {
if (rrset->rrs[i].is_added) {
if (!rrset->rrs[i].exists) {
/* ixfr +RR */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_add_rr(zone->ixfr, rrset->rrs[i].rr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
del_sigs = 1;
}
rrset->rrs[i].exists = 1;
if ((rrset->rrtype == LDNS_RR_TYPE_DNSKEY ||
rrset->rrtype == LDNS_RR_TYPE_NSEC3PARAMS) && more_coming) {
continue;
}
rrset->rrs[i].is_added = 0;
} else if (!is_ixfr || rrset->rrs[i].is_removed) {
if (rrset->rrs[i].exists) {
/* ixfr -RR */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_del_rr(zone->ixfr, rrset->rrs[i].rr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
}
rrset->rrs[i].exists = 0;
rrset_del_rr(rrset, i);
del_sigs = 1;
i--;
}
}
if (del_sigs) {
rrset_drop_rrsigs(zone, rrset);
}
}
/**
* Remove signatures, deallocate storage and add then to the outgoing IFXR for that zone.
*
*/
void
rrset_drop_rrsigs(zone_type* zone, rrset_type* rrset)
{
rrsig_type* rrsig;
while((rrsig = collection_iterator(rrset->rrsigs))) {
/* ixfr -RRSIG */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_del_rr(zone->ixfr, rrsig->rr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
collection_del_cursor(rrset->rrsigs);
}
}
/**
* Add RRSIG to RRset.
*
*/
void
rrset_add_rrsig(rrset_type* rrset, ldns_rr* rr,
const char* locator, uint32_t flags)
{
rrsig_type rrsig;
ods_log_assert(rrset);
ods_log_assert(rr);
ods_log_assert(ldns_rr_get_type(rr) == LDNS_RR_TYPE_RRSIG);
rrsig.owner = rrset->domain;
rrsig.rr = rr;
rrsig.key_locator = locator;
rrsig.key_flags = flags;
collection_add(rrset->rrsigs, &rrsig);
}
/**
* Recycle signatures from RRset and drop unreusable signatures.
*
*/
static uint32_t
rrset_recycle(rrset_type* rrset, time_t signtime, ldns_rr_type dstatus,
ldns_rr_type delegpt)
{
uint32_t refresh = 0;
uint32_t expiration = 0;
uint32_t inception = 0;
uint32_t reusedsigs = 0;
unsigned drop_sig = 0;
key_type* key = NULL;
zone_type* zone = NULL;
rrsig_type* rrsig;
if (!rrset) {
return 0;
}
zone = (zone_type*) rrset->zone;
/* Calculate the Refresh Window = Signing time + Refresh */
if (zone->signconf && zone->signconf->sig_refresh_interval) {
refresh = (uint32_t) (signtime +
duration2time(zone->signconf->sig_refresh_interval));
}
/* Check every signature if it matches the recycling logic. */
while((rrsig = collection_iterator(rrset->rrsigs))) {
drop_sig = 0;
/* 0. Skip delegation, glue and occluded RRsets */
if (dstatus != LDNS_RR_TYPE_SOA || (delegpt != LDNS_RR_TYPE_SOA &&
rrset->rrtype != LDNS_RR_TYPE_DS)) {
drop_sig = 1;
goto recycle_drop_sig;
}
ods_log_assert(dstatus == LDNS_RR_TYPE_SOA ||
(delegpt == LDNS_RR_TYPE_SOA || rrset->rrtype == LDNS_RR_TYPE_DS));
/* 1. If the RRset has changed, drop all signatures */
/* 2. If Refresh is disabled, drop all signatures */
if (rrset->needs_signing || refresh <= (uint32_t) signtime) {
drop_sig = 1;
goto recycle_drop_sig;
}
/* 3. Expiration - Refresh has passed */
expiration = ldns_rdf2native_int32(
ldns_rr_rrsig_expiration(rrsig->rr));
if (expiration < refresh) {
drop_sig = 1;
goto recycle_drop_sig;
}
/* 4. Inception has not yet passed */
inception = ldns_rdf2native_int32(
ldns_rr_rrsig_inception(rrsig->rr));
if (inception > (uint32_t) signtime) {
drop_sig = 1;
goto recycle_drop_sig;
}
/* 5. Corresponding key is dead (key is locator+flags) */
key = keylist_lookup_by_locator(zone->signconf->keys,
rrsig->key_locator);
if (!key || key->flags != rrsig->key_flags) {
drop_sig = 1;
}
recycle_drop_sig:
if (drop_sig) {
/* A rule mismatched, refresh signature */
/* ixfr -RRSIG */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_del_rr(zone->ixfr, rrsig->rr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
collection_del_cursor(rrset->rrsigs);
} else {
/* All rules ok, recycle signature */
reusedsigs += 1;
}
}
return reusedsigs;
}
/**
* Is the RRset signed with this algorithm?
*
*/
static int
rrset_sigalgo(rrset_type* rrset, uint8_t algorithm)
{
rrsig_type* rrsig;
int match = 0;
if (rrset) {
while((rrsig = collection_iterator(rrset->rrsigs))) {
if (algorithm == ldns_rdf2native_int8(ldns_rr_rrsig_algorithm(rrsig->rr))) {
match = 1;
}
}
}
return match;
}
/**
* Is the RRset signed with this locator?
*
*/
static int
rrset_siglocator(rrset_type* rrset, const char* locator)
{
rrsig_type* rrsig;
int match = 0;
if (rrset) {
while ((rrsig = collection_iterator(rrset->rrsigs))) {
if (!ods_strcmp(locator, rrsig->key_locator)) {
match = 1;
}
}
}
return match;
}
/**
* Transmogrify the RRset to a RRlist.
*
*/
static ldns_rr_list*
rrset2rrlist(rrset_type* rrset)
{
ldns_rr_list* rr_list = NULL;
int ret = 0;
size_t i = 0;
rr_list = ldns_rr_list_new();
for (i=0; i < rrset->rr_count; i++) {
if (!rrset->rrs[i].exists) {
log_rr(rrset->rrs[i].rr, "RR does not exist", LOG_WARNING);
continue;
}
/* clone if you want to keep the original format in the signed zone */
ldns_rr2canonical(rrset->rrs[i].rr);
ret = (int) ldns_rr_list_push_rr(rr_list, rrset->rrs[i].rr);
if (!ret) {
ldns_rr_list_free(rr_list);
return NULL;
}
if (rrset->rrtype == LDNS_RR_TYPE_CNAME ||
rrset->rrtype == LDNS_RR_TYPE_DNAME) {
/* singleton types */
return rr_list;
}
}
ldns_rr_list_sort(rr_list);
return rr_list;
}
/**
* Calculate the signature validation period.
*
*/
static void
rrset_sigvalid_period(signconf_type* sc, ldns_rr_type rrtype, time_t signtime,
time_t* inception, time_t* expiration)
{
time_t jitter = 0;
time_t offset = 0;
time_t validity = 0;
time_t random_jitter = 0;
if (!sc || !rrtype || !signtime) {
return;
}
jitter = duration2time(sc->sig_jitter);
if (jitter) {
random_jitter = ods_rand(jitter*2);
}
offset = duration2time(sc->sig_inception_offset);
switch (rrtype) {
case LDNS_RR_TYPE_NSEC:
case LDNS_RR_TYPE_NSEC3:
validity = duration2time(sc->sig_validity_denial);
break;
case LDNS_RR_TYPE_DNSKEY:
if (sc->sig_validity_keyset != NULL && duration2time(sc->sig_validity_keyset) > 0) {
validity = duration2time(sc->sig_validity_keyset);
} else {
validity = duration2time(sc->sig_validity_default);
}
break;
default:
validity = duration2time(sc->sig_validity_default);
}
*inception = signtime - offset;
*expiration = (signtime + validity + random_jitter) - jitter;
}
/**
* Sign RRset.
*
*/
ods_status
rrset_sign(hsm_ctx_t* ctx, rrset_type* rrset, time_t signtime)
{
ods_status status;
zone_type* zone = NULL;
uint32_t newsigs = 0;
uint32_t reusedsigs = 0;
ldns_rr* rrsig = NULL;
ldns_rr_list* rr_list = NULL;
const char* locator = NULL;
time_t inception = 0;
time_t expiration = 0;
size_t i = 0;
domain_type* domain = NULL;
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
ldns_rr_type delegpt = LDNS_RR_TYPE_FIRST;
ods_log_assert(ctx);
ods_log_assert(rrset);
zone = (zone_type*) rrset->zone;
ods_log_assert(zone);
ods_log_assert(zone->signconf);
/* Recycle signatures */
if (rrset->rrtype == LDNS_RR_TYPE_NSEC ||
rrset->rrtype == LDNS_RR_TYPE_NSEC3) {
dstatus = LDNS_RR_TYPE_SOA;
delegpt = LDNS_RR_TYPE_SOA;
} else {
domain = (domain_type*) rrset->domain;
dstatus = domain_is_occluded(domain);
delegpt = domain_is_delegpt(domain);
}
reusedsigs = rrset_recycle(rrset, signtime, dstatus, delegpt);
rrset->needs_signing = 0;
ods_log_assert(rrset->rrs);
ods_log_assert(rrset->rrs[0].rr);
/* Skip delegation, glue and occluded RRsets */
if (dstatus != LDNS_RR_TYPE_SOA) {
log_rrset(ldns_rr_owner(rrset->rrs[0].rr), rrset->rrtype,
"skip signing occluded RRset", LOG_DEEEBUG);
return ODS_STATUS_OK;
}
if (delegpt != LDNS_RR_TYPE_SOA && rrset->rrtype != LDNS_RR_TYPE_DS) {
log_rrset(ldns_rr_owner(rrset->rrs[0].rr), rrset->rrtype,
"skip signing delegation RRset", LOG_DEEEBUG);
return ODS_STATUS_OK;
}
log_rrset(ldns_rr_owner(rrset->rrs[0].rr), rrset->rrtype,
"sign RRset", LOG_DEEEBUG);
ods_log_assert(dstatus == LDNS_RR_TYPE_SOA ||
(delegpt == LDNS_RR_TYPE_SOA || rrset->rrtype == LDNS_RR_TYPE_DS));
/* Transmogrify rrset */
rr_list = rrset2rrlist(rrset);
if (ldns_rr_list_rr_count(rr_list) <= 0) {
/* Empty RRset, no signatures needed */
ldns_rr_list_free(rr_list);
return ODS_STATUS_OK;
}
/* Calculate signature validity */
rrset_sigvalid_period(zone->signconf, rrset->rrtype, signtime,
&inception, &expiration);
/* Walk keys */
for (i=0; i < zone->signconf->keys->count; i++) {
/* If not ZSK don't sign other RRsets */
if (!zone->signconf->keys->keys[i].zsk &&
rrset->rrtype != LDNS_RR_TYPE_DNSKEY) {
continue;
}
/* If not KSK don't sign DNSKEY RRset */
if (!zone->signconf->keys->keys[i].ksk &&
rrset->rrtype == LDNS_RR_TYPE_DNSKEY) {
continue;
}
/* Additional rules for signatures */
if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) {
continue;
}
if (rrset->rrtype != LDNS_RR_TYPE_DNSKEY &&
rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) {
continue;
}
/* If key has no locator, and should be pre-signed dnskey RR, skip */
if (zone->signconf->keys->keys[i].ksk && zone->signconf->keys->keys[i].locator == NULL) {
continue;
}
/* Sign the RRset with this key */
ods_log_deeebug("[%s] signing RRset[%i] with key %s", rrset_str,
rrset->rrtype, zone->signconf->keys->keys[i].locator);
rrsig = lhsm_sign(ctx, rr_list, &zone->signconf->keys->keys[i],
zone->apex, inception, expiration);
if (!rrsig) {
ods_log_crit("[%s] unable to sign RRset[%i]: lhsm_sign() failed",
rrset_str, rrset->rrtype);
ldns_rr_list_free(rr_list);
return ODS_STATUS_HSM_ERR;
}
/* Add signature */
locator = strdup(zone->signconf->keys->keys[i].locator);
rrset_add_rrsig(rrset, rrsig, locator,
zone->signconf->keys->keys[i].flags);
newsigs++;
/* ixfr +RRSIG */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_add_rr(zone->ixfr, rrsig);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
}
if(rrset->rrtype == LDNS_RR_TYPE_DNSKEY && zone->signconf->dnskey_signature) {
for(i=0; zone->signconf->dnskey_signature[i]; i++) {
rrsig = NULL;
if ((status = rrset_getliteralrr(&rrsig, zone->signconf->dnskey_signature[i], duration2time(zone->signconf->dnskey_ttl), zone->apex)) != ODS_STATUS_OK) {
ods_log_error("[%s] unable to publish dnskeys for zone %s: "
"error decoding literal dnskey", rrset_str, zone->name);
return status;
}
/* Add signature */
rrset_add_rrsig(rrset, rrsig, NULL, 0);
newsigs++;
/* ixfr +RRSIG */
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_add_rr(zone->ixfr, rrsig);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
}
}
/* RRset signing completed */
ldns_rr_list_free(rr_list);
lock_basic_lock(&zone->stats->stats_lock);
if (rrset->rrtype == LDNS_RR_TYPE_SOA) {
zone->stats->sig_soa_count += newsigs;
}
zone->stats->sig_count += newsigs;
zone->stats->sig_reuse += reusedsigs;
lock_basic_unlock(&zone->stats->stats_lock);
return ODS_STATUS_OK;
}
ods_status
rrset_getliteralrr(ldns_rr** dnskey, const char *resourcerecord, uint32_t ttl, ldns_rdf* apex)
{
uint8_t dnskeystring[4096];
ldns_status ldnsstatus;
int len;
if ((len = b64_pton(resourcerecord, dnskeystring, sizeof (dnskeystring) - 2)) < 0) {
return ODS_STATUS_PARSE_ERR;
}
dnskeystring[len] = '\0';
if ((ldnsstatus = ldns_rr_new_frm_str(dnskey, (const char*) dnskeystring, ttl, apex, NULL)) != LDNS_STATUS_OK) {
return ODS_STATUS_PARSE_ERR;
}
return ODS_STATUS_OK;
}
/**
* Print RRset.
*
*/
void
rrset_print(FILE* fd, rrset_type* rrset, int skip_rrsigs,
ods_status* status)
{
rrsig_type* rrsig;
uint16_t i = 0;
ods_status result = ODS_STATUS_OK;
if (!rrset || !fd) {
ods_log_crit("[%s] unable to print RRset: rrset or fd missing",
rrset_str);
if (status) {
*status = ODS_STATUS_ASSERT_ERR;
}
} else {
for (i=0; i < rrset->rr_count; i++) {
if (rrset->rrs[i].exists) {
result = util_rr_print(fd, rrset->rrs[i].rr);
if (rrset->rrtype == LDNS_RR_TYPE_CNAME ||
rrset->rrtype == LDNS_RR_TYPE_DNAME) {
/* singleton types */
break;
}
if (result != ODS_STATUS_OK) {
zone_type* zone = (zone_type*) rrset->zone;
log_rrset(ldns_rr_owner(rrset->rrs[i].rr), rrset->rrtype,
"error printing RRset", LOG_CRIT);
zone->adoutbound->error = 1;
break;
}
}
}
if (! skip_rrsigs) {
result = ODS_STATUS_OK;
while((rrsig = collection_iterator(rrset->rrsigs))) {
if (result == ODS_STATUS_OK) {
result = util_rr_print(fd, rrsig->rr);
if (result != ODS_STATUS_OK) {
zone_type* zone = rrset->zone;
log_rrset(ldns_rr_owner(rrset->rrs[i].rr), rrset->rrtype,
"error printing RRset", LOG_CRIT);
zone->adoutbound->error = 1;
}
}
}
}
if (status) {
*status = result;
}
}
}
/**
* Clean up RRset.
*
*/
void
rrset_cleanup(rrset_type* rrset)
{
uint16_t i = 0;
if (!rrset) {
return;
}
rrset_cleanup(rrset->next);
rrset->next = NULL;
rrset->domain = NULL;
for (i=0; i < rrset->rr_count; i++) {
ldns_rr_free(rrset->rrs[i].rr);
rrset->rrs[i].owner = NULL;
}
collection_destroy(&rrset->rrsigs);
free(rrset->rrs);
free(rrset);
}
/**
* Backup RRset.
*
*/
void
rrset_backup2(FILE* fd, rrset_type* rrset)
{
rrsig_type* rrsig;
char* str = NULL;
if (!rrset || !fd) {
return;
}
while((rrsig = collection_iterator(rrset->rrsigs))) {
if ((str = ldns_rr2str(rrsig->rr))) {
fprintf(fd, "%.*s; {locator %s flags %u}\n", (int)strlen(str)-1, str,
rrsig->key_locator, rrsig->key_flags);
free(str);
}
}
}
opendnssec-2.0.4/signer/src/signer/zone.h 0000644 0001750 0001750 00000015047 13036123713 015276 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef SIGNER_ZONE_H
#define SIGNER_ZONE_H
#include "config.h"
#include
enum zone_zl_status_enum {
ZONE_ZL_OK = 0,
ZONE_ZL_ADDED,
ZONE_ZL_UPDATED,
ZONE_ZL_REMOVED
};
typedef enum zone_zl_status_enum zone_zl_status;
typedef struct zone_struct zone_type;
#include "adapter/adapter.h"
#include "scheduler/schedule.h"
#include "locks.h"
#include "status.h"
#include "signer/ixfr.h"
#include "signer/namedb.h"
#include "signer/signconf.h"
#include "signer/stats.h"
#include "signer/rrset.h"
#include "wire/buffer.h"
#include "wire/notify.h"
#include "wire/xfrd.h"
struct schedule_struct;
struct zone_struct {
ldns_rdf* apex; /* wire format zone name */
ldns_rr_class klass; /* class */
uint32_t default_ttl; /* ttl */
/* from conf.xml */
char *notify_command; /* placeholder for the whole notify command */
const char* notify_ns; /* master name server reload command */
char** notify_args; /* reload command arguments */
/* from zonelist.xml */
const char* name; /* string format zone name */
const char* policy_name; /* policy identifier */
const char* signconf_filename; /* signconf filename */
zone_zl_status zl_status; /* zonelist status */
/* adapters */
adapter_type* adinbound; /* inbound adapter */
adapter_type* adoutbound; /* outbound adapter */
/* from signconf.xml */
signconf_type* signconf; /* signer configuration values */
/* zone data */
namedb_type* db;
ixfr_type* ixfr;
/* zone transfers */
xfrd_type* xfrd;
notify_type* notify;
/* worker variables */
task_type* task; /* next assigned task */
/* statistics */
stats_type* stats;
lock_basic_type zone_lock;
lock_basic_type xfr_lock;
/* backing store for rrsigs (both domain as denial) */
collection_class rrstore;
};
/**
* Create a new zone.
* \param[in] name zone name
* \param[in] klass zone class
* \return zone_type* zone
*
*/
zone_type* zone_create(char* name, ldns_rr_class klass);
/**
* Load signer configuration for zone.
* \param[in] zone zone
* \param[out] new_signconf new signer configuration
* \return ods_status status
* ODS_STATUS_OK: new signer configuration loaded
* ODS_STATUS_UNCHANGED: signer configuration has not changed
* other: signer configuration not loaded, error occurred
*
*/
ods_status zone_load_signconf(zone_type* zone, signconf_type** new_signconf);
/**
* Reschedule task for zone.
* \param[in] zone zone
* \param[in] taskq task queue
* \param[in] what new task identifier
* \return ods_status status
*
*/
ods_status zone_reschedule_task(zone_type* zone, schedule_type* taskq,
task_id what);
/**
* Publish the keys as indicated by the signer configuration.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status zone_publish_dnskeys(zone_type* zone);
/**
* Unlink DNSKEY RRs.
* \param[in] zone zone
*
*/
void zone_rollback_dnskeys(zone_type* zone);
/**
* Publish the NSEC3 parameters as indicated by the signer configuration.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status zone_publish_nsec3param(zone_type* zone);
/**
* Unlink NSEC3PARAM RR.
* \param[in] zone zone
*
*/
void zone_rollback_nsec3param(zone_type* zone);
/**
* Prepare keys for signing.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status zone_prepare_keys(zone_type* zone);
/**
* Update serial.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status zone_update_serial(zone_type* zone);
/**
* Lookup RRset.
* \param[in] zone zone
* \param[in] owner RRset owner
* \param[in] type RRtype
* \return rrset_type* RRset, if found
*
*/
rrset_type* zone_lookup_rrset(zone_type* zone, ldns_rdf* owner,
ldns_rr_type type);
/**
* Add RR.
* \param[in] zone zone
* \param[in] rr rr
* \param[in] do_stats true if we need to maintain statistics
* \return ods_status status
* ODS_STATUS_OK: rr to be added to zone
* ODS_STATUS_UNCHANGED: rr not added to zone, rr already exists
* other: rr not added to zone, error occurred
*
*/
ods_status zone_add_rr(zone_type* zone, ldns_rr* rr, int do_stats);
/**
* Delete RR.
* \param[in] zone zone
* \param[in] rr rr
* \param[in] do_stats true if we need to maintain statistics
* \return ods_status status
* ODS_STATUS_OK: rr to be removed from zone
* ODS_STATUS_UNCHANGED: rr not removed from zone, rr does not exist
* other: rr not removed from zone, error occurred
*
*/
ods_status zone_del_rr(zone_type* zone, ldns_rr* rr, int do_stats);
/**
* Remove all NSEC3PARAM RRs from the zone
* \return ODS_STATUS_UNCHANGED or ODS_STATUS_OK
*/
ods_status zone_del_nsec3params(zone_type* zone);
/**
* Merge zones. Values that are merged:
* - policy name
* - signconf filename
* - input and output adapter
*
* \param[in] z1 zone
* \param[in] z2 zone with new values
*
*/
void zone_merge(zone_type* z1, zone_type* z2);
/**
* Clean up zone.
* \param[in] zone zone
*
*/
void zone_cleanup(zone_type* zone);
/**
* Backup zone.
* \param[in] zone corresponding zone
* \return ods_status status
*
*/
ods_status zone_backup2(zone_type* zone);
/**
* Recover zone from backup.
* \param[in] zone corresponding zone
*
*/
ods_status zone_recover2(zone_type* zone);
#endif /* SIGNER_ZONE_H */
opendnssec-2.0.4/signer/src/signer/denial.c 0000644 0001750 0001750 00000023720 13036123676 015557 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Denial of Existence.
*
*/
#include "config.h"
#include "log.h"
#include "signer/denial.h"
#include "signer/domain.h"
#include "signer/zone.h"
#define SE_MAX_RRTYPE_COUNT 65536
static const char* denial_str = "denial";
/**
* Create new Denial of Existence data point.
*
*/
denial_type*
denial_create(zone_type* zone, ldns_rdf* dname)
{
denial_type* denial = NULL;
if (!dname || !zone) {
return NULL;
}
CHECKALLOC(denial = (denial_type*) malloc(sizeof(denial_type)));
if (!denial) {
ods_log_error("[%s] unable to create denial: allocator_alloc() "
"failed", denial_str);
return NULL;
}
denial->dname = dname;
denial->zone = zone;
denial->domain = NULL; /* no back reference yet */
denial->node = NULL; /* not in db yet */
denial->rrset = NULL;
denial->bitmap_changed = 0;
denial->nxt_changed = 0;
return denial;
}
/**
* Create NSEC(3) Type Bitmaps Field.
*
*/
static void
denial_create_bitmap(denial_type* denial, ldns_rr_type types[],
size_t* types_count)
{
domain_type* domain = NULL;
rrset_type* rrset = NULL;
ods_log_assert(denial);
ods_log_assert(denial->domain);
domain = denial->domain;
rrset = domain->rrsets;
while (rrset) {
ldns_rr_type dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_SOA) {
/* Authoritative or delegation */
dstatus = domain_is_delegpt(domain);
if (dstatus == LDNS_RR_TYPE_SOA ||
rrset->rrtype == LDNS_RR_TYPE_NS ||
rrset->rrtype == LDNS_RR_TYPE_DS) {
types[*types_count] = rrset->rrtype;
*types_count = *types_count + 1;
}
}
rrset = rrset->next;
}
}
/**
* Create NSEC3 Next Hashed Owner Name Field.
*
*/
static ldns_rdf*
denial_create_nsec3_nxt(ldns_rdf* nxt)
{
ldns_status status = LDNS_STATUS_OK;
ldns_rdf* next_owner_label = NULL;
ldns_rdf* next_owner_rdf = NULL;
char* next_owner_string = NULL;
ods_log_assert(nxt);
next_owner_label = ldns_dname_label(nxt, 0);
if (!next_owner_label) {
ods_log_alert("[%s] unable to create NSEC3 Next: "
"ldns_dname_label() failed", denial_str);
return NULL;
}
next_owner_string = ldns_rdf2str(next_owner_label);
if (!next_owner_string) {
ods_log_alert("[%s] unable to create NSEC3 Next: "
"ldns_rdf2str() failed", denial_str);
ldns_rdf_deep_free(next_owner_label);
return NULL;
}
if (next_owner_string[strlen(next_owner_string)-1] == '.') {
next_owner_string[strlen(next_owner_string)-1] = '\0';
}
status = ldns_str2rdf_b32_ext(&next_owner_rdf, next_owner_string);
if (status != LDNS_STATUS_OK) {
ods_log_alert("[%s] unable to create NSEC3 Next: "
"ldns_str2rdf_b32_ext() failed", denial_str);
}
free((void*)next_owner_string);
ldns_rdf_deep_free(next_owner_label);
return next_owner_rdf;
}
/**
* Create NSEC(3) RR.
*
*/
static ldns_rr*
denial_create_nsec(denial_type* denial, denial_type* nxt, uint32_t ttl,
ldns_rr_class klass, nsec3params_type* n3p)
{
ldns_rr* nsec_rr = NULL;
ldns_rr_type rrtype = LDNS_RR_TYPE_NSEC;
ldns_rr_type dstatus = LDNS_RR_TYPE_FIRST;
ldns_rdf* rdf = NULL;
domain_type* domain = NULL;
ldns_rr_type types[SE_MAX_RRTYPE_COUNT];
size_t types_count = 0;
int i = 0;
ods_log_assert(denial);
ods_log_assert(denial->dname);
ods_log_assert(nxt);
ods_log_assert(nxt->dname);
nsec_rr = ldns_rr_new();
if (!nsec_rr) {
ods_log_alert("[%s] unable to create NSEC(3) RR: "
"ldns_rr_new() failed", denial_str);
return NULL;
}
/* RRtype */
if (n3p) {
rrtype = LDNS_RR_TYPE_NSEC3;
}
ldns_rr_set_type(nsec_rr, rrtype);
/* owner */
rdf = ldns_rdf_clone(denial->dname);
if (!rdf) {
ods_log_alert("[%s] unable to create NSEC(3) RR: "
"ldns_rdf_clone(owner) failed", denial_str);
ldns_rr_free(nsec_rr);
return NULL;
}
ldns_rr_set_owner(nsec_rr, rdf);
/* NSEC3 parameters */
if (n3p) {
/* set all to NULL first, then call nsec3_add_param_rdfs. */
for (i=0; i < SE_NSEC3_RDATA_NSEC3PARAMS; i++) {
ldns_rr_push_rdf(nsec_rr, NULL);
}
ldns_nsec3_add_param_rdfs(nsec_rr, n3p->algorithm, n3p->flags,
n3p->iterations, n3p->salt_len, n3p->salt_data);
}
/* NXT */
if (n3p) {
rdf = denial_create_nsec3_nxt(nxt->dname);
} else {
rdf = ldns_rdf_clone(nxt->dname);
}
if (!rdf) {
ods_log_alert("[%s] unable to create NSEC(3) RR: "
"create next field failed", denial_str);
ldns_rr_free(nsec_rr);
return NULL;
}
ldns_rr_push_rdf(nsec_rr, rdf);
/* Type Bit Maps */
denial_create_bitmap(denial, types, &types_count);
if (n3p) {
domain = (domain_type*) denial->domain;
dstatus = domain_is_occluded(domain);
if (dstatus == LDNS_RR_TYPE_SOA) {
dstatus = domain_is_delegpt(domain);
if (dstatus != LDNS_RR_TYPE_NS && domain->rrsets) {
/* Authoritative domain, not empty: add RRSIGs */
types[types_count] = LDNS_RR_TYPE_RRSIG;
types_count++;
}
}
/* and don't add NSEC3 type... */
} else {
types[types_count] = LDNS_RR_TYPE_RRSIG;
types_count++;
types[types_count] = LDNS_RR_TYPE_NSEC;
types_count++;
}
rdf = ldns_dnssec_create_nsec_bitmap(types, types_count, rrtype);
if (!rdf) {
ods_log_alert("[%s] unable to create NSEC(3) RR: "
"ldns_dnssec_create_nsec_bitmap() failed", denial_str);
ldns_rr_free(nsec_rr);
return NULL;
}
ldns_rr_push_rdf(nsec_rr, rdf);
ldns_rr_set_ttl(nsec_rr, ttl);
ldns_rr_set_class(nsec_rr, klass);
return nsec_rr;
}
/**
* Apply differences at denial.
*
*/
void
denial_diff(denial_type* denial)
{
if (denial && denial->rrset) {
rrset_diff(denial->rrset, 0, 0);
}
}
/**
* Add NSEC(3) to the Denial of Existence data point.
*
*/
void
denial_add_rr(denial_type* denial, ldns_rr* rr)
{
rr_type* record = NULL;
zone_type* zone = NULL;
ods_log_assert(denial);
ods_log_assert(rr);
zone = (zone_type*) denial->zone;
ods_log_assert(zone);
ods_log_assert(zone->signconf);
if (!denial->rrset) {
if (zone->signconf->nsec3params) {
denial->rrset = rrset_create(denial->zone, LDNS_RR_TYPE_NSEC3);
} else {
denial->rrset = rrset_create(denial->zone, LDNS_RR_TYPE_NSEC);
}
if (!denial->rrset) {
ods_fatal_exit("[%s] unable to nsecify: rrset_create() failed",
denial_str);
}
}
ods_log_assert(denial->rrset);
record = rrset_add_rr(denial->rrset, rr);
ods_log_assert(record);
ods_log_assert(record->rr);
record->owner = (void*) denial;
denial_diff(denial);
denial->bitmap_changed = 0;
denial->nxt_changed = 0;
}
/**
* Nsecify Denial of Existence data point.
*
*/
void
denial_nsecify(denial_type* denial, denial_type* nxt, uint32_t* num_added)
{
ldns_rr* nsec_rr = NULL;
zone_type* zone = NULL;
uint32_t ttl = 0;
ods_log_assert(denial);
ods_log_assert(nxt);
zone = (zone_type*) denial->zone;
ods_log_assert(zone);
ods_log_assert(zone->signconf);
if (denial->nxt_changed || denial->bitmap_changed) {
ttl = zone->default_ttl;
/* SOA MINIMUM */
if (zone->signconf->soa_min) {
ttl = (uint32_t) duration2time(zone->signconf->soa_min);
}
/* create new NSEC(3) rr */
nsec_rr = denial_create_nsec(denial, nxt, ttl, zone->klass,
zone->signconf->nsec3params);
if (!nsec_rr) {
ods_fatal_exit("[%s] unable to nsecify: denial_create_nsec() "
"failed", denial_str);
}
denial_add_rr(denial, nsec_rr);
if (num_added) {
(*num_added)++;
}
}
}
/**
* Print Denial of Existence data point.
*
*/
void
denial_print(FILE* fd, denial_type* denial, ods_status* status)
{
if (!denial || !fd) {
if (status) {
ods_log_crit("[%s] unable to print denial: denial of fd missing",
denial_str);
*status = ODS_STATUS_ASSERT_ERR;
}
} else if (denial->rrset) {
rrset_print(fd, denial->rrset, 0, status);
}
}
/**
* Cleanup Denial of Existence data point.
*
*/
void
denial_cleanup(denial_type* denial)
{
if (!denial) {
return;
}
ldns_rdf_deep_free(denial->dname);
rrset_cleanup(denial->rrset);
free(denial);
}
opendnssec-2.0.4/signer/src/adapter/ 0000755 0001750 0001750 00000000000 13036124774 014364 5 0000000 0000000 opendnssec-2.0.4/signer/src/adapter/adutil.c 0000644 0001750 0001750 00000012023 13036123676 015730 0000000 0000000 /*
* Copyright (c) 2009-2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
*
* Adapter utilities.
*/
#include "config.h"
#include "adapter/adutil.h"
#include "file.h"
#include "log.h"
#include
static const char* adapter_str = "adapter";
/**
* Read one line from zone file.
*
*/
int
adutil_readline_frm_file(FILE* fd, char* line, unsigned int* l,
int keep_comments)
{
int i = 0;
int li = 0;
int in_string = 0;
int depth = 0;
int comments = 0;
int c = 0;
int lc = 0;
for (i = 0; i < SE_ADFILE_MAXLINE; i++) {
c = ods_fgetc(fd, l);
if (comments) {
while (c != EOF && (char)c != '\n') {
c = ods_fgetc(fd, l);
}
}
if (c == EOF) {
if (depth != 0) {
ods_log_error("[%s] read line: bracket mismatch discovered at "
"line %i, missing ')'", adapter_str, l&&*l?*l:0);
}
if (li > 0) {
line[li] = '\0';
return li;
} else {
return -1;
}
} else if ((char)c == '"' && (char)lc != '\\') {
in_string = 1 - in_string; /* swap status */
line[li] = (char)c;
li++;
} else if ((char)c == '(') {
if (in_string) {
line[li] = (char)c;
li++;
} else if ((char)lc != '\\') {
depth++;
line[li] = ' ';
li++;
} else {
line[li] = (char)c;
li++;
}
} else if ((char)c == ')') {
if (in_string) {
line[li] = (char)c;
li++;
} else if ((char)lc != '\\') {
if (depth < 1) {
ods_log_error("[%s] read line: bracket mismatch "
"discovered at line %i, missing '('", adapter_str,
l&&*l?*l:0);
line[li] = '\0';
return li;
}
depth--;
line[li] = ' ';
li++;
} else {
line[li] = (char)c;
li++;
}
} else if ((char)c == ';') {
if (in_string) {
line[li] = (char)c;
li++;
} else if ((char)lc != '\\' && !keep_comments) {
comments = 1;
} else {
line[li] = (char)c;
li++;
}
} else if ((char)c == '\n' && (char)lc != '\\') {
comments = 0;
/* if no depth issue, we are done */
if (depth == 0) {
break;
}
line[li] = ' ';
li++;
} else {
line[li] = (char)c;
li++;
}
/* continue with line */
lc = c;
}
/* done */
if (depth != 0) {
ods_log_error("[%s] read line: bracket mismatch discovered at line %i,"
" missing ')'", adapter_str, l&&*l?*l:0);
return li;
}
line[li] = '\0';
return li;
}
/*
* Trim trailing whitespace.
*
*/
void
adutil_rtrim_line(char* line, int* line_len)
{
int i = strlen(line), nl = 0;
int trimmed = 0;
while (i>0) {
--i;
if (line[i] == '\n') {
nl = 1;
}
if (line[i] == ' ' || line[i] == '\t' || line[i] == '\n') {
line[i] = '\0';
trimmed++;
} else {
break;
}
}
if (nl) {
line[++i] = '\n';
}
*line_len -= trimmed;
}
/**
* Check for white space.
*
*/
int
adutil_whitespace_line(char* line, int line_len)
{
int i;
for (i = 0; i < line_len; i++) {
if (!isspace((int)line[i])) {
return 0;
}
}
return 1;
}
opendnssec-2.0.4/signer/src/adapter/adfile.h 0000644 0001750 0001750 00000003560 13036123676 015705 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* File Adapters.
*
*/
#ifndef ADAPTER_ADFILE_H
#define ADAPTER_ADFILE_H
#include "config.h"
#include "status.h"
#include
/**
* File adapter.
*
*/
/** NULL */
/**
* Read zone from input file adapter.
* \param[in] zone zone reference
* \return ods_status status
*
*/
ods_status adfile_read(void* zone);
/**
* Write zone to output file adapter.
* \param[in] zone zone reference
* \param[in] filename write to this specific file
* \return ods_status status
*
*/
ods_status adfile_write(void* zone, const char* filename);
#endif /* ADAPTER_ADFILE_H */
opendnssec-2.0.4/signer/src/adapter/adfile.c 0000644 0001750 0001750 00000030413 13036123676 015675 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* File Adapters.
*
*/
#include "config.h"
#include "adapter/adapi.h"
#include "adapter/adapter.h"
#include "adapter/adfile.h"
#include "adapter/adutil.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/zone.h"
#include
#include
#include
static const char* adapter_str = "adapter";
static ods_status adfile_read_file(FILE* fd, zone_type* zone);
/**
* Read the next RR from zone file.
*
*/
static ldns_rr*
adfile_read_rr(FILE* fd, zone_type* zone, char* line, ldns_rdf** orig,
ldns_rdf** prev, uint32_t* ttl, ldns_status* status, unsigned int* l)
{
ldns_rr* rr = NULL;
ldns_rdf* tmp = NULL;
FILE* fd_include = NULL;
int len = 0;
ods_status s = ODS_STATUS_OK;
uint32_t new_ttl = 0;
const char *endptr; /* unused */
int offset = 0;
adfile_read_line:
if (ttl) {
new_ttl = *ttl;
}
len = adutil_readline_frm_file(fd, line, l, 0);
adutil_rtrim_line(line, &len);
if (len >= 0) {
switch (line[0]) {
/* directive */
case '$':
if (strncmp(line, "$ORIGIN", 7) == 0 && isspace((int)line[7])) {
/* copy from ldns */
if (*orig) {
ldns_rdf_deep_free(*orig);
*orig = NULL;
}
offset = 8;
while (isspace((int)line[offset])) {
offset++;
}
tmp = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME,
line + offset);
if (!tmp) {
/* could not parse what next to $ORIGIN */
*status = LDNS_STATUS_SYNTAX_DNAME_ERR;
return NULL;
}
*orig = tmp;
/* end copy from ldns */
goto adfile_read_line; /* perhaps next line is rr */
break;
} else if (strncmp(line, "$TTL", 4) == 0 &&
isspace((int)line[4])) {
/* override default ttl */
offset = 5;
while (isspace((int)line[offset])) {
offset++;
}
if (ttl) {
*ttl = ldns_str2period(line + offset, &endptr);
new_ttl = *ttl;
}
goto adfile_read_line; /* perhaps next line is rr */
break;
} else if (strncmp(line, "$INCLUDE", 8) == 0 &&
isspace((int)line[8])) {
/* dive into this file */
offset = 9;
while (isspace((int)line[offset])) {
offset++;
}
fd_include = ods_fopen(line + offset, NULL, "r");
if (fd_include) {
s = adfile_read_file(fd_include, zone);
ods_fclose(fd_include);
} else {
ods_log_error("[%s] unable to open include file %s",
adapter_str, (line+offset));
*status = LDNS_STATUS_SYNTAX_ERR;
return NULL;
}
if (s != ODS_STATUS_OK) {
*status = LDNS_STATUS_SYNTAX_ERR;
ods_log_error("[%s] error in include file %s",
adapter_str, (line+offset));
return NULL;
}
/* restore current ttl */
if (ttl) {
*ttl = new_ttl;
}
goto adfile_read_line; /* perhaps next line is rr */
break;
}
goto adfile_read_rr; /* this can be an owner name */
break;
/* comments, empty lines */
case ';':
case '\n':
goto adfile_read_line; /* perhaps next line is rr */
break;
/* let's hope its a RR */
default:
adfile_read_rr:
if (adutil_whitespace_line(line, len)) {
goto adfile_read_line; /* perhaps next line is rr */
break;
}
*status = ldns_rr_new_frm_str(&rr, line, new_ttl, *orig, prev);
if (*status == LDNS_STATUS_OK) {
return rr;
} else if (*status == LDNS_STATUS_SYNTAX_EMPTY) {
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
*status = LDNS_STATUS_OK;
goto adfile_read_line; /* perhaps next line is rr */
break;
} else {
ods_log_error("[%s] error parsing RR at line %i (%s): %s",
adapter_str, l&&*l?*l:0,
ldns_get_errorstr_by_id(*status), line);
while (len >= 0) {
len = adutil_readline_frm_file(fd, line, l, 0);
}
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
return NULL;
}
break;
}
}
/* -1, EOF */
*status = LDNS_STATUS_OK;
return NULL;
}
/**
* Read zone file.
*
*/
static ods_status
adfile_read_file(FILE* fd, zone_type* zone)
{
ods_status result = ODS_STATUS_OK;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
ldns_rdf* dname = NULL;
uint32_t ttl = 0;
uint32_t new_serial = 0;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
unsigned int line_update_interval = 100000;
unsigned int line_update = line_update_interval;
unsigned int l = 0;
ods_log_assert(fd);
ods_log_assert(zone);
/* $ORIGIN */
dname = adapi_get_origin(zone);
if (!dname) {
ods_log_error("[%s] error getting default value for $ORIGIN",
adapter_str);
return ODS_STATUS_ERR;
}
orig = ldns_rdf_clone(dname);
if (!orig) {
ods_log_error("[%s] error setting default value for $ORIGIN",
adapter_str);
return ODS_STATUS_ERR;
}
/* $TTL */
ttl = adapi_get_ttl(zone);
/* read RRs */
while ((rr = adfile_read_rr(fd, zone, line, &orig, &prev, &ttl,
&status, &l)) != NULL) {
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR at line %i (%s): %s",
adapter_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
break;
}
/* debug update */
if (l > line_update) {
ods_log_debug("[%s] ...at line %i: %s", adapter_str, l, line);
line_update += line_update_interval;
}
/* SOA? */
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
new_serial =
ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
}
/* add to the database */
result = adapi_add_rr(zone, rr, 0);
if (result == ODS_STATUS_UNCHANGED) {
ods_log_debug("[%s] skipping RR at line %i (duplicate): %s",
adapter_str, l, line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
continue;
} else if (result != ODS_STATUS_OK) {
ods_log_error("[%s] error adding RR at line %i: %s",
adapter_str, l, line);
ldns_rr_free(rr);
rr = NULL;
break;
}
}
/* and done */
if (orig) {
ldns_rdf_deep_free(orig);
orig = NULL;
}
if (prev) {
ldns_rdf_deep_free(prev);
prev = NULL;
}
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR at line %i (%s): %s",
adapter_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
}
/* input zone ok, set inbound serial and apply differences */
if (result == ODS_STATUS_OK) {
result = namedb_examine(zone->db);
if (result != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read file: zonefile contains errors",
adapter_str);
return result;
}
adapi_set_serial(zone, new_serial);
}
return result;
}
/**
* Read zone from zonefile.
*
*/
ods_status
adfile_read(void* zone)
{
FILE* fd = NULL;
zone_type* adzone = (zone_type*) zone;
ods_status status = ODS_STATUS_OK;
if (!adzone || !adzone->adinbound || !adzone->adinbound->configstr) {
ods_log_error("[%s] unable to read file: no input adapter",
adapter_str);
return ODS_STATUS_ASSERT_ERR;
}
fd = ods_fopen(adzone->adinbound->configstr, NULL, "r");
if (!fd) {
return ODS_STATUS_FOPEN_ERR;
}
status = adfile_read_file(fd, adzone);
ods_fclose(fd);
if (status == ODS_STATUS_OK) {
adapi_trans_full(zone, 0);
}
return status;
}
/**
* Write zonefile.
*
*/
ods_status
adfile_write(void* zone, const char* filename)
{
FILE* fd = NULL;
char* tmpname = NULL;
zone_type* adzone = (zone_type*) zone;
ods_status status = ODS_STATUS_OK;
/* [start] sanity parameter checking */
if (!adzone || !adzone->adoutbound) {
ods_log_error("[%s] unable to write file: no output adapter",
adapter_str);
return ODS_STATUS_ASSERT_ERR;
}
if (!filename) {
ods_log_error("[%s] unable to write file: no filename given",
adapter_str);
return ODS_STATUS_ASSERT_ERR;
}
/* [end] sanity parameter checking */
/* [start] write zone */
tmpname = ods_build_path(filename, ".tmp", 0, 0);
if (!tmpname) {
return ODS_STATUS_MALLOC_ERR;
}
fd = ods_fopen(tmpname, NULL, "w");
if (fd) {
status = adapi_printzone(fd, adzone);
ods_fclose(fd);
if (status == ODS_STATUS_OK) {
if (adzone->adoutbound->error) {
ods_log_error("[%s] unable to write zone %s file %s: one or "
"more RR print failed", adapter_str, adzone->name,
filename);
/* clear error */
adzone->adoutbound->error = 0;
status = ODS_STATUS_FWRITE_ERR;
}
}
} else {
status = ODS_STATUS_FOPEN_ERR;
}
if (status == ODS_STATUS_OK) {
if (rename((const char*) tmpname, filename) != 0) {
ods_log_error("[%s] unable to write file: failed to rename %s "
"to %s (%s)", adapter_str, tmpname, filename, strerror(errno));
status = ODS_STATUS_RENAME_ERR;
}
}
free(tmpname);
/* [end] write zone */
return status;
}
opendnssec-2.0.4/signer/src/adapter/addns.h 0000644 0001750 0001750 00000007170 13036123676 015553 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* DNS Adapters.
*
*/
#ifndef ADAPTER_ADDNS_H
#define ADAPTER_ADDNS_H
#include "config.h"
#include "status.h"
#include "wire/acl.h"
#include "wire/tsig.h"
#include
#include
#include
/**
* DNS input adapter.
*
*/
typedef struct dnsin_struct dnsin_type;
struct dnsin_struct {
acl_type* request_xfr;
acl_type* allow_notify;
tsig_type* tsig;
time_t last_modified;
};
/**
* DNS output adapter.
*
*/
typedef struct dnsout_struct dnsout_type;
struct dnsout_struct {
acl_type* provide_xfr;
acl_type* do_notify;
tsig_type* tsig;
time_t last_modified;
};
/**
* Create DNS input adapter.
* \return dnsin_type* DNS input adapter
*
*/
dnsin_type* dnsin_create(void);
/**
* Create DNS output adapter.
* \return dnsout_type* DNS output adapter
*
*/
dnsout_type* dnsout_create(void);
/**
* Update DNS input adapter.
* \param[out] addns DNS input adapter
* \param[in] filename filename
* \param[out] last_mod last modified
* \return ods_status status
*
*/
ods_status dnsin_update(dnsin_type** addns, const char* filename,
time_t* last_mod);
/**
* Update DNS output adapter.
* \param[out] addns DNS output adapter
* \param[in] filename filename
* \param[out] last_mod last modified
* \return ods_status status
*
*/
ods_status dnsout_update(dnsout_type** addns, const char* filename,
time_t* last_mod);
/**
* Read the next RR from zone file.
* \param[in] fd file descriptor
* \param[in] line read line
* \param[in] orig origin
* \param[in] prev previous name
* \param[in] ttl default ttl
* \param[in] status status
* \param[out] l line count
* \return ldns_rr* RR
*
*/
ldns_rr* addns_read_rr(FILE* fd, char* line, ldns_rdf** orig, ldns_rdf** prev,
uint32_t* ttl, ldns_status* status, unsigned int* l);
/**
* Read zone from DNS input adapter.
* \param[in] zone zone reference
* \return ods_status status
*
*/
ods_status addns_read(void* zone);
/**
* Write zone to DNS output adapter.
* \param[in] zone zone reference
* \return ods_status status
*
*/
ods_status addns_write(void* zone);
/**
* Clean up DNS input adapter.
* \param[in] addns DNS input adapter
*
*/
void dnsin_cleanup(dnsin_type* addns);
/**
* Clean up DNS output adapter.
* \param[in] addns DNS output adapter
*
*/
void dnsout_cleanup(dnsout_type* addns);
#endif /* ADAPTER_ADDNS_H */
opendnssec-2.0.4/signer/src/adapter/adutil.h 0000644 0001750 0001750 00000004256 13036123676 015746 0000000 0000000 /*
* Copyright (c) 2009-2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
*
* Adapter utilities.
*/
#ifndef ADAPTER_ADUTIL_H
#define ADAPTER_ADUTIL_H
#include "config.h"
#include
#include
#define SE_ADFILE_MAXLINE 65535
/**
* Read one line from file.
* \param[in] fd file descriptor of zonefile
* \param[out] line the one line
* \param[out] l keeps track of line numbers
* \param[in] keep_comments if true, keep comments
* \return int number of characters read
*
*/
int adutil_readline_frm_file(FILE* fd, char* line, unsigned int* l,
int keep_comments);
/*
* Trim trailing whitespace.
* \param[in] line line to be trimmed
* \param[out] line_len maintain line length
*
*/
void adutil_rtrim_line(char* line, int* line_len);
/**
* Check for white space.
* \param[in] line line to be checked
* \param[in] line_len line length
*
*/
int adutil_whitespace_line(char* line, int line_len);
#endif /* ADAPTER_ADUTIL_H */
opendnssec-2.0.4/signer/src/adapter/adapter.h 0000644 0001750 0001750 00000005743 13036123676 016106 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Inbound and Outbound Adapters.
*
*/
#ifndef ADAPTER_ADAPTER_H
#define ADAPTER_ADAPTER_H
#include "config.h"
#include
/** Adapter mode. */
enum adapter_mode_enum
{
ADAPTER_FILE = 1,
ADAPTER_DNS
};
typedef enum adapter_mode_enum adapter_mode;
typedef struct adapter_struct adapter_type;
#include "adapter/addns.h"
#include "adapter/adfile.h"
#include "status.h"
#include "signer/zone.h"
/**
* Adapter.
*
*/
struct adapter_struct {
adapter_mode type;
time_t config_last_modified;
const char* configstr;
void* config; /* TODO used either as dnsin_t* or dnsout_t* */
unsigned inbound : 1;
unsigned error : 1;
};
/**
* Create new adapter.
* \param[in] str configuration string
* \param[in] type type of adapter
* \param[in] in inbound or not (thus outbound)
* \return adapter_type* created adapter
*
*/
adapter_type* adapter_create(const char* str, adapter_mode type, unsigned in);
/**
* Load configuration.
* \param[in] adapter adapter
* \return ods_status status
*
*/
ods_status adapter_load_config(adapter_type* adapter);
/**
* Compare adapters.
* \param[in] a1 adapter 1
* \param[in] a2 adapter 2
* \return int 0 on equal, -1 if a1 < a2, 1 if a1 > a2
*
*/
int adapter_compare(adapter_type* a1, adapter_type* a2);
/**
* Read zone from input adapter.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status adapter_read(zone_type* zone);
/**
* Write zone to output adapter.
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status adapter_write(zone_type* zone);
/**
* Clean up adapter.
* \param[in] adapter adapter to cleanup
*
*/
void adapter_cleanup(adapter_type* adapter);
#endif /* ADAPTER_ADAPTER_H */
opendnssec-2.0.4/signer/src/adapter/addns.c 0000644 0001750 0001750 00000070156 13036123713 015542 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* DNS Adapters.
*
*/
#include "config.h"
#include "adapter/adapi.h"
#include "adapter/adapter.h"
#include "adapter/addns.h"
#include "adapter/adutil.h"
#include "parser/addnsparser.h"
#include "parser/confparser.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/zone.h"
#include "wire/notify.h"
#include "wire/xfrd.h"
#include
#include
#include
static const char* adapter_str = "adapter";
static ods_status addns_read_pkt(FILE* fd, zone_type* zone);
static ods_status addns_read_file(FILE* fd, zone_type* zone);
/**
* Read the next RR from zone file.
*
*/
ldns_rr*
addns_read_rr(FILE* fd, char* line, ldns_rdf** orig, ldns_rdf** prev,
uint32_t* ttl, ldns_status* status, unsigned int* l)
{
ldns_rr* rr = NULL;
int len = 0;
uint32_t new_ttl = 0;
addns_read_line:
if (ttl) {
new_ttl = *ttl;
}
len = adutil_readline_frm_file(fd, line, l, 1);
adutil_rtrim_line(line, &len);
if (len >= 0) {
switch (line[0]) {
/* no directives */
/* comments, empty lines */
case ';':
case '\n':
if (ods_strcmp(";;ENDPACKET", line) == 0) {
/* end of pkt */
*status = LDNS_STATUS_OK;
return NULL;
}
if (ods_strcmp(";;BEGINPACKET", line) == 0) {
/* begin packet but previous not ended, rollback */
*status = LDNS_STATUS_OK;
return NULL;
}
goto addns_read_line; /* perhaps next line is rr */
break;
/* let's hope its a RR */
default:
if (adutil_whitespace_line(line, len)) {
goto addns_read_line; /* perhaps next line is rr */
break;
}
*status = ldns_rr_new_frm_str(&rr, line, new_ttl, *orig, prev);
if (*status == LDNS_STATUS_OK) {
return rr;
} else if (*status == LDNS_STATUS_SYNTAX_EMPTY) {
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
*status = LDNS_STATUS_OK;
goto addns_read_line; /* perhaps next line is rr */
break;
} else {
ods_log_error("[%s] error parsing RR at line %i (%s): %s",
adapter_str, l&&*l?*l:0,
ldns_get_errorstr_by_id(*status), line);
while (len >= 0) {
len = adutil_readline_frm_file(fd, line, l, 0);
}
if (rr) {
ldns_rr_free(rr);
rr = NULL;
}
return NULL;
}
break;
}
}
/* -1, EOF */
*status = LDNS_STATUS_OK;
return NULL;
}
/**
* Read pkt from file.
*
*/
static ods_status
addns_read_pkt(FILE* fd, zone_type* zone)
{
ldns_rr* rr = NULL;
long startpos = 0;
long fpos = 0;
int len = 0;
uint32_t new_serial = 0;
uint32_t old_serial = 0;
uint32_t tmp_serial = 0;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
ldns_rdf* dname = NULL;
uint32_t ttl = 0;
size_t rr_count = 0;
ods_status result = ODS_STATUS_OK;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
unsigned is_axfr = 0;
unsigned del_mode = 0;
unsigned soa_seen = 0;
unsigned line_update_interval = 100000;
unsigned line_update = line_update_interval;
unsigned l = 0;
char* xfrd;
char* fin;
char* fout;
ods_log_assert(fd);
ods_log_assert(zone);
ods_log_assert(zone->name);
fpos = ftell(fd);
len = adutil_readline_frm_file(fd, line, &l, 1);
if (len < 0) {
/* -1 EOF */
return ODS_STATUS_EOF;
}
adutil_rtrim_line(line, &len);
if (ods_strcmp(";;BEGINPACKET", line) != 0) {
ods_log_error("[%s] bogus xfrd file zone %s, missing ;;BEGINPACKET (was %s)",
adapter_str, zone->name, line);
return ODS_STATUS_ERR;
}
startpos = fpos;
fpos = ftell(fd);
begin_pkt:
rr_count = 0;
is_axfr = 0;
del_mode = 0;
soa_seen = 0;
/* $ORIGIN */
dname = adapi_get_origin(zone);
if (!dname) {
ods_log_error("[%s] error getting default value for $ORIGIN",
adapter_str);
return ODS_STATUS_ERR;
}
orig = ldns_rdf_clone(dname);
if (!orig) {
ods_log_error("[%s] error setting default value for $ORIGIN",
adapter_str);
return ODS_STATUS_ERR;
}
/* $TTL */
ttl = adapi_get_ttl(zone);
/* read RRs */
while ((rr = addns_read_rr(fd, line, &orig, &prev, &ttl, &status, &l))
!= NULL) {
/* update file position */
fpos = ftell(fd);
/* check status */
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR at line %i (%s): %s",
adapter_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
break;
}
/* debug update */
if (l > line_update) {
ods_log_debug("[%s] ...at line %i: %s", adapter_str, l, line);
line_update += line_update_interval;
}
/* first RR: check if SOA and correct zone & serialno */
if (rr_count == 0) {
rr_count++;
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_SOA) {
ods_log_error("[%s] bad xfr, first rr is not soa",
adapter_str);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
break;
}
soa_seen++;
if (ldns_dname_compare(ldns_rr_owner(rr), zone->apex)) {
ods_log_error("[%s] bad xfr, soa dname not equal to zone "
"dname %s", adapter_str, zone->name);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
break;
}
tmp_serial =
ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
old_serial = adapi_get_serial(zone);
/**
* Do we need to make this check? It is already done by xfrd.
* By not doing this check, retransfers will be taken into account.
*
if (!util_serial_gt(tmp_serial, old_serial) &&
zone->db->is_initialized) {
ods_log_info("[%s] zone %s is already up to date, have "
"serial %u, got serial %u", adapter_str, zone->name,
old_serial, tmp_serial);
new_serial = tmp_serial;
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_UPTODATE;
while (len >= 0) {
len = adutil_readline_frm_file(fd, line, &l, 1);
if (len && ods_strcmp(";;ENDPACKET", line) == 0) {
startpos = 0;
break;
}
}
break;
}
*
**/
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
continue;
}
/* second RR: if not soa, this is an AXFR */
if (rr_count == 1) {
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_SOA) {
ods_log_verbose("[%s] detected axfr serial=%u for zone %s",
adapter_str, tmp_serial, zone->name);
new_serial = tmp_serial;
is_axfr = 1;
del_mode = 0;
} else {
ods_log_verbose("[%s] detected ixfr serial=%u for zone %s",
adapter_str, tmp_serial, zone->name);
if (!util_serial_gt(tmp_serial, old_serial) &&
zone->db->is_initialized) {
ods_log_error("[%s] bad ixfr for zone %s, bad start serial %lu",
adapter_str, zone->name, (unsigned long)tmp_serial);
result = ODS_STATUS_ERR;
}
new_serial = tmp_serial;
tmp_serial =
ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
ldns_rr_free(rr);
rr = NULL;
rr_count++;
if (tmp_serial < new_serial) {
del_mode = 1;
result = ODS_STATUS_OK;
continue;
} else {
ods_log_error("[%s] bad ixfr for zone %s, bad soa serial %lu",
adapter_str, zone->name, (unsigned long) tmp_serial);
result = ODS_STATUS_ERR;
break;
}
}
}
/* soa means swap */
rr_count++;
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
if (!is_axfr) {
tmp_serial =
ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
if (tmp_serial <= new_serial) {
if (tmp_serial == new_serial) {
soa_seen++;
}
del_mode = !del_mode;
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
continue;
} else {
ods_log_assert(tmp_serial > new_serial);
ods_log_error("[%s] bad xfr for zone %s, bad soa serial",
adapter_str, zone->name);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_ERR;
break;
}
} else {
/* for axfr */
soa_seen++;
}
}
/* [add to/remove from] the zone */
if (!is_axfr && del_mode) {
ods_log_deeebug("[%s] delete RR #%lu at line %i: %s",
adapter_str, (unsigned long)rr_count, l, line);
result = adapi_del_rr(zone, rr, 0);
ldns_rr_free(rr);
rr = NULL;
} else {
ods_log_deeebug("[%s] add RR #%lu at line %i: %s",
adapter_str, (unsigned long)rr_count, l, line);
result = adapi_add_rr(zone, rr, 0);
}
if (result == ODS_STATUS_UNCHANGED) {
ods_log_debug("[%s] skipping RR at line %i (%s): %s",
adapter_str, l, del_mode?"not found":"duplicate", line);
ldns_rr_free(rr);
rr = NULL;
result = ODS_STATUS_OK;
continue;
} else if (result != ODS_STATUS_OK) {
ods_log_error("[%s] error %s RR at line %i: %s",
adapter_str, del_mode?"deleting":"adding", l, line);
ldns_rr_free(rr);
rr = NULL;
break;
}
}
/* and done */
if (orig) {
ldns_rdf_deep_free(orig);
orig = NULL;
}
if (prev) {
ldns_rdf_deep_free(prev);
prev = NULL;
}
/* check again */
if (ods_strcmp(";;ENDPACKET", line) == 0) {
ods_log_verbose("[%s] xfr zone %s on disk complete, commit to db",
adapter_str, zone->name);
startpos = 0;
} else {
ods_log_warning("[%s] xfr zone %s on disk incomplete, rollback",
adapter_str, zone->name);
namedb_rollback(zone->db, 1);
if (ods_strcmp(";;BEGINPACKET", line) == 0) {
result = ODS_STATUS_OK;
startpos = fpos;
goto begin_pkt;
} else {
result = ODS_STATUS_XFRINCOMPLETE;
}
}
/* otherwise EOF */
if (result == ODS_STATUS_OK && status != LDNS_STATUS_OK) {
ods_log_error("[%s] error reading RR at line %i (%s): %s",
adapter_str, l, ldns_get_errorstr_by_id(status), line);
result = ODS_STATUS_ERR;
}
/* check the number of SOAs seen */
if (result == ODS_STATUS_OK) {
if ((is_axfr && soa_seen != 2) || (!is_axfr && soa_seen != 3)) {
ods_log_error("[%s] bad %s, wrong number of SOAs (%u)",
adapter_str, is_axfr?"axfr":"ixfr", soa_seen);
result = ODS_STATUS_ERR;
}
}
/* input zone ok, set inbound serial and apply differences */
if (result == ODS_STATUS_OK) {
adapi_set_serial(zone, new_serial);
if (is_axfr) {
adapi_trans_full(zone, 1);
} else {
adapi_trans_diff(zone, 1);
}
}
if (result == ODS_STATUS_UPTODATE) {
/* do a transaction for DNSKEY and NSEC3PARAM */
adapi_trans_diff(zone, 1);
result = ODS_STATUS_OK;
}
if (result == ODS_STATUS_XFRINCOMPLETE) {
/** we have to restore the incomplete zone transfer:
* xfrd = (xfrd.tmp + startpos) . (xfrd)
*/
xfrd = ods_build_path(zone->name, ".xfrd", 0, 1);
fin = ods_build_path(zone->name, ".xfrd.tmp", 0, 1);
fout = ods_build_path(zone->name, ".xfrd.bak", 0, 1);
if (!xfrd || !fin || !fout) {
return ODS_STATUS_MALLOC_ERR;
}
ods_log_debug("[%s] restore xfrd zone %s xfrd %s fin %s fout %s",
adapter_str, zone->name, xfrd, fin, fout);
result = ods_file_copy(fin, fout, startpos, 0);
if (result != ODS_STATUS_OK) {
ods_log_crit("[%s] unable to restore incomple xfr zone %s: %s",
adapter_str, zone->name, ods_status2str(result));
} else {
lock_basic_lock(&zone->xfrd->rw_lock);
if (ods_file_lastmodified(xfrd)) {
result = ods_file_copy(xfrd, fout, 0, 1);
if (result != ODS_STATUS_OK) {
ods_log_crit("[%s] unable to restore xfrd zone %s: %s",
adapter_str, zone->name, ods_status2str(result));
} else if (rename(fout, xfrd) != 0) {
result = ODS_STATUS_RENAME_ERR;
ods_log_crit("[%s] unable to restore xfrd zone %s: %s",
adapter_str, zone->name, ods_status2str(result));
}
} else if (rename(fout, xfrd) != 0) {
result = ODS_STATUS_RENAME_ERR;
ods_log_crit("[%s] unable to restore xfrd zone %s: %s",
adapter_str, zone->name, ods_status2str(result));
}
lock_basic_unlock(&zone->xfrd->rw_lock);
}
free((void*) xfrd);
free((void*) fin);
free((void*) fout);
result = ODS_STATUS_XFRINCOMPLETE;
}
return result;
}
/**
* Read pkt from file.
*
*/
static ods_status
addns_read_file(FILE* fd, zone_type* zone)
{
ods_status status = ODS_STATUS_OK;
while (status == ODS_STATUS_OK) {
status = addns_read_pkt(fd, zone);
if (status == ODS_STATUS_OK) {
lock_basic_lock(&zone->xfrd->serial_lock);
zone->xfrd->serial_xfr = adapi_get_serial(zone);
zone->xfrd->serial_xfr_acquired = zone->xfrd->serial_disk_acquired;
lock_basic_unlock(&zone->xfrd->serial_lock);
}
}
if (status == ODS_STATUS_EOF) {
status = ODS_STATUS_OK;
}
return status;
}
/**
* Create DNS input adapter.
*
*/
dnsin_type*
dnsin_create(void)
{
dnsin_type* addns = NULL;
CHECKALLOC(addns = (dnsin_type*) malloc(sizeof(dnsin_type)));
addns->request_xfr = NULL;
addns->allow_notify = NULL;
addns->tsig = NULL;
return addns;
}
/**
* Create DNS output adapter.
*
*/
dnsout_type*
dnsout_create(void)
{
dnsout_type* addns = NULL;
CHECKALLOC(addns = (dnsout_type*) malloc(sizeof(dnsout_type)));
addns->provide_xfr = NULL;
addns->do_notify = NULL;
addns->tsig = NULL;
return addns;
}
/**
* Read DNS input adapter.
*
*/
static ods_status
dnsin_read(dnsin_type* addns, const char* filename)
{
const char* rngfile = ODS_SE_RNGDIR "/addns.rng";
ods_status status = ODS_STATUS_OK;
FILE* fd = NULL;
if (!filename || !addns) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_debug("[%s] read dnsin file %s", adapter_str, filename);
status = parse_file_check(filename, rngfile);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read dnsin: parse error in "
"file %s (%s)", adapter_str, filename, ods_status2str(status));
return status;
}
fd = ods_fopen(filename, NULL, "r");
if (fd) {
addns->tsig = parse_addns_tsig(filename);
addns->request_xfr = parse_addns_request_xfr(filename, addns->tsig);
addns->allow_notify = parse_addns_allow_notify(filename, addns->tsig);
ods_fclose(fd);
return ODS_STATUS_OK;
}
ods_log_error("[%s] unable to read dnsout: failed to open file %s",
adapter_str, filename);
return ODS_STATUS_ERR;
}
/**
* Update DNS input adapter.
*
*/
ods_status
dnsin_update(dnsin_type** addns, const char* filename, time_t* last_mod)
{
dnsin_type* new_addns = NULL;
time_t st_mtime = 0;
ods_status status = ODS_STATUS_OK;
if (!filename || !addns || !last_mod) {
return ODS_STATUS_UNCHANGED;
}
/* read the new signer configuration */
status = dnsin_read(*addns, filename);
if (status == ODS_STATUS_OK) {
*last_mod = st_mtime;
} else {
ods_log_error("[%s] unable to update dnsin: dnsin_read(%s) "
"failed (%s)", adapter_str, filename, ods_status2str(status));
}
return status;
}
/**
* Read DNS output adapter.
*
*/
static ods_status
dnsout_read(dnsout_type* addns, const char* filename)
{
const char* rngfile = ODS_SE_RNGDIR "/addns.rng";
ods_status status = ODS_STATUS_OK;
FILE* fd = NULL;
if (!filename || !addns) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_debug("[%s] read dnsout file %s", adapter_str, filename);
status = parse_file_check(filename, rngfile);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to read dnsout: parse error in "
"file %s (%s)", adapter_str, filename, ods_status2str(status));
return status;
}
fd = ods_fopen(filename, NULL, "r");
if (fd) {
addns->tsig = parse_addns_tsig(filename);
addns->provide_xfr = parse_addns_provide_xfr(filename, addns->tsig);
addns->do_notify = parse_addns_do_notify(filename, addns->tsig);
ods_fclose(fd);
return ODS_STATUS_OK;
}
ods_log_error("[%s] unable to read dnsout: failed to open file %s",
adapter_str, filename);
return ODS_STATUS_ERR;
}
/**
* Update DNS output adapter.
*
*/
ods_status
dnsout_update(dnsout_type** addns, const char* filename, time_t* last_mod)
{
time_t st_mtime = 0;
ods_status status = ODS_STATUS_OK;
if (!filename || !addns || !last_mod) {
return ODS_STATUS_UNCHANGED;
}
/* read the new signer configuration */
status = dnsout_read(*addns, filename);
if (status == ODS_STATUS_OK) {
*last_mod = st_mtime;
} else {
ods_log_error("[%s] unable to update dnsout: dnsout_read(%s) "
"failed (%s)", adapter_str, filename, ods_status2str(status));
/* Don't do this cleanup. Signer will crash on exit and will
* access the wrong memory runtime. Leak is only once per badly
* configured adapter. */
/* dnsout_cleanup(*addns); */
}
return status;
}
/**
* Send notifies.
*
*/
static void
dnsout_send_notify(void* zone)
{
zone_type* z = (zone_type*) zone;
rrset_type* rrset = NULL;
ldns_rr* soa = NULL;
if (!z->notify) {
ods_log_error("[%s] unable to send notify for zone %s: no notify "
"handler", adapter_str, z->name);
return;
}
ods_log_assert(z->adoutbound);
ods_log_assert(z->adoutbound->config);
ods_log_assert(z->adoutbound->type == ADAPTER_DNS);
ods_log_assert(z->db);
ods_log_assert(z->name);
ods_log_debug("[%s] enable notify for zone %s serial %u", adapter_str,
z->name, z->db->intserial);
rrset = zone_lookup_rrset(z, z->apex, LDNS_RR_TYPE_SOA);
ods_log_assert(rrset);
soa = ldns_rr_clone(rrset->rrs[0].rr);
notify_enable(z->notify, soa);
}
/**
* Read zone from DNS Input Adapter.
*
*/
ods_status
addns_read(void* zone)
{
zone_type* z = (zone_type*) zone;
ods_status status = ODS_STATUS_OK;
char* xfrfile = NULL;
char* file = NULL;
FILE* fd = NULL;
ods_log_assert(z);
ods_log_assert(z->name);
ods_log_assert(z->xfrd);
ods_log_assert(z->db);
ods_log_assert(z->adinbound);
ods_log_assert(z->adinbound->type == ADAPTER_DNS);
lock_basic_lock(&z->xfrd->rw_lock);
lock_basic_lock(&z->xfrd->serial_lock);
/* did we already store a new zone transfer on disk? */
if (!z->xfrd->serial_disk_acquired ||
z->xfrd->serial_disk_acquired <= z->xfrd->serial_xfr_acquired) {
if (!z->xfrd->serial_disk_acquired) {
lock_basic_unlock(&z->xfrd->serial_lock);
lock_basic_unlock(&z->xfrd->rw_lock);
return ODS_STATUS_XFR_NOT_READY;
}
lock_basic_unlock(&z->xfrd->serial_lock);
lock_basic_unlock(&z->xfrd->rw_lock);
/* do a transaction for DNSKEY and NSEC3PARAM */
adapi_trans_diff(z, 0);
ods_log_verbose("[%s] no new xfr ready for zone %s", adapter_str,
z->name);
return ODS_STATUS_UNCHANGED;
}
/* copy zone transfers */
xfrfile = ods_build_path(z->name, ".xfrd", 0, 1);
file = ods_build_path(z->name, ".xfrd.tmp", 0, 1);
if (!xfrfile || !file) {
free(xfrfile);
free(file);
lock_basic_unlock(&z->xfrd->serial_lock);
lock_basic_unlock(&z->xfrd->rw_lock);
ods_log_error("[%s] unable to build paths to xfrd files", adapter_str);
return ODS_STATUS_MALLOC_ERR;
}
if (rename(xfrfile, file) != 0) {
lock_basic_unlock(&z->xfrd->serial_lock);
lock_basic_unlock(&z->xfrd->rw_lock);
ods_log_error("[%s] unable to rename file %s to %s: %s", adapter_str,
xfrfile, file, strerror(errno));
free((void*) xfrfile);
free((void*) file);
return ODS_STATUS_RENAME_ERR;
}
lock_basic_unlock(&z->xfrd->serial_lock);
/* open copy of zone transfers to read */
fd = ods_fopen(file, NULL, "r");
free((void*) xfrfile);
if (!fd) {
lock_basic_unlock(&z->xfrd->rw_lock);
free((void*) file);
return ODS_STATUS_FOPEN_ERR;
}
lock_basic_unlock(&z->xfrd->rw_lock);
status = addns_read_file(fd, z);
if (status == ODS_STATUS_OK) {
/* clean up copy of zone transfer */
if (unlink((const char*) file) != 0) {
ods_log_error("[%s] unable to unlink zone transfer copy file %s: "
" %s", adapter_str, file, strerror(errno));
/* should be no issue */
}
}
free((void*) file);
ods_fclose(fd);
return status;
}
/**
* Write to DNS Output Adapter.
*
*/
ods_status
addns_write(void* zone)
{
FILE* fd = NULL;
char* atmpfile = NULL;
char* axfrfile = NULL;
char* itmpfile = NULL;
char* ixfrfile = NULL;
zone_type* z = (zone_type*) zone;
int ret = 0;
ods_status status = ODS_STATUS_OK;
ods_log_assert(z);
ods_log_assert(z->name);
ods_log_assert(z->adoutbound);
ods_log_assert(z->adoutbound->type == ADAPTER_DNS);
atmpfile = ods_build_path(z->name, ".axfr.tmp", 0, 1);
if (!atmpfile) {
return ODS_STATUS_MALLOC_ERR;
}
fd = ods_fopen(atmpfile, NULL, "w");
if (!fd) {
free((void*) atmpfile);
return ODS_STATUS_FOPEN_ERR;
}
status = adapi_printaxfr(fd, z);
ods_fclose(fd);
if (status != ODS_STATUS_OK) {
free((void*) atmpfile);
return status;
}
if (z->db->is_initialized && z->ixfr->part[0] &&
z->ixfr->part[0]->soamin && z->ixfr->part[0]->soaplus)
{
itmpfile = ods_build_path(z->name, ".ixfr.tmp", 0, 1);
if (!itmpfile) {
free((void*) atmpfile);
return ODS_STATUS_MALLOC_ERR;
}
fd = ods_fopen(itmpfile, NULL, "w");
if (!fd) {
free((void*) atmpfile);
free((void*) itmpfile);
return ODS_STATUS_FOPEN_ERR;
}
status = adapi_printixfr(fd, z);
ods_fclose(fd);
if (status != ODS_STATUS_OK) {
free((void*) atmpfile);
free((void*) itmpfile);
return status;
}
}
if (status == ODS_STATUS_OK) {
if (z->adoutbound->error) {
ods_log_error("[%s] unable to write zone %s axfr: one or "
"more RR print failed", adapter_str, z->name);
/* clear error */
z->adoutbound->error = 0;
free((void*) atmpfile);
free((void*) itmpfile);
return ODS_STATUS_FWRITE_ERR;
}
}
/* lock and move */
axfrfile = ods_build_path(z->name, ".axfr", 0, 1);
if (!axfrfile) {
free((void*) atmpfile);
free((void*) itmpfile);
return ODS_STATUS_MALLOC_ERR;
}
lock_basic_lock(&z->xfr_lock);
ret = rename(atmpfile, axfrfile);
if (ret != 0) {
ods_log_error("[%s] unable to rename file %s to %s: %s", adapter_str,
atmpfile, axfrfile, strerror(errno));
lock_basic_unlock(&z->xfr_lock);
free((void*) atmpfile);
free((void*) axfrfile);
free((void*) itmpfile);
return ODS_STATUS_RENAME_ERR;
}
free((void*) axfrfile);
free((void*) atmpfile);
axfrfile = NULL;
atmpfile = NULL;
if (z->db->is_initialized && z->ixfr->part[0] &&
z->ixfr->part[0]->soamin && z->ixfr->part[0]->soaplus)
{
ixfrfile = ods_build_path(z->name, ".ixfr", 0, 1);
if (!ixfrfile) {
lock_basic_unlock(&z->xfr_lock);
free((void*) axfrfile);
free((void*) atmpfile);
free((void*) itmpfile);
return ODS_STATUS_MALLOC_ERR;
}
ret = rename(itmpfile, ixfrfile);
if (ret != 0) {
ods_log_error("[%s] unable to rename file %s to %s: %s",
adapter_str, itmpfile, ixfrfile, strerror(errno));
lock_basic_unlock(&z->xfr_lock);
free((void*) itmpfile);
free((void*) ixfrfile);
return ODS_STATUS_RENAME_ERR;
}
free((void*) ixfrfile);
}
free((void*) itmpfile);
lock_basic_unlock(&z->xfr_lock);
dnsout_send_notify(zone);
return ODS_STATUS_OK;
}
/**
* Clean up DNS input adapter.
*
*/
void
dnsin_cleanup(dnsin_type* addns)
{
if (!addns) {
return;
}
acl_cleanup(addns->request_xfr);
acl_cleanup(addns->allow_notify);
tsig_cleanup(addns->tsig);
free(addns);
}
/**
* Clean up DNS output adapter.
*
*/
void
dnsout_cleanup(dnsout_type* addns)
{
if (!addns) {
return;
}
acl_cleanup(addns->provide_xfr);
acl_cleanup(addns->do_notify);
tsig_cleanup(addns->tsig);
free(addns);
}
opendnssec-2.0.4/signer/src/adapter/adapter.c 0000644 0001750 0001750 00000016442 13036123676 016077 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Inbound and Outbound Adapters.
*
*/
#include "adapter/adapter.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "signer/zone.h"
#include
static const char* adapter_str = "adapter";
/**
* Create a new adapter.
*
*/
adapter_type*
adapter_create(const char* str, adapter_mode type, unsigned in)
{
adapter_type* adapter = NULL;
CHECKALLOC(adapter = (adapter_type*) malloc(sizeof(adapter_type)));
adapter->type = type;
adapter->inbound = in;
adapter->error = 0;
adapter->config = NULL;
adapter->config_last_modified = 0;
adapter->configstr = strdup(str);
if (!adapter->configstr) {
ods_log_error("[%s] unable to create adapter: allocator_strdup() "
"failed", adapter_str);
adapter_cleanup(adapter);
return NULL;
}
/* type specific */
switch(adapter->type) {
case ADAPTER_FILE:
break;
case ADAPTER_DNS:
if (adapter->inbound) {
adapter->config = (void*) dnsin_create();
if (!adapter->config) {
ods_log_error("[%s] unable to create adapter: "
"dnsin_create() failed", adapter_str);
adapter_cleanup(adapter);
return NULL;
}
} else {
adapter->config = (void*) dnsout_create();
if (!adapter->config) {
ods_log_error("[%s] unable to create adapter: "
"dnsout_create() failed", adapter_str);
adapter_cleanup(adapter);
return NULL;
}
}
break;
default:
break;
}
return adapter;
}
/**
* Load ACL.
*
*/
ods_status
adapter_load_config(adapter_type* adapter)
{
dnsin_type* dnsin = NULL;
dnsout_type* dnsout = NULL;
ods_status status = ODS_STATUS_OK;
if (!adapter || !adapter->configstr) {
return ODS_STATUS_ASSERT_ERR;
}
/* type specific */
switch(adapter->type) {
case ADAPTER_FILE:
break;
case ADAPTER_DNS:
ods_log_assert(adapter->config);
if (adapter->inbound) {
dnsin = (dnsin_type*)adapter->config;
status = dnsin_update(&dnsin, adapter->configstr,
&adapter->config_last_modified);
if (status == ODS_STATUS_OK) {
ods_log_assert(dnsin);
} else if (status != ODS_STATUS_UNCHANGED) {
return status;
}
return ODS_STATUS_OK;
} else { /* outbound */
dnsout = (dnsout_type*)adapter->config;
status = dnsout_update(&dnsout, adapter->configstr,
&adapter->config_last_modified);
if (status == ODS_STATUS_OK) {
ods_log_assert(dnsout);
} else if (status != ODS_STATUS_UNCHANGED) {
return status;
}
}
break;
default:
break;
}
return ODS_STATUS_OK;
}
/*
* Read zone from input adapter.
*
*/
ods_status
adapter_read(zone_type* zone)
{
if (!zone || !zone->adinbound) {
ods_log_error("[%s] unable to read zone: no input adapter",
adapter_str);
return ODS_STATUS_ASSERT_ERR;
}
ods_log_assert(zone->adinbound->configstr);
switch (zone->adinbound->type) {
case ADAPTER_FILE:
ods_log_verbose("[%s] read zone %s from file input adapter %s",
adapter_str, zone->name, zone->adinbound->configstr);
return adfile_read(zone);
case ADAPTER_DNS:
ods_log_verbose("[%s] read zone %s from dns input adapter %s",
adapter_str, zone->name, zone->adinbound->configstr);
return addns_read(zone);
default:
ods_log_error("[%s] unable to read zone %s from adapter: unknown "
"adapter", adapter_str, zone->name);
return ODS_STATUS_ERR;
}
/* not reached */
return ODS_STATUS_ERR;
}
/**
* Write zone to output adapter.
*
*/
ods_status
adapter_write(zone_type* zone)
{
if (!zone || !zone->db || !zone->adoutbound) {
ods_log_error("[%s] unable to write zone: no output adapter",
adapter_str);
return ODS_STATUS_ASSERT_ERR;
}
ods_log_assert(zone->name);
ods_log_assert(zone->adoutbound->configstr);
switch(zone->adoutbound->type) {
case ADAPTER_FILE:
ods_log_verbose("[%s] write zone %s serial %u to output file "
"adapter %s", adapter_str, zone->name,
zone->db->intserial, zone->adoutbound->configstr);
return adfile_write(zone, zone->adoutbound->configstr);
case ADAPTER_DNS:
return addns_write(zone);
default:
ods_log_error("[%s] unable to write zone %s to adapter: unknown "
"adapter", adapter_str, zone->name);
return ODS_STATUS_ERR;
}
/* not reached */
return ODS_STATUS_ERR;
}
/**
* Compare adapters.
*
*/
int
adapter_compare(adapter_type* a1, adapter_type* a2)
{
if (!a1 && !a2) {
return 0;
} else if (!a1) {
return -1;
} else if (!a2) {
return 1;
} else if (a1->inbound != a2->inbound) {
return a1->inbound - a2->inbound;
} else if (a1->type != a2->type) {
return a1->type - a2->type;
}
return ods_strcmp(a1->configstr, a2->configstr);
}
/**
* Clean up adapter.
*
*/
void
adapter_cleanup(adapter_type* adapter)
{
if (!adapter) {
return;
}
free((void*)adapter->configstr);
switch(adapter->type) {
case ADAPTER_FILE:
break;
case ADAPTER_DNS:
if (adapter->inbound) {
dnsin_cleanup((dnsin_type*) adapter->config);
} else { /* outbound */
dnsout_cleanup((dnsout_type*) adapter->config);
}
break;
default:
break;
}
free(adapter);
}
opendnssec-2.0.4/signer/src/adapter/adapi.h 0000644 0001750 0001750 00000006403 13036123676 015536 0000000 0000000 /*
* Copyright (c) 2009-2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
*
* Adapter API.
*/
#ifndef ADAPTER_ADAPI_H
#define ADAPTER_ADAPI_H
#include "config.h"
#include "status.h"
#include "signer/zone.h"
#include
/**
* Get the inbound serial.
* \param[in] zone zone
* \return uint32_t inbound serial
*
*/
uint32_t adapi_get_serial(zone_type* zone);
/**
* Set the inbound serial.
* \param[in] zone zone
* \param[in] serial inbound serial
*
*/
void adapi_set_serial(zone_type* zone, uint32_t serial);
/**
* Get origin.
* \param[in] zone zone
* \return ldns_rdf* origin
*
*/
ldns_rdf* adapi_get_origin(zone_type* zone);
/**
* Get ttl.
* \param[in] zone zone
* \return uint32_t ttl
*
*/
uint32_t adapi_get_ttl(zone_type* zone);
/*
* Do full zone transaction.
* \param[in] zone zone
* \param[in] more_coming more transactions are possible
*
*/
void adapi_trans_full(zone_type* zone, unsigned more_coming);
/*
* Do incremental zone transaction.
* \param[in] zone zone
* \param[in] more_coming more transactions are possible
*
*/
void adapi_trans_diff(zone_type* zone, unsigned more_coming);
/**
* Add RR.
* \param[in] zone zone
* \param[in] rr RR
* \param[in] backup from backup
* \return ods_status status
*
*/
ods_status adapi_add_rr(zone_type* zone, ldns_rr* rr, int backup);
/**
* Delete RR.
* \param[in] zone zone
* \param[in] rr RR
* \param[in] backup from backup
* \return ods_status status
*
*/
ods_status adapi_del_rr(zone_type* zone, ldns_rr* rr, int backup);
/**
* Print zonefile.
* \param[in] fd file descriptor
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status adapi_printzone(FILE* fd, zone_type* zone);
/**
* Print axfr.
* \param[in] fd file descriptor
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status adapi_printaxfr(FILE* fd, zone_type* zone);
/**
* Print ixfr.
* \param[in] fd file descriptor
* \param[in] zone zone
* \return ods_status status
*
*/
ods_status adapi_printixfr(FILE* fd, zone_type* zone);
#endif /* ADAPTER_ADAPI_H */
opendnssec-2.0.4/signer/src/adapter/adapi.c 0000644 0001750 0001750 00000027724 13036123713 015532 0000000 0000000 /*
* Copyright (c) 2009-2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
*
* Adapter API.
*/
#include "config.h"
#include "adapter/adapi.h"
#include "duration.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/zone.h"
#include
static const char* adapi_str = "adapter";
/**
* Get the inbound serial.
*
*/
uint32_t
adapi_get_serial(zone_type* zone)
{
if (!zone || !zone->db) {
return 0;
}
return zone->db->inbserial;
}
/**
* Set the inbound serial.
*
*/
void
adapi_set_serial(zone_type* zone, uint32_t serial)
{
if (!zone || !zone->db) {
return;
}
zone->db->inbserial = serial;
}
/**
* Get origin.
*
*/
ldns_rdf*
adapi_get_origin(zone_type* zone)
{
if (!zone) {
return NULL;
}
return zone->apex;
}
/**
* Get ttl.
*
*/
uint32_t
adapi_get_ttl(zone_type* zone)
{
if (!zone) {
return 0;
}
return zone->default_ttl;
}
/*
* Do full zone transaction.
*
*/
void
adapi_trans_full(zone_type* zone, unsigned more_coming)
{
time_t start = 0;
time_t end = 0;
uint32_t num_added = 0;
if (!zone || !zone->db) {
return;
}
namedb_diff(zone->db, 0, more_coming);
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->nsec_time = 0;
zone->stats->nsec_count = 0;
lock_basic_unlock(&zone->stats->stats_lock);
}
start = time(NULL);
/* nsecify(3) */
namedb_nsecify(zone->db, &num_added);
end = time(NULL);
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
if (!zone->stats->start_time) {
zone->stats->start_time = start;
}
zone->stats->nsec_time = (end-start);
zone->stats->nsec_count = num_added;
lock_basic_unlock(&zone->stats->stats_lock);
}
}
/*
* Do incremental zone transaction.
*
*/
void
adapi_trans_diff(zone_type* zone, unsigned more_coming)
{
time_t start = 0;
time_t end = 0;
uint32_t num_added = 0;
if (!zone || !zone->db) {
return;
}
namedb_diff(zone->db, 1, more_coming);
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->nsec_time = 0;
zone->stats->nsec_count = 0;
lock_basic_unlock(&zone->stats->stats_lock);
}
start = time(NULL);
/* nsecify(3) */
namedb_nsecify(zone->db, &num_added);
end = time(NULL);
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
if (!zone->stats->start_time) {
zone->stats->start_time = start;
}
zone->stats->nsec_time = (end-start);
zone->stats->nsec_count = num_added;
lock_basic_unlock(&zone->stats->stats_lock);
}
}
/**
* Process SOA.
*
*/
static ods_status
adapi_process_soa(zone_type* zone, ldns_rr* rr, int add, int backup)
{
uint32_t tmp = 0;
ldns_rdf* soa_rdata = NULL;
ods_status status = ODS_STATUS_OK;
ods_log_assert(rr);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->signconf);
if (backup) {
/* no need to do processing */
return ODS_STATUS_OK;
}
if (zone->signconf->soa_ttl) {
tmp = (uint32_t) duration2time(zone->signconf->soa_ttl);
ods_log_verbose("[%s] zone %s set soa ttl to %u",
adapi_str, zone->name, tmp);
ldns_rr_set_ttl(rr, tmp);
}
if (zone->signconf->soa_min) {
tmp = (uint32_t) duration2time(zone->signconf->soa_min);
ods_log_verbose("[%s] zone %s set soa minimum to %u",
adapi_str, zone->name, tmp);
soa_rdata = ldns_rr_set_rdf(rr,
ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32, tmp),
SE_SOA_RDATA_MINIMUM);
if (soa_rdata) {
ldns_rdf_deep_free(soa_rdata);
soa_rdata = NULL;
} else {
ods_log_error("[%s] unable to %s soa to zone %s: failed to replace "
"soa minimum rdata", adapi_str, add?"add":"delete",
zone->name);
return ODS_STATUS_ASSERT_ERR;
}
}
if (!add) {
/* we are done */
return ODS_STATUS_OK;
}
tmp = ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
status = namedb_update_serial(zone->db, zone->name,
zone->signconf->soa_serial, tmp);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to add soa to zone %s: failed to replace "
"soa serial rdata (%s)", adapi_str, zone->name,
ods_status2str(status));
if (status == ODS_STATUS_CONFLICT_ERR) {
ods_log_error("[%s] If this is the result of a key rollover, "
"please increment the serial in the unsigned zone %s",
adapi_str, zone->name);
}
return status;
}
ods_log_verbose("[%s] zone %s set soa serial to %u", adapi_str,
zone->name, zone->db->intserial);
soa_rdata = ldns_rr_set_rdf(rr, ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
zone->db->intserial), SE_SOA_RDATA_SERIAL);
if (soa_rdata) {
ldns_rdf_deep_free(soa_rdata);
soa_rdata = NULL;
} else {
ods_log_error("[%s] unable to add soa to zone %s: failed to replace "
"soa serial rdata", adapi_str, zone->name);
return ODS_STATUS_ERR;
}
zone->db->serial_updated = 1;
return ODS_STATUS_OK;
}
/**
* Process DNSKEY.
*
*/
static void
adapi_process_dnskey(zone_type* zone, ldns_rr* rr)
{
uint32_t tmp = 0;
ods_log_assert(rr);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->signconf);
tmp = (uint32_t) duration2time(zone->signconf->dnskey_ttl);
ods_log_verbose("[%s] zone %s set dnskey ttl to %u",
adapi_str, zone->name, tmp);
ldns_rr_set_ttl(rr, tmp);
}
/**
* Process RR.
*
*/
static ods_status
adapi_process_rr(zone_type* zone, ldns_rr* rr, int add, int backup)
{
ods_status status = ODS_STATUS_OK;
uint32_t tmp = 0;
ods_log_assert(rr);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
/* We only support IN class */
if (ldns_rr_get_class(rr) != LDNS_RR_CLASS_IN) {
ods_log_warning("[%s] only class in is supported, changing class "
"to in", adapi_str);
ldns_rr_set_class(rr, LDNS_RR_CLASS_IN);
}
/* RR processing */
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
if (ldns_dname_compare(ldns_rr_owner(rr), zone->apex)) {
ods_log_error("[%s] unable to %s rr to zone: soa record has "
"invalid owner name", adapi_str, add?"add":"delete");
return ODS_STATUS_ERR;
}
status = adapi_process_soa(zone, rr, add, backup);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to %s rr: failed to process soa "
"record", adapi_str, add?"add":"delete");
return status;
}
} else {
if (ldns_dname_compare(ldns_rr_owner(rr), zone->apex) &&
!ldns_dname_is_subdomain(ldns_rr_owner(rr), zone->apex)) {
ods_log_warning("[%s] zone %s contains out-of-zone data, "
"skipping", adapi_str, zone->name);
return ODS_STATUS_UNCHANGED;
} else if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_DNSKEY) {
adapi_process_dnskey(zone, rr);
} else if (util_is_dnssec_rr(rr) && !backup) {
ods_log_warning("[%s] zone %s contains dnssec data (type=%u), "
"skipping", adapi_str, zone->name,
(unsigned) ldns_rr_get_type(rr));
return ODS_STATUS_UNCHANGED;
} else if (zone->signconf->max_zone_ttl) {
/* Convert MaxZoneTTL */
tmp = (uint32_t) duration2time(zone->signconf->max_zone_ttl);
}
}
/* //MaxZoneTTL. Only set for RRtype != SOA && RRtype != DNSKEY */
if (tmp && tmp < ldns_rr_ttl(rr)) {
char* str = ldns_rdf2str(ldns_rr_owner(rr));
if (str) {
size_t i = 0;
str[(strlen(str))-1] = '\0';
/* replace tabs with white space */
for (i=0; i < strlen(str); i++) {
if (str[i] == '\t') {
str[i] = ' ';
}
}
ods_log_debug("[%s] capping ttl %u to MaxZoneTTL %u for rrset "
"<%s,%s>", adapi_str, ldns_rr_ttl(rr), tmp, str,
rrset_type2str(ldns_rr_get_type(rr)));
}
ldns_rr_set_ttl(rr, tmp);
}
/* TODO: DNAME and CNAME checks */
/* TODO: NS and DS checks */
if (add) {
return zone_add_rr(zone, rr, 1);
} else {
return zone_del_rr(zone, rr, 1);
}
/* not reached */
return ODS_STATUS_ERR;
}
/**
* Add RR.
*
*/
ods_status
adapi_add_rr(zone_type* zone, ldns_rr* rr, int backup)
{
return adapi_process_rr(zone, rr, 1, backup);
}
/**
* Delete RR.
*
*/
ods_status
adapi_del_rr(zone_type* zone, ldns_rr* rr, int backup)
{
return adapi_process_rr(zone, rr, 0, backup);
}
/**
* Print zone.
*
*/
ods_status
adapi_printzone(FILE* fd, zone_type* zone)
{
ods_status status = ODS_STATUS_OK;
if (!fd || !zone || !zone->db) {
ods_log_error("[%s] unable to print zone: file descriptor, zone or "
"name database missing", adapi_str);
return ODS_STATUS_ASSERT_ERR;
}
namedb_export(fd, zone->db, &status);
return status;
}
/**
* Print axfr.
*
*/
ods_status
adapi_printaxfr(FILE* fd, zone_type* zone)
{
rrset_type* rrset = NULL;
ods_status status = ODS_STATUS_OK;
if (!fd || !zone || !zone->db) {
ods_log_error("[%s] unable to print axfr: file descriptor, zone or "
"name database missing", adapi_str);
return ODS_STATUS_ASSERT_ERR;
}
namedb_export(fd, zone->db, &status);
if (status == ODS_STATUS_OK) {
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_SOA);
ods_log_assert(rrset);
rrset_print(fd, rrset, 1, &status);
}
return status;
}
/**
* Print ixfr.
*
*/
ods_status
adapi_printixfr(FILE* fd, zone_type* zone)
{
rrset_type* rrset = NULL;
ods_status status = ODS_STATUS_OK;
if (!fd || !zone || !zone->db || !zone->ixfr) {
ods_log_error("[%s] unable to print ixfr: file descriptor, zone or "
"name database missing", adapi_str);
return ODS_STATUS_ASSERT_ERR;
}
if (!zone->db->is_initialized) {
/* no ixfr yet */
return ODS_STATUS_OK;
}
rrset = zone_lookup_rrset(zone, zone->apex, LDNS_RR_TYPE_SOA);
ods_log_assert(rrset);
rrset_print(fd, rrset, 1, &status);
if (status != ODS_STATUS_OK) {
return status;
}
lock_basic_lock(&zone->ixfr->ixfr_lock);
ixfr_print(fd, zone->ixfr);
lock_basic_unlock(&zone->ixfr->ixfr_lock);
rrset_print(fd, rrset, 1, &status);
return status;
}
opendnssec-2.0.4/signer/src/scheduler/ 0000755 0001750 0001750 00000000000 13036124774 014722 5 0000000 0000000 opendnssec-2.0.4/signer/src/scheduler/schedule.h 0000644 0001750 0001750 00000006751 13036123713 016610 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Task scheduling.
*
*/
#ifndef SCHEDULER_SCHEDULE_H
#define SCHEDULER_SCHEDULE_H
#include "config.h"
#include
#include
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#ifdef HAVE_UNISTD_H
# include
#endif
#include
typedef struct schedule_struct schedule_type;
#include "scheduler/task.h"
#include "locks.h"
#include "status.h"
#include "task.h"
/**
* Task schedule.
*/
struct schedule_struct {
ldns_rbtree_t* tasks;
int flushcount;
int loading; /* to determine backoff */
lock_basic_type schedule_lock;
};
/**
* Create new schedule.
* \param[in] allocator memory allocator
* \return schedule_type* created schedule
*
*/
schedule_type* schedule_create(void);
/**
* Flush schedule.
* \param[in] schedule schedule to be flushed
* \param[in] override override task
*
*/
void schedule_flush(schedule_type* schedule, task_id override);
/**
* Look up task.
* \param[in] schedule schedule
* \param[in] task task
* \return task_type* task, if found
*
*/
task_type* schedule_lookup_task(schedule_type* schedule, task_type* task);
/**
* Schedule task.
* \param[in] schedule schedule
* \param[in] task task
* \param[in] log add entry in log for this
* \return ods_status status
*
*/
ods_status schedule_task(schedule_type* schedule, task_type* task, int log);
/**
* Unschedule task.
* \param[in] schedule schedule
* \param[in] task task to delete
* \return task_type* task, if it was scheduled
*
*/
task_type* unschedule_task(schedule_type* schedule, task_type* task);
/**
* Pop the first scheduled task.
* \param[in] schedule schedule
* \return task_type* popped task
*
*/
task_type* schedule_pop_task(schedule_type* schedule);
/**
* Get the first scheduled task.
* \param[in] schedule schedule
* \return task_type* first scheduled task
*
*/
task_type* schedule_get_first_task(schedule_type* schedule);
/**
* Print schedule.
* \param[in] out file descriptor
* \param[in] schedule schedule
*
*/
void schedule_print(FILE* out, schedule_type* schedule);
/**
* Clean up schedule.
* \param[in] schedule schedule to be cleaned up
*
*/
void schedule_cleanup(schedule_type* schedule);
#endif /* SCHEDULER_SCHEDULE_H */
opendnssec-2.0.4/signer/src/scheduler/schedule.c 0000644 0001750 0001750 00000020462 13036123713 016576 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Task scheduling.
*
*/
#include "config.h"
#include "scheduler/schedule.h"
#include "scheduler/task.h"
#include "duration.h"
#include "log.h"
#include
static const char* schedule_str = "scheduler";
/**
* Create new schedule.
*
*/
schedule_type*
schedule_create()
{
schedule_type* schedule;
CHECKALLOC(schedule = (schedule_type*) malloc(sizeof(schedule_type)));
if (!schedule) {
ods_log_error("[%s] unable to create schedule: allocator_alloc() "
"failed", schedule_str);
return NULL;
}
schedule->loading = 0;
schedule->flushcount = 0;
schedule->tasks = ldns_rbtree_create(task_compare);
if (!schedule->tasks) {
ods_log_error("[%s] unable to create schedule: ldns_rbtree_create() "
"failed", schedule_str);
free(schedule);
return NULL;
}
lock_basic_init(&schedule->schedule_lock);
return schedule;
}
/**
* Flush schedule.
*
*/
void
schedule_flush(schedule_type* schedule, task_id override)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
task_type* task = NULL;
ods_log_debug("[%s] flush all tasks", schedule_str);
if (!schedule || !schedule->tasks) {
return;
}
node = ldns_rbtree_first(schedule->tasks);
while (node && node != LDNS_RBTREE_NULL) {
task = (task_type*) node->data;
task->flush = 1;
schedule->flushcount++;
if (override != TASK_NONE) {
task->what = override;
}
node = ldns_rbtree_next(node);
}
}
/**
* Convert task to a tree node.
*
*/
static ldns_rbnode_t*
task2node(task_type* task)
{
ldns_rbnode_t* node = (ldns_rbnode_t*) malloc(sizeof(ldns_rbnode_t));
if (node) {
node->key = task;
node->data = task;
}
return node;
}
/**
* Look up task.
*
*/
task_type*
schedule_lookup_task(schedule_type* schedule, task_type* task)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
task_type* lookup = NULL;
if (!schedule || !task) {
return NULL;
}
ods_log_assert(schedule->tasks);
node = ldns_rbtree_search(schedule->tasks, task);
if (node && node != LDNS_RBTREE_NULL) {
lookup = (task_type*) node->data;
}
return lookup;
}
/**
* Schedule task.
*
*/
ods_status
schedule_task(schedule_type* schedule, task_type* task, int log)
{
ldns_rbnode_t* new_node = NULL;
ldns_rbnode_t* ins_node = NULL;
if (!task || !schedule || !schedule->tasks) {
return ODS_STATUS_ASSERT_ERR;
}
ods_log_debug("[%s] schedule task %s for zone %s", schedule_str,
task_what2str(task->what), task_who2str(task));
if (schedule_lookup_task(schedule, task) != NULL) {
ods_log_error("[%s] unable to schedule task %s for zone %s: "
" already present", schedule_str, task_what2str(task->what),
task_who2str(task));
return ODS_STATUS_ERR;
}
new_node = task2node(task);
if (!new_node) {
ods_log_error("[%s] unable to schedule task %s for zone %s: "
" task2node() failed", schedule_str, task_what2str(task->what),
task_who2str(task));
return ODS_STATUS_MALLOC_ERR;
}
ins_node = ldns_rbtree_insert(schedule->tasks, new_node);
if (!ins_node) {
ods_log_error("[%s] unable to schedule task %s for zone %s: "
" insert failed", schedule_str, task_what2str(task->what),
task_who2str(task));
free((void*)new_node);
return ODS_STATUS_ERR;
}
if (task->flush) {
schedule->flushcount++;
}
if (log) {
task_log(task);
}
return ODS_STATUS_OK;
}
/**
* Unschedule task.
*
*/
task_type*
unschedule_task(schedule_type* schedule, task_type* task)
{
ldns_rbnode_t* del_node = LDNS_RBTREE_NULL;
task_type* del_task = NULL;
if (!task || !schedule || !schedule->tasks) {
return NULL;
}
ods_log_debug("[%s] unschedule task %s for zone %s",
schedule_str, task_what2str(task->what), task_who2str(task));
del_node = ldns_rbtree_delete(schedule->tasks, (const void*) task);
if (del_node) {
del_task = (task_type*) del_node->data;
free((void*)del_node);
} else {
ods_log_warning("[%s] unable to unschedule task %s for zone %s: not "
"scheduled", schedule_str, task_what2str(task->what),
task_who2str(task));
return NULL;
}
if (del_task->flush) {
del_task->flush = 0;
schedule->flushcount--;
}
return del_task;
}
/**
* Get the first scheduled task.
*
*/
task_type*
schedule_get_first_task(schedule_type* schedule)
{
ldns_rbnode_t* first_node = LDNS_RBTREE_NULL;
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
task_type* pop = NULL;
if (!schedule || !schedule->tasks) {
return NULL;
}
first_node = ldns_rbtree_first(schedule->tasks);
if (!first_node) {
return NULL;
}
if (schedule->flushcount > 0) {
/* find remaining to be flushed tasks */
node = first_node;
while (node && node != LDNS_RBTREE_NULL) {
pop = (task_type*) node->data;
if (pop->flush) {
return pop;
}
node = ldns_rbtree_next(node);
}
/* no more to be flushed tasks found */
ods_log_warning("[%s] unable to get first scheduled task: could not "
"find flush-task, while there should be %i flush-tasks left",
schedule_str, schedule->flushcount);
ods_log_info("[%s] reset flush count to 0", schedule_str);
schedule->flushcount = 0;
}
/* no more tasks to be flushed, return first task in schedule */
pop = (task_type*) first_node->data;
return pop;
}
/**
* Pop the first scheduled task.
*
*/
task_type*
schedule_pop_task(schedule_type* schedule)
{
task_type* pop = NULL;
time_t now = 0;
if (!schedule || !schedule->tasks) {
return NULL;
}
now = time_now();
pop = schedule_get_first_task(schedule);
if (pop && (pop->flush || pop->when <= now)) {
if (pop->flush) {
ods_log_debug("[%s] flush task for zone %s", schedule_str,
task_who2str(pop));
} else {
ods_log_debug("[%s] pop task for zone %s", schedule_str,
task_who2str(pop));
}
return unschedule_task(schedule, pop);
}
return NULL;
}
/**
* Internal task cleanup function.
*
*/
static void
task_delfunc(ldns_rbnode_t* elem)
{
task_type* task;
if (elem && elem != LDNS_RBTREE_NULL) {
task = (task_type*) elem->data;
task_delfunc(elem->left);
task_delfunc(elem->right);
task_cleanup(task);
free((void*)elem);
}
}
/**
* Clean up schedule.
*
*/
void
schedule_cleanup(schedule_type* schedule)
{
if (!schedule) {
return;
}
ods_log_debug("[%s] cleanup schedule", schedule_str);
if (schedule->tasks) {
task_delfunc(schedule->tasks->root);
ldns_rbtree_free(schedule->tasks);
schedule->tasks = NULL;
}
lock_basic_destroy(&schedule->schedule_lock);
free(schedule);
}
opendnssec-2.0.4/signer/src/scheduler/task.h 0000644 0001750 0001750 00000005740 13036123713 015753 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Tasks.
*
*/
#ifndef SCHEDULER_TASK_H
#define SCHEDULER_TASK_H
#include "config.h"
#include
enum task_id_enum {
TASK_NONE = 0,
TASK_SIGNCONF, /* ods-signer update */
TASK_READ, /* ods-signer sign */
TASK_NSECIFY,
TASK_SIGN, /* ods-signer flush */
TASK_WRITE
};
typedef enum task_id_enum task_id;
typedef struct task_struct task_type;
#include "status.h"
#include "signer/zone.h"
/**
* Task.
*/
struct task_struct {
task_id what;
task_id interrupt;
task_id halted;
time_t when;
time_t halted_when;
time_t backoff;
int flush;
zone_type* zone;
};
/**
* Create a new task.
* \param[in] what task identifier
* \param[in] when scheduled time
* \param[in] zone zone reference
* \return task_type* created task
*
*/
task_type* task_create(task_id what, time_t when, void* zone);
/**
* Compare tasks.
* \param[in] a one task
* \param[in] b another task
* \return int -1, 0 or 1
*
*/
int task_compare(const void* a, const void* b);
/**
* Convert task to string.
* \param[in] task task
* \param[out] buffer to store string-based task in
* \return string-format task
*
*/
char* task2str(task_type* task, char* buftask);
/**
* String-format of who.
* \param[in] what task identifier
* \return const char* string-format of what
*
*/
const char* task_what2str(task_id what);
/**
* String-format of who.
* \param[in] task task
* \return const char* string-format of who
*/
const char* task_who2str(task_type* task);
/**
* Log task.
* \param[in] task task
*
*/
void task_log(task_type* task);
/**
* Clean up task.
* \param[in] task task
*
*/
void task_cleanup(task_type* task);
#endif /* SCHEDULER_TASK_H */
opendnssec-2.0.4/signer/src/scheduler/task.c 0000644 0001750 0001750 00000012223 13036123713 015740 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Tasks.
*
*/
#include "config.h"
#include "scheduler/task.h"
#include "status.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "signer/zone.h"
static const char* task_str = "task";
/**
* Create a new task.
*
*/
task_type*
task_create(task_id what, time_t when, void* zone)
{
task_type* task = NULL;
if (!zone) {
return NULL;
}
CHECKALLOC(task = (task_type*) malloc(sizeof(task_type)));
task->what = what;
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
task->when = when;
task->halted_when = 0;
task->backoff = 0;
task->flush = 0;
task->zone = zone;
return task;
}
/**
* Compare tasks.
*
*/
int
task_compare(const void* a, const void* b)
{
task_type* x = (task_type*)a;
task_type* y = (task_type*)b;
zone_type* zx = NULL;
zone_type* zy = NULL;
ods_log_assert(x);
ods_log_assert(y);
zx = (zone_type*) x->zone;
zy = (zone_type*) y->zone;
if (!ldns_dname_compare((const void*) zx->apex,
(const void*) zy->apex)) {
/* if dname is the same, consider the same task */
return 0;
}
/* order task on time, what to do, dname */
if (x->when != y->when) {
return (int) x->when - y->when;
}
if (x->what != y->what) {
return (int) x->what - y->what;
}
/* this is unfair, it prioritizes zones that are first in canonical line */
return ldns_dname_compare((const void*) zx->apex,
(const void*) zy->apex);
}
/**
* String-format of what.
*
*/
const char*
task_what2str(task_id what)
{
switch (what) {
case TASK_NONE:
return "[ignore]";
break;
case TASK_SIGNCONF:
return "[configure]";
break;
case TASK_READ:
return "[read]";
break;
case TASK_SIGN:
return "[sign]";
break;
case TASK_WRITE:
return "[write]";
break;
default:
break;
}
return "[???]";
}
/**
* String-format of who.
*
*/
const char*
task_who2str(task_type* task)
{
zone_type* zone = NULL;
if (task) {
zone = (zone_type*) task->zone;
}
if (zone && zone->name) {
return zone->name;
}
return "(null)";
}
/**
* Convert task to string.
*
*/
char*
task2str(task_type* task, char* buftask)
{
char* strtime = NULL;
char* strtask = NULL;
if (task) {
strtime = ctime(&task->when);
if (strtime) {
strtime[strlen(strtime)-1] = '\0';
}
if (buftask) {
(void)snprintf(buftask, ODS_SE_MAXLINE, "%s %s I will %s zone %s"
"\n", task->flush?"Flush":"On", strtime?strtime:"(null)",
task_what2str(task->what), task_who2str(task));
return buftask;
} else {
strtask = (char*) calloc(ODS_SE_MAXLINE, sizeof(char));
if (strtask) {
snprintf(strtask, ODS_SE_MAXLINE, "%s %s I will %s zone %s\n",
task->flush?"Flush":"On", strtime?strtime:"(null)",
task_what2str(task->what), task_who2str(task));
return strtask;
} else {
ods_log_error("[%s] unable to convert task to string: malloc "
"error", task_str);
}
}
}
return NULL;
}
/**
* Log task.
*
*/
void
task_log(task_type* task)
{
char* strtime = NULL;
if (task) {
strtime = ctime(&task->when);
if (strtime) {
strtime[strlen(strtime)-1] = '\0';
}
ods_log_debug("[%s] %s %s I will %s zone %s", task_str,
task->flush?"Flush":"On", strtime?strtime:"(null)",
task_what2str(task->what), task_who2str(task));
}
}
/**
* Clean up task.
*
*/
void
task_cleanup(task_type* task)
{
if (!task) {
return;
}
free(task);
}
opendnssec-2.0.4/signer/src/scheduler/fifoq.h 0000644 0001750 0001750 00000005405 13036123713 016113 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* FIFO Queue.
*
*/
#ifndef SCHEDULER_FIFOQ_H
#define SCHEDULER_FIFOQ_H
#include "config.h"
#include
#include
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#ifdef HAVE_UNISTD_H
# include
#endif
#include
typedef struct fifoq_struct fifoq_type;
#include "daemon/worker.h"
#include "locks.h"
#include "status.h"
#define FIFOQ_MAX_COUNT 1000
#define FIFOQ_TRIES_COUNT 10
/**
* FIFO Queue.
*/
struct fifoq_struct {
void* blob[FIFOQ_MAX_COUNT];
worker_type* owner[FIFOQ_MAX_COUNT];
size_t count;
lock_basic_type q_lock;
cond_basic_type q_threshold;
cond_basic_type q_nonfull;
};
/**
* Create new FIFO queue.
* \param[in] allocator memory allocator
* \return fifoq_type* created queue
*
*/
fifoq_type* fifoq_create(void);
/**
* Wipe queue.
* \param[in] q queue to be wiped
*
*/
void fifoq_wipe(fifoq_type* q);
/**
* Pop item from queue.
* \param[in] q queue
* \param[out] worker worker that owns the item
* \return void* popped item
*
*/
void* fifoq_pop(fifoq_type* q, worker_type** worker);
/**
* Push item to queue.
* \param[in] q queue
* \param[in] item item
* \param[in] worker owner of item
* \param[out] tries number of tries
* \return ods_status status
*
*/
ods_status fifoq_push(fifoq_type* q, void* item, worker_type* worker,
int* tries);
/**
* Clean up queue.
* \param[in] q queue to be cleaned up
*
*/
void fifoq_cleanup(fifoq_type* q);
#endif /* SCHEDULER_FIFOQ_H */
opendnssec-2.0.4/signer/src/scheduler/fifoq.c 0000644 0001750 0001750 00000010043 13036123713 016100 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* FIFO Queue.
*
*/
#include "config.h"
#include "scheduler/fifoq.h"
#include "log.h"
#include
static const char* fifoq_str = "fifo";
/**
* Create new FIFO queue.
*
*/
fifoq_type*
fifoq_create()
{
fifoq_type* fifoq;
CHECKALLOC(fifoq = (fifoq_type*) malloc(sizeof(fifoq_type)));
if (!fifoq) {
ods_log_error("[%s] unable to create fifoq: allocator_alloc() failed",
fifoq_str);
return NULL;
}
fifoq_wipe(fifoq);
lock_basic_init(&fifoq->q_lock);
lock_basic_set(&fifoq->q_threshold);
lock_basic_set(&fifoq->q_nonfull);
return fifoq;
}
/**
* Wipe queue.
*
*/
void
fifoq_wipe(fifoq_type* q)
{
size_t i = 0;
for (i=0; i < FIFOQ_MAX_COUNT; i++) {
q->blob[i] = NULL;
q->owner[i] = NULL;
}
q->count = 0;
}
/**
* Pop item from queue.
*
*/
void*
fifoq_pop(fifoq_type* q, worker_type** worker)
{
void* pop = NULL;
size_t i = 0;
if (!q || q->count <= 0) {
return NULL;
}
pop = q->blob[0];
*worker = q->owner[0];
for (i = 0; i < q->count-1; i++) {
q->blob[i] = q->blob[i+1];
q->owner[i] = q->owner[i+1];
}
q->count -= 1;
if (q->count <= (size_t) FIFOQ_MAX_COUNT * 0.1) {
/**
* Notify waiting workers that they can start queuing again
* If no workers are waiting, this call has no effect.
*/
lock_basic_broadcast(&q->q_nonfull);
}
return pop;
}
/**
* Push item to queue.
*
*/
ods_status
fifoq_push(fifoq_type* q, void* item, worker_type* worker, int* tries)
{
if (!q || !item || !worker) {
return ODS_STATUS_ASSERT_ERR;
}
if (q->count >= FIFOQ_MAX_COUNT) {
/**
* #262:
* If drudgers remain on hold, do additional broadcast.
* If no drudgers are waiting, this call has no effect.
*/
if (*tries > FIFOQ_TRIES_COUNT) {
lock_basic_broadcast(&q->q_threshold);
ods_log_debug("[%s] queue full, notify drudgers again", fifoq_str);
/* reset tries */
*tries = 0;
}
return ODS_STATUS_UNCHANGED;
}
q->blob[q->count] = item;
assert(worker);
assert(worker->task);
q->owner[q->count] = worker;
q->count += 1;
if (q->count == 1) {
ods_log_deeebug("[%s] threshold %lu reached, notify drudgers",
fifoq_str, (unsigned long) q->count);
/* If no drudgers are waiting, this call has no effect. */
lock_basic_broadcast(&q->q_threshold);
}
return ODS_STATUS_OK;
}
/**
* Clean up queue.
*
*/
void
fifoq_cleanup(fifoq_type* q)
{
if (!q) {
return;
}
lock_basic_off(&q->q_threshold);
lock_basic_off(&q->q_nonfull);
lock_basic_destroy(&q->q_lock);
free(q);
}
opendnssec-2.0.4/signer/src/hsm.c 0000644 0001750 0001750 00000013110 13036123713 013603 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Hardware Security Module support.
*
*/
#include "daemon/engine.h"
#include "hsm.h"
#include "log.h"
#include "cryptoki_compat/pkcs11.h"
static const char* hsm_str = "hsm";
/**
* Clear key cache.
*
*/
static void
lhsm_clear_key_cache(key_type* key)
{
if (!key) {
return;
}
if (key->dnskey) {
/* DNSKEY still exists in zone */
key->dnskey = NULL;
}
if (key->params) {
hsm_sign_params_free(key->params);
key->params = NULL;
}
}
static const libhsm_key_t*
keylookup(hsm_ctx_t* ctx, const char* locator)
{
const libhsm_key_t* key;
key = keycache_lookup(ctx, locator);
if (key == NULL) {
char* error = hsm_get_error(ctx);
if (error) {
ods_log_error("[%s] %s", hsm_str, error);
free((void*)error);
}
/* could not find key */
ods_log_error("[%s] unable to get key: key %s not found", hsm_str, locator);
}
return key;
}
/**
* Get key from one of the HSMs.
*
*/
ods_status
lhsm_get_key(hsm_ctx_t* ctx, ldns_rdf* owner, key_type* key_id)
{
char *error = NULL;
int retries = 0;
if (!owner || !key_id) {
ods_log_error("[%s] unable to get key: missing required elements",
hsm_str);
return ODS_STATUS_ASSERT_ERR;
}
llibhsm_key_start:
/* set parameters */
if (!key_id->params) {
key_id->params = hsm_sign_params_new();
if (key_id->params) {
key_id->params->owner = ldns_rdf_clone(owner);
key_id->params->algorithm = key_id->algorithm;
key_id->params->flags = key_id->flags;
} else {
/* could not create params */
error = hsm_get_error(ctx);
if (error) {
ods_log_error("[%s] %s", hsm_str, error);
free((void*)error);
} else if (!retries) {
lhsm_clear_key_cache(key_id);
retries++;
goto llibhsm_key_start;
}
ods_log_error("[%s] unable to get key: create params for key %s "
"failed", hsm_str, key_id->locator?key_id->locator:"(null)");
return ODS_STATUS_ERR;
}
}
/* get dnskey */
if (!key_id->dnskey) {
key_id->dnskey = hsm_get_dnskey(ctx, keylookup(ctx, key_id->locator), key_id->params);
}
if (!key_id->dnskey) {
error = hsm_get_error(ctx);
if (error) {
ods_log_error("[%s] %s", hsm_str, error);
free((void*)error);
} else if (!retries) {
lhsm_clear_key_cache(key_id);
retries++;
goto llibhsm_key_start;
}
ods_log_error("[%s] unable to get key: hsm failed to create dnskey",
hsm_str);
return ODS_STATUS_ERR;
}
key_id->params->keytag = ldns_calc_keytag(key_id->dnskey);
return ODS_STATUS_OK;
}
/**
* Get RRSIG from one of the HSMs, given a RRset and a key.
*
*/
ldns_rr*
lhsm_sign(hsm_ctx_t* ctx, ldns_rr_list* rrset, key_type* key_id,
ldns_rdf* owner, time_t inception, time_t expiration)
{
char* error = NULL;
ldns_rr* result = NULL;
hsm_sign_params_t* params = NULL;
if (!owner || !key_id || !rrset || !inception || !expiration) {
ods_log_error("[%s] unable to sign: missing required elements",
hsm_str);
return NULL;
}
ods_log_assert(key_id->dnskey);
ods_log_assert(key_id->params);
/* adjust parameters */
params = hsm_sign_params_new();
params->owner = ldns_rdf_clone(key_id->params->owner);
params->algorithm = key_id->algorithm;
params->flags = key_id->flags;
params->inception = inception;
params->expiration = expiration;
params->keytag = key_id->params->keytag;
ods_log_deeebug("[%s] sign RRset[%i] with key %s tag %u", hsm_str,
ldns_rr_get_type(ldns_rr_list_rr(rrset, 0)),
key_id->locator?key_id->locator:"(null)", params->keytag);
result = hsm_sign_rrset(ctx, rrset, keylookup(ctx, key_id->locator), params);
hsm_sign_params_free(params);
if (!result) {
error = hsm_get_error(ctx);
if (error) {
ods_log_error("[%s] %s", hsm_str, error);
free((void*)error);
}
ods_log_crit("[%s] error signing rrset with libhsm", hsm_str);
}
return result;
}
opendnssec-2.0.4/signer/src/daemon/ 0000755 0001750 0001750 00000000000 13036124774 014207 5 0000000 0000000 opendnssec-2.0.4/signer/src/daemon/dnshandler.c 0000644 0001750 0001750 00000023074 13036123713 016413 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* DNS handler.
*
*/
#include "config.h"
#include "daemon/dnshandler.h"
#include "daemon/engine.h"
#include "status.h"
#include "wire/buffer.h"
#include
#include
static const char* dnsh_str = "dnshandler";
static void dnshandler_handle_xfr(netio_type* netio,
netio_handler_type* handler, netio_events_type event_types);
/**
* Create dns handler.
*
*/
dnshandler_type*
dnshandler_create(listener_type* interfaces)
{
dnshandler_type* dnsh = NULL;
if (!interfaces || interfaces->count <= 0) {
return NULL;
}
CHECKALLOC(dnsh = (dnshandler_type*) malloc(sizeof(dnshandler_type)));
if (!dnsh) {
ods_log_error("[%s] unable to create dnshandler: "
"allocator_alloc() failed", dnsh_str);
return NULL;
}
dnsh->need_to_exit = 0;
dnsh->engine = NULL;
dnsh->interfaces = interfaces;
dnsh->socklist = NULL;
dnsh->netio = NULL;
dnsh->query = NULL;
/* setup */
CHECKALLOC(dnsh->socklist = (socklist_type*) malloc(sizeof(socklist_type)));
if (!dnsh->socklist) {
ods_log_error("[%s] unable to create socklist: "
"allocator_alloc() failed", dnsh_str);
dnshandler_cleanup(dnsh);
return NULL;
}
dnsh->netio = netio_create();
if (!dnsh->netio) {
ods_log_error("[%s] unable to create dnshandler: "
"netio_create() failed", dnsh_str);
dnshandler_cleanup(dnsh);
return NULL;
}
dnsh->query = query_create();
if (!dnsh->query) {
ods_log_error("[%s] unable to create dnshandler: "
"query_create() failed", dnsh_str);
dnshandler_cleanup(dnsh);
return NULL;
}
dnsh->xfrhandler.fd = -1;
dnsh->xfrhandler.user_data = (void*) dnsh;
dnsh->xfrhandler.timeout = 0;
dnsh->xfrhandler.event_types = NETIO_EVENT_READ;
dnsh->xfrhandler.event_handler = dnshandler_handle_xfr;
return dnsh;
}
/**
* Start dns handler listener.
*
*/
ods_status
dnshandler_listen(dnshandler_type* dnshandler)
{
ods_status status = ODS_STATUS_OK;
ods_log_assert(dnshandler);
status = sock_listen(dnshandler->socklist, dnshandler->interfaces);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to start: sock_listen() "
"failed (%s)", dnsh_str, ods_status2str(status));
dnshandler->thread_id = 0;
}
return status;
}
/**
* Start dns handler.
*
*/
void
dnshandler_start(dnshandler_type* dnshandler)
{
size_t i = 0;
engine_type* engine = NULL;
netio_handler_type* tcp_accept_handlers = NULL;
ods_log_assert(dnshandler);
ods_log_assert(dnshandler->engine);
ods_log_debug("[%s] start", dnsh_str);
engine = dnshandler->engine;
/* udp */
for (i=0; i < dnshandler->interfaces->count; i++) {
struct udp_data* data = NULL;
netio_handler_type* handler = NULL;
CHECKALLOC(data = (struct udp_data*) malloc(sizeof(struct udp_data)));
if (!data) {
ods_log_error("[%s] unable to start: allocator_alloc() "
"failed", dnsh_str);
dnshandler->thread_id = 0;
engine->need_to_exit = 1;
break;
}
data->query = dnshandler->query;
data->engine = dnshandler->engine;
data->socket = &dnshandler->socklist->udp[i];
CHECKALLOC(handler = (netio_handler_type*) malloc(sizeof(netio_handler_type)));
if (!handler) {
ods_log_error("[%s] unable to start: allocator_alloc() "
"failed", dnsh_str);
free(data);
dnshandler->thread_id = 0;
engine->need_to_exit = 1;
break;
}
handler->fd = dnshandler->socklist->udp[i].s;
handler->timeout = NULL;
handler->user_data = data;
handler->event_types = NETIO_EVENT_READ;
handler->event_handler = sock_handle_udp;
ods_log_debug("[%s] add udp network handler fd %u", dnsh_str,
(unsigned) handler->fd);
netio_add_handler(dnshandler->netio, handler);
}
/* tcp */
CHECKALLOC(tcp_accept_handlers = (netio_handler_type*) malloc(dnshandler->interfaces->count * sizeof(netio_handler_type)));
for (i=0; i < dnshandler->interfaces->count; i++) {
struct tcp_accept_data* data = NULL;
netio_handler_type* handler = NULL;
CHECKALLOC(data = (struct tcp_accept_data*) malloc(sizeof(struct tcp_accept_data)));
if (!data) {
ods_log_error("[%s] unable to start: allocator_alloc() "
"failed", dnsh_str);
dnshandler->thread_id = 0;
engine->need_to_exit = 1;
return;
}
data->engine = dnshandler->engine;
data->socket = &dnshandler->socklist->udp[i];
data->tcp_accept_handler_count = dnshandler->interfaces->count;
data->tcp_accept_handlers = tcp_accept_handlers;
handler = &tcp_accept_handlers[i];
handler->fd = dnshandler->socklist->tcp[i].s;
handler->timeout = NULL;
handler->user_data = data;
handler->event_types = NETIO_EVENT_READ;
handler->event_handler = sock_handle_tcp_accept;
ods_log_debug("[%s] add tcp network handler fd %u", dnsh_str,
(unsigned) handler->fd);
netio_add_handler(dnshandler->netio, handler);
}
/* service */
while (dnshandler->need_to_exit == 0) {
ods_log_deeebug("[%s] netio dispatch", dnsh_str);
if (netio_dispatch(dnshandler->netio, NULL, NULL) == -1) {
if (errno != EINTR) {
ods_log_error("[%s] unable to dispatch netio: %s", dnsh_str,
strerror(errno));
break;
}
}
}
/* shutdown */
ods_log_debug("[%s] shutdown", dnsh_str);
free(tcp_accept_handlers);
/* for (i=0; i < dnshandler->interfaces->count; i++) {
if (dnshandler->socklist->udp[i].s != -1) {
close(dnshandler->socklist->udp[i].s);
freeaddrinfo((void*)dnshandler->socklist->udp[i].addr);
}
if (dnshandler->socklist->tcp[i].s != -1) {
close(dnshandler->socklist->tcp[i].s);
freeaddrinfo((void*)dnshandler->socklist->tcp[i].addr);
}
}*/
}
/**
* Signal dns handler.
*
*/
void
dnshandler_signal(dnshandler_type* dnshandler)
{
if (dnshandler && dnshandler->thread_id) {
ods_thread_kill(dnshandler->thread_id, SIGHUP);
}
}
/**
* Forward notify to zone transfer handler.
*
*/
void
dnshandler_fwd_notify(dnshandler_type* dnshandler, uint8_t* pkt, size_t len)
{
ssize_t nb = 0;
ods_log_assert(dnshandler);
ods_log_assert(pkt);
nb = send(dnshandler->xfrhandler.fd, (const void*) pkt, len, 0);
if (nb < 0) {
ods_log_error("[%s] unable to forward notify: send() failed (%s)",
dnsh_str, strerror(errno));
} else {
ods_log_debug("[%s] forwarded notify: %ld bytes sent", dnsh_str, (long)nb);
}
}
/**
* Handle forwarded dns packets.
*
*/
static void
dnshandler_handle_xfr(netio_type* ATTR_UNUSED(netio),
netio_handler_type* handler, netio_events_type event_types)
{
dnshandler_type* dnshandler = NULL;
uint8_t buf[MAX_PACKET_SIZE];
ssize_t received = 0;
if (!handler) {
return;
}
dnshandler = (dnshandler_type*) handler->user_data;
ods_log_assert(event_types & NETIO_EVENT_READ);
received = read(dnshandler->xfrhandler.fd, &buf, MAX_PACKET_SIZE);
ods_log_debug("[%s] read forwarded xfr packet: %d bytes received",
dnsh_str, (int) received);
if (received == -1) {
ods_log_error("[%s] unable to forward xfr packet: %s", dnsh_str,
strerror(errno));
}
}
/**
* Cleanup dns handler.
*
*/
void
dnshandler_cleanup(dnshandler_type* dnshandler)
{
size_t i = 0;
if (!dnshandler) {
return;
}
netio_cleanup(dnshandler->netio);
query_cleanup(dnshandler->query);
for (i = 0; i < dnshandler->interfaces->count; i++) {
if (dnshandler->socklist->udp[i].s != -1) {
close(dnshandler->socklist->udp[i].s);
freeaddrinfo((void*)dnshandler->socklist->udp[i].addr);
}
if (dnshandler->socklist->tcp[i].s != -1) {
close(dnshandler->socklist->tcp[i].s);
freeaddrinfo((void*)dnshandler->socklist->tcp[i].addr);
}
}
free(dnshandler->socklist);
free(dnshandler);
}
opendnssec-2.0.4/signer/src/daemon/cfg.c 0000644 0001750 0001750 00000020665 13036123676 015043 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signer engine configuration.
*
*/
#include "config.h"
#include "daemon/cfg.h"
#include "parser/confparser.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include
#include
#include
static const char* conf_str = "config";
/**
* Configure engine.
*
*/
engineconfig_type*
engine_config(const char* cfgfile, int cmdline_verbosity)
{
engineconfig_type* ecfg;
const char* rngfile = ODS_SE_RNGDIR "/conf.rng";
FILE* cfgfd = NULL;
if (!cfgfile) {
return NULL;
}
/* check syntax (slows down parsing configuration file) */
if (parse_file_check(cfgfile, rngfile) != ODS_STATUS_OK) {
ods_log_error("[%s] unable to create config: parse error in %s",
conf_str, cfgfile);
return NULL;
}
/* open cfgfile */
cfgfd = ods_fopen(cfgfile, NULL, "r");
if (cfgfd) {
ods_log_verbose("[%s] read cfgfile: %s", conf_str, cfgfile);
/* create config */
CHECKALLOC(ecfg = (engineconfig_type*) malloc(sizeof(engineconfig_type)));
/* get values */
ecfg->cfg_filename = strdup(cfgfile);
ecfg->zonelist_filename = parse_conf_zonelist_filename(cfgfile);
ecfg->log_filename = parse_conf_log_filename(cfgfile);
ecfg->pid_filename = parse_conf_pid_filename(cfgfile);
ecfg->notify_command = parse_conf_notify_command(cfgfile);
ecfg->clisock_filename = parse_conf_clisock_filename(cfgfile);
ecfg->working_dir = parse_conf_working_dir(cfgfile);
ecfg->username = parse_conf_username(cfgfile);
ecfg->group = parse_conf_group(cfgfile);
ecfg->chroot = parse_conf_chroot(cfgfile);
ecfg->use_syslog = parse_conf_use_syslog(cfgfile);
ecfg->num_worker_threads = parse_conf_worker_threads(cfgfile);
ecfg->num_signer_threads = parse_conf_signer_threads(cfgfile);
/* If any verbosity has been specified at cmd line we will use that */
if (cmdline_verbosity > 0) {
ecfg->verbosity = cmdline_verbosity;
}
else {
ecfg->verbosity = parse_conf_verbosity(cfgfile);
}
ecfg->interfaces = parse_conf_listener(cfgfile);
ecfg->repositories = parse_conf_repositories(cfgfile);
/* done */
ods_fclose(cfgfd);
return ecfg;
}
ods_log_error("[%s] unable to create config: failed to open file %s",
conf_str, cfgfile);
return NULL;
}
/**
* Check configuration.
*
*/
ods_status
engine_config_check(engineconfig_type* config)
{
if (!config) {
ods_log_error("[%s] config-check failed: no config", conf_str);
return ODS_STATUS_CFG_ERR;
}
if (!config->cfg_filename) {
ods_log_error("[%s] config-check failed: no config filename",
conf_str);
return ODS_STATUS_CFG_ERR;
}
if (!config->zonelist_filename) {
ods_log_error("[%s] config-check failed: no zonelist filename",
conf_str);
return ODS_STATUS_CFG_ERR;
}
if (!config->clisock_filename) {
ods_log_error("[%s] config-check failed: no socket filename",
conf_str);
return ODS_STATUS_CFG_ERR;
}
if (!config->interfaces) {
ods_log_error("[%s] config-check failed: no listener",
conf_str);
return ODS_STATUS_CFG_ERR;
}
/* [TODO] room for more checks here */
return ODS_STATUS_OK;
}
/**
* Print configuration.
*
*/
void
engine_config_print(FILE* out, engineconfig_type* config)
{
if (!out) {
return;
}
fprintf(out, "\n");
if (config) {
fprintf(out, "\n");
/* Common */
fprintf(out, "\t\n");
if (config->use_syslog && config->log_filename) {
fprintf(out, "\t\t\n");
fprintf(out, "\t\t\t\n");
fprintf(out, "\t\t\t\t%s \n",
config->log_filename);
fprintf(out, "\t\t\t \n");
fprintf(out, "\t\t \n");
} else if (config->log_filename) {
fprintf(out, "\t\t\n");
fprintf(out, "\t\t\t\n");
fprintf(out, "\t\t\t\t%s \n",
config->log_filename);
fprintf(out, "\t\t\t \n");
fprintf(out, "\t\t \n");
}
fprintf(out, "\t \n");
/* Enforcer */
fprintf(out, "\t\n");
fprintf(out, "\t\t%s \n",
config->zonelist_filename);
fprintf(out, "\t \n");
/* Signer */
fprintf(out, "\t\n");
if (config->username || config->group || config->chroot) {
fprintf(out, "\t\t\n");
if (config->username) {
fprintf(out, "\t\t%s \n", config->username);
}
if (config->group) {
fprintf(out, "\t\t%s \n", config->group);
}
if (config->chroot) {
fprintf(out, "\t\t%s \n",
config->chroot);
}
fprintf(out, "\t\t \n");
}
if (config->interfaces) {
size_t i = 0;
fprintf(out, "\t\t\n");
for (i=0; i < config->interfaces->count; i++) {
fprintf(out, "\t\t\t");
if (config->interfaces->interfaces[i].address) {
fprintf(out, "%s ",
config->interfaces->interfaces[i].address);
}
if (config->interfaces->interfaces[i].port) {
fprintf(out, "%s ",
config->interfaces->interfaces[i].port);
}
fprintf(out, "\n");
}
fprintf(out, "\t\t \n");
}
fprintf(out, "\t\t%s \n",
config->working_dir);
fprintf(out, "\t\t%i \n",
config->num_worker_threads);
fprintf(out, "\t\t%i \n",
config->num_signer_threads);
if (config->notify_command) {
fprintf(out, "\t\t%s \n",
config->notify_command);
}
fprintf(out, "\t \n");
fprintf(out, " \n");
/* make configurable:
- pid_filename
- clisock_filename
*/
}
}
/**
* Clean up config.
*
*/
void
engine_config_cleanup(engineconfig_type* config)
{
if (!config) {
return;
}
listener_cleanup(config->interfaces);
hsm_repository_free(config->repositories);
free((void*)config->notify_command);
free((void*)config->cfg_filename);
free((void*)config->zonelist_filename);
free((void*)config->log_filename);
free((void*)config->pid_filename);
free((void*)config->clisock_filename);
free((void*)config->working_dir);
free((void*)config->username);
free((void*)config->group);
free((void*)config->chroot);
free(config);
}
opendnssec-2.0.4/signer/src/daemon/signal.h 0000644 0001750 0001750 00000003635 13036123713 015554 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signal handling.
*
*/
#ifndef DAEMON_SIGNAL_H
#define DAEMON_SIGNAL_H
#include "config.h"
#include
#define SIGNAL_RUN 0
#define SIGNAL_INIT 1
#define SIGNAL_RELOAD 2
#define SIGNAL_SHUTDOWN 3
/**
* Set corresponding engine.
* \param[in] engine corresponding engine
*
*/
void signal_set_engine(void* engine);
/**
* Handle signals.
* \param[in] sig signal to handle
*
*/
void* signal_handler(sig_atomic_t sig);
/**
* Capture signal.
* \param[in] dflsig default signal
* \return sig_atomic_t captured signal
*
*/
sig_atomic_t signal_capture(sig_atomic_t dflsig);
#endif /* DAEMON_SIGNAL_H */
opendnssec-2.0.4/signer/src/daemon/cmdhandler.h 0000644 0001750 0001750 00000004414 13036123713 016374 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Command handler.
*
*/
#ifndef DAEMON_CMDHANDLER_H
#define DAEMON_CMDHANDLER_H
#include "config.h"
#include
typedef struct cmdhandler_struct cmdhandler_type;
#include "status.h"
#include "locks.h"
#include "engine.h"
#define ODS_SE_MAX_HANDLERS 5
struct cmdhandler_struct {
engine_type* engine;
struct sockaddr_un listen_addr;
ods_thread_type thread_id;
int listen_fd;
int client_fd;
int need_to_exit;
};
/**
* Create command handler.
* \param[in] allocator memory allocator
* \param[in] filename socket file name
* \return cmdhandler_type* created command handler
*
*/
cmdhandler_type* cmdhandler_create(const char* filename);
/**
* Start command handler.
* \param[in] cmdhandler_type* command handler
*
*/
void cmdhandler_start(cmdhandler_type* cmdhandler);
/**
* Cleanup command handler.
* \param[in] cmdhandler_type* command handler
*
*/
void cmdhandler_cleanup(cmdhandler_type* cmdhandler);
#endif /* DAEMON_CMDHANDLER_H */
opendnssec-2.0.4/signer/src/daemon/cfg.h 0000644 0001750 0001750 00000005652 13036123676 015047 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef DAEMON_CONFIG_H
#define DAEMON_CONFIG_H
#include "config.h"
#include
typedef struct engineconfig_struct engineconfig_type;
#include "status.h"
#include "hsm.h"
#include "locks.h"
#include "status.h"
#include "wire/listener.h"
/**
* Engine configuration.
*
*/
struct engineconfig_struct {
listener_type* interfaces;
hsm_repository_t* repositories;
const char* cfg_filename;
const char* zonelist_filename;
const char* log_filename;
const char* pid_filename;
const char* notify_command;
const char* clisock_filename;
const char* working_dir;
const char* username;
const char* group;
const char* chroot;
int use_syslog;
int num_worker_threads;
int num_signer_threads;
int verbosity;
};
/**
* Configure engine.
* \param[in] allocator memory allocator
* \param[in] cfgfile config file
* \param[in] cmdline_verbosity log level
* \return engineconfig_type* engine configuration
*
*/
engineconfig_type*
engine_config(const char* cfgfile, int cmdline_verbosity);
/**
* Check configuration.
* \param[in] config engine configuration
* \return ods_status status
* ODS_STATUS_OK: configuration settings ok
* else: error in configuration settings
*
*/
ods_status engine_config_check(engineconfig_type* config);
/**
* Print engine configuration.
* \param[in] out output file descriptor
* \param[in] config engine configuration
*
*/
void engine_config_print(FILE* out, engineconfig_type* config);
/**
* Clean up config.
* \param[in] config engine configuration
*
*/
void engine_config_cleanup(engineconfig_type* config);
#endif /* DAEMON_CONFIG_H */
opendnssec-2.0.4/signer/src/daemon/dnshandler.h 0000644 0001750 0001750 00000005760 13036123713 016422 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* DNS handler.
*
*/
#ifndef DAEMON_DNSHANDLER_H
#define DAEMON_DNSHANDLER_H
#include "config.h"
#include
typedef struct dnshandler_struct dnshandler_type;
#include "status.h"
#include "locks.h"
#include "status.h"
#include "wire/listener.h"
#include "wire/netio.h"
#include "wire/query.h"
#include "wire/sock.h"
#define ODS_SE_NOTIFY_CMD "NOTIFY"
#define ODS_SE_MAX_HANDLERS 5
struct dnshandler_struct {
ods_thread_type thread_id;
engine_type* engine;
listener_type* interfaces;
socklist_type* socklist;
netio_type* netio;
query_type* query;
netio_handler_type xfrhandler;
unsigned need_to_exit;
};
/**
* Create dns handler.
* \param[in] allocator memory allocator
* \param[in] interfaces list of interfaces
* \return dnshandler_type* created dns handler
*
*/
dnshandler_type* dnshandler_create(listener_type* interfaces);
/**
* Start dns handler listener.
* \param[in] dnshandler_type* dns handler
* \return ods_status status
*
*/
ods_status dnshandler_listen(dnshandler_type* dnshandler);
/**
* Start dns handler.
* \param[in] dnshandler_type* dns handler
*
*/
void dnshandler_start(dnshandler_type* dnshandler);
/**
* Signal dns handler.
* \param[in] dnshandler_type* dns handler
*
*/
void dnshandler_signal(dnshandler_type* dnshandler);
/**
* Forward notify to zone transfer handler.
* \param[in] dnshandler_type* dns handler
* \param[in] pkt notify packet
* \param[in] len packet length
*
*/
void dnshandler_fwd_notify(dnshandler_type* dnshandler,
uint8_t* pkt, size_t len);
/**
* Cleanup dns handler.
* \param[in] dnshandler_type* dns handler
*
*/
void dnshandler_cleanup(dnshandler_type* dnshandler);
#endif /* DAEMON_DNSHANDLER_H */
opendnssec-2.0.4/signer/src/daemon/engine.h 0000644 0001750 0001750 00000006503 13036123713 015541 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* The engine.
*
*/
#ifndef DAEMON_ENGINE_H
#define DAEMON_ENGINE_H
#include "config.h"
#include
typedef struct engine_struct engine_type;
#include "daemon/cfg.h"
#include "daemon/cmdhandler.h"
#include "daemon/dnshandler.h"
#include "daemon/xfrhandler.h"
#include "daemon/worker.h"
#include "scheduler/fifoq.h"
#include "scheduler/schedule.h"
#include "status.h"
#include "locks.h"
#include "signer/zonelist.h"
#include "wire/edns.h"
/**
* Engine stuff.
*
*/
struct engine_struct {
engineconfig_type* config;
worker_type** workers;
worker_type** drudgers;
zonelist_type* zonelist;
schedule_type* taskq;
fifoq_type* signq;
cmdhandler_type* cmdhandler;
dnshandler_type* dnshandler;
xfrhandler_type* xfrhandler;
edns_data_type edns;
int cmdhandler_done;
pid_t pid;
uid_t uid;
gid_t gid;
int daemonize;
int need_to_exit;
int need_to_reload;
sig_atomic_t signal;
cond_basic_type signal_cond;
lock_basic_type signal_lock;
};
/**
* Start engine.
* \param[in] cfgfile configuration file
* \param[in] cmdline_verbosity how many -v on the command line
* \param[in] daemonize to run as daemon or not
* \param[in] info print info and exit
* \param[in] single_run run once
* \return 0 if successful, 1 on error
*
*/
int engine_start(const char* cfgfile, int cmdline_verbosity,
int daemonize, int info, int single_run);
/**
* Start drudgers.
* \param[in] engine engine
*
*/
void engine_start_drudgers(engine_type* engine);
/**
* Stop drudgers.
* \param[in] engine engine
*
*/
void engine_stop_drudgers(engine_type* engine);
/**
* Wake up workers.
* \param[in] engine engine
*
*/
void engine_wakeup_workers(engine_type* engine);
/**
* Update zones.
* \param[in] engine engine
* \param[in] zl_changed whether the zonelist has changed or not
*
*/
void engine_update_zones(engine_type* engine, ods_status zl_changed);
/**
* Clean up engine.
* \param[in] engine engine
*
*/
void engine_cleanup(engine_type* engine);
#endif /* DAEMON_ENGINE_H */
opendnssec-2.0.4/signer/src/daemon/cmdhandler.c 0000644 0001750 0001750 00000101454 13036123713 016371 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Command handler.
*
*/
#include "daemon/cmdhandler.h"
#include "daemon/engine.h"
#include "file.h"
#include "str.h"
#include "locks.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
#ifdef HAVE_SYS_TYPES_H
# include
#endif
#include
/* According to earlier standards: select() sys/time.h sys/types.h unistd.h */
#include
#include
#define SE_CMDH_CMDLEN 7
static int count = 0;
static char const * cmdh_str = "cmdhandler";
/**
* Handle the 'help' command.
*
*/
static void
cmdhandler_handle_cmd_help(int sockfd)
{
char buf[ODS_SE_MAXLINE];
(void) snprintf(buf, ODS_SE_MAXLINE,
"Commands:\n"
"zones Show the currently known zones.\n"
"sign [--serial ] Read zone and schedule for immediate "
"(re-)sign.\n"
" If a serial is given, that serial is used "
"in the output zone.\n"
"sign --all Read all zones and schedule all for "
"immediate (re-)sign.\n"
);
ods_writen(sockfd, buf, strlen(buf));
(void) snprintf(buf, ODS_SE_MAXLINE,
"clear Delete the internal storage of this "
"zone.\n"
" All signatures will be regenerated "
"on the next re-sign.\n"
"queue Show the current task queue.\n"
"flush Execute all scheduled tasks "
"immediately.\n"
);
ods_writen(sockfd, buf, strlen(buf));
(void) snprintf(buf, ODS_SE_MAXLINE,
"update Update this zone signer "
"configurations.\n"
"update [--all] Update zone list and all signer "
"configurations.\n"
"retransfer Retransfer the zone from the master.\n"
"start Start the engine.\n"
"running Check if the engine is running.\n"
"reload Reload the engine.\n"
"stop Stop the engine.\n"
"verbosity Set verbosity.\n"
);
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'zones' command.
*
*/
static void
cmdhandler_handle_cmd_zones(int sockfd, cmdhandler_type* cmdc)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
size_t i;
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
zone_type* zone = NULL;
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = cmdc->engine;
if (!engine->zonelist || !engine->zonelist->zones) {
(void)snprintf(buf, ODS_SE_MAXLINE, "There are no zones configured\n");
ods_writen(sockfd, buf, strlen(buf));
return;
}
/* how many zones */
lock_basic_lock(&engine->zonelist->zl_lock);
(void)snprintf(buf, ODS_SE_MAXLINE, "There are %i zones configured\n",
(int) engine->zonelist->zones->count);
ods_writen(sockfd, buf, strlen(buf));
/* list zones */
node = ldns_rbtree_first(engine->zonelist->zones);
while (node && node != LDNS_RBTREE_NULL) {
zone = (zone_type*) node->data;
for (i=0; i < ODS_SE_MAXLINE; i++) {
buf[i] = 0;
}
(void)snprintf(buf, ODS_SE_MAXLINE, "- %s\n", zone->name);
ods_writen(sockfd, buf, strlen(buf));
node = ldns_rbtree_next(node);
}
lock_basic_unlock(&engine->zonelist->zl_lock);
}
/**
* Handle the 'update' command.
*
*/
static void
cmdhandler_handle_cmd_update(int sockfd, cmdhandler_type* cmdc,
const char* tbd)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
ods_status status = ODS_STATUS_OK;
zone_type* zone = NULL;
ods_status zl_changed = ODS_STATUS_OK;
ods_log_assert(tbd);
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = cmdc->engine;
ods_log_assert(engine->taskq);
if (ods_strcmp(tbd, "--all") == 0) {
lock_basic_lock(&engine->zonelist->zl_lock);
zl_changed = zonelist_update(engine->zonelist,
engine->config->zonelist_filename);
if (zl_changed == ODS_STATUS_UNCHANGED) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone list has not changed."
" Signer configurations updated.\n");
ods_writen(sockfd, buf, strlen(buf));
} else if (zl_changed == ODS_STATUS_OK) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone list updated: %i "
"removed, %i added, %i updated.\n",
engine->zonelist->just_removed,
engine->zonelist->just_added,
engine->zonelist->just_updated);
ods_writen(sockfd, buf, strlen(buf));
} else {
lock_basic_unlock(&engine->zonelist->zl_lock);
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone list has errors.\n");
ods_writen(sockfd, buf, strlen(buf));
}
if (zl_changed == ODS_STATUS_OK ||
zl_changed == ODS_STATUS_UNCHANGED) {
engine->zonelist->just_removed = 0;
engine->zonelist->just_added = 0;
engine->zonelist->just_updated = 0;
lock_basic_unlock(&engine->zonelist->zl_lock);
/**
* Always update the signconf for zones, even if zonelist has
* not changed: ODS_STATUS_OK.
*/
engine_update_zones(engine, ODS_STATUS_OK);
}
} else {
/* look up zone */
lock_basic_lock(&engine->zonelist->zl_lock);
zone = zonelist_lookup_zone_by_name(engine->zonelist, tbd,
LDNS_RR_CLASS_IN);
/* If this zone is just added, don't update (it might not have a
* task yet) */
if (zone && zone->zl_status == ZONE_ZL_ADDED) {
zone = NULL;
}
lock_basic_unlock(&engine->zonelist->zl_lock);
if (!zone) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Zone %s not found.\n",
tbd);
ods_writen(sockfd, buf, strlen(buf));
/* update all */
cmdhandler_handle_cmd_update(sockfd, cmdc, "--all");
return;
}
lock_basic_lock(&zone->zone_lock);
status = zone_reschedule_task(zone, engine->taskq, TASK_SIGNCONF);
lock_basic_unlock(&zone->zone_lock);
if (status != ODS_STATUS_OK) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Unable to reschedule "
"task for zone %s.\n", tbd);
ods_writen(sockfd, buf, strlen(buf));
ods_log_crit("[%s] unable to reschedule task for zone %s: %s",
cmdh_str, zone->name, ods_status2str(status));
} else {
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone %s config being updated.\n",
tbd);
ods_writen(sockfd, buf, strlen(buf));
ods_log_verbose("[%s] zone %s scheduled for immediate update signconf",
cmdh_str, tbd);
engine_wakeup_workers(engine);
}
}
}
/**
* Handle the 'retransfer' command.
*
*/
static void
cmdhandler_handle_cmd_retransfer(int sockfd, cmdhandler_type* cmdc, char* tbd)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
zone_type* zone = NULL;
ods_log_assert(tbd);
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
ods_log_assert(engine->taskq);
/* look up zone */
lock_basic_lock(&engine->zonelist->zl_lock);
zone = zonelist_lookup_zone_by_name(engine->zonelist, tbd,
LDNS_RR_CLASS_IN);
/* If this zone is just added, don't retransfer (it might not have a
* task yet) */
if (zone && zone->zl_status == ZONE_ZL_ADDED) {
zone = NULL;
}
lock_basic_unlock(&engine->zonelist->zl_lock);
if (!zone) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Zone %s not found.\n",
tbd);
ods_writen(sockfd, buf, strlen(buf));
} else if (zone->adinbound->type != ADAPTER_DNS) {
(void)snprintf(buf, ODS_SE_MAXLINE,
"Error: Zone %s not configured to use DNS input adapter.\n",
tbd);
ods_writen(sockfd, buf, strlen(buf));
} else {
zone->xfrd->serial_retransfer = 1;
xfrd_set_timer_now(zone->xfrd);
ods_log_debug("[%s] forward a notify", cmdh_str);
dnshandler_fwd_notify(engine->dnshandler,
(uint8_t*) ODS_SE_NOTIFY_CMD, strlen(ODS_SE_NOTIFY_CMD));
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone %s being retransferred.\n", tbd);
ods_writen(sockfd, buf, strlen(buf));
ods_log_verbose("[%s] zone %s being retransferred", cmdh_str, tbd);
}
}
static uint32_t
max(uint32_t a, uint32_t b)
{
return (aengine);
engine = (engine_type*) cmdc->engine;
ods_log_assert(engine->taskq);
if (ods_strcmp(tbd, "--all") == 0) {
lock_basic_lock(&engine->taskq->schedule_lock);
schedule_flush(engine->taskq, TASK_READ);
lock_basic_unlock(&engine->taskq->schedule_lock);
engine_wakeup_workers(engine);
(void)snprintf(buf, ODS_SE_MAXLINE, "All zones scheduled for "
"immediate re-sign.\n");
ods_writen(sockfd, buf, strlen(buf));
ods_log_verbose("[%s] all zones scheduled for immediate re-sign",
cmdh_str);
} else {
char* delim1 = strchr(tbd, ' ');
char* delim2 = NULL;
int force_serial = 0;
uint32_t serial = 0;
if (delim1) {
char* end = NULL;
/** Some trailing text, could it be --serial? */
if (strncmp(delim1+1, "--serial ", 9) != 0) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Expecting "
"--serial , got %s.\n", tbd);
ods_writen(sockfd, buf, strlen(buf));
return;
}
delim2 = strchr(delim1+1, ' ');
if (!delim2) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Expecting serial.\n");
ods_writen(sockfd, buf, strlen(buf));
return;
}
serial = (uint32_t) strtol(delim2+1, &end, 10);
if (*end != '\0') {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Expecting serial, "
"got %s.\n", delim2+1);
ods_writen(sockfd, buf, strlen(buf));
return;
}
force_serial = 1;
*delim1 = '\0';
}
lock_basic_lock(&engine->zonelist->zl_lock);
zone = zonelist_lookup_zone_by_name(engine->zonelist, tbd,
LDNS_RR_CLASS_IN);
/* If this zone is just added, don't update (it might not have a task
* yet).
*/
if (zone && zone->zl_status == ZONE_ZL_ADDED) {
zone = NULL;
}
lock_basic_unlock(&engine->zonelist->zl_lock);
if (!zone) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Zone %s not found.\n",
tbd);
ods_writen(sockfd, buf, strlen(buf));
return;
}
lock_basic_lock(&zone->zone_lock);
if (force_serial) {
ods_log_assert(zone->db);
if (!util_serial_gt(serial, max(zone->db->outserial,
zone->db->inbserial))) {
lock_basic_unlock(&zone->zone_lock);
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Unable to enforce "
"serial %u for zone %s.\n", serial, tbd);
ods_writen(sockfd, buf, strlen(buf));
return;
}
zone->db->altserial = serial;
zone->db->force_serial = 1;
}
status = zone_reschedule_task(zone, engine->taskq, TASK_READ);
lock_basic_unlock(&zone->zone_lock);
if (status != ODS_STATUS_OK) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Unable to reschedule "
"task for zone %s.\n", tbd);
ods_writen(sockfd, buf, strlen(buf));
ods_log_crit("[%s] unable to reschedule task for zone %s: %s",
cmdh_str, zone->name, ods_status2str(status));
} else {
(void)snprintf(buf, ODS_SE_MAXLINE, "Zone %s scheduled for "
"immediate re-sign.\n", tbd);
ods_writen(sockfd, buf, strlen(buf));
ods_log_verbose("[%s] zone %s scheduled for immediate re-sign",
cmdh_str, tbd);
engine_wakeup_workers(engine);
}
}
}
/**
* Unlink backup file.
*
*/
static void
unlink_backup_file(const char* filename, const char* extension)
{
char* tmpname = ods_build_path(filename, extension, 0, 1);
if (tmpname) {
ods_log_debug("[%s] unlink file %s", cmdh_str, tmpname);
unlink(tmpname);
free((void*)tmpname);
}
}
/**
* Handle the 'clear' command.
*
*/
static void
cmdhandler_handle_cmd_clear(int sockfd, cmdhandler_type* cmdc, const char* tbd)
{
ods_status status = ODS_STATUS_OK;
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
zone_type* zone = NULL;
uint32_t inbserial = 0;
uint32_t intserial = 0;
uint32_t outserial = 0;
ods_log_assert(tbd);
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
unlink_backup_file(tbd, ".inbound");
unlink_backup_file(tbd, ".backup");
unlink_backup_file(tbd, ".axfr");
unlink_backup_file(tbd, ".ixfr");
lock_basic_lock(&engine->zonelist->zl_lock);
zone = zonelist_lookup_zone_by_name(engine->zonelist, tbd,
LDNS_RR_CLASS_IN);
lock_basic_unlock(&engine->zonelist->zl_lock);
if (zone) {
lock_basic_lock(&zone->zone_lock);
inbserial = zone->db->inbserial;
intserial = zone->db->intserial;
outserial = zone->db->outserial;
namedb_cleanup(zone->db);
ixfr_cleanup(zone->ixfr);
signconf_cleanup(zone->signconf);
zone->db = namedb_create((void*)zone);
zone->ixfr = ixfr_create((void*)zone);
zone->signconf = signconf_create();
if (!zone->signconf || !zone->ixfr || !zone->db) {
ods_fatal_exit("[%s] unable to clear zone %s: failed to recreate"
"signconf, ixfr of db structure (out of memory?)", cmdh_str, tbd);
return;
}
/* restore serial management */
zone->db->inbserial = inbserial;
zone->db->intserial = intserial;
zone->db->outserial = outserial;
zone->db->have_serial = 1;
status = zone_reschedule_task(zone, engine->taskq, TASK_SIGNCONF);
lock_basic_unlock(&zone->zone_lock);
if (status != ODS_STATUS_OK) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: Unable to reschedule "
"task for zone %s.\n", tbd);
ods_log_crit("[%s] unable to reschedule task for zone %s: %s",
cmdh_str, zone->name, ods_status2str(status));
} else {
(void)snprintf(buf, ODS_SE_MAXLINE, "Internal zone information about "
"%s cleared", tbd?tbd:"(null)");
ods_log_info("[%s] internal zone information about %s cleared",
cmdh_str, tbd?tbd:"(null)");
}
} else {
(void)snprintf(buf, ODS_SE_MAXLINE, "Cannot clear zone %s, zone not "
"found", tbd?tbd:"(null)");
ods_log_warning("[%s] cannot clear zone %s, zone not found",
cmdh_str, tbd?tbd:"(null)");
}
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'queue' command.
*
*/
static void
cmdhandler_handle_cmd_queue(int sockfd, cmdhandler_type* cmdc)
{
engine_type* engine = NULL;
char* strtime = NULL;
char buf[ODS_SE_MAXLINE];
size_t i = 0;
time_t now = 0;
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
task_type* task = NULL;
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
if (!engine->taskq || !engine->taskq->tasks) {
(void)snprintf(buf, ODS_SE_MAXLINE, "There are no tasks scheduled.\n");
ods_writen(sockfd, buf, strlen(buf));
return;
}
/* current time */
now = time_now();
strtime = ctime(&now);
(void)snprintf(buf, ODS_SE_MAXLINE, "It is now %s",
strtime?strtime:"(null)");
ods_writen(sockfd, buf, strlen(buf));
/* current work */
lock_basic_lock(&engine->taskq->schedule_lock);
for (i=0; i < (size_t) engine->config->num_worker_threads; i++) {
task = engine->workers[i]->task;
if (task) {
(void)snprintf(buf, ODS_SE_MAXLINE, "Working with task %s on "
"zone %s\n",
task_what2str(engine->workers[i]->working_with),
task_who2str(task));
ods_writen(sockfd, buf, strlen(buf));
}
}
/* how many tasks */
(void)snprintf(buf, ODS_SE_MAXLINE, "\nThere are %i tasks scheduled.\n",
(int) engine->taskq->tasks->count);
ods_writen(sockfd, buf, strlen(buf));
/* list tasks */
node = ldns_rbtree_first(engine->taskq->tasks);
while (node && node != LDNS_RBTREE_NULL) {
task = (task_type*) node->data;
for (i=0; i < ODS_SE_MAXLINE; i++) {
buf[i] = 0;
}
(void)task2str(task, (char*) &buf[0]);
ods_writen(sockfd, buf, strlen(buf));
node = ldns_rbtree_next(node);
}
lock_basic_unlock(&engine->taskq->schedule_lock);
}
/**
* Handle the 'flush' command.
*
*/
static void
cmdhandler_handle_cmd_flush(int sockfd, cmdhandler_type* cmdc)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
ods_log_assert(engine->taskq);
lock_basic_lock(&engine->taskq->schedule_lock);
schedule_flush(engine->taskq, TASK_NONE);
lock_basic_unlock(&engine->taskq->schedule_lock);
engine_wakeup_workers(engine);
(void)snprintf(buf, ODS_SE_MAXLINE, "All tasks scheduled immediately.\n");
ods_writen(sockfd, buf, strlen(buf));
ods_log_verbose("[%s] all tasks scheduled immediately", cmdh_str);
}
/**
* Handle the 'reload' command.
*
*/
static void
cmdhandler_handle_cmd_reload(int sockfd, cmdhandler_type* cmdc)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
ods_log_error("signer instructed to reload due to explicit command");
engine->need_to_reload = 1;
lock_basic_lock(&engine->signal_lock);
lock_basic_alarm(&engine->signal_cond);
lock_basic_unlock(&engine->signal_lock);
(void)snprintf(buf, ODS_SE_MAXLINE, "Reloading engine.\n");
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'stop' command.
*
*/
static void
cmdhandler_handle_cmd_stop(int sockfd, cmdhandler_type* cmdc)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
engine->need_to_exit = 1;
lock_basic_lock(&engine->signal_lock);
lock_basic_alarm(&engine->signal_cond);
lock_basic_unlock(&engine->signal_lock);
(void)snprintf(buf, ODS_SE_MAXLINE, ODS_SE_STOP_RESPONSE);
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'start' command.
*
*/
static void
cmdhandler_handle_cmd_start(int sockfd)
{
char buf[ODS_SE_MAXLINE];
(void)snprintf(buf, ODS_SE_MAXLINE, "Engine already running.\n");
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'running' command.
*
*/
static void
cmdhandler_handle_cmd_running(int sockfd)
{
char buf[ODS_SE_MAXLINE];
(void)snprintf(buf, ODS_SE_MAXLINE, "Engine running.\n");
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle the 'verbosity' command.
*
*/
static void
cmdhandler_handle_cmd_verbosity(int sockfd, cmdhandler_type* cmdc, int val)
{
engine_type* engine = NULL;
char buf[ODS_SE_MAXLINE];
ods_log_assert(cmdc);
ods_log_assert(cmdc->engine);
engine = (engine_type*) cmdc->engine;
ods_log_assert(engine->config);
ods_log_init("ods-signerd", engine->config->use_syslog, engine->config->log_filename, val);
(void)snprintf(buf, ODS_SE_MAXLINE, "Verbosity level set to %i.\n", val);
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle erroneous command.
*
*/
static void
cmdhandler_handle_cmd_error(int sockfd, const char* str)
{
char buf[ODS_SE_MAXLINE];
(void)snprintf(buf, ODS_SE_MAXLINE, "Error: %s.\n", str?str:"(null)");
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle unknown command.
*
*/
static void
cmdhandler_handle_cmd_unknown(int sockfd, const char* str)
{
char buf[ODS_SE_MAXLINE];
(void)snprintf(buf, ODS_SE_MAXLINE, "Unknown command %s.\n",
str?str:"(null)");
ods_writen(sockfd, buf, strlen(buf));
}
/**
* Handle not implemented.
*
static void
cmdhandler_handle_cmd_notimpl(int sockfd, const char* str)
{
char buf[ODS_SE_MAXLINE];
(void)snprintf(buf, ODS_SE_MAXLINE, "Command %s not implemented.\n", str);
ods_writen(sockfd, buf, strlen(buf));
}
*/
/**
* Handle client command.
*
*/
static void
cmdhandler_handle_cmd(cmdhandler_type* cmdc)
{
ssize_t n = 0;
int sockfd = 0;
char buf[ODS_SE_MAXLINE];
ods_log_assert(cmdc);
sockfd = cmdc->client_fd;
again:
while ((n = read(sockfd, buf, ODS_SE_MAXLINE)) > 0) {
/* what if this number is smaller than the number of bytes requested? */
buf[n-1] = '\0';
n--;
ods_log_verbose("[%s] received command %s[%ld]", cmdh_str, buf, (long)n);
ods_str_trim(buf,1);
n = strlen(buf);
if (n == 4 && strncmp(buf, "help", n) == 0) {
ods_log_debug("[%s] help command", cmdh_str);
cmdhandler_handle_cmd_help(sockfd);
} else if (n == 5 && strncmp(buf, "zones", n) == 0) {
ods_log_debug("[%s] list zones command", cmdh_str);
cmdhandler_handle_cmd_zones(sockfd, cmdc);
} else if (n >= 4 && strncmp(buf, "sign", 4) == 0) {
ods_log_debug("[%s] sign zone command", cmdh_str);
if (n == 4 || buf[4] == '\0') {
/* NOTE: wouldn't it be nice that we default to --all? */
cmdhandler_handle_cmd_error(sockfd, "sign command needs "
"an argument (either '--all' or a zone name)");
} else if (buf[4] != ' ') {
cmdhandler_handle_cmd_unknown(sockfd, buf);
} else {
cmdhandler_handle_cmd_sign(sockfd, cmdc, &buf[5]);
}
} else if (n >= 5 && strncmp(buf, "clear", 5) == 0) {
ods_log_debug("[%s] clear zone command", cmdh_str);
if (n == 5 || buf[5] == '\0') {
cmdhandler_handle_cmd_error(sockfd, "clear command needs "
"a zone name");
} else if (buf[5] != ' ') {
cmdhandler_handle_cmd_unknown(sockfd, buf);
} else {
cmdhandler_handle_cmd_clear(sockfd, cmdc, &buf[6]);
}
} else if (n == 5 && strncmp(buf, "queue", n) == 0) {
ods_log_debug("[%s] list tasks command", cmdh_str);
cmdhandler_handle_cmd_queue(sockfd, cmdc);
} else if (n == 5 && strncmp(buf, "flush", n) == 0) {
ods_log_debug("[%s] flush tasks command", cmdh_str);
cmdhandler_handle_cmd_flush(sockfd, cmdc);
} else if (n >= 6 && strncmp(buf, "update", 6) == 0) {
ods_log_debug("[%s] update command", cmdh_str);
if (n == 6 || buf[6] == '\0') {
cmdhandler_handle_cmd_update(sockfd, cmdc, "--all");
} else if (buf[6] != ' ') {
cmdhandler_handle_cmd_unknown(sockfd, buf);
} else {
cmdhandler_handle_cmd_update(sockfd, cmdc, &buf[7]);
}
} else if (n == 4 && strncmp(buf, "stop", n) == 0) {
ods_log_debug("[%s] shutdown command", cmdh_str);
cmdhandler_handle_cmd_stop(sockfd, cmdc);
return;
} else if (n == 5 && strncmp(buf, "start", n) == 0) {
ods_log_debug("[%s] start command", cmdh_str);
cmdhandler_handle_cmd_start(sockfd);
} else if (n == 6 && strncmp(buf, "reload", n) == 0) {
ods_log_debug("[%s] reload command", cmdh_str);
cmdhandler_handle_cmd_reload(sockfd, cmdc);
} else if (n == 7 && strncmp(buf, "running", n) == 0) {
ods_log_debug("[%s] running command", cmdh_str);
cmdhandler_handle_cmd_running(sockfd);
} else if (n >= 9 && strncmp(buf, "verbosity", 9) == 0) {
ods_log_debug("[%s] verbosity command", cmdh_str);
if (n == 9 || buf[9] == '\0') {
cmdhandler_handle_cmd_error(sockfd, "verbosity command "
"an argument (verbosity level)");
} else if (buf[9] != ' ') {
cmdhandler_handle_cmd_unknown(sockfd, buf);
} else {
cmdhandler_handle_cmd_verbosity(sockfd, cmdc, atoi(&buf[10]));
}
} else if (n >= 10 && strncmp(buf, "retransfer", 10) == 0) {
ods_log_debug("[%s] retransfer zone command", cmdh_str);
if (n == 10 || buf[10] == '\0') {
cmdhandler_handle_cmd_error(sockfd, "retransfer command needs "
"an argument (a zone name)");
} else if (buf[10] != ' ') {
cmdhandler_handle_cmd_unknown(sockfd, buf);
} else {
cmdhandler_handle_cmd_retransfer(sockfd, cmdc, &buf[11]);
}
} else if (n > 0) {
ods_log_debug("[%s] unknown command", cmdh_str);
cmdhandler_handle_cmd_unknown(sockfd, buf);
}
ods_log_debug("[%s] done handling command %s[%ld]", cmdh_str, buf, (long)n);
(void)snprintf(buf, SE_CMDH_CMDLEN, "\ncmd> ");
ods_writen(sockfd, buf, strlen(buf));
}
if (n < 0 && (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN) ) {
goto again;
} else if (n < 0 && errno == ECONNRESET) {
ods_log_debug("[%s] done handling client: %s", cmdh_str,
strerror(errno));
} else if (n < 0 ) {
ods_log_error("[%s] read error: %s", cmdh_str, strerror(errno));
}
}
/**
* Accept client.
*
*/
static void*
cmdhandler_accept_client(void* arg)
{
cmdhandler_type* cmdc = (cmdhandler_type*) arg;
ods_thread_blocksigs();
ods_thread_detach(cmdc->thread_id);
ods_log_debug("[%s] accept client %i", cmdh_str, cmdc->client_fd);
cmdhandler_handle_cmd(cmdc);
if (cmdc->client_fd) {
shutdown(cmdc->client_fd, SHUT_RDWR);
close(cmdc->client_fd);
}
free(cmdc);
count--;
return NULL;
}
/**
* Create command handler.
*
*/
cmdhandler_type*
cmdhandler_create(const char* filename)
{
cmdhandler_type* cmdh = NULL;
struct sockaddr_un servaddr;
int listenfd = 0;
int flags = 0;
int ret = 0;
if (!filename) {
return NULL;
}
/* new socket */
ods_log_debug("[%s] create socket %s", cmdh_str, filename);
listenfd = socket(AF_UNIX, SOCK_STREAM, 0);
if (listenfd < 0) {
ods_log_error("[%s] unable to create cmdhandler: "
"socket() failed (%s)", cmdh_str, strerror(errno));
return NULL;
}
/* set it to non-blocking */
flags = fcntl(listenfd, F_GETFL, 0);
if (flags < 0) {
ods_log_error("[%s] unable to create cmdhandler: "
"fcntl(F_GETFL) failed (%s)", cmdh_str, strerror(errno));
close(listenfd);
return NULL;
}
flags |= O_NONBLOCK;
if (fcntl(listenfd, F_SETFL, flags) < 0) {
ods_log_error("[%s] unable to create cmdhandler: "
"fcntl(F_SETFL) failed (%s)", cmdh_str, strerror(errno));
close(listenfd);
return NULL;
}
/* no surprises so far */
if (filename) {
(void)unlink(filename);
}
bzero(&servaddr, sizeof(servaddr));
servaddr.sun_family = AF_UNIX;
strncpy(servaddr.sun_path, filename, sizeof(servaddr.sun_path) - 1);
#ifdef HAVE_SOCKADDR_SUN_LEN
servaddr.sun_len = strlen(servaddr.sun_path);
#endif
/* bind and listen... */
ret = bind(listenfd, (const struct sockaddr*) &servaddr, sizeof(struct sockaddr_un));
if (ret != 0) {
ods_log_error("[%s] unable to create cmdhandler: "
"bind() failed (%s)", cmdh_str, strerror(errno));
close(listenfd);
return NULL;
}
ret = listen(listenfd, ODS_SE_MAX_HANDLERS);
if (ret != 0) {
ods_log_error("[%s] unable to create cmdhandler: "
"listen() failed (%s)", cmdh_str, strerror(errno));
close(listenfd);
return NULL;
}
/* all ok */
CHECKALLOC(cmdh = (cmdhandler_type*) malloc(sizeof(cmdhandler_type)));
cmdh->listen_fd = listenfd;
cmdh->listen_addr = servaddr;
cmdh->need_to_exit = 0;
return cmdh;
}
/**
* Start command handler.
*
*/
void
cmdhandler_start(cmdhandler_type* cmdhandler)
{
struct sockaddr_un cliaddr;
socklen_t clilen;
cmdhandler_type* cmdc = NULL;
engine_type* engine = NULL;
fd_set rset;
int connfd = 0;
int ret = 0;
ods_log_assert(cmdhandler);
ods_log_assert(cmdhandler->engine);
ods_log_debug("[%s] start", cmdh_str);
engine = cmdhandler->engine;
ods_thread_detach(cmdhandler->thread_id);
FD_ZERO(&rset);
while (cmdhandler->need_to_exit == 0) {
clilen = sizeof(cliaddr);
FD_SET(cmdhandler->listen_fd, &rset);
ret = select(cmdhandler->listen_fd+1, &rset, NULL, NULL, NULL);
if (ret < 0) {
if (errno != EINTR && errno != EWOULDBLOCK) {
ods_log_warning("[%s] select() error: %s", cmdh_str,
strerror(errno));
}
continue;
}
if (FD_ISSET(cmdhandler->listen_fd, &rset)) {
connfd = accept(cmdhandler->listen_fd,
(struct sockaddr *) &cliaddr, &clilen);
if (connfd < 0) {
if (errno != EINTR && errno != EWOULDBLOCK) {
ods_log_warning("[%s] accept() error: %s", cmdh_str,
strerror(errno));
}
continue;
}
/* client accepted, create new thread */
cmdc = (cmdhandler_type*) malloc(sizeof(cmdhandler_type));
if (!cmdc) {
ods_log_crit("[%s] unable to create thread for client: "
"malloc() failed", cmdh_str);
cmdhandler->need_to_exit = 1;
break;
}
cmdc->listen_fd = cmdhandler->listen_fd;
cmdc->client_fd = connfd;
cmdc->listen_addr = cmdhandler->listen_addr;
cmdc->engine = cmdhandler->engine;
cmdc->need_to_exit = cmdhandler->need_to_exit;
ods_thread_create(&cmdc->thread_id, &cmdhandler_accept_client,
(void*) cmdc);
count++;
ods_log_debug("[%s] %i clients in progress...", cmdh_str, count);
}
}
ods_log_debug("[%s] shutdown", cmdh_str);
engine = cmdhandler->engine;
engine->cmdhandler_done = 1;
}
/**
* Cleanup command handler.
*
*/
void
cmdhandler_cleanup(cmdhandler_type* cmdhandler)
{
free(cmdhandler);
}
opendnssec-2.0.4/signer/src/daemon/engine.c 0000644 0001750 0001750 00000103730 13036123713 015534 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* The engine.
*
*/
#include "config.h"
#include "daemon/cfg.h"
#include "daemon/engine.h"
#include "daemon/signal.h"
#include "duration.h"
#include "file.h"
#include "str.h"
#include "hsm.h"
#include "locks.h"
#include "log.h"
#include "privdrop.h"
#include "status.h"
#include "util.h"
#include "signer/zonelist.h"
#include "wire/tsig.h"
#include "libhsm.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
static const char* engine_str = "engine";
/**
* Create engine.
*
*/
static engine_type*
engine_create(void)
{
engine_type* engine;
CHECKALLOC(engine = (engine_type*) malloc(sizeof(engine_type)));
engine->config = NULL;
engine->workers = NULL;
engine->drudgers = NULL;
engine->cmdhandler = NULL;
engine->cmdhandler_done = 0;
engine->dnshandler = NULL;
engine->xfrhandler = NULL;
engine->taskq = NULL;
engine->signq = NULL;
engine->pid = -1;
engine->uid = -1;
engine->gid = -1;
engine->daemonize = 0;
engine->need_to_exit = 0;
engine->need_to_reload = 0;
lock_basic_init(&engine->signal_lock);
lock_basic_set(&engine->signal_cond);
lock_basic_lock(&engine->signal_lock);
engine->signal = SIGNAL_INIT;
lock_basic_unlock(&engine->signal_lock);
engine->zonelist = zonelist_create();
if (!engine->zonelist) {
engine_cleanup(engine);
return NULL;
}
engine->taskq = schedule_create();
if (!engine->taskq) {
engine_cleanup(engine);
return NULL;
}
engine->signq = fifoq_create();
if (!engine->signq) {
engine_cleanup(engine);
return NULL;
}
return engine;
}
/**
* Start command handler.
*
*/
static void*
cmdhandler_thread_start(void* arg)
{
cmdhandler_type* cmd = (cmdhandler_type*) arg;
ods_thread_blocksigs();
cmdhandler_start(cmd);
return NULL;
}
static void
engine_start_cmdhandler(engine_type* engine)
{
ods_log_assert(engine);
ods_log_debug("[%s] start command handler", engine_str);
engine->cmdhandler->engine = engine;
ods_thread_create(&engine->cmdhandler->thread_id,
cmdhandler_thread_start, engine->cmdhandler);
}
/**
* Self pipe trick (see Unix Network Programming).
*
*/
static int
self_pipe_trick(engine_type* engine)
{
int sockfd, ret;
struct sockaddr_un servaddr;
const char* servsock_filename = ODS_SE_SOCKFILE;
ods_log_assert(engine);
ods_log_assert(engine->cmdhandler);
sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
if (sockfd < 0) {
ods_log_error("[%s] unable to connect to command handler: "
"socket() failed (%s)", engine_str, strerror(errno));
return 1;
} else {
bzero(&servaddr, sizeof(servaddr));
servaddr.sun_family = AF_UNIX;
strncpy(servaddr.sun_path, servsock_filename, sizeof(servaddr.sun_path)-1);
ret = connect(sockfd, (const struct sockaddr*) &servaddr,
sizeof(servaddr));
if (ret != 0) {
ods_log_error("[%s] unable to connect to command handler: "
"connect() failed (%s)", engine_str, strerror(errno));
close(sockfd);
return 1;
} else {
/* self-pipe trick */
ods_writen(sockfd, "", 1);
close(sockfd);
}
}
return 0;
}
/**
* Stop command handler.
*
*/
static void
engine_stop_cmdhandler(engine_type* engine)
{
ods_log_assert(engine);
if (!engine->cmdhandler || engine->cmdhandler_done) {
return;
}
ods_log_debug("[%s] stop command handler", engine_str);
engine->cmdhandler->need_to_exit = 1;
if (self_pipe_trick(engine) == 0) {
while (!engine->cmdhandler_done) {
ods_log_debug("[%s] waiting for command handler to exit...",
engine_str);
sleep(1);
}
} else {
ods_log_error("[%s] command handler self pipe trick failed, "
"unclean shutdown", engine_str);
}
}
/**
* Start/stop dnshandler.
*
*/
static void*
dnshandler_thread_start(void* arg)
{
dnshandler_type* dnshandler = (dnshandler_type*) arg;
dnshandler_start(dnshandler);
return NULL;
}
static void
engine_start_dnshandler(engine_type* engine)
{
if (!engine || !engine->dnshandler) {
return;
}
ods_log_debug("[%s] start dnshandler", engine_str);
engine->dnshandler->engine = engine;
ods_thread_create(&engine->dnshandler->thread_id,
dnshandler_thread_start, engine->dnshandler);
}
static void
engine_stop_dnshandler(engine_type* engine)
{
if (!engine || !engine->dnshandler || !engine->dnshandler->thread_id) {
return;
}
ods_log_debug("[%s] stop dnshandler", engine_str);
engine->dnshandler->need_to_exit = 1;
dnshandler_signal(engine->dnshandler);
ods_log_debug("[%s] join dnshandler", engine_str);
ods_thread_join(engine->dnshandler->thread_id);
engine->dnshandler->engine = NULL;
}
/**
* Start/stop xfrhandler.
*
*/
static void*
xfrhandler_thread_start(void* arg)
{
xfrhandler_type* xfrhandler = (xfrhandler_type*) arg;
xfrhandler_start(xfrhandler);
return NULL;
}
static void
engine_start_xfrhandler(engine_type* engine)
{
if (!engine || !engine->xfrhandler) {
return;
}
ods_log_debug("[%s] start xfrhandler", engine_str);
engine->xfrhandler->engine = engine;
/* This might be the wrong place to mark the xfrhandler started but
* if its isn't done here we might try to shutdown and stop it before
* it has marked itself started
*/
engine->xfrhandler->started = 1;
ods_thread_create(&engine->xfrhandler->thread_id,
xfrhandler_thread_start, engine->xfrhandler);
}
static void
engine_stop_xfrhandler(engine_type* engine)
{
if (!engine || !engine->xfrhandler) {
return;
}
ods_log_debug("[%s] stop xfrhandler", engine_str);
engine->xfrhandler->need_to_exit = 1;
xfrhandler_signal(engine->xfrhandler);
ods_log_debug("[%s] join xfrhandler", engine_str);
if (engine->xfrhandler->started) {
ods_thread_join(engine->xfrhandler->thread_id);
engine->xfrhandler->started = 0;
}
engine->xfrhandler->engine = NULL;
}
/**
* Drop privileges.
*
*/
static ods_status
engine_privdrop(engine_type* engine)
{
ods_status status = ODS_STATUS_OK;
uid_t uid = -1;
gid_t gid = -1;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] drop privileges", engine_str);
if (engine->config->username && engine->config->group) {
ods_log_verbose("[%s] drop privileges to user %s, group %s",
engine_str, engine->config->username, engine->config->group);
} else if (engine->config->username) {
ods_log_verbose("[%s] drop privileges to user %s", engine_str,
engine->config->username);
} else if (engine->config->group) {
ods_log_verbose("[%s] drop privileges to group %s", engine_str,
engine->config->group);
}
if (engine->config->chroot) {
ods_log_verbose("[%s] chroot to %s", engine_str,
engine->config->chroot);
}
status = privdrop(engine->config->username, engine->config->group,
engine->config->chroot, &uid, &gid);
engine->uid = uid;
engine->gid = gid;
privclose(engine->config->username, engine->config->group);
return status;
}
/**
* Start/stop workers.
*
*/
static void
engine_create_workers(engine_type* engine)
{
size_t i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
CHECKALLOC(engine->workers = (worker_type**) malloc(((size_t)engine->config->num_worker_threads) * sizeof(worker_type*)));
for (i=0; i < (size_t) engine->config->num_worker_threads; i++) {
engine->workers[i] = worker_create(i, WORKER_WORKER);
}
}
static void
engine_create_drudgers(engine_type* engine)
{
size_t i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
CHECKALLOC(engine->drudgers = (worker_type**) malloc(((size_t)engine->config->num_signer_threads) * sizeof(worker_type*)));
for (i=0; i < (size_t) engine->config->num_signer_threads; i++) {
engine->drudgers[i] = worker_create(i, WORKER_DRUDGER);
}
}
static void*
worker_thread_start(void* arg)
{
worker_type* worker = (worker_type*) arg;
ods_thread_blocksigs();
worker_start(worker);
return NULL;
}
static void
engine_start_workers(engine_type* engine)
{
size_t i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] start workers", engine_str);
for (i=0; i < (size_t) engine->config->num_worker_threads; i++) {
engine->workers[i]->need_to_exit = 0;
engine->workers[i]->engine = (void*) engine;
ods_thread_create(&engine->workers[i]->thread_id, worker_thread_start,
engine->workers[i]);
}
}
void
engine_start_drudgers(engine_type* engine)
{
size_t i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] start drudgers", engine_str);
for (i=0; i < (size_t) engine->config->num_signer_threads; i++) {
engine->drudgers[i]->need_to_exit = 0;
engine->drudgers[i]->engine = (void*) engine;
ods_thread_create(&engine->drudgers[i]->thread_id, worker_thread_start,
engine->drudgers[i]);
}
}
static void
engine_stop_workers(engine_type* engine)
{
int i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] stop workers", engine_str);
/* tell them to exit and wake up sleepyheads */
for (i=0; i < engine->config->num_worker_threads; i++) {
engine->workers[i]->need_to_exit = 1;
worker_wakeup(engine->workers[i]);
}
ods_log_debug("[%s] notify workers", engine_str);
worker_notify_all(&engine->signq->q_lock, &engine->signq->q_nonfull);
/* head count */
for (i=0; i < engine->config->num_worker_threads; i++) {
ods_log_debug("[%s] join worker %d", engine_str, i+1);
ods_thread_join(engine->workers[i]->thread_id);
engine->workers[i]->engine = NULL;
}
}
void
engine_stop_drudgers(engine_type* engine)
{
int i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] stop drudgers", engine_str);
/* tell them to exit and wake up sleepyheads */
for (i=0; i < engine->config->num_signer_threads; i++) {
engine->drudgers[i]->need_to_exit = 1;
}
ods_log_debug("[%s] notify drudgers", engine_str);
worker_notify_all(&engine->signq->q_lock, &engine->signq->q_threshold);
/* head count */
for (i=0; i < engine->config->num_signer_threads; i++) {
ods_log_debug("[%s] join drudger %d", engine_str, i+1);
ods_thread_join(engine->drudgers[i]->thread_id);
engine->drudgers[i]->engine = NULL;
}
}
/**
* Wake up all workers.
*
*/
void
engine_wakeup_workers(engine_type* engine)
{
size_t i = 0;
ods_log_assert(engine);
ods_log_assert(engine->config);
ods_log_debug("[%s] wake up workers", engine_str);
/* wake up sleepyheads */
for (i=0; i < (size_t) engine->config->num_worker_threads; i++) {
worker_wakeup(engine->workers[i]);
}
}
/**
* Set up engine.
*
*/
static ods_status
engine_setup(engine_type* engine)
{
ods_status status = ODS_STATUS_OK;
struct sigaction action;
int sockets[2] = {0,0};
ods_log_debug("[%s] setup signer engine", engine_str);
if (!engine || !engine->config) {
return ODS_STATUS_ASSERT_ERR;
}
/* set edns */
edns_init(&engine->edns, EDNS_MAX_MESSAGE_LEN);
/* create command handler (before chowning socket file) */
engine->cmdhandler = cmdhandler_create(engine->config->clisock_filename);
if (!engine->cmdhandler) {
return ODS_STATUS_CMDHANDLER_ERR;
}
engine->dnshandler = dnshandler_create(engine->config->interfaces);
engine->xfrhandler = xfrhandler_create();
if (!engine->xfrhandler) {
return ODS_STATUS_XFRHANDLER_ERR;
}
if (engine->dnshandler) {
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sockets) == -1) {
return ODS_STATUS_XFRHANDLER_ERR;
}
engine->xfrhandler->dnshandler.fd = sockets[0];
engine->dnshandler->xfrhandler.fd = sockets[1];
status = dnshandler_listen(engine->dnshandler);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] setup: unable to listen to sockets (%s)",
engine_str, ods_status2str(status));
return ODS_STATUS_XFRHANDLER_ERR;
}
}
/* privdrop */
engine->uid = privuid(engine->config->username);
engine->gid = privgid(engine->config->group);
/* TODO: does piddir exists? */
/* remove the chown stuff: piddir? */
ods_chown(engine->config->pid_filename, engine->uid, engine->gid, 1);
ods_chown(engine->config->clisock_filename, engine->uid, engine->gid, 0);
ods_chown(engine->config->working_dir, engine->uid, engine->gid, 0);
if (engine->config->log_filename && !engine->config->use_syslog) {
ods_chown(engine->config->log_filename, engine->uid, engine->gid, 0);
}
if (engine->config->working_dir &&
chdir(engine->config->working_dir) != 0) {
ods_log_error("[%s] setup: unable to chdir to %s (%s)", engine_str,
engine->config->working_dir, strerror(errno));
return ODS_STATUS_CHDIR_ERR;
}
if (engine_privdrop(engine) != ODS_STATUS_OK) {
return ODS_STATUS_PRIVDROP_ERR;
}
/* daemonize */
if (engine->daemonize) {
switch ((engine->pid = fork())) {
case -1: /* error */
ods_log_error("[%s] setup: unable to fork daemon (%s)",
engine_str, strerror(errno));
return ODS_STATUS_FORK_ERR;
case 0: /* child */
break;
default: /* parent */
engine_cleanup(engine);
engine = NULL;
xmlCleanupParser();
xmlCleanupGlobals();
xmlCleanupThreads();
exit(0);
}
if (setsid() == -1) {
ods_log_error("[%s] setup: unable to setsid daemon (%s)",
engine_str, strerror(errno));
return ODS_STATUS_SETSID_ERR;
}
}
engine->pid = getpid();
/* write pidfile */
if (util_write_pidfile(engine->config->pid_filename, engine->pid) == -1) {
return ODS_STATUS_WRITE_PIDFILE_ERR;
}
/* setup done */
ods_log_verbose("[%s] running as pid %lu", engine_str,
(unsigned long) engine->pid);
/* catch signals */
signal_set_engine(engine);
action.sa_handler = (void (*)(int))signal_handler;
sigfillset(&action.sa_mask);
action.sa_flags = 0;
sigaction(SIGTERM, &action, NULL);
sigaction(SIGHUP, &action, NULL);
sigaction(SIGINT, &action, NULL);
sigaction(SIGILL, &action, NULL);
sigaction(SIGUSR1, &action, NULL);
sigaction(SIGALRM, &action, NULL);
sigaction(SIGCHLD, &action, NULL);
action.sa_handler = SIG_IGN;
sigaction(SIGPIPE, &action, NULL);
/* create workers/drudgers */
engine_create_workers(engine);
engine_create_drudgers(engine);
/* start cmd/dns/xfr handlers */
engine_start_cmdhandler(engine);
engine_start_dnshandler(engine);
engine_start_xfrhandler(engine);
tsig_handler_init();
return ODS_STATUS_OK;
}
/**
* Make sure that all zones have been worked on at least once.
*
*/
static int
engine_all_zones_processed(engine_type* engine)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
zone_type* zone = NULL;
ods_log_assert(engine);
ods_log_assert(engine->zonelist);
ods_log_assert(engine->zonelist->zones);
node = ldns_rbtree_first(engine->zonelist->zones);
while (node && node != LDNS_RBTREE_NULL) {
zone = (zone_type*) node->key;
ods_log_assert(zone);
ods_log_assert(zone->db);
if (!zone->db->is_processed) {
return 0;
}
node = ldns_rbtree_next(node);
}
return 1;
}
/**
* Run engine, run!.
*
*/
static void
engine_run(engine_type* engine, int single_run)
{
if (!engine) {
return;
}
engine_start_workers(engine);
engine_start_drudgers(engine);
lock_basic_lock(&engine->signal_lock);
engine->signal = SIGNAL_RUN;
lock_basic_unlock(&engine->signal_lock);
while (!engine->need_to_exit && !engine->need_to_reload) {
lock_basic_lock(&engine->signal_lock);
engine->signal = signal_capture(engine->signal);
switch (engine->signal) {
case SIGNAL_RUN:
ods_log_assert(1);
break;
case SIGNAL_RELOAD:
ods_log_error("signer instructed to reload due to explicit signal");
engine->need_to_reload = 1;
break;
case SIGNAL_SHUTDOWN:
engine->need_to_exit = 1;
break;
default:
ods_log_warning("[%s] invalid signal %d captured, "
"keep running", engine_str, (int)engine->signal);
engine->signal = SIGNAL_RUN;
break;
}
lock_basic_unlock(&engine->signal_lock);
if (single_run) {
engine->need_to_exit = engine_all_zones_processed(engine);
}
lock_basic_lock(&engine->signal_lock);
if (engine->signal == SIGNAL_RUN && !single_run) {
ods_log_debug("[%s] taking a break", engine_str);
lock_basic_sleep(&engine->signal_cond, &engine->signal_lock, 3600);
}
lock_basic_unlock(&engine->signal_lock);
}
ods_log_debug("[%s] signer halted", engine_str);
engine_stop_drudgers(engine);
engine_stop_workers(engine);
}
/**
* Parse notify command.
*
*/
static void
set_notify_ns(zone_type* zone, const char* cmd)
{
const char* str = NULL;
const char* str2 = NULL;
char* token = NULL;
ods_log_assert(cmd);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->adoutbound);
if (zone->adoutbound->type == ADAPTER_FILE) {
str = ods_replace(cmd, "%zonefile", zone->adoutbound->configstr);
if (!str) {
ods_log_error("[%s] unable to set notify ns: replace zonefile failed",
engine_str);
}
str2 = ods_replace(str, "%zone", zone->name);
free((void*)str);
} else {
str2 = ods_replace(cmd, "%zone", zone->name);
}
if (str2) {
ods_str_trim((char*) str2, 1);
str = str2;
if (*str) {
token = NULL;
while ((token = strtok((char*) str, " "))) {
if (*token) {
ods_str_list_add(&zone->notify_args, token);
}
str = NULL;
}
}
zone->notify_command = (char*) str2;
zone->notify_ns = zone->notify_args[0];
ods_log_debug("[%s] set notify ns: %s", engine_str, zone->notify_ns);
} else {
ods_log_error("[%s] unable to set notify ns: replace zone failed",
engine_str);
}
}
/**
* Update DNS configuration for zone.
*
*/
static int
dnsconfig_zone(engine_type* engine, zone_type* zone)
{
int numdns = 0;
ods_log_assert(engine);
ods_log_assert(engine->xfrhandler);
ods_log_assert(engine->xfrhandler->netio);
ods_log_assert(zone);
ods_log_assert(zone->adinbound);
ods_log_assert(zone->adoutbound);
ods_log_assert(zone->name);
if (zone->adinbound->type == ADAPTER_DNS) {
/* zone transfer handler */
if (!zone->xfrd) {
ods_log_debug("[%s] add transfer handler for zone %s",
engine_str, zone->name);
zone->xfrd = xfrd_create((void*) engine->xfrhandler,
(void*) zone);
ods_log_assert(zone->xfrd);
netio_add_handler(engine->xfrhandler->netio,
&zone->xfrd->handler);
} else if (!zone->xfrd->serial_disk_acquired) {
xfrd_set_timer_now(zone->xfrd);
}
numdns++;
} else if (zone->xfrd) {
netio_remove_handler(engine->xfrhandler->netio,
&zone->xfrd->handler);
xfrd_cleanup(zone->xfrd, 0);
zone->xfrd = NULL;
}
if (zone->adoutbound->type == ADAPTER_DNS) {
/* notify handler */
if (!zone->notify) {
ods_log_debug("[%s] add notify handler for zone %s",
engine_str, zone->name);
zone->notify = notify_create((void*) engine->xfrhandler,
(void*) zone);
ods_log_assert(zone->notify);
netio_add_handler(engine->xfrhandler->netio,
&zone->notify->handler);
}
numdns++;
} else if (zone->notify) {
netio_remove_handler(engine->xfrhandler->netio,
&zone->notify->handler);
notify_cleanup(zone->notify);
zone->notify = NULL;
}
return numdns;
}
/**
* Update zones.
*
*/
void
engine_update_zones(engine_type* engine, ods_status zl_changed)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
zone_type* zone = NULL;
zone_type* delzone = NULL;
task_type* task = NULL;
ods_status status = ODS_STATUS_OK;
unsigned wake_up = 0;
int warnings = 0;
time_t now = 0;
if (!engine || !engine->zonelist || !engine->zonelist->zones) {
return;
}
now = time_now();
ods_log_debug("[%s] commit zone list changes", engine_str);
lock_basic_lock(&engine->zonelist->zl_lock);
node = ldns_rbtree_first(engine->zonelist->zones);
while (node && node != LDNS_RBTREE_NULL) {
zone = (zone_type*) node->data;
task = NULL; /* reset task */
if (zone->zl_status == ZONE_ZL_REMOVED) {
node = ldns_rbtree_next(node);
lock_basic_lock(&zone->zone_lock);
delzone = zonelist_del_zone(engine->zonelist, zone);
if (delzone) {
lock_basic_lock(&engine->taskq->schedule_lock);
task = unschedule_task(engine->taskq,
(task_type*) zone->task);
lock_basic_unlock(&engine->taskq->schedule_lock);
}
task_cleanup(task);
task = NULL;
lock_basic_unlock(&zone->zone_lock);
netio_remove_handler(engine->xfrhandler->netio,
&zone->xfrd->handler);
zone_cleanup(zone);
zone = NULL;
continue;
} else if (zone->zl_status == ZONE_ZL_ADDED) {
lock_basic_lock(&zone->zone_lock);
ods_log_assert(!zone->task);
/* set notify nameserver command */
if (engine->config->notify_command && !zone->notify_ns) {
set_notify_ns(zone, engine->config->notify_command);
}
/* create task */
task = task_create(TASK_SIGNCONF, now, zone);
lock_basic_unlock(&zone->zone_lock);
if (!task) {
ods_log_crit("[%s] unable to create task for zone %s: "
"task_create() failed", engine_str, zone->name);
node = ldns_rbtree_next(node);
continue;
}
}
/* load adapter config */
status = adapter_load_config(zone->adinbound);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to load config for inbound adapter "
"for zone %s: %s", engine_str, zone->name,
ods_status2str(status));
}
status = adapter_load_config(zone->adoutbound);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to load config for outbound adapter "
"for zone %s: %s", engine_str, zone->name,
ods_status2str(status));
}
/* for dns adapters */
warnings += dnsconfig_zone(engine, zone);
if (zone->zl_status == ZONE_ZL_ADDED) {
ods_log_assert(task);
lock_basic_lock(&zone->zone_lock);
zone->task = task;
lock_basic_unlock(&zone->zone_lock);
/* TODO: task is reachable from other threads by means of
* zone->task. To fix this we need to nest the locks. But
* first investigate any possible deadlocks. */
lock_basic_lock(&engine->taskq->schedule_lock);
status = schedule_task(engine->taskq, task, 0);
lock_basic_unlock(&engine->taskq->schedule_lock);
} else if (zl_changed == ODS_STATUS_OK) {
/* always try to update signconf */
lock_basic_lock(&zone->zone_lock);
status = zone_reschedule_task(zone, engine->taskq, TASK_SIGNCONF);
lock_basic_unlock(&zone->zone_lock);
}
if (status != ODS_STATUS_OK) {
ods_log_crit("[%s] unable to schedule task for zone %s: %s",
engine_str, zone->name, ods_status2str(status));
} else {
wake_up = 1;
zone->zl_status = ZONE_ZL_OK;
}
node = ldns_rbtree_next(node);
}
lock_basic_unlock(&engine->zonelist->zl_lock);
if (engine->dnshandler) {
ods_log_debug("[%s] forward notify for all zones", engine_str);
dnshandler_fwd_notify(engine->dnshandler,
(uint8_t*) ODS_SE_NOTIFY_CMD, strlen(ODS_SE_NOTIFY_CMD));
} else if (warnings) {
ods_log_warning("[%s] no dnshandler/listener configured, but zones "
"are configured with dns adapters: notify and zone transfer "
"requests will not work properly", engine_str);
}
if (wake_up) {
engine_wakeup_workers(engine);
}
}
/**
* Try to recover from the backup files.
*
*/
static ods_status
engine_recover(engine_type* engine)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
zone_type* zone = NULL;
ods_status status = ODS_STATUS_OK;
ods_status result = ODS_STATUS_UNCHANGED;
if (!engine || !engine->zonelist || !engine->zonelist->zones) {
ods_log_error("[%s] cannot recover zones: no engine or zonelist",
engine_str);
return ODS_STATUS_ERR; /* no need to update zones */
}
ods_log_assert(engine);
ods_log_assert(engine->zonelist);
ods_log_assert(engine->zonelist->zones);
lock_basic_lock(&engine->zonelist->zl_lock);
/* [LOCK] zonelist */
node = ldns_rbtree_first(engine->zonelist->zones);
while (node && node != LDNS_RBTREE_NULL) {
zone = (zone_type*) node->data;
ods_log_assert(zone->zl_status == ZONE_ZL_ADDED);
lock_basic_lock(&zone->zone_lock);
status = zone_recover2(zone);
if (status == ODS_STATUS_OK) {
ods_log_assert(zone->task);
ods_log_assert(zone->db);
ods_log_assert(zone->signconf);
/* notify nameserver */
if (engine->config->notify_command && !zone->notify_ns) {
set_notify_ns(zone, engine->config->notify_command);
}
/* schedule task */
lock_basic_lock(&engine->taskq->schedule_lock);
/* [LOCK] schedule */
status = schedule_task(engine->taskq, (task_type*) zone->task, 0);
/* [UNLOCK] schedule */
lock_basic_unlock(&engine->taskq->schedule_lock);
if (status != ODS_STATUS_OK) {
ods_log_crit("[%s] unable to schedule task for zone %s: %s",
engine_str, zone->name, ods_status2str(status));
task_cleanup((task_type*) zone->task);
zone->task = NULL;
result = ODS_STATUS_OK; /* will trigger update zones */
} else {
ods_log_debug("[%s] recovered zone %s", engine_str,
zone->name);
/* recovery done */
zone->zl_status = ZONE_ZL_OK;
}
} else {
if (status != ODS_STATUS_UNCHANGED) {
ods_log_warning("[%s] unable to recover zone %s from backup,"
" performing full sign", engine_str, zone->name);
}
result = ODS_STATUS_OK; /* will trigger update zones */
}
lock_basic_unlock(&zone->zone_lock);
node = ldns_rbtree_next(node);
}
/* [UNLOCK] zonelist */
lock_basic_unlock(&engine->zonelist->zl_lock);
return result;
}
/**
* Start engine.
*
*/
int
engine_start(const char* cfgfile, int cmdline_verbosity, int daemonize,
int info, int single_run)
{
engine_type* engine = NULL;
ods_status zl_changed = ODS_STATUS_UNCHANGED;
ods_status status = ODS_STATUS_OK;
engine = engine_create();
if (!engine) {
ods_fatal_exit("[%s] create failed", engine_str);
return 1;
}
engine->daemonize = daemonize;
/* config */
engine->config = engine_config(cfgfile, cmdline_verbosity);
status = engine_config_check(engine->config);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] cfgfile %s has errors", engine_str, cfgfile);
goto earlyexit;
}
if (info) {
engine_config_print(stdout, engine->config); /* for debugging */
goto earlyexit;
}
/* check pidfile */
if (!util_check_pidfile(engine->config->pid_filename)) {
exit(1);
}
/* open log */
ods_log_init("ods-signerd", engine->config->use_syslog,
engine->config->log_filename, engine->config->verbosity);
/* setup */
status = engine_setup(engine);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] setup failed: %s", engine_str,
ods_status2str(status));
if (status != ODS_STATUS_WRITE_PIDFILE_ERR) {
/* command handler had not yet been started */
engine->cmdhandler_done = 1;
}
goto earlyexit;
}
/* run */
while (engine->need_to_exit == 0) {
/* update zone list */
lock_basic_lock(&engine->zonelist->zl_lock);
zl_changed = zonelist_update(engine->zonelist,
engine->config->zonelist_filename);
engine->zonelist->just_removed = 0;
engine->zonelist->just_added = 0;
engine->zonelist->just_updated = 0;
lock_basic_unlock(&engine->zonelist->zl_lock);
/* start/reload */
if (engine->need_to_reload) {
ods_log_info("[%s] signer reloading", engine_str);
fifoq_wipe(engine->signq);
engine->need_to_reload = 0;
} else {
ods_log_info("[%s] signer started (version %s), pid %u",
engine_str, PACKAGE_VERSION, engine->pid);
if (hsm_open2(engine->config->repositories, hsm_check_pin) != HSM_OK) {
char* error = hsm_get_error(NULL);
if (error != NULL) {
ods_log_error("[%s] %s", "hsm", error);
free(error);
}
ods_log_error("[%s] opening hsm failed (for engine recover)", engine_str);
break;
}
zl_changed = engine_recover(engine);
hsm_close();
}
if (zl_changed == ODS_STATUS_OK ||
zl_changed == ODS_STATUS_UNCHANGED) {
engine_update_zones(engine, zl_changed);
}
if (hsm_open2(engine->config->repositories, hsm_check_pin) != HSM_OK) {
char* error = hsm_get_error(NULL);
if (error != NULL) {
ods_log_error("[%s] %s", "hsm", error);
free(error);
}
ods_log_error("[%s] opening hsm failed (for engine run)", engine_str);
break;
}
engine_run(engine, single_run);
hsm_close();
}
/* shutdown */
ods_log_info("[%s] signer shutdown", engine_str);
engine_stop_cmdhandler(engine);
engine_stop_xfrhandler(engine);
engine_stop_dnshandler(engine);
earlyexit:
if (engine && engine->config) {
if (engine->config->pid_filename) {
(void)unlink(engine->config->pid_filename);
}
if (engine->config->clisock_filename) {
(void)unlink(engine->config->clisock_filename);
}
}
tsig_handler_cleanup();
engine_cleanup(engine);
engine = NULL;
return 1;
}
/**
* Clean up engine.
*
*/
void
engine_cleanup(engine_type* engine)
{
size_t i = 0;
if (!engine) {
return;
}
if (engine->workers && engine->config) {
for (i=0; i < (size_t) engine->config->num_worker_threads; i++) {
worker_cleanup(engine->workers[i]);
}
free(engine->workers);
}
if (engine->drudgers && engine->config) {
for (i=0; i < (size_t) engine->config->num_signer_threads; i++) {
worker_cleanup(engine->drudgers[i]);
}
free(engine->drudgers);
}
zonelist_cleanup(engine->zonelist);
schedule_cleanup(engine->taskq);
fifoq_cleanup(engine->signq);
cmdhandler_cleanup(engine->cmdhandler);
dnshandler_cleanup(engine->dnshandler);
xfrhandler_cleanup(engine->xfrhandler);
engine_config_cleanup(engine->config);
lock_basic_destroy(&engine->signal_lock);
lock_basic_off(&engine->signal_cond);
free(engine);
}
opendnssec-2.0.4/signer/src/daemon/xfrhandler.h 0000644 0001750 0001750 00000006210 13036123713 016424 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone transfer handler.
*
*/
#ifndef DAEMON_XFRHANDLER_H
#define DAEMON_XFRHANDLER_H
#include "config.h"
typedef struct xfrhandler_struct xfrhandler_type;
#include "status.h"
#include "locks.h"
#include "wire/buffer.h"
#include "wire/netio.h"
#include "wire/notify.h"
#include "wire/tcpset.h"
#include "wire/xfrd.h"
#include "engine.h"
/**
* Zone transfer handler.
*
*/
struct xfrhandler_struct {
/* Engine reference */
ods_thread_type thread_id;
engine_type* engine;
/* Start time */
time_t start_time;
time_t current_time;
/* Network support */
netio_type* netio;
tcp_set_type* tcp_set;
buffer_type* packet;
xfrd_type* tcp_waiting_first;
xfrd_type* udp_waiting_first;
xfrd_type* udp_waiting_last;
size_t udp_use_num;
notify_type* notify_waiting_first;
notify_type* notify_waiting_last;
int notify_udp_num;
netio_handler_type dnshandler;
unsigned got_time : 1;
unsigned need_to_exit : 1;
unsigned started : 1;
};
/**
* Create zone transfer handler.
* \param[in] allocator memory allocator
* \return xfrhandler_type* created zoned transfer handler
*
*/
xfrhandler_type* xfrhandler_create(void);
/**
* Start zone transfer handler.
* \param[in] xfrhandler_type* zone transfer handler
*
*/
void xfrhandler_start(xfrhandler_type* xfrhandler);
/**
* Get current time from the zone transfer handler.
* \param[in] xfrhandler_type* zone transfer handler
* \return time_t current time
*
*/
time_t xfrhandler_time(xfrhandler_type* xfrhandler);
/**
* Signal zone transfer handler.
* \param[in] xfrhandler_type* zone transfer handler
*
*/
void xfrhandler_signal(xfrhandler_type* xfrhandler);
/**
* Cleanup zone transfer handler.
* \param[in] xfrhandler_type* zone transfer handler
*
*/
void xfrhandler_cleanup(xfrhandler_type* xfrhandler);
#endif /* DAEMON_XFRHANDLER_H */
opendnssec-2.0.4/signer/src/daemon/signal.c 0000644 0001750 0001750 00000006065 13036123713 015547 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Signal handling.
*
*/
#include "config.h"
#include "daemon/engine.h"
#include "daemon/signal.h"
#include "locks.h"
#include "log.h"
#include
static int signal_hup_recvd = 0;
static int signal_term_recvd = 0;
static engine_type* signal_engine = NULL;
static const char* signal_str = "signal";
/**
* Set corresponding engine.
*
*/
void
signal_set_engine(void* engine)
{
signal_engine = (engine_type*) engine;
}
/**
* Handle signals.
*
*/
void *
signal_handler(sig_atomic_t sig)
{
switch (sig) {
case SIGHUP:
ods_log_debug("[%s] SIGHUP received", signal_str);
signal_hup_recvd++;
if (signal_engine) {
lock_basic_lock(&signal_engine->signal_lock);
/* [LOCK] signal */
lock_basic_alarm(&signal_engine->signal_cond);
/* [UNLOCK] signal */
lock_basic_unlock(&signal_engine->signal_lock);
}
break;
case SIGINT:
case SIGTERM:
ods_log_debug("[%s] SIGTERM received", signal_str);
signal_term_recvd++;
if (signal_engine) {
lock_basic_lock(&signal_engine->signal_lock);
/* [LOCK] signal */
lock_basic_alarm(&signal_engine->signal_cond);
/* [UNLOCK] signal */
lock_basic_unlock(&signal_engine->signal_lock);
}
break;
default:
break;
}
return NULL;
}
/**
* Capture signal.
*
*/
sig_atomic_t
signal_capture(sig_atomic_t dflsig)
{
if (signal_term_recvd) {
signal_term_recvd = 0;
return SIGNAL_SHUTDOWN;
} else if (signal_hup_recvd) {
signal_hup_recvd = 0;
return SIGNAL_RELOAD;
}
return dflsig;
}
opendnssec-2.0.4/signer/src/daemon/xfrhandler.c 0000644 0001750 0001750 00000013234 13036123713 016423 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone transfer handler.
*
*/
#include "config.h"
#include "daemon/engine.h"
#include "daemon/xfrhandler.h"
#include "duration.h"
#include "status.h"
#include
#include
static const char* xfrh_str = "xfrhandler";
static void xfrhandler_handle_dns(netio_type* netio,
netio_handler_type* handler, netio_events_type event_types);
/**
* Create zone transfer handler.
*
*/
xfrhandler_type*
xfrhandler_create()
{
xfrhandler_type* xfrh = NULL;
CHECKALLOC(xfrh = (xfrhandler_type*) malloc(sizeof(xfrhandler_type)));
xfrh->engine = NULL;
xfrh->packet = NULL;
xfrh->netio = NULL;
xfrh->tcp_set = NULL;
xfrh->tcp_waiting_first = NULL;
xfrh->udp_waiting_first = NULL;
xfrh->udp_waiting_last = NULL;
xfrh->udp_use_num = 0;
xfrh->start_time = 0;
xfrh->current_time = 0;
xfrh->got_time = 0;
xfrh->need_to_exit = 0;
xfrh->started = 0;
/* notify */
xfrh->notify_waiting_first = NULL;
xfrh->notify_waiting_last = NULL;
xfrh->notify_udp_num = 0;
/* setup */
xfrh->netio = netio_create();
if (!xfrh->netio) {
ods_log_error("[%s] unable to create xfrhandler: "
"netio_create() failed", xfrh_str);
xfrhandler_cleanup(xfrh);
return NULL;
}
xfrh->packet = buffer_create(PACKET_BUFFER_SIZE);
if (!xfrh->packet) {
ods_log_error("[%s] unable to create xfrhandler: "
"buffer_create() failed", xfrh_str);
xfrhandler_cleanup(xfrh);
return NULL;
}
xfrh->tcp_set = tcp_set_create();
if (!xfrh->tcp_set) {
ods_log_error("[%s] unable to create xfrhandler: "
"tcp_set_create() failed", xfrh_str);
xfrhandler_cleanup(xfrh);
return NULL;
}
xfrh->dnshandler.fd = -1;
xfrh->dnshandler.user_data = (void*) xfrh;
xfrh->dnshandler.timeout = 0;
xfrh->dnshandler.event_types = NETIO_EVENT_READ;
xfrh->dnshandler.event_handler = xfrhandler_handle_dns;
return xfrh;
}
/**
* Start zone transfer handler.
*
*/
void
xfrhandler_start(xfrhandler_type* xfrhandler)
{
ods_log_assert(xfrhandler);
ods_log_assert(xfrhandler->engine);
ods_log_debug("[%s] start", xfrh_str);
/* setup */
xfrhandler->start_time = time_now();
/* handlers */
netio_add_handler(xfrhandler->netio, &xfrhandler->dnshandler);
/* service */
while (xfrhandler->need_to_exit == 0) {
/* dispatch may block for a longer period, so current is gone */
xfrhandler->got_time = 0;
ods_log_deeebug("[%s] netio dispatch", xfrh_str);
if (netio_dispatch(xfrhandler->netio, NULL, NULL) == -1) {
if (errno != EINTR) {
ods_log_error("[%s] unable to dispatch netio: %s", xfrh_str,
strerror(errno));
}
}
}
/* shutdown */
ods_log_debug("[%s] shutdown", xfrh_str);
}
/**
* Get current time from zone transfer handler.
*
*/
time_t
xfrhandler_time(xfrhandler_type* xfrhandler)
{
if (!xfrhandler) {
return 0;
}
if (!xfrhandler->got_time) {
xfrhandler->current_time = time_now();
xfrhandler->got_time = 1;
}
return xfrhandler->current_time;
}
/**
* Signal zone transfer handler.
*
*/
void
xfrhandler_signal(xfrhandler_type* xfrhandler)
{
if (xfrhandler && xfrhandler->started) {
ods_thread_kill(xfrhandler->thread_id, SIGHUP);
}
}
/**
* Handle forwarded dns packets.
*
*/
static void
xfrhandler_handle_dns(netio_type* ATTR_UNUSED(netio),
netio_handler_type* handler, netio_events_type event_types)
{
xfrhandler_type* xfrhandler = NULL;
uint8_t buf[MAX_PACKET_SIZE];
ssize_t received = 0;
if (!handler) {
return;
}
xfrhandler = (xfrhandler_type*) handler->user_data;
ods_log_assert(event_types & NETIO_EVENT_READ);
received = read(xfrhandler->dnshandler.fd, &buf, MAX_PACKET_SIZE);
ods_log_debug("[%s] read forwarded dns packet: %d bytes received",
xfrh_str, (int) received);
if (received == -1) {
ods_log_error("[%s] unable to forward dns packet: %s", xfrh_str,
strerror(errno));
}
}
/**
* Cleanup zone transfer handler.
*
*/
void
xfrhandler_cleanup(xfrhandler_type* xfrhandler)
{
if (!xfrhandler) {
return;
}
netio_cleanup(xfrhandler->netio);
buffer_cleanup(xfrhandler->packet);
tcp_set_cleanup(xfrhandler->tcp_set);
free(xfrhandler);
}
opendnssec-2.0.4/signer/src/daemon/worker.c 0000644 0001750 0001750 00000066726 13036123713 015615 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include /* time() */
#include "daemon/engine.h"
#include "daemon/worker.h"
#include "duration.h"
#include "hsm.h"
#include "locks.h"
#include "log.h"
#include "status.h"
#include "signer/tools.h"
#include "signer/zone.h"
ods_lookup_table worker_str[] = {
{ WORKER_WORKER, "worker" },
{ WORKER_DRUDGER, "drudger" },
{ 0, NULL }
};
/**
* Convert worker type to string.
*
*/
static const char*
worker2str(worker_id type)
{
ods_lookup_table *lt = ods_lookup_by_id(worker_str, type);
if (lt) {
return lt->name;
}
return NULL;
}
/**
* Create worker.
*
*/
worker_type*
worker_create(int num, worker_id type)
{
worker_type* worker;
CHECKALLOC(worker = (worker_type*) malloc(sizeof(worker_type)));
ods_log_debug("[%s[%i]] create", worker2str(type), num+1);
lock_basic_init(&worker->worker_lock);
lock_basic_set(&worker->worker_alarm);
lock_basic_lock(&worker->worker_lock);
worker->thread_num = num +1;
worker->engine = NULL;
worker->task = NULL;
worker->working_with = TASK_NONE;
worker->need_to_exit = 0;
worker->type = type;
worker->clock_in = 0;
worker->jobs_appointed = 0;
worker->jobs_completed = 0;
worker->jobs_failed = 0;
worker->sleeping = 0;
worker->waiting = 0;
lock_basic_unlock(&worker->worker_lock);
return worker;
}
/**
* Worker working with...
*
*/
static void
worker_working_with(worker_type* worker, task_id with, task_id next,
const char* str, const char* name, task_id* what, time_t* when)
{
worker->working_with = with;
ods_log_verbose("[%s[%i]] %s zone %s", worker2str(worker->type),
worker->thread_num, str, name);
*what = next;
*when = time_now();
}
/**
* Has this worker measured up to all appointed jobs?
*
*/
static int
worker_fulfilled(worker_type* worker)
{
int ret = 0;
ret = (worker->jobs_completed + worker->jobs_failed) ==
worker->jobs_appointed;
return ret;
}
/**
* Clear jobs.
*
*/
static void
worker_clear_jobs(worker_type* worker)
{
ods_log_assert(worker);
lock_basic_lock(&worker->worker_lock);
worker->jobs_appointed = 0;
worker->jobs_completed = 0;
worker->jobs_failed = 0;
lock_basic_unlock(&worker->worker_lock);
}
/**
* Queue RRset for signing.
*
*/
static void
worker_queue_rrset(worker_type* worker, fifoq_type* q, rrset_type* rrset)
{
ods_status status = ODS_STATUS_UNCHANGED;
int tries = 0;
ods_log_assert(worker);
ods_log_assert(worker->task);
ods_log_assert(q);
ods_log_assert(rrset);
lock_basic_lock(&q->q_lock);
status = fifoq_push(q, (void*) rrset, worker, &tries);
while (status == ODS_STATUS_UNCHANGED) {
tries++;
if (worker->need_to_exit) {
lock_basic_unlock(&q->q_lock);
return;
}
/**
* Apparently the queue is full. Lets take a small break to not hog CPU.
* The worker will release the signq lock while sleeping and will
* automatically grab the lock when the queue is nonfull.
* Queue is nonfull at 10% of the queue size.
*/
lock_basic_sleep(&q->q_nonfull, &q->q_lock, 5);
status = fifoq_push(q, (void*) rrset, worker, &tries);
}
lock_basic_unlock(&q->q_lock);
ods_log_assert(status == ODS_STATUS_OK);
lock_basic_lock(&worker->worker_lock);
worker->jobs_appointed += 1;
lock_basic_unlock(&worker->worker_lock);
}
/**
* Queue domain for signing.
*
*/
static void
worker_queue_domain(worker_type* worker, fifoq_type* q, domain_type* domain)
{
rrset_type* rrset = NULL;
denial_type* denial = NULL;
ods_log_assert(worker);
ods_log_assert(q);
ods_log_assert(domain);
rrset = domain->rrsets;
while (rrset) {
worker_queue_rrset(worker, q, rrset);
rrset = rrset->next;
}
denial = (denial_type*) domain->denial;
if (denial && denial->rrset) {
worker_queue_rrset(worker, q, denial->rrset);
}
}
/**
* Queue zone for signing.
*
*/
static void
worker_queue_zone(worker_type* worker, fifoq_type* q, zone_type* zone)
{
ldns_rbnode_t* node = LDNS_RBTREE_NULL;
domain_type* domain = NULL;
ods_log_assert(worker);
ods_log_assert(q);
ods_log_assert(zone);
worker_clear_jobs(worker);
if (!zone->db || !zone->db->domains) {
return;
}
if (zone->db->domains->root != LDNS_RBTREE_NULL) {
node = ldns_rbtree_first(zone->db->domains);
}
while (node && node != LDNS_RBTREE_NULL) {
domain = (domain_type*) node->data;
worker_queue_domain(worker, q, domain);
node = ldns_rbtree_next(node);
}
}
/**
* Make sure that no appointed jobs have failed.
*
*/
static ods_status
worker_check_jobs(worker_type* worker, task_type* task)
{
ods_log_assert(worker);
ods_log_assert(task);
lock_basic_lock(&worker->worker_lock);
if (worker->jobs_failed) {
ods_log_error("[%s[%i]] sign zone %s failed: %lu RRsets failed",
worker2str(worker->type), worker->thread_num,
task_who2str(task), (unsigned long)worker->jobs_failed);
lock_basic_unlock(&worker->worker_lock);
return ODS_STATUS_ERR;
} else if (worker->jobs_completed != worker->jobs_appointed) {
ods_log_error("[%s[%i]] sign zone %s failed: processed %lu of %lu "
"RRsets", worker2str(worker->type), worker->thread_num,
task_who2str(task), (unsigned long)worker->jobs_completed,
(unsigned long)worker->jobs_appointed);
lock_basic_unlock(&worker->worker_lock);
return ODS_STATUS_ERR;
} else if (worker->need_to_exit) {
ods_log_debug("[%s[%i]] sign zone %s failed: worker needs to exit",
worker2str(worker->type), worker->thread_num, task_who2str(task));
lock_basic_unlock(&worker->worker_lock);
return ODS_STATUS_ERR;
} else {
ods_log_debug("[%s[%i]] sign zone %s ok: %lu of %lu RRsets "
"succeeded", worker2str(worker->type), worker->thread_num,
task_who2str(task), (unsigned long)worker->jobs_completed,
(unsigned long)worker->jobs_appointed);
ods_log_assert(worker->jobs_appointed == worker->jobs_completed);
}
lock_basic_unlock(&worker->worker_lock);
return ODS_STATUS_OK;
}
/**
* Perform task.
*
*/
static void
worker_perform_task(worker_type* worker)
{
engine_type* engine = NULL;
zone_type* zone = NULL;
task_type* task = NULL;
task_id what = TASK_NONE;
time_t when = 0;
time_t never = (3600*24*365);
ods_status status = ODS_STATUS_OK;
int backup = 0;
time_t start = 0;
time_t end = 0;
if (!worker || !worker->task || !worker->task->zone || !worker->engine) {
return;
}
engine = worker->engine;
task = (task_type*) worker->task;
zone = (zone_type*) worker->task->zone;
ods_log_debug("[%s[%i]] perform task %s for zone %s",
worker2str(worker->type), worker->thread_num, task_what2str(task->what),
task_who2str(task));
/* do what you have been told to do */
switch (task->what) {
case TASK_SIGNCONF:
/* perform 'load signconf' task */
worker_working_with(worker, TASK_SIGNCONF, TASK_READ,
"configure", task_who2str(task), &what, &when);
status = tools_signconf(zone);
if (status == ODS_STATUS_UNCHANGED) {
if (!zone->signconf->last_modified) {
ods_log_debug("[%s[%i]] no signconf.xml for zone %s yet",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
status = ODS_STATUS_ERR;
}
}
if (status == ODS_STATUS_UNCHANGED) {
if (task->halted != TASK_NONE && task->halted != TASK_SIGNCONF) {
goto task_perform_continue;
}
status = ODS_STATUS_OK;
} else if (status == ODS_STATUS_OK) {
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
} else {
if (task->halted == TASK_NONE) {
goto task_perform_fail;
}
goto task_perform_continue;
}
/* break; */
case TASK_READ:
/* perform 'read input adapter' task */
worker_working_with(worker, TASK_READ, TASK_SIGN,
"read", task_who2str(task), &what, &when);
task->what = TASK_READ;
if (!zone->signconf->last_modified) {
ods_log_debug("[%s[%i]] no signconf.xml for zone %s yet",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
status = ODS_STATUS_ERR;
} else {
if (hsm_check_context()) {
ods_log_error("signer instructed to reload due to hsm reset in read task");
engine->need_to_reload = 1;
status = ODS_STATUS_ERR;
} else {
status = tools_input(zone);
}
}
if (status == ODS_STATUS_UNCHANGED) {
ods_log_verbose("[%s[%i]] zone %s unsigned data not changed, "
"continue", worker2str(worker->type), worker->thread_num,
task_who2str(task));
status = ODS_STATUS_OK;
}
if (status == ODS_STATUS_OK) {
if (task->interrupt > TASK_SIGNCONF) {
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
}
} else {
if (task->halted == TASK_NONE) {
goto task_perform_fail;
}
goto task_perform_continue;
}
/* break; */
case TASK_SIGN:
/* perform 'sign' task */
worker_working_with(worker, TASK_SIGN, TASK_WRITE,
"sign", task_who2str(task), &what, &when);
task->what = TASK_SIGN;
status = zone_update_serial(zone);
if (status == ODS_STATUS_OK) {
if (task->interrupt > TASK_SIGNCONF) {
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
}
} else {
ods_log_error("[%s[%i]] unable to sign zone %s: "
"failed to increment serial",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
if (task->halted == TASK_NONE) {
goto task_perform_fail;
}
goto task_perform_continue;
}
/* start timer */
start = time(NULL);
if (zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
if (!zone->stats->start_time) {
zone->stats->start_time = start;
}
zone->stats->sig_count = 0;
zone->stats->sig_soa_count = 0;
zone->stats->sig_reuse = 0;
zone->stats->sig_time = 0;
lock_basic_unlock(&zone->stats->stats_lock);
}
/* check the HSM connection before queuing sign operations */
if (hsm_check_context()) {
ods_log_error("signer instructed to reload due to hsm reset in sign task");
engine->need_to_reload = 1;
goto task_perform_fail;
}
/* prepare keys */
status = zone_prepare_keys(zone);
if (status == ODS_STATUS_OK) {
/* queue menial, hard signing work */
worker_queue_zone(worker, engine->signq, zone);
ods_log_deeebug("[%s[%i]] wait until drudgers are finished "
"signing zone %s", worker2str(worker->type),
worker->thread_num, task_who2str(task));
/* sleep until work is done */
worker_sleep_unless(worker, 0);
}
/* stop timer */
end = time(NULL);
/* check status and jobs */
if (status == ODS_STATUS_OK) {
status = worker_check_jobs(worker, task);
}
worker_clear_jobs(worker);
if (status == ODS_STATUS_OK && zone->stats) {
lock_basic_lock(&zone->stats->stats_lock);
zone->stats->sig_time = (end-start);
lock_basic_unlock(&zone->stats->stats_lock);
}
if (status != ODS_STATUS_OK) {
if (task->halted == TASK_NONE) {
goto task_perform_fail;
}
goto task_perform_continue;
} else {
if (task->interrupt > TASK_SIGNCONF) {
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
}
}
/* break; */
case TASK_WRITE:
/* perform 'write to output adapter' task */
worker_working_with(worker, TASK_WRITE, TASK_SIGN,
"write", task_who2str(task), &what, &when);
task->what = TASK_WRITE;
status = tools_output(zone, engine);
if (status == ODS_STATUS_OK) {
if (task->interrupt > TASK_SIGNCONF) {
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
}
} else {
/* clear signatures? */
if (task->halted == TASK_NONE) {
goto task_perform_fail;
}
goto task_perform_continue;
}
zone->db->is_processed = 1;
if (zone->signconf &&
duration2time(zone->signconf->sig_resign_interval)) {
what = TASK_SIGN;
when = worker->clock_in +
duration2time(zone->signconf->sig_resign_interval);
} else {
ods_log_error("[%s[%i]] unable to retrieve resign interval "
"for zone %s: duration2time() failed",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
ods_log_info("[%s[%i]] defaulting to 1H resign interval for "
"zone %s", worker2str(worker->type), worker->thread_num,
task_who2str(task));
what = TASK_SIGN;
when = worker->clock_in + 3600;
}
backup = 1;
break;
case TASK_NONE:
worker->working_with = TASK_NONE;
/* no task */
ods_log_warning("[%s[%i]] none task for zone %s",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
when = time_now() + never;
break;
default:
worker->working_with = TASK_NONE;
/* unknown task */
ods_log_warning("[%s[%i]] unknown task, trying full sign zone %s",
worker2str(worker->type), worker->thread_num,
task_who2str(task));
what = TASK_SIGNCONF;
when = time_now();
break;
}
/* no error */
task->backoff = 0;
if (task->interrupt != TASK_NONE && task->interrupt != what) {
ods_log_debug("[%s[%i]] interrupt task %s for zone %s",
worker2str(worker->type), worker->thread_num,
task_what2str(what), task_who2str(task));
task->halted = what;
task->halted_when = when;
task->what = task->interrupt;
task->when = time_now();
} else {
ods_log_debug("[%s[%i]] next task %s for zone %s",
worker2str(worker->type), worker->thread_num,
task_what2str(what), task_who2str(task));
task->what = what;
task->when = when;
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
task->halted_when = 0;
}
/* backup the last successful run */
if (backup) {
status = zone_backup2(zone);
if (status != ODS_STATUS_OK) {
ods_log_warning("[%s[%i]] unable to backup zone %s: %s",
worker2str(worker->type), worker->thread_num,
task_who2str(task), ods_status2str(status));
/* just a warning */
status = ODS_STATUS_OK;
}
backup = 0;
}
return;
task_perform_fail:
if (status != ODS_STATUS_XFR_NOT_READY) {
/* other statuses is critical, and we know it is not ODS_STATUS_OK */
ods_log_crit("[%s[%i]] CRITICAL: failed to sign zone %s: %s",
worker2str(worker->type), worker->thread_num,
task_who2str(task), ods_status2str(status));
}
/* in case of failure, also mark zone processed (for single run usage) */
zone->db->is_processed = 1;
if (task->backoff) {
task->backoff *= 2;
} else {
task->backoff = 60;
}
if (task->backoff > ODS_SE_MAX_BACKOFF) {
task->backoff = ODS_SE_MAX_BACKOFF;
}
ods_log_info("[%s[%i]] backoff task %s for zone %s with %lu seconds",
worker2str(worker->type), worker->thread_num,
task_what2str(task->what), task_who2str(task), (long)task->backoff);
task->when = time_now() + task->backoff;
return;
task_perform_continue:
ods_log_info("[%s[%i]] continue task %s for zone %s",
worker2str(worker->type), worker->thread_num,
task_what2str(task->halted), task_who2str(task));
task->what = task->halted;
task->when = task->halted_when;
task->interrupt = TASK_NONE;
task->halted = TASK_NONE;
task->halted_when = 0;
return;
}
/**
* Work.
*
*/
static void
worker_work(worker_type* worker)
{
time_t now = 0;
time_t timeout = 1;
engine_type* engine = NULL;
zone_type* zone = NULL;
ods_status status = ODS_STATUS_OK;
ods_log_assert(worker);
ods_log_assert(worker->type == WORKER_WORKER);
engine = worker->engine;
while (worker->need_to_exit == 0) {
ods_log_debug("[%s[%i]] report for duty", worker2str(worker->type),
worker->thread_num);
now = time_now();
lock_basic_lock(&engine->taskq->schedule_lock);
worker->task = schedule_pop_task(engine->taskq);
if (worker->task) {
worker->working_with = worker->task->what;
lock_basic_unlock(&engine->taskq->schedule_lock);
zone = (zone_type*) worker->task->zone;
lock_basic_lock(&zone->zone_lock);
ods_log_debug("[%s[%i]] start working on zone %s",
worker2str(worker->type), worker->thread_num, zone->name);
worker->clock_in = time_now();
worker_perform_task(worker);
zone->task = worker->task;
ods_log_debug("[%s[%i]] finished working on zone %s",
worker2str(worker->type), worker->thread_num, zone->name);
lock_basic_lock(&engine->taskq->schedule_lock);
worker->task = NULL;
worker->working_with = TASK_NONE;
status = schedule_task(engine->taskq, zone->task, 1);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s[%i]] unable to schedule task for zone %s: "
"%s", worker2str(worker->type), worker->thread_num,
zone->name, ods_status2str(status));
}
lock_basic_unlock(&engine->taskq->schedule_lock);
lock_basic_unlock(&zone->zone_lock);
timeout = 1;
/** Do we need to tell the engine that we require a reload? */
lock_basic_lock(&engine->signal_lock);
if (engine->need_to_reload) {
lock_basic_alarm(&engine->signal_cond);
}
lock_basic_unlock(&engine->signal_lock);
} else {
ods_log_debug("[%s[%i]] nothing to do", worker2str(worker->type),
worker->thread_num);
worker->task = schedule_get_first_task(engine->taskq);
lock_basic_unlock(&engine->taskq->schedule_lock);
if (worker->task && !engine->taskq->loading) {
timeout = (worker->task->when - now);
} else {
timeout *= 2;
}
if (timeout > ODS_SE_MAX_BACKOFF) {
timeout = ODS_SE_MAX_BACKOFF;
}
worker->task = NULL;
worker_sleep(worker, timeout);
}
}
}
/**
* Drudge.
*
*/
static void
worker_drudge(worker_type* worker)
{
engine_type* engine = NULL;
zone_type* zone = NULL;
task_type* task = NULL;
rrset_type* rrset = NULL;
ods_status status = ODS_STATUS_OK;
worker_type* superior = NULL;
hsm_ctx_t* ctx = NULL;
ods_log_assert(worker);
ods_log_assert(worker->engine);
ods_log_assert(worker->type == WORKER_DRUDGER);
engine = worker->engine;
while (worker->need_to_exit == 0) {
ods_log_deeebug("[%s[%i]] report for duty", worker2str(worker->type),
worker->thread_num);
/* initialize */
superior = NULL;
zone = NULL;
task = NULL;
/* get item */
lock_basic_lock(&engine->signq->q_lock);
rrset = (rrset_type*) fifoq_pop(engine->signq, &superior);
if (!rrset) {
ods_log_deeebug("[%s[%i]] nothing to do, wait",
worker2str(worker->type), worker->thread_num);
/**
* Apparently the queue is empty. Wait until new work is queued.
* The drudger will release the signq lock while sleeping and
* will automatically grab the lock when the threshold is reached.
* Threshold is at 1 and MAX (after a number of tries).
*/
lock_basic_sleep(&engine->signq->q_threshold,
&engine->signq->q_lock, 0);
if(worker->need_to_exit == 0)
rrset = (rrset_type*) fifoq_pop(engine->signq, &superior);
}
lock_basic_unlock(&engine->signq->q_lock);
/* do some work */
if (rrset) {
ods_log_assert(superior);
if (!ctx) {
ods_log_debug("[%s[%i]] create hsm context",
worker2str(worker->type), worker->thread_num);
ctx = hsm_create_context();
}
if (!ctx) {
ods_log_crit("[%s[%i]] error creating libhsm context",
worker2str(worker->type), worker->thread_num);
engine->need_to_reload = 1;
ods_log_error("signer instructed to reload due to hsm reset while signing");
lock_basic_lock(&superior->worker_lock);
superior->jobs_failed++;
lock_basic_unlock(&superior->worker_lock);
} else {
ods_log_assert(ctx);
lock_basic_lock(&superior->worker_lock);
task = superior->task;
ods_log_assert(task);
zone = task->zone;
lock_basic_unlock(&superior->worker_lock);
ods_log_assert(zone);
ods_log_assert(zone->apex);
ods_log_assert(zone->signconf);
worker->clock_in = time_now();
status = rrset_sign(ctx, rrset, superior->clock_in);
lock_basic_lock(&superior->worker_lock);
if (status == ODS_STATUS_OK) {
superior->jobs_completed++;
} else {
superior->jobs_failed++;
}
lock_basic_unlock(&superior->worker_lock);
}
if (worker_fulfilled(superior) && superior->sleeping) {
ods_log_deeebug("[%s[%i]] wake up superior[%u], work is "
"done", worker2str(worker->type), worker->thread_num,
superior->thread_num);
worker_wakeup(superior);
}
superior = NULL;
rrset = NULL;
}
/* done work */
}
/* cleanup open HSM sessions */
if (ctx) {
hsm_destroy_context(ctx);
}
}
/**
* Start worker.
*
*/
void
worker_start(worker_type* worker)
{
ods_log_assert(worker);
switch (worker->type) {
case WORKER_DRUDGER:
worker_drudge(worker);
break;
case WORKER_WORKER:
worker_work(worker);
break;
default:
ods_log_error("[worker] illegal worker (id=%i)", worker->type);
break;
}
}
/**
* Put worker to sleep.
*
*/
void
worker_sleep(worker_type* worker, time_t timeout)
{
ods_log_assert(worker);
if (!worker->need_to_exit) {
lock_basic_lock(&worker->worker_lock);
worker->sleeping = 1;
lock_basic_sleep(&worker->worker_alarm, &worker->worker_lock,
timeout);
lock_basic_unlock(&worker->worker_lock);
}
}
/**
* Put worker to sleep unless worker has measured up to all appointed jobs.
*
*/
void
worker_sleep_unless(worker_type* worker, time_t timeout)
{
ods_log_assert(worker);
lock_basic_lock(&worker->worker_lock);
while (!worker->need_to_exit && !worker_fulfilled(worker)) {
worker->sleeping = 1;
lock_basic_sleep(&worker->worker_alarm, &worker->worker_lock,
timeout);
ods_log_debug("[%s[%i]] somebody poked me, check completed jobs %lu "
"appointed, %lu completed, %lu failed", worker2str(worker->type),
worker->thread_num, (long)worker->jobs_appointed, (long)worker->jobs_completed,
(long)worker->jobs_failed);
}
lock_basic_unlock(&worker->worker_lock);
}
/**
* Wake up worker.
*
*/
void
worker_wakeup(worker_type* worker)
{
ods_log_assert(worker);
if (worker && worker->sleeping && !worker->waiting) {
ods_log_debug("[%s[%i]] wake up", worker2str(worker->type),
worker->thread_num);
lock_basic_lock(&worker->worker_lock);
lock_basic_alarm(&worker->worker_alarm);
worker->sleeping = 0;
lock_basic_unlock(&worker->worker_lock);
}
}
/**
* Notify all workers.
*
*/
void
worker_notify_all(lock_basic_type* lock, cond_basic_type* condition)
{
lock_basic_lock(lock);
lock_basic_broadcast(condition);
lock_basic_unlock(lock);
}
/**
* Clean up worker.
*
*/
void
worker_cleanup(worker_type* worker)
{
if (!worker) {
return;
}
lock_basic_destroy(&worker->worker_lock);
lock_basic_off(&worker->worker_alarm);
free(worker);
}
opendnssec-2.0.4/signer/src/daemon/worker.h 0000644 0001750 0001750 00000006556 13036123713 015615 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* The hard workers.
*
*/
#ifndef DAEMON_WORKER_H
#define DAEMON_WORKER_H
#include "config.h"
#include
enum worker_enum {
WORKER_NONE = 0,
WORKER_WORKER = 1,
WORKER_DRUDGER
};
typedef enum worker_enum worker_id;
typedef struct worker_struct worker_type;
#include "scheduler/task.h"
#include "status.h"
#include "locks.h"
struct worker_struct {
int thread_num;
ods_thread_type thread_id;
engine_type* engine;
task_type* task;
task_id working_with;
worker_id type;
time_t clock_in;
size_t jobs_appointed;
size_t jobs_completed;
size_t jobs_failed;
cond_basic_type worker_alarm;
lock_basic_type worker_lock;
unsigned sleeping : 1;
unsigned waiting : 1;
unsigned need_to_exit : 1;
};
/**
* Create worker.
* \param[in] allocator memory allocator
* \param[in] num thread number
* \param[in] type type of worker
* \return worker_type* created worker
*
*/
worker_type* worker_create(int num, worker_id type);
/**
* Start working.
* \param[in] worker worker to start working
*
*/
void worker_start(worker_type* worker);
/**
* Put worker to sleep.
* \param[in] worker put this worker to sleep
* \param[in] timeout time before alarm clock is going off,
* 0 means no alarm clock is set.
*
*/
void worker_sleep(worker_type* worker, time_t timeout);
/**
* Put worker to sleep unless the worker has measured up to all
* appointed jobs.
* \param[in] worker put this worker to sleep
* \param[in] timeout time before alarm clock is going off,
* 0 means no alarm clock is set.
*
*/
void worker_sleep_unless(worker_type* worker, time_t timeout);
/**
* Wake up worker.
* \param[in] worker wake up this worker
*
*/
void worker_wakeup(worker_type* worker);
/**
* Notify all workers.
* \param[in] lock lock to use
* \param[in] condition condition that has been met
*
*/
void worker_notify_all(lock_basic_type* lock, cond_basic_type* condition);
/**
* Clean up worker.
* \param[in] worker worker to clean up
*
*/
void worker_cleanup(worker_type* worker);
#endif /* DAEMON_WORKER_H */
opendnssec-2.0.4/signer/src/wire/ 0000755 0001750 0001750 00000000000 13036124774 013712 5 0000000 0000000 opendnssec-2.0.4/signer/src/wire/listener.h 0000644 0001750 0001750 00000005657 13036123713 015635 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Listener.
*
*/
#ifndef WIRE_LISTENER_H
#define WIRE_LISTENER_H
#include "config.h"
#include "status.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define DNS_PORT_STRING "53"
#define INBUF_SIZE 4096 /* max size for incoming queries */
#define MAX_INTERFACES 32
/**
* Access control.
*
*/
union acl_addr_storage {
struct in_addr addr;
struct in6_addr addr6;
};
/**
* Interface.
*
*/
typedef struct interface_struct interface_type;
struct interface_struct {
char* port;
char* address;
int family;
union acl_addr_storage addr;
};
/**
* Listener.
*
*/
typedef struct listener_struct listener_type;
struct listener_struct {
interface_type* interfaces;
size_t count;
};
/**
* Create listener.
* \param[in] allocator memory allocator
* \return listener_type* listener
*
*/
listener_type* listener_create(void);
/**
* Push an interface to the listener.
* \param[in] listener listener
* \param[in] address IP address
* \param[in] family address family
* \param[in] port port or NULL
* \return interface_type* added interface
*
*/
interface_type* listener_push(listener_type* list, char* address, int family,
char* port);
/**
* Clean up interface.
* \param[in] i interface
*
*/
void interface_cleanup(interface_type* i);
/**
* Clean up listener.
* \param[in] listener listener to clean up
*
*/
void listener_cleanup(listener_type* listener);
#endif /* WIRE_LISTENER_H */
opendnssec-2.0.4/signer/src/wire/axfr.h 0000644 0001750 0001750 00000004342 13036123676 014746 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* AXFR.
*
*/
#ifndef WIRE_AXFR_H
#define WIRE_AXFR_H
#include "config.h"
#include "daemon/engine.h"
#include "wire/query.h"
#include
/* NSD values */
#define MAX_COMPRESSION_OFFSET 16383 /* Compression pointers are 14 bit. */
#define AXFR_MAX_MESSAGE_LEN MAX_COMPRESSION_OFFSET
/**
* Handle SOA request.
* \param[in] q soa request
* \param[in] engine signer engine
* \return query_state state of the query
*
*/
query_state soa_request(query_type* q, engine_type* engine);
/**
* Do AXFR.
* \param[in] q axfr request
* \param[in] engine signer engine
* \param[in] fallback fallback from ixfr?
* \return query_state state of the query
*
*/
query_state axfr(query_type* q, engine_type* engine, int fallback);
/**
* Do IXFR.
* \param[in] q ixfr request
* \param[in] engine signer engine
* \return query_state state of the query
*
*/
query_state ixfr(query_type* q, engine_type* engine);
#endif /* WIRE_AXFR_H */
opendnssec-2.0.4/signer/src/wire/tcpset.h 0000644 0001750 0001750 00000006611 13036123676 015311 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* TCP connections.
*
*/
#ifndef WIRE_TCPSET_H
#define WIRE_TCPSET_H
#include "config.h"
#include
typedef struct tcp_conn_struct tcp_conn_type;
typedef struct tcp_set_struct tcp_set_type;
#include "status.h"
#include "wire/buffer.h"
#include "wire/xfrd.h"
#define TCPSET_MAX 50
/**
* tcp connection.
*
*/
struct tcp_conn_struct {
int fd;
/* how many bytes have been read/written - total, incl. tcp length bytes */
uint32_t total_bytes;
/* msg len bytes */
uint16_t msglen;
/* packet buffer of connection */
buffer_type* packet;
/* state: reading or writing */
unsigned is_reading : 1;
};
/*
* Set of tcp connections.
*
*/
struct tcp_set_struct {
tcp_conn_type* tcp_conn[TCPSET_MAX];
xfrd_type* tcp_waiting_first;
xfrd_type* tcp_waiting_last;
size_t tcp_count;
};
/**
* Create a tcp connection.
* \param[in] allocator memory allocator
* \return tcp_conn_type* TCP connection.
*
*/
tcp_conn_type* tcp_conn_create(void);
/**
* Create a set of tcp connections.
* \param[in] allocator memory allocator
* \return tcp_set_type* set of tcp connection.
*
*/
tcp_set_type* tcp_set_create(void);
/**
* Make tcp connection ready for reading.
* \param[in] tcp tcp connection
*
*/
void tcp_conn_ready(tcp_conn_type* tcp);
/*
* Read from a tcp connection.
* On first call, make sure total_bytes = 0, msglen=0, buffer clear,
* and the packet and fd need to be set.
* \param[in] tcp tcp connection
* \return int -1 on error,
* 0 on short read,
* 1 on completed read.
*
*/
int tcp_conn_read(tcp_conn_type* tcp);
/*
* Write to a tcp connection.
* On first call, make sure total_bytes=0, msglen=limit, buffer filled,
* and the packet and fd need to be set.
* \param[in] tcp tcp connection
* \return int -1 on error,
* 0 on short write,
* 1 on completed write.
*
*/
int tcp_conn_write(tcp_conn_type* tcp);
/**
* Clean up set of tcp connections.
* \param[in] set set of tcp connections
* \param[in] allocator memory allocator
*
*/
void tcp_set_cleanup(tcp_set_type* set);
#endif /* WIRE_TCPSET_H */
opendnssec-2.0.4/signer/src/wire/edns.h 0000644 0001750 0001750 00000006174 13036123676 014744 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Taken from NSD3 and adjusted for OpenDNSSEC, NLnet Labs.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* EDNS.
*
*/
#ifndef WIRE_EDNS_H
#define WIRE_EDNS_H
#include "config.h"
#include "status.h"
#include "wire/buffer.h"
#include
#define OPT_LEN 9U /* length of the NSD EDNS response record minus 2 */
#define OPT_RDATA 2 /* holds the rdata length comes after OPT_LEN */
#define DNSSEC_OK_MASK 0x8000U /* do bit mask */
#define EDNS_MAX_MESSAGE_LEN 4096
/**
* EDNS data.
*
*/
typedef struct edns_data_struct edns_data_type;
struct edns_data_struct {
unsigned char ok[OPT_LEN];
unsigned char error[OPT_LEN];
unsigned char rdata_none[OPT_RDATA];
};
/**
* EDNS status.
*
*/
enum edns_status_enum {
EDNS_NOT_PRESENT,
EDNS_OK,
EDNS_ERROR
};
typedef enum edns_status_enum edns_status;
/**
* EDNS RR.
*
*/
typedef struct edns_rr_struct edns_rr_type;
struct edns_rr_struct {
edns_status status;
size_t position;
size_t maxlen;
int dnssec_ok;
};
/**
* Initialize EDNS.
* \param[in] data EDNS data.
* \param[in] max_length maximum length.
*
*/
void edns_init(edns_data_type* data, uint16_t max_length);
/**
* Create new EDNS RR.
* \param[in] allocator memory allocator.
* \return edns_rr_type* EDNS RR.
*
*/
edns_rr_type* edns_rr_create(void);
/**
* Reset EDNS OPT RR.
* \param[in] err EDNS record.
*
*/
void edns_rr_reset(edns_rr_type* err);
/**
* Parse EDNS OPT RR.
* \param[in] err EDNS record.
* \param[in] buffer packet buffer.
* \return int 1 if EDNS and valid, 0 otherwise.
*
*/
int edns_rr_parse(edns_rr_type* err, buffer_type* buffer);
/**
* The amount of space to reserve in the response for the EDNS data.
* \param[in] err EDNS record.
* \return size_t amount of space to reserve.
*
*/
size_t edns_rr_reserved_space(edns_rr_type* err);
void edns_rr_cleanup(edns_rr_type* err);
#endif /* WIRE_EDNS_H */
opendnssec-2.0.4/signer/src/wire/netio.c 0000644 0001750 0001750 00000022536 13036123713 015114 0000000 0000000 /*
* Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
*/
#include
#include
#include
#include
#include
#include
#include "log.h"
#include "wire/netio.h"
#ifndef HAVE_PSELECT
int pselect(int n, fd_set* readfds, fd_set* writefds, fd_set* exceptfds,
const struct timespec* timeout, const sigset_t* sigmask);
#else
#include
#endif
/* One second is 1e9 nanoseconds. */
#define NANOSECONDS_PER_SECOND 1000000000L
static const char* netio_str = "netio";
/*
* Create a new netio instance.
* \return netio_type* netio instance
*
*/
netio_type*
netio_create()
{
netio_type* netio = NULL;
CHECKALLOC(netio = (netio_type*) malloc(sizeof(netio_type)));
netio->handlers = NULL;
netio->deallocated = NULL;
netio->dispatch_next = NULL;
return netio;
}
/*
* Add a new handler to netio.
*
*/
void
netio_add_handler(netio_type* netio, netio_handler_type* handler)
{
netio_handler_list_type* l = NULL;
if (!netio || !handler) {
return;
}
if (netio->deallocated) {
l = netio->deallocated;
netio->deallocated = l->next;
} else {
CHECKALLOC(l = (netio_handler_list_type*) malloc(sizeof(netio_handler_list_type)));
}
l->next = netio->handlers;
l->handler = handler;
netio->handlers = l;
ods_log_debug("[%s] handler added", netio_str);
}
/*
* Remove the handler from netio.
*
*/
void
netio_remove_handler(netio_type* netio, netio_handler_type* handler)
{
netio_handler_list_type** lptr;
if (!netio || !handler) {
return;
}
for (lptr = &netio->handlers; *lptr; lptr = &(*lptr)->next) {
if ((*lptr)->handler == handler) {
netio_handler_list_type* next = (*lptr)->next;
if ((*lptr) == netio->dispatch_next) {
netio->dispatch_next = next;
}
(*lptr)->handler = NULL;
(*lptr)->next = netio->deallocated;
netio->deallocated = *lptr;
*lptr = next;
break;
}
}
ods_log_debug("[%s] handler removed", netio_str);
}
/*
* Convert timeval to timespec.
*
*/
static void
timeval_to_timespec(struct timespec* left, const struct timeval* right)
{
left->tv_sec = right->tv_sec;
left->tv_nsec = 1000 * right->tv_usec;
}
/**
* Compare timespec.
*
*/
static int
timespec_compare(const struct timespec* left,
const struct timespec* right)
{
if (left->tv_sec < right->tv_sec) {
return -1;
} else if (left->tv_sec > right->tv_sec) {
return 1;
} else if (left->tv_nsec < right->tv_nsec) {
return -1;
} else if (left->tv_nsec > right->tv_nsec) {
return 1;
}
return 0;
}
/**
* Add timespecs.
*
*/
void
timespec_add(struct timespec* left, const struct timespec* right)
{
left->tv_sec += right->tv_sec;
left->tv_nsec += right->tv_nsec;
if (left->tv_nsec >= NANOSECONDS_PER_SECOND) {
++left->tv_sec;
left->tv_nsec -= NANOSECONDS_PER_SECOND;
}
}
/**
* Substract timespecs.
*
*/
static void
timespec_subtract(struct timespec* left, const struct timespec* right)
{
left->tv_sec -= right->tv_sec;
left->tv_nsec -= right->tv_nsec;
if (left->tv_nsec < 0L) {
--left->tv_sec;
left->tv_nsec += NANOSECONDS_PER_SECOND;
}
}
/*
* Retrieve the current time (using gettimeofday(2)).
*
*/
const struct timespec*
netio_current_time(netio_type* netio)
{
struct timeval current_timeval;
ods_log_assert(netio);
if (!netio->have_current_time) {
if (gettimeofday(¤t_timeval, NULL) == -1) {
ods_log_crit("[%s] unable to get current time: "
"gettimeofday() failed (%s)", netio_str,
strerror(errno));
abort();
}
timeval_to_timespec(&netio->cached_current_time,
¤t_timeval);
netio->have_current_time = 1;
}
return &netio->cached_current_time;
}
/*
* Check for events and dispatch them to the handlers.
*
*/
int
netio_dispatch(netio_type* netio, const struct timespec* timeout,
const sigset_t* sigmask)
{
fd_set readfds, writefds, exceptfds;
int max_fd;
int have_timeout = 0;
struct timespec minimum_timeout;
netio_handler_type* timeout_handler = NULL;
netio_handler_list_type* l = NULL;
int rc = 0;
int result = 0;
if (!netio || !netio->handlers) {
return 0;
}
/* Clear the cached current time */
netio->have_current_time = 0;
/* Initialize the minimum timeout with the timeout parameter */
if (timeout) {
have_timeout = 1;
memcpy(&minimum_timeout, timeout, sizeof(struct timespec));
}
/* Initialize the fd_sets and timeout based on the handler
* information */
max_fd = -1;
FD_ZERO(&readfds);
FD_ZERO(&writefds);
FD_ZERO(&exceptfds);
for (l = netio->handlers; l; l = l->next) {
netio_handler_type* handler = l->handler;
if (handler->fd >= 0 && handler->fd < (int) FD_SETSIZE) {
if (handler->fd > max_fd) {
max_fd = handler->fd;
}
if (handler->event_types & NETIO_EVENT_READ) {
FD_SET(handler->fd, &readfds);
}
if (handler->event_types & NETIO_EVENT_WRITE) {
FD_SET(handler->fd, &writefds);
}
if (handler->event_types & NETIO_EVENT_EXCEPT) {
FD_SET(handler->fd, &exceptfds);
}
}
if (handler->timeout &&
(handler->event_types & NETIO_EVENT_TIMEOUT)) {
struct timespec relative;
relative.tv_sec = handler->timeout->tv_sec;
relative.tv_nsec = handler->timeout->tv_nsec;
timespec_subtract(&relative, netio_current_time(netio));
if (!have_timeout ||
timespec_compare(&relative, &minimum_timeout) < 0) {
have_timeout = 1;
minimum_timeout.tv_sec = relative.tv_sec;
minimum_timeout.tv_nsec = relative.tv_nsec;
timeout_handler = handler;
}
}
}
if (have_timeout && minimum_timeout.tv_sec < 0) {
/*
* On negative timeout for a handler, immediately
* dispatch the timeout event without checking for other events.
*/
ods_log_debug("[%s] dispatch timeout event without checking for "
"other events", netio_str);
if (timeout_handler &&
(timeout_handler->event_types & NETIO_EVENT_TIMEOUT)) {
timeout_handler->event_handler(netio, timeout_handler,
NETIO_EVENT_TIMEOUT);
}
return result;
}
/* Check for events. */
rc = pselect(max_fd + 1, &readfds, &writefds, &exceptfds,
have_timeout ? &minimum_timeout : NULL, sigmask);
if (rc == -1) {
if(errno == EINVAL || errno == EACCES || errno == EBADF) {
ods_fatal_exit("[%s] fatal error pselect: %s", netio_str,
strerror(errno));
}
return -1;
}
/* Clear the cached current_time (pselect(2) may block for
* some time so the cached value is likely to be old).
*/
netio->have_current_time = 0;
if (rc == 0) {
ods_log_debug("[%s] no events before the minimum timeout "
"expired", netio_str);
/*
* No events before the minimum timeout expired.
* Dispatch to handler if interested.
*/
if (timeout_handler &&
(timeout_handler->event_types & NETIO_EVENT_TIMEOUT)) {
timeout_handler->event_handler(netio, timeout_handler,
NETIO_EVENT_TIMEOUT);
}
} else {
/*
* Dispatch all the events to interested handlers
* based on the fd_sets. Note that a handler might
* deinstall itself, so store the next handler before
* calling the current handler!
*/
ods_log_assert(netio->dispatch_next == NULL);
for (l = netio->handlers; l && rc; ) {
netio_handler_type* handler = l->handler;
netio->dispatch_next = l->next;
if (handler->fd >= 0 && handler->fd < (int) FD_SETSIZE) {
netio_events_type event_types = NETIO_EVENT_NONE;
if (FD_ISSET(handler->fd, &readfds)) {
event_types |= NETIO_EVENT_READ;
FD_CLR(handler->fd, &readfds);
rc--;
}
if (FD_ISSET(handler->fd, &writefds)) {
event_types |= NETIO_EVENT_WRITE;
FD_CLR(handler->fd, &writefds);
rc--;
}
if (FD_ISSET(handler->fd, &exceptfds)) {
event_types |= NETIO_EVENT_EXCEPT;
FD_CLR(handler->fd, &exceptfds);
rc--;
}
if (event_types & handler->event_types) {
handler->event_handler(netio, handler,
event_types & handler->event_types);
++result;
}
}
l = netio->dispatch_next;
}
netio->dispatch_next = NULL;
}
return result;
}
/**
* Clean up netio instance
*
*/
void
netio_cleanup(netio_type* netio)
{
if (!netio) {
return;
}
free(netio->handlers);
free(netio->deallocated);
free(netio);
}
opendnssec-2.0.4/signer/src/wire/listener.c 0000644 0001750 0001750 00000010271 13036123713 015614 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Listener.
*
*/
#include "config.h"
#include
#include "log.h"
#include "wire/listener.h"
static const char* listener_str = "listener";
/**
* Create listener.
*
*/
listener_type*
listener_create()
{
listener_type* listener = NULL;
CHECKALLOC(listener = (listener_type*) malloc(sizeof(listener_type)));
listener->count = 0;
listener->interfaces = NULL;
return listener;
}
/**
* Push an interface to the listener.
*
*/
interface_type*
listener_push(listener_type* listener, char* address, int family, char* port)
{
interface_type* ifs_old = NULL;
ods_log_assert(listener);
ods_log_assert(address);
ifs_old = listener->interfaces;
CHECKALLOC(listener->interfaces = (interface_type*) malloc((listener->count + 1) * sizeof(interface_type)));
if (ifs_old) {
memcpy(listener->interfaces, ifs_old,
(listener->count) * sizeof(interface_type));
}
free(ifs_old);
listener->count++;
listener->interfaces[listener->count -1].address = strdup(address);
listener->interfaces[listener->count -1].family = family;
if (port) {
listener->interfaces[listener->count -1].port = strdup(port);
} else{
listener->interfaces[listener->count -1].port = NULL;
}
memset(&listener->interfaces[listener->count -1].addr, 0,
sizeof(union acl_addr_storage));
if (listener->interfaces[listener->count -1].family == AF_INET6 &&
strlen(listener->interfaces[listener->count -1].address) > 0) {
if (inet_pton(listener->interfaces[listener->count -1].family,
listener->interfaces[listener->count -1].address,
&listener->interfaces[listener->count -1].addr.addr6) != 1) {
ods_log_error("[%s] bad ip address '%s'", listener_str,
listener->interfaces[listener->count -1].address);
return NULL;
}
} else if (listener->interfaces[listener->count -1].family == AF_INET &&
strlen(listener->interfaces[listener->count -1].address) > 0) {
if (inet_pton(listener->interfaces[listener->count -1].family,
listener->interfaces[listener->count -1].address,
&listener->interfaces[listener->count -1].addr.addr) != 1) {
ods_log_error("[%s] bad ip address '%s'", listener_str,
listener->interfaces[listener->count -1].address);
return NULL;
}
}
return &listener->interfaces[listener->count -1];
}
/**
* Clean up interface.
*
*/
void
interface_cleanup(interface_type* i)
{
if (!i) {
return;
}
free((void*)i->port);
free((void*)i->address);
}
/**
* Clean up listener.
*
*/
void
listener_cleanup(listener_type* listener)
{
uint16_t i = 0;
if (!listener) {
return;
}
for (i=0; i < listener->count; i++) {
interface_cleanup(&listener->interfaces[i]);
}
free(listener->interfaces);
free(listener);
}
opendnssec-2.0.4/signer/src/wire/xfrd.c 0000644 0001750 0001750 00000211743 13036123713 014741 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone transfers.
*
*/
#include "config.h"
#include "daemon/engine.h"
#include "daemon/xfrhandler.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "signer/domain.h"
#include "signer/zone.h"
#include "wire/tcpset.h"
#include "wire/xfrd.h"
#include "signer/backup.h"
#include
#include
#define XFRD_TSIG_MAX_UNSIGNED 100
static const char* xfrd_str = "xfrd";
static void xfrd_handle_zone(netio_type* netio,
netio_handler_type* handler, netio_events_type event_types);
static void xfrd_make_request(xfrd_type* xfrd);
static socklen_t xfrd_acl_sockaddr(acl_type* acl, unsigned int port,
struct sockaddr_storage *sck);
static void xfrd_write_soa(xfrd_type* xfrd, buffer_type* buffer);
static int xfrd_parse_soa(xfrd_type* xfrd, buffer_type* buffer,
unsigned rdata_only, unsigned update, uint32_t t,
uint32_t* serial);
static ods_status xfrd_parse_rrs(xfrd_type* xfrd, buffer_type* buffer,
uint16_t count, int* done);
static xfrd_pkt_status xfrd_parse_packet(xfrd_type* xfrd,
buffer_type* buffer);
static xfrd_pkt_status xfrd_handle_packet(xfrd_type* xfrd,
buffer_type* buffer);
static void xfrd_tcp_obtain(xfrd_type* xfrd, tcp_set_type* set);
static void xfrd_tcp_read(xfrd_type* xfrd, tcp_set_type* set);
static void xfrd_tcp_release(xfrd_type* xfrd, tcp_set_type* set, int open_waiting);
static void xfrd_tcp_write(xfrd_type* xfrd, tcp_set_type* set);
static void xfrd_tcp_xfr(xfrd_type* xfrd, tcp_set_type* set);
static int xfrd_tcp_open(xfrd_type* xfrd, tcp_set_type* set);
static void xfrd_udp_obtain(xfrd_type* xfrd);
static void xfrd_udp_read(xfrd_type* xfrd);
static void xfrd_udp_release(xfrd_type* xfrd);
static int xfrd_udp_read_packet(xfrd_type* xfrd);
static int xfrd_udp_send(xfrd_type* xfrd, buffer_type* buffer);
static int xfrd_udp_send_request_ixfr(xfrd_type* xfrd);
static time_t xfrd_time(xfrd_type* xfrd);
static void xfrd_set_timer(xfrd_type* xfrd, time_t t);
static void xfrd_set_timer_time(xfrd_type* xfrd, time_t t);
static void xfrd_unset_timer(xfrd_type* xfrd);
/**
* Recover transfer variables.
*
*/
static uint8_t
xfrd_recover_dname(uint8_t* dname, const char* name)
{
const uint8_t *s = (const uint8_t *) name;
uint8_t *h;
uint8_t *p;
uint8_t *d = dname;
size_t label_length;
if (strcmp(name, ".") == 0) {
/* Root domain. */
dname[0] = 0;
return 1;
}
for (h = d, p = h + 1; *s; ++s, ++p) {
if (p - dname >= MAXDOMAINLEN) {
return 0;
}
switch (*s) {
case '.':
if (p == h + 1) {
/* Empty label. */
return 0;
} else {
label_length = p - h - 1;
if (label_length > MAXLABELLEN) {
return 0;
}
*h = label_length;
h = p;
}
break;
case '\\':
/* Handle escaped characters (RFC1035 5.1) */
if (isdigit(s[1]) && isdigit(s[2]) && isdigit(s[3])) {
int val = (ldns_hexdigit_to_int(s[1]) * 100 +
ldns_hexdigit_to_int(s[2]) * 10 +
ldns_hexdigit_to_int(s[3]));
if (0 <= val && val <= 255) {
s += 3;
*p = val;
} else {
*p = *++s;
}
} else if (s[1] != '\0') {
*p = *++s;
}
break;
default:
*p = *s;
break;
}
}
if (p != h + 1) {
/* Terminate last label. */
label_length = p - h - 1;
if (label_length > MAXLABELLEN) {
return 0;
}
*h = label_length;
h = p;
}
/* Add root label. */
*h = 0;
return p-dname;
}
/**
* Recover transfer variables.
*
*/
static void
xfrd_recover(xfrd_type* xfrd)
{
zone_type* zone = (zone_type*) xfrd->zone;
char* file = NULL;
FILE* fd = NULL;
int round_num = 0;
int master_num = 0;
int next_master = 0;
uint32_t timeout = 0;
uint32_t serial_xfr = 0;
uint32_t serial_notify = 0;
uint32_t serial_disk = 0;
time_t serial_xfr_acquired = 0;
time_t serial_notify_acquired = 0;
time_t serial_disk_acquired = 0;
uint32_t soa_ttl = 0;
uint32_t soa_serial = 0;
uint32_t soa_refresh = 0;
uint32_t soa_retry = 0;
uint32_t soa_expire = 0;
uint32_t soa_minimum = 0;
const char* soa_mname = NULL;
const char* soa_rname = NULL;
if (zone && zone->name && zone->db &&
zone->db->is_initialized && zone->db->have_serial) {
file = ods_build_path(zone->name, ".xfrd-state", 0, 1);
if (file) {
ods_log_verbose("[%s] recover xfrd.state file %s zone %s", xfrd_str,
file, zone->name);
fd = ods_fopen(file, NULL, "r");
if (fd) {
if (!backup_read_check_str(fd, ODS_SE_FILE_MAGIC_V3)) {
ods_log_error("[%s] corrupted state file zone %s: read "
"magic (start) error", xfrd_str, zone->name);
goto xfrd_recover_error;
}
if (!backup_read_check_str(fd, ";;Zone:") |
!backup_read_check_str(fd, "name") |
!backup_read_check_str(fd, zone->name) |
!backup_read_check_str(fd, "ttl") |
!backup_read_uint32_t(fd, &soa_ttl) |
!backup_read_check_str(fd, "mname") |
!backup_read_str(fd, &soa_mname) |
!backup_read_check_str(fd, "rname") |
!backup_read_str(fd, &soa_rname) |
!backup_read_check_str(fd, "serial") |
!backup_read_uint32_t(fd, &soa_serial) |
!backup_read_check_str(fd, "refresh") |
!backup_read_uint32_t(fd, &soa_refresh) |
!backup_read_check_str(fd, "retry") |
!backup_read_uint32_t(fd, &soa_retry) |
!backup_read_check_str(fd, "expire") |
!backup_read_uint32_t(fd, &soa_expire) |
!backup_read_check_str(fd, "minimum") |
!backup_read_uint32_t(fd, &soa_minimum)) {
ods_log_error("[%s] corrupted state file zone %s: read "
";;Zone error", xfrd_str, zone->name);
goto xfrd_recover_error;
}
if (!backup_read_check_str(fd, ";;Master:") |
!backup_read_check_str(fd, "num") |
!backup_read_int(fd, &master_num) |
!backup_read_check_str(fd, "next") |
!backup_read_int(fd, &next_master) |
!backup_read_check_str(fd, "round") |
!backup_read_int(fd, &round_num) |
!backup_read_check_str(fd, "timeout") |
!backup_read_uint32_t(fd, &timeout)) {
ods_log_error("[%s] corrupt state file zone %s: read "
";;Master error", xfrd_str, zone->name);
goto xfrd_recover_error;
}
if (!backup_read_check_str(fd, ";;Serial:") |
!backup_read_check_str(fd, "xfr") |
!backup_read_uint32_t(fd, &serial_xfr) |
!backup_read_time_t(fd, &serial_xfr_acquired) |
!backup_read_check_str(fd, "notify") |
!backup_read_uint32_t(fd, &serial_notify) |
!backup_read_time_t(fd, &serial_notify_acquired) |
!backup_read_check_str(fd, "disk") |
!backup_read_uint32_t(fd, &serial_disk) |
!backup_read_time_t(fd, &serial_disk_acquired)) {
ods_log_error("[%s] corrupt state file zone %s: read "
";;Serial error", xfrd_str, zone->name);
goto xfrd_recover_error;
}
if (!backup_read_check_str(fd, ODS_SE_FILE_MAGIC_V3)) {
ods_log_error("[%s] corrupt state file zone %s: read "
"magic (end) error", xfrd_str, zone->name);
goto xfrd_recover_error;
}
/* all ok */
xfrd->master_num = master_num;
xfrd->next_master = next_master;
xfrd->round_num = round_num;
xfrd->timeout.tv_sec = timeout;
xfrd->timeout.tv_nsec = 0;
xfrd->master = NULL; /* acl_find_num(...) */
xfrd->soa.ttl = soa_ttl;
xfrd->soa.serial = soa_serial;
xfrd->soa.refresh = soa_refresh;
xfrd->soa.retry = soa_retry;
xfrd->soa.expire = soa_expire;
xfrd->soa.minimum = soa_minimum;
xfrd->soa.mname[0] = xfrd_recover_dname(xfrd->soa.mname+1,
soa_mname);
xfrd->soa.rname[0] = xfrd_recover_dname(xfrd->soa.rname+1,
soa_rname);
xfrd->serial_xfr = serial_xfr;
xfrd->serial_xfr_acquired = serial_xfr_acquired;
xfrd->serial_notify = serial_notify;
xfrd->serial_notify_acquired = serial_notify_acquired;
xfrd->serial_disk = serial_disk;
xfrd->serial_disk_acquired = serial_disk_acquired;
if (!timeout || serial_notify_acquired ||
(serial_disk_acquired &&
(uint32_t)xfrd_time(xfrd) - serial_disk_acquired >
soa_refresh)) {
xfrd_set_timer_refresh(xfrd);
}
if (serial_disk_acquired &&
((uint32_t)xfrd_time(xfrd) - serial_disk_acquired >
soa_expire)) {
xfrd_set_timer_refresh(xfrd);
}
xfrd_recover_error:
free((void*)soa_mname);
free((void*)soa_rname);
ods_fclose(fd);
}
free(file);
}
} else {
ods_log_verbose("[%s] did not recover xfrd.state file zone %s", xfrd_str,
(zone && zone->name)?zone->name:"(null)");
}
}
/**
* Create zone transfer structure.
*
*/
xfrd_type*
xfrd_create(xfrhandler_type* xfrhandler, zone_type* zone)
{
xfrd_type* xfrd = NULL;
if (!xfrhandler || !zone) {
return NULL;
}
CHECKALLOC(xfrd = (xfrd_type*) malloc(sizeof(xfrd_type)));
lock_basic_init(&xfrd->serial_lock);
lock_basic_init(&xfrd->rw_lock);
xfrd->xfrhandler = xfrhandler;
xfrd->zone = zone;
xfrd->tcp_conn = -1;
xfrd->round_num = -1;
xfrd->master_num = 0;
xfrd->next_master = -1;
xfrd->master = NULL;
lock_basic_lock(&xfrd->serial_lock);
xfrd->serial_xfr = 0;
xfrd->serial_disk = 0;
xfrd->serial_notify = 0;
xfrd->serial_xfr_acquired = 0;
xfrd->serial_disk_acquired = 0;
xfrd->serial_notify_acquired = 0;
xfrd->serial_retransfer = 0;
lock_basic_unlock(&xfrd->serial_lock);
xfrd->query_id = 0;
xfrd->msg_seq_nr = 0;
xfrd->msg_rr_count = 0;
xfrd->msg_old_serial = 0;
xfrd->msg_new_serial = 0;
xfrd->msg_is_ixfr = 0;
xfrd->msg_do_retransfer = 0;
xfrd->udp_waiting = 0;
xfrd->udp_waiting_next = NULL;
xfrd->tcp_waiting = 0;
xfrd->tcp_waiting_next = NULL;
xfrd->tsig_rr = tsig_rr_create();
if (!xfrd->tsig_rr) {
xfrd_cleanup(xfrd, 0);
return NULL;
}
memset(&xfrd->soa, 0, sizeof(xfrd->soa));
xfrd->soa.ttl = 0;
xfrd->soa.mname[0] = 1;
xfrd->soa.rname[0] = 1;
xfrd->soa.serial = 0;
xfrd->soa.refresh = 3600;
xfrd->soa.retry = 300;
xfrd->soa.expire = 604800;
xfrd->soa.minimum = 3600;
xfrd->handler.fd = -1;
xfrd->handler.user_data = (void*) xfrd;
xfrd->handler.timeout = 0;
xfrd->handler.event_types =
NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT;
xfrd->handler.event_handler = xfrd_handle_zone;
xfrd_set_timer_time(xfrd, 0);
xfrd_recover(xfrd);
return xfrd;
}
/**
* Get time.
*
*/
static time_t
xfrd_time(xfrd_type* xfrd)
{
ods_log_assert(xfrd);
ods_log_assert(xfrd->xfrhandler);
return xfrhandler_time((xfrhandler_type*) xfrd->xfrhandler);
}
/**
* Set timer.
*
*/
static void
xfrd_set_timer(xfrd_type* xfrd, time_t t)
{
if (!xfrd || !xfrd->xfrhandler) {
return;
}
/**
* Randomize the time, within 90%-100% of original.
* Not later so zones cannot expire too late.
*/
if(t > xfrd_time(xfrd) + 10) {
time_t extra = t - xfrd_time(xfrd);
time_t base = extra*9/10;
#ifdef HAVE_ARC4RANDOM_UNIFORM
t = xfrd_time(xfrd) + base +
arc4random_uniform(extra-base);
#elif HAVE_ARC4RANDOM
t = xfrd_time(xfrd) + base +
arc4random()%(extra-base);
#else
t = xfrd_time(xfrd) + base +
random()%(extra-base);
#endif
}
xfrd->handler.timeout = &xfrd->timeout;
xfrd->timeout.tv_sec = t;
xfrd->timeout.tv_nsec = 0;
}
/**
* Unset timer.
*
*/
static void
xfrd_unset_timer(xfrd_type* xfrd)
{
ods_log_assert(xfrd);
xfrd->handler.timeout = NULL;
}
/**
* Set timer timeout to time.
*
*/
static void
xfrd_set_timer_time(xfrd_type* xfrd, time_t t)
{
ods_log_assert(xfrd);
xfrd_set_timer(xfrd, xfrd_time(xfrd) + t);
}
/**
* Set timeout for zone transfer to now.
*
*/
void
xfrd_set_timer_now(xfrd_type* xfrd)
{
zone_type* zone = NULL;
if (!xfrd || !xfrd->zone || !xfrd->xfrhandler) {
return;
}
zone = (zone_type*) xfrd->zone;
ods_log_debug("[%s] zone %s sets timer timeout now", xfrd_str,
zone->name);
xfrd_set_timer_time(xfrd, 0);
}
/**
* Set timeout for zone transfer to RETRY.
*
*/
void
xfrd_set_timer_retry(xfrd_type* xfrd)
{
zone_type* zone = NULL;
if (!xfrd || !xfrd->zone || !xfrd->xfrhandler) {
return;
}
zone = (zone_type*) xfrd->zone;
ods_log_debug("[%s] zone %s sets timer timeout retry %u", xfrd_str,
zone->name, (unsigned) xfrd->soa.retry);
xfrd_set_timer_time(xfrd, xfrd->soa.retry);
}
/**
* Set timeout for zone transfer to REFRESH.
*
*/
void
xfrd_set_timer_refresh(xfrd_type* xfrd)
{
zone_type* zone = NULL;
if (!xfrd || !xfrd->zone || !xfrd->xfrhandler) {
return;
}
zone = (zone_type*) xfrd->zone;
ods_log_debug("[%s] zone %s sets timer timeout refresh %u", xfrd_str,
zone->name, (unsigned) xfrd->soa.refresh);
xfrd_set_timer_time(xfrd, xfrd->soa.refresh);
}
/**
* Use acl address to setup sockaddr struct.
*
*/
static socklen_t
xfrd_acl_sockaddr(acl_type* acl, unsigned int port,
struct sockaddr_storage *sck)
{
ods_log_assert(acl);
ods_log_assert(sck);
ods_log_assert(port);
memset(sck, 0, sizeof(struct sockaddr_storage));
if (acl->family == AF_INET6) {
struct sockaddr_in6* sa = (struct sockaddr_in6*)sck;
sa->sin6_family = AF_INET6;
sa->sin6_port = htons(port);
sa->sin6_addr = acl->addr.addr6;
return sizeof(struct sockaddr_in6);
} else {
struct sockaddr_in* sa = (struct sockaddr_in*)sck;
sa->sin_family = AF_INET;
sa->sin_port = htons(port);
sa->sin_addr = acl->addr.addr;
return sizeof(struct sockaddr_in);
}
return 0;
}
/**
* Use acl address to setup remote sockaddr struct.
*
*/
socklen_t
xfrd_acl_sockaddr_to(acl_type* acl, struct sockaddr_storage *to)
{
unsigned int port = 0;
if (!acl || !to) {
return 0;
}
port = acl->port ? acl->port : (unsigned) atoi(DNS_PORT_STRING);
return xfrd_acl_sockaddr(acl, port, to);
}
/**
* Sign transfer request.
*
*/
static void
xfrd_tsig_sign(xfrd_type* xfrd, buffer_type* buffer)
{
tsig_algo_type* algo = NULL;
if (!xfrd || !xfrd->tsig_rr || !xfrd->master || !xfrd->master->tsig ||
!xfrd->master->tsig->key || !buffer) {
return; /* no tsig configured */
}
algo = tsig_lookup_algo(xfrd->master->tsig->algorithm);
if (!algo) {
ods_log_error("[%s] unable to sign request: tsig unknown algorithm "
"%s", xfrd_str, xfrd->master->tsig->algorithm);
return;
}
ods_log_assert(algo);
tsig_rr_reset(xfrd->tsig_rr, algo, xfrd->master->tsig->key);
xfrd->tsig_rr->original_query_id = buffer_pkt_id(buffer);
xfrd->tsig_rr->algo_name = ldns_rdf_clone(xfrd->tsig_rr->algo->wf_name);
xfrd->tsig_rr->key_name = ldns_rdf_clone(xfrd->tsig_rr->key->dname);
log_dname(xfrd->tsig_rr->key_name, "tsig sign query with key", LOG_DEBUG);
log_dname(xfrd->tsig_rr->algo_name, "tsig sign query with algorithm",
LOG_DEBUG);
tsig_rr_prepare(xfrd->tsig_rr);
tsig_rr_update(xfrd->tsig_rr, buffer, buffer_position(buffer));
tsig_rr_sign(xfrd->tsig_rr);
ods_log_debug("[%s] tsig append rr to request id=%u", xfrd_str,
buffer_pkt_id(buffer));
tsig_rr_append(xfrd->tsig_rr, buffer);
buffer_pkt_set_arcount(buffer, buffer_pkt_arcount(buffer)+1);
tsig_rr_prepare(xfrd->tsig_rr);
}
/**
* Process TSIG in transfer.
*
*/
static int
xfrd_tsig_process(xfrd_type* xfrd, buffer_type* buffer)
{
zone_type* zone = NULL;
int have_tsig = 0;
if (!xfrd || !xfrd->tsig_rr || !xfrd->master || !xfrd->master->tsig ||
!xfrd->master->tsig->key || !buffer) {
return 1; /* no tsig configured */
}
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(xfrd->master->address);
if (!tsig_rr_find(xfrd->tsig_rr, buffer)) {
ods_log_error("[%s] unable to process tsig: xfr zone %s from %s "
"has malformed tsig rr", xfrd_str, zone->name,
xfrd->master->address);
return 0;
}
if (xfrd->tsig_rr->status == TSIG_OK) {
have_tsig = 1;
if (xfrd->tsig_rr->error_code != LDNS_RCODE_NOERROR) {
ods_log_error("[%s] zone %s, from %s has tsig error (%s)",
xfrd_str, zone->name, xfrd->master->address,
tsig_strerror(xfrd->tsig_rr->error_code));
}
/* strip the TSIG resource record off... */
buffer_set_limit(buffer, xfrd->tsig_rr->position);
buffer_pkt_set_arcount(buffer, buffer_pkt_arcount(buffer)-1);
}
/* keep running the TSIG hash */
tsig_rr_update(xfrd->tsig_rr, buffer, buffer_limit(buffer));
if (have_tsig) {
if (!tsig_rr_verify(xfrd->tsig_rr)) {
ods_log_error("[%s] unable to process tsig: xfr zone %s from %s "
"has bad tsig signature", xfrd_str, zone->name,
xfrd->master->address);
return 0;
}
/* prepare for next tsigs */
tsig_rr_prepare(xfrd->tsig_rr);
} else if (xfrd->tsig_rr->update_since_last_prepare >
XFRD_TSIG_MAX_UNSIGNED) {
/* we allow a number of non-tsig signed packets */
ods_log_error("[%s] unable to process tsig: xfr zone %s, from %s "
"has too many consecutive packets without tsig", xfrd_str,
zone->name, xfrd->master->address);
return 0;
}
if (!have_tsig && xfrd->msg_seq_nr == 0) {
ods_log_error("[%s] unable to process tsig: xfr zone %s from %s "
"has no tsig in first packet of reply", xfrd_str,
zone->name, xfrd->master->address);
return 0;
}
/* process TSIG ok */
return 1;
}
/**
* Commit answer on disk.
*
*/
static void
xfrd_commit_packet(xfrd_type* xfrd)
{
zone_type* zone = NULL;
char* xfrfile = NULL;
FILE* fd = NULL;
time_t serial_disk_acq = 0;
ods_log_assert(xfrd);
zone = (zone_type*) xfrd->zone;
xfrfile = ods_build_path(zone->name, ".xfrd", 0, 1);
if (!xfrfile) {
ods_log_crit("[%s] unable to commit xfr zone %s: build path failed",
xfrd_str, zone->name);
return;
}
ods_log_assert(zone);
ods_log_assert(zone->name);
lock_basic_lock(&zone->zone_lock);
lock_basic_lock(&xfrd->rw_lock);
lock_basic_lock(&xfrd->serial_lock);
/* mark end packet */
fd = ods_fopen(xfrfile, NULL, "a");
free((void*)xfrfile);
if (fd) {
fprintf(fd, ";;ENDPACKET\n");
ods_fclose(fd);
} else {
lock_basic_unlock(&xfrd->rw_lock);
lock_basic_unlock(&zone->zone_lock);
lock_basic_unlock(&xfrd->serial_lock);
ods_log_crit("[%s] unable to commit xfr zone %s: ods_fopen() failed "
"(%s)", xfrd_str, zone->name, strerror(errno));
return;
}
/* update soa serial management */
xfrd->serial_disk = xfrd->msg_new_serial;
serial_disk_acq = xfrd->serial_disk_acquired;
xfrd->serial_disk_acquired = xfrd_time(xfrd);
/* ensure newer time */
if (xfrd->serial_disk_acquired == serial_disk_acq) {
xfrd->serial_disk_acquired++;
}
xfrd->soa.serial = xfrd->serial_disk;
if (xfrd->msg_do_retransfer ||
(util_serial_gt(xfrd->serial_disk, xfrd->serial_xfr) &&
xfrd->serial_disk_acquired > xfrd->serial_xfr_acquired)) {
/* reschedule task */
int ret = 0;
xfrhandler_type* xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
engine_type* engine = (engine_type*) xfrhandler->engine;
ods_log_assert(xfrhandler);
ods_log_assert(engine);
ods_log_debug("[%s] reschedule task for zone %s: disk serial=%u "
"acquired=%lu, memory serial=%u acquired=%lu", xfrd_str,
zone->name, xfrd->serial_disk,
(unsigned long)xfrd->serial_disk_acquired, xfrd->serial_xfr,
(unsigned long)xfrd->serial_xfr_acquired);
ret = zone_reschedule_task(zone, engine->taskq, TASK_READ);
if (ret != ODS_STATUS_OK) {
ods_log_crit("[%s] unable to reschedule task for zone %s: %s",
xfrd_str, zone->name, ods_status2str(ret));
} else {
engine_wakeup_workers(engine);
}
}
/* reset retransfer */
xfrd->msg_do_retransfer = 0;
lock_basic_unlock(&xfrd->serial_lock);
lock_basic_unlock(&xfrd->rw_lock);
lock_basic_unlock(&zone->zone_lock);
}
/**
* Dump answer to disk.
*
*/
static void
xfrd_dump_packet(xfrd_type* xfrd, buffer_type* buffer)
{
zone_type* zone = NULL;
char* xfrfile = NULL;
FILE* fd = NULL;
ldns_pkt* pkt = NULL;
ldns_status status = LDNS_STATUS_OK;
ods_log_assert(buffer);
ods_log_assert(xfrd);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
status = ldns_wire2pkt(&pkt, buffer_begin(buffer), buffer_limit(buffer));
if (status != LDNS_STATUS_OK) {
ods_log_crit("[%s] unable to dump packet zone %s: ldns_wire2pkt() "
"failed (%s)", xfrd_str, zone->name,
ldns_get_errorstr_by_id(status));
return;
}
ods_log_assert(pkt);
xfrfile = ods_build_path(zone->name, ".xfrd", 0, 1);
if (!xfrfile) {
ods_log_crit("[%s] unable to dump packet zone %s: build path failed",
xfrd_str, zone->name);
return;
}
lock_basic_lock(&xfrd->rw_lock);
if (xfrd->msg_do_retransfer && !xfrd->msg_seq_nr && !xfrd->msg_is_ixfr) {
fd = ods_fopen(xfrfile, NULL, "w");
} else {
fd = ods_fopen(xfrfile, NULL, "a");
}
free((void*) xfrfile);
if (!fd) {
ods_log_crit("[%s] unable to dump packet zone %s: ods_fopen() failed "
"(%s)", xfrd_str, zone->name, strerror(errno));
lock_basic_unlock(&xfrd->rw_lock);
return;
}
ods_log_assert(fd);
if (xfrd->msg_seq_nr == 0) {
fprintf(fd, ";;BEGINPACKET\n");
}
ldns_rr_list_print(fd, ldns_pkt_answer(pkt));
ods_fclose(fd);
lock_basic_unlock(&xfrd->rw_lock);
ldns_pkt_free(pkt);
}
/**
* Write SOA in packet.
*
*/
static void
xfrd_write_soa(xfrd_type* xfrd, buffer_type* buffer)
{
zone_type* zone = NULL;
size_t rdlength_pos = 0;
uint16_t rdlength = 0;
ods_log_assert(xfrd);
ods_log_assert(buffer);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->apex);
buffer_write_rdf(buffer, zone->apex);
buffer_write_u16(buffer, (uint16_t) LDNS_RR_TYPE_SOA);
buffer_write_u16(buffer, (uint16_t) zone->klass);
buffer_write_u32(buffer, xfrd->soa.ttl);
rdlength_pos = buffer_position(buffer);
buffer_skip(buffer, sizeof(rdlength));
buffer_write(buffer, xfrd->soa.mname+1, xfrd->soa.mname[0]);
buffer_write(buffer, xfrd->soa.rname+1, xfrd->soa.rname[0]);
buffer_write_u32(buffer, xfrd->soa.serial);
buffer_write_u32(buffer, xfrd->soa.refresh);
buffer_write_u32(buffer, xfrd->soa.retry);
buffer_write_u32(buffer, xfrd->soa.expire);
buffer_write_u32(buffer, xfrd->soa.minimum);
rdlength = buffer_position(buffer) - rdlength_pos - sizeof(rdlength);
buffer_write_u16_at(buffer, rdlength_pos, rdlength);
}
/**
* Update SOA.
*
*/
static void
xfrd_update_soa(xfrd_type* xfrd, buffer_type* buffer, uint32_t ttl,
uint16_t mname_pos, uint16_t rname_pos,
uint32_t refresh, uint32_t retry, uint32_t expire, uint32_t minimum)
{
zone_type* zone = NULL;
ods_log_assert(xfrd);
ods_log_assert(buffer);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->apex);
xfrd->soa.ttl = ttl;
xfrd->soa.refresh = refresh;
xfrd->soa.retry = retry;
xfrd->soa.expire = expire;
xfrd->soa.minimum = minimum;
buffer_set_position(buffer, mname_pos);
if (!(xfrd->soa.mname[0] =
buffer_read_dname(buffer, xfrd->soa.mname+1, 1))) {
xfrd->soa.mname[0] = 1;
xfrd->soa.mname[1] = 0;
}
buffer_set_position(buffer, rname_pos);
if (!(xfrd->soa.rname[0] =
buffer_read_dname(buffer, xfrd->soa.rname+1, 1))) {
xfrd->soa.rname[0] = 1;
xfrd->soa.rname[1] = 0;
}
}
/**
* Parse SOA RR in packet.
*
*/
static int
xfrd_parse_soa(xfrd_type* xfrd, buffer_type* buffer, unsigned rdata_only,
unsigned update, uint32_t t, uint32_t* soa_serial)
{
ldns_rr_type type = LDNS_RR_TYPE_SOA;
uint16_t mname_pos = 0;
uint16_t rname_pos = 0;
uint16_t pos = 0;
uint32_t serial = 0;
uint32_t refresh = 0;
uint32_t retry = 0;
uint32_t expire = 0;
uint32_t minimum = 0;
uint32_t ttl = t;
ods_log_assert(xfrd);
ods_log_assert(buffer);
/* type class ttl */
if (!rdata_only) {
if (!buffer_available(buffer, 10)) {
ods_log_debug("[%s] unable to parse soa: rr too short",
xfrd_str);
return 0;
}
type = (ldns_rr_type) buffer_read_u16(buffer);
if (type != LDNS_RR_TYPE_SOA) {
ods_log_debug("[%s] unable to parse soa: rrtype %u != soa",
xfrd_str, (unsigned) type);
return 0;
}
(void)buffer_read_u16(buffer); /* class */
ttl = buffer_read_u32(buffer);
/* rdata length */
if (!buffer_available(buffer, buffer_read_u16(buffer))) {
ods_log_debug("[%s] unable to parse soa: rdata too short",
xfrd_str);
return 0;
}
}
/* MNAME */
mname_pos = buffer_position(buffer);
if (!buffer_skip_dname(buffer)) {
ods_log_debug("[%s] unable to parse soa: bad mname",
xfrd_str);
return 0;
}
/* RNAME */
rname_pos = buffer_position(buffer);
if (!buffer_skip_dname(buffer)) {
ods_log_debug("[%s] unable to parse soa: bad rname",
xfrd_str);
return 0;
}
serial = buffer_read_u32(buffer);
refresh = buffer_read_u32(buffer);
retry = buffer_read_u32(buffer);
expire = buffer_read_u32(buffer);
minimum = buffer_read_u32(buffer);
pos = buffer_position(buffer);
if (soa_serial) {
*soa_serial = serial;
}
if (update) {
xfrd_update_soa(xfrd, buffer, ttl, mname_pos, rname_pos,
refresh, retry, expire, minimum);
}
buffer_set_position(buffer, pos);
return 1;
}
/**
* Parse RRs in packet.
*
*/
static ods_status
xfrd_parse_rrs(xfrd_type* xfrd, buffer_type* buffer, uint16_t count,
int* done)
{
ldns_rr_type type = 0;
uint16_t rrlen = 0;
uint32_t ttl = 0;
uint32_t serial = 0;
uint32_t tmp_serial = 0;
size_t i = 0;
ods_log_assert(xfrd);
ods_log_assert(buffer);
ods_log_assert(done);
for (i=0; i < count; ++i, ++xfrd->msg_rr_count) {
if (*done) {
return ODS_STATUS_OK;
}
if (!buffer_skip_dname(buffer)) {
return ODS_STATUS_SKIPDNAME;
}
if (!buffer_available(buffer, 10)) {
return ODS_STATUS_BUFAVAIL;
}
(void)buffer_position(buffer);
type = (ldns_rr_type) buffer_read_u16(buffer);
(void)buffer_read_u16(buffer); /* class */
ttl = buffer_read_u32(buffer);
rrlen = buffer_read_u16(buffer);
if (!buffer_available(buffer, rrlen)) {
return ODS_STATUS_BUFAVAIL;
}
if (type == LDNS_RR_TYPE_SOA) {
if (!xfrd_parse_soa(xfrd, buffer, 1, 0, ttl, &serial)) {
return ODS_STATUS_PARSESOA;
}
if (xfrd->msg_rr_count == 1 && serial != xfrd->msg_new_serial) {
/* 2nd RR is SOA with different serial, this is an IXFR */
xfrd->msg_is_ixfr = 1;
lock_basic_lock(&xfrd->serial_lock);
if (!xfrd->serial_disk_acquired) {
lock_basic_unlock(&xfrd->serial_lock);
/* got IXFR but need AXFR */
return ODS_STATUS_REQAXFR;
}
if (!xfrd->msg_do_retransfer && serial != xfrd->serial_disk) {
lock_basic_unlock(&xfrd->serial_lock);
/* bad start serial in IXFR */
return ODS_STATUS_INSERIAL;
}
lock_basic_unlock(&xfrd->serial_lock);
xfrd->msg_old_serial = serial;
tmp_serial = serial;
} else if (serial == xfrd->msg_new_serial) {
/* saw another SOA of new serial. */
if (xfrd->msg_is_ixfr == 1) {
xfrd->msg_is_ixfr = 2; /* seen middle SOA in ixfr */
} else {
*done = 1; /* final axfr/ixfr soa */
}
} else if (xfrd->msg_is_ixfr) {
/* some additional checks */
if (util_serial_gt(serial, xfrd->msg_new_serial)) {
/* bad middle serial in IXFR (too high) */
return ODS_STATUS_INSERIAL;
}
if (util_serial_gt(tmp_serial, serial)) {
/* middle serial decreases in IXFR */
return ODS_STATUS_INSERIAL;
}
/* serial ok, update tmp serial */
tmp_serial = serial;
}
} else {
buffer_skip(buffer, rrlen);
}
}
return ODS_STATUS_OK;
}
/**
* Parse packet.
*
*/
static xfrd_pkt_status
xfrd_parse_packet(xfrd_type* xfrd, buffer_type* buffer)
{
zone_type* zone = NULL;
uint16_t qdcount = 0;
uint16_t ancount = 0;
uint16_t ancount_todo = 0;
uint16_t rrcount = 0;
uint32_t serial = 0;
int done = 0;
ods_status status = ODS_STATUS_OK;
ods_log_assert(buffer);
ods_log_assert(xfrd);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
/* check packet size */
if (!buffer_available(buffer, BUFFER_PKT_HEADER_SIZE)) {
ods_log_error("[%s] unable to parse packet: zone %s received bad "
"packet from %s (too small)", xfrd_str, zone->name,
xfrd->master->address);
return XFRD_PKT_BAD;
}
/* check query id */
if (buffer_pkt_id(buffer) != xfrd->query_id) {
ods_log_error("[%s] bad packet: zone %s received bad query id "
"%u from %s (expected %u)", xfrd_str, zone->name,
buffer_pkt_id(buffer), xfrd->master->address, xfrd->query_id);
return XFRD_PKT_BAD;
}
/* check rcode */
if (buffer_pkt_rcode(buffer) != LDNS_RCODE_NOERROR) {
ods_log_error("[%s] bad packet: zone %s received error code %s from %s",
xfrd_str, zone->name, ldns_pkt_rcode2str(buffer_pkt_rcode(buffer)),
xfrd->master->address);
if (buffer_pkt_rcode(buffer) == LDNS_RCODE_NOTIMPL) {
return XFRD_PKT_NOTIMPL;
} else if (buffer_pkt_rcode(buffer) != LDNS_RCODE_NOTAUTH) {
return XFRD_PKT_BAD;
}
}
/* check tsig */
if (!xfrd_tsig_process(xfrd, buffer)) {
ods_log_error("[%s] bad packet: zone %s received bad tsig "
"from %s", xfrd_str, zone->name, xfrd->master->address);
return XFRD_PKT_BAD;
}
/* skip header and question section */
buffer_skip(buffer, BUFFER_PKT_HEADER_SIZE);
qdcount = buffer_pkt_qdcount(buffer);
for (rrcount = 0; rrcount < qdcount; rrcount++) {
if (!buffer_skip_rr(buffer, 1)) {
ods_log_error("[%s] bad packet: zone %s received bad "
"question section from %s (bad rr)", xfrd_str, zone->name,
xfrd->master->address);
return XFRD_PKT_BAD;
}
}
/* answer section */
ancount = buffer_pkt_ancount(buffer);
if (xfrd->msg_rr_count == 0 && ancount == 0) {
if (xfrd->tcp_conn == -1 && buffer_pkt_tc(buffer)) {
ods_log_info("[%s] zone %s received tc from %s, retry tcp",
xfrd_str, zone->name, xfrd->master->address);
return XFRD_PKT_TC;
}
ods_log_error("[%s] bad packet: zone %s received bad xfr packet "
"from %s (nodata)", xfrd_str, zone->name, xfrd->master->address);
return XFRD_PKT_BAD;
}
ancount_todo = ancount;
if (xfrd->msg_rr_count == 0) {
/* parse the first RR, see if it is a SOA */
if (!buffer_skip_dname(buffer) ||
!xfrd_parse_soa(xfrd, buffer, 0, 1, 0, &serial)) {
ods_log_error("[%s] bad packet: zone %s received bad xfr "
"packet from %s (bad soa)", xfrd_str, zone->name,
xfrd->master->address);
return XFRD_PKT_BAD;
}
/* check serial */
lock_basic_lock(&xfrd->serial_lock);
if (!xfrd->msg_do_retransfer &&
xfrd->serial_disk_acquired && xfrd->serial_disk == serial) {
ods_log_info("[%s] zone %s got update indicating current "
"serial %u from %s", xfrd_str, zone->name, serial,
xfrd->master->address);
xfrd->serial_disk_acquired = xfrd_time(xfrd);
if (xfrd->serial_xfr == serial) {
xfrd->serial_xfr_acquired = xfrd->serial_disk_acquired;
if (!xfrd->serial_notify_acquired) {
/* not notified or anything, so stop asking around */
xfrd->round_num = -1; /* next try start a new round */
xfrd_set_timer_refresh(xfrd);
ods_log_debug("[%s] zone %s wait refresh time", xfrd_str,
zone->name);
lock_basic_unlock(&xfrd->serial_lock);
return XFRD_PKT_NEWLEASE;
}
/* try next master */
ods_log_debug("[%s] zone %s try next master", xfrd_str,
zone->name);
lock_basic_unlock(&xfrd->serial_lock);
return XFRD_PKT_BAD;
}
}
if (!xfrd->msg_do_retransfer && xfrd->serial_disk_acquired &&
!util_serial_gt(serial, xfrd->serial_disk)) {
ods_log_info("[%s] zone %s ignoring old serial %u from %s "
"(have %u)", xfrd_str, zone->name, serial,
xfrd->master->address, xfrd->serial_disk);
lock_basic_unlock(&xfrd->serial_lock);
return XFRD_PKT_BAD;
}
xfrd->msg_new_serial = serial;
if (!xfrd->msg_do_retransfer && xfrd->serial_disk_acquired) {
xfrd->msg_old_serial = xfrd->serial_disk;
} else {
xfrd->msg_old_serial = 0;
}
/* update notify serial if this xfr is newer */
if (ancount > 1 && xfrd->serial_notify_acquired &&
util_serial_gt(serial, xfrd->serial_notify)) {
xfrd->serial_notify = serial;
}
lock_basic_unlock(&xfrd->serial_lock);
xfrd->msg_rr_count = 1;
xfrd->msg_is_ixfr = 0;
ancount_todo = ancount - 1;
}
/* check tc bit */
if (xfrd->tcp_conn == -1 && buffer_pkt_tc(buffer)) {
ods_log_info("[%s] zone %s received tc from %s, retry tcp",
xfrd_str, zone->name, xfrd->master->address);
return XFRD_PKT_TC;
}
if (xfrd->tcp_conn == -1 && ancount < 2) {
/* too short to be a real ixfr/axfr data transfer */
ods_log_info("[%s] zone %s received too short udp reply from %s, "
"retry tcp", xfrd_str, zone->name, xfrd->master->address);
return XFRD_PKT_TC;
}
status = xfrd_parse_rrs(xfrd, buffer, ancount_todo, &done);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] bad packet: zone %s received bad xfr packet "
"from %s (%s)", xfrd_str, zone->name, xfrd->master->address,
ods_status2str(status));
return XFRD_PKT_BAD;
}
if (xfrd->tcp_conn == -1 && !done) {
ods_log_error("[%s] bad packet: zone %s received bad xfr packet "
"(xfr over udp incomplete)", xfrd_str, zone->name);
return XFRD_PKT_BAD;
}
if (!done) {
return XFRD_PKT_MORE;
}
return XFRD_PKT_XFR;
}
/**
* Handle packet.
*
*/
static xfrd_pkt_status
xfrd_handle_packet(xfrd_type* xfrd, buffer_type* buffer)
{
xfrd_pkt_status res = XFRD_PKT_BAD;
zone_type* zone = NULL;
ods_log_assert(xfrd);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
res = xfrd_parse_packet(xfrd, buffer);
ods_log_debug("[%s] zone %s xfr packet parsed (res %d)", xfrd_str,
zone->name, res);
switch (res) {
case XFRD_PKT_MORE:
case XFRD_PKT_XFR:
/* continue with commit */
break;
case XFRD_PKT_NEWLEASE:
case XFRD_PKT_TC:
return res;
break;
case XFRD_PKT_NOTIMPL:
case XFRD_PKT_BAD:
default:
/* rollback */
if (xfrd->msg_seq_nr > 0) {
buffer_clear(buffer);
ods_log_info("[%s] zone %s xfr rollback", xfrd_str,
zone->name);
buffer_flip(buffer);
}
return res;
break;
}
/* dump reply on disk to diff file */
xfrd_dump_packet(xfrd, buffer);
/* more? */
xfrd->msg_seq_nr++;
if (res == XFRD_PKT_MORE) {
/* wait for more */
return XFRD_PKT_MORE;
}
/* done */
buffer_clear(buffer);
buffer_flip(buffer);
/* commit packet */
xfrd_commit_packet(xfrd);
/* next time */
lock_basic_lock(&xfrd->serial_lock);
ods_log_info("[%s] zone %s transfer done [notify acquired %lu, serial on "
"disk %u, notify serial %u]", xfrd_str, zone->name,
(unsigned long)xfrd->serial_notify_acquired, xfrd->serial_disk,
xfrd->serial_notify);
if (xfrd->serial_notify_acquired &&
!util_serial_gt(xfrd->serial_notify, xfrd->serial_disk)) {
ods_log_verbose("[%s] zone %s reset notify acquired", xfrd_str,
zone->name);
xfrd->serial_notify_acquired = 0;
}
if (!xfrd->serial_notify_acquired) {
ods_log_debug("[%s] zone %s xfr done", xfrd_str, zone->name);
xfrd->round_num = -1; /* next try start anew */
xfrd_set_timer_refresh(xfrd);
lock_basic_unlock(&xfrd->serial_lock);
return XFRD_PKT_XFR;
}
lock_basic_unlock(&xfrd->serial_lock);
/* try to get an even newer serial */
ods_log_info("[%s] zone %s try get newer serial", xfrd_str, zone->name);
return XFRD_PKT_BAD;
}
/** TCP **/
/**
* Write to tcp.
*
*/
static void
xfrd_tcp_write(xfrd_type* xfrd, tcp_set_type* set)
{
zone_type* zone = NULL;
tcp_conn_type* tcp = NULL;
int ret = 0;
int error = 0;
socklen_t len = 0;
ods_log_assert(set);
ods_log_assert(xfrd);
ods_log_assert(xfrd->tcp_conn != -1);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
tcp = set->tcp_conn[xfrd->tcp_conn];
if (tcp->total_bytes == 0) {
/* check for pending error from nonblocking connect */
/* from Stevens, unix network programming, vol1, 3rd ed, p450 */
len = sizeof(error);
if (getsockopt(tcp->fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0) {
error = errno; /* on solaris errno is error */
}
if (error == EINPROGRESS || error == EWOULDBLOCK) {
ods_log_debug("[%s] zone %s zero write, write again later (%s)",
xfrd_str, zone->name, strerror(error));
return; /* try again later */
}
if (error != 0) {
ods_log_error("[%s] zone %s cannot tcp connect to %s: %s",
xfrd_str, zone->name, xfrd->master->address, strerror(errno));
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 1);
return;
}
}
ret = tcp_conn_write(tcp);
if(ret == -1) {
ods_log_error("[%s] zone %s cannot tcp write to %s: %s",
xfrd_str, zone->name, xfrd->master->address, strerror(errno));
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 1);
return;
}
if (ret == 0) {
ods_log_debug("[%s] zone %s zero write, write again later",
xfrd_str, zone->name);
return; /* write again later */
}
/* done writing, get ready for reading */
ods_log_debug("[%s] zone %s done writing, get ready for reading",
xfrd_str, zone->name);
tcp->is_reading = 1;
tcp_conn_ready(tcp);
xfrd->handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT;
xfrd_tcp_read(xfrd, set);
}
/**
* Open tcp connection.
*
*/
static int
xfrd_tcp_open(xfrd_type* xfrd, tcp_set_type* set)
{
int fd, family, conn;
struct sockaddr_storage to;
socklen_t to_len;
zone_type* zone = NULL;
ods_log_assert(set);
ods_log_assert(xfrd);
ods_log_assert(xfrd->tcp_conn != -1);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_debug("[%s] zone %s open tcp connection to %s", xfrd_str,
zone->name, xfrd->master->address);
set->tcp_conn[xfrd->tcp_conn]->is_reading = 0;
set->tcp_conn[xfrd->tcp_conn]->total_bytes = 0;
set->tcp_conn[xfrd->tcp_conn]->msglen = 0;
if (xfrd->master->family == AF_INET6) {
family = PF_INET6;
} else {
family = PF_INET;
}
fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
set->tcp_conn[xfrd->tcp_conn]->fd = fd;
if (fd == -1) {
ods_log_error("[%s] zone %s cannot create tcp socket to %s: %s",
xfrd_str, zone->name, xfrd->master->address, strerror(errno));
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 0);
return 0;
}
if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
ods_log_error("[%s] zone %s cannot fcntl tcp socket: %s",
xfrd_str, zone->name, strerror(errno));
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 0);
return 0;
}
to_len = xfrd_acl_sockaddr_to(xfrd->master, &to);
/* bind it? */
conn = connect(fd, (struct sockaddr*)&to, to_len);
if (conn == -1 && errno != EINPROGRESS) {
ods_log_error("[%s] zone %s cannot connect tcp socket to %s: %s",
xfrd_str, zone->name, xfrd->master->address, strerror(errno));
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 0);
return 0;
}
xfrd->handler.fd = fd;
xfrd->handler.event_types = NETIO_EVENT_WRITE|NETIO_EVENT_TIMEOUT;
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_TCP_TIMEOUT);
return 1;
}
/**
* Obtain tcp.
*
*/
static void
xfrd_tcp_obtain(xfrd_type* xfrd, tcp_set_type* set)
{
xfrhandler_type* xfrhandler;
int i = 0;
ods_log_assert(set);
ods_log_assert(xfrd);
ods_log_assert(xfrd->tcp_conn == -1);
ods_log_assert(xfrd->tcp_waiting == 0);
if (set->tcp_count < TCPSET_MAX) {
ods_log_assert(!set->tcp_waiting_first);
set->tcp_count ++;
/* find a free tcp_buffer */
for (i=0; i < TCPSET_MAX; i++) {
if (set->tcp_conn[i]->fd == -1) {
xfrd->tcp_conn = i;
break;
}
}
ods_log_assert(xfrd->tcp_conn != -1);
xfrd->tcp_waiting = 0;
/* stop udp use (if any) */
if (xfrd->handler.fd != -1) {
xfrd_udp_release(xfrd);
}
if (!xfrd_tcp_open(xfrd, set)) {
return;
}
xfrd_tcp_xfr(xfrd, set);
return;
}
/* wait, at end of line */
ods_log_verbose("[%s] max number of tcp connections (%d) reached",
xfrd_str, TCPSET_MAX);
xfrd->tcp_waiting = 1;
xfrd_unset_timer(xfrd);
/* add it to the waiting queue */
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
xfrd->tcp_waiting_next = xfrhandler->tcp_waiting_first;
xfrhandler->tcp_waiting_first = xfrd;
}
/**
* Start xfr.
*
*/
static void
xfrd_tcp_xfr(xfrd_type* xfrd, tcp_set_type* set)
{
tcp_conn_type* tcp = NULL;
zone_type* zone = NULL;
ods_log_assert(set);
ods_log_assert(xfrd);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(xfrd->tcp_conn != -1);
ods_log_assert(xfrd->tcp_waiting == 0);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
/* start AXFR or IXFR for the zone */
tcp = set->tcp_conn[xfrd->tcp_conn];
if (xfrd->msg_do_retransfer || xfrd->serial_xfr_acquired <= 0 ||
xfrd->master->ixfr_disabled) {
ods_log_info("[%s] zone %s request axfr to %s", xfrd_str,
zone->name, xfrd->master->address);
buffer_pkt_query(tcp->packet, zone->apex, LDNS_RR_TYPE_AXFR,
zone->klass);
} else {
ods_log_info("[%s] zone %s request tcp/ixfr=%u to %s", xfrd_str,
zone->name, xfrd->soa.serial, xfrd->master->address);
buffer_pkt_query(tcp->packet, zone->apex, LDNS_RR_TYPE_IXFR,
zone->klass);
buffer_pkt_set_nscount(tcp->packet, 1);
xfrd_write_soa(xfrd, tcp->packet);
}
/* make packet */
xfrd->query_id = buffer_pkt_id(tcp->packet);
xfrd->msg_seq_nr = 0;
xfrd->msg_rr_count = 0;
xfrd->msg_old_serial = 0;
xfrd->msg_new_serial = 0;
xfrd->msg_is_ixfr = 0;
xfrd_tsig_sign(xfrd, tcp->packet);
buffer_flip(tcp->packet);
tcp->msglen = buffer_limit(tcp->packet);
ods_log_verbose("[%s] zone %s sending tcp query id=%d", xfrd_str,
zone->name, xfrd->query_id);
/* wait for select to complete connect before write */
}
/**
* Read from tcp.
*
*/
static void
xfrd_tcp_read(xfrd_type* xfrd, tcp_set_type* set)
{
tcp_conn_type* tcp = NULL;
int ret = 0;
ods_log_assert(set);
ods_log_assert(xfrd);
ods_log_assert(xfrd->tcp_conn != -1);
tcp = set->tcp_conn[xfrd->tcp_conn];
ret = tcp_conn_read(tcp);
if (ret == -1) {
xfrd_set_timer_now(xfrd);
xfrd_tcp_release(xfrd, set, 1);
return;
}
if (ret == 0) {
return;
}
/* completed msg */
buffer_flip(tcp->packet);
ret = xfrd_handle_packet(xfrd, tcp->packet);
switch (ret) {
case XFRD_PKT_MORE:
tcp_conn_ready(tcp);
break;
case XFRD_PKT_XFR:
case XFRD_PKT_NEWLEASE:
ods_log_verbose("[%s] tcp read %s: release connection", xfrd_str,
XFRD_PKT_XFR?"xfr":"newlease");
xfrd_tcp_release(xfrd, set, 1);
ods_log_assert(xfrd->round_num == -1);
break;
case XFRD_PKT_NOTIMPL:
xfrd->master->ixfr_disabled = time_now();
ods_log_verbose("[%s] disable ixfr requests for %s from now (%lu)",
xfrd_str, xfrd->master->address, (unsigned long)xfrd->master->ixfr_disabled);
/* break; */
case XFRD_PKT_BAD:
default:
ods_log_debug("[%s] tcp read %s: release connection", xfrd_str,
ret==XFRD_PKT_BAD?"bad":"notimpl");
xfrd_tcp_release(xfrd, set, 1);
xfrd_make_request(xfrd);
break;
}
}
/**
* Release tcp connection from set for xfrd. If there are waiting TCP
* connections open as many as free slots in set. This step is skipped
* if open_waiting flag is unset.
*/
static void
xfrd_tcp_release(xfrd_type* xfrd, tcp_set_type* set, int open_waiting)
{
xfrhandler_type* xfrhandler;
int conn = 0;
zone_type* zone = NULL;
ods_log_assert(set);
ods_log_assert(xfrd);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
ods_log_assert(xfrd->tcp_conn != -1);
ods_log_assert(xfrd->tcp_waiting == 0);
zone = (zone_type*) xfrd->zone;
ods_log_debug("[%s] zone %s release tcp connection to %s", xfrd_str,
zone->name, xfrd->master->address);
conn = xfrd->tcp_conn;
xfrd->tcp_conn = -1;
xfrd->tcp_waiting = 0;
xfrd->handler.fd = -1;
xfrd->handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT;
if (set->tcp_conn[conn]->fd != -1) {
close(set->tcp_conn[conn]->fd);
}
set->tcp_conn[conn]->fd = -1;
set->tcp_count --;
/* see if there are any connections waiting for a slot. Or return. */
if (!open_waiting) return;
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
while (xfrhandler->tcp_waiting_first && set->tcp_count < TCPSET_MAX) {
int i;
xfrd_type* waiting_xfrd = xfrhandler->tcp_waiting_first;
xfrhandler->tcp_waiting_first = waiting_xfrd->tcp_waiting_next;
waiting_xfrd->tcp_waiting_next = NULL;
/* find a free tcp_buffer */
for (i=0; i < TCPSET_MAX; i++) {
if (set->tcp_conn[i]->fd == -1) {
waiting_xfrd->tcp_conn = i;
set->tcp_count++;
break;
}
}
waiting_xfrd->tcp_waiting = 0;
/* stop udp use (if any) */
if (waiting_xfrd->handler.fd != -1) {
xfrd_udp_release(waiting_xfrd);
}
/* if xfrd_tcp_open() fails its slot in set->tcp_conn[]
* is released. Continue to next. We don't put it back in the
* waiting queue, it would keep the signer busy retrying, making
* things only worse. */
if (xfrd_tcp_open(waiting_xfrd, set)) {
xfrd_tcp_xfr(waiting_xfrd, set);
}
}
}
/** UDP **/
/**
* Send packet over udp.
*
*/
static int
xfrd_udp_send(xfrd_type* xfrd, buffer_type* buffer)
{
struct sockaddr_storage to;
socklen_t to_len = 0;
int fd = -1;
int family = PF_INET;
ssize_t nb = -1;
ods_log_assert(buffer);
ods_log_assert(xfrd);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
/* this will set the remote port to acl->port or TCP_PORT */
to_len = xfrd_acl_sockaddr_to(xfrd->master, &to);
/* get the address family of the remote host */
if (xfrd->master->family == AF_INET6) {
family = PF_INET6;
}
/* create socket */
fd = socket(family, SOCK_DGRAM, IPPROTO_UDP);
if (fd == -1) {
ods_log_error("[%s] unable to send data over udp to %s: "
"socket() failed (%s)", xfrd_str, xfrd->master->address,
strerror(errno));
return -1;
}
/* bind it? */
/* send it (udp) */
ods_log_deeebug("[%s] send %lu bytes over udp to %s", xfrd_str,
(unsigned long)buffer_remaining(buffer), xfrd->master->address);
nb = sendto(fd, buffer_current(buffer), buffer_remaining(buffer), 0,
(struct sockaddr*)&to, to_len);
if (nb == -1) {
ods_log_error("[%s] unable to send data over udp to %s: "
"sendto() failed (%s)", xfrd_str, xfrd->master->address,
strerror(errno));
close(fd);
return -1;
}
return fd;
}
/**
* Send IXFR request.
*
*/
static int
xfrd_udp_send_request_ixfr(xfrd_type* xfrd)
{
int fd;
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
ods_log_assert(xfrd);
ods_log_assert(xfrd->master);
ods_log_assert(xfrd->master->address);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
if (xfrd->tcp_conn != -1) {
/* tcp is using the handler.fd */
ods_log_error("[%s] unable to transfer zone %s: tried to send "
"udp while tcp obtained", xfrd_str, zone->name);
return -1;
}
/* make packet */
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
buffer_pkt_query(xfrhandler->packet, zone->apex, LDNS_RR_TYPE_IXFR,
zone->klass);
xfrd->query_id = buffer_pkt_id(xfrhandler->packet);
xfrd->msg_seq_nr = 0;
xfrd->msg_rr_count = 0;
xfrd->msg_old_serial = 0;
xfrd->msg_new_serial = 0;
xfrd->msg_is_ixfr = 0;
buffer_pkt_set_nscount(xfrhandler->packet, 1);
xfrd_write_soa(xfrd, xfrhandler->packet);
xfrd_tsig_sign(xfrd, xfrhandler->packet);
buffer_flip(xfrhandler->packet);
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_UDP_TIMEOUT);
ods_log_info("[%s] zone %s request udp/ixfr=%u to %s", xfrd_str,
zone->name, xfrd->soa.serial, xfrd->master->address);
if((fd = xfrd_udp_send(xfrd, xfrhandler->packet)) == -1) {
return -1;
}
return fd;
}
/**
* Obtain udp.
*
*/
static void
xfrd_udp_obtain(xfrd_type* xfrd)
{
xfrhandler_type* xfrhandler = NULL;
ods_log_assert(xfrd);
ods_log_assert(xfrd->xfrhandler);
ods_log_assert(xfrd->udp_waiting == 0);
xfrhandler = (void*) xfrd->xfrhandler;
if (xfrd->tcp_conn != -1) {
/* no tcp and udp at the same time */
xfrd_tcp_release(xfrd, xfrhandler->tcp_set, 1);
}
if (xfrhandler->udp_use_num < XFRD_MAX_UDP) {
xfrhandler->udp_use_num++;
xfrd->handler.fd = xfrd_udp_send_request_ixfr(xfrd);
if (xfrd->handler.fd == -1) {
xfrhandler->udp_use_num--;
}
return;
}
/* queue the zone as last */
xfrd->udp_waiting = 1;
xfrd->udp_waiting_next = NULL;
if (!xfrhandler->udp_waiting_first) {
xfrhandler->udp_waiting_first = xfrd;
}
if (xfrhandler->udp_waiting_last) {
xfrhandler->udp_waiting_last->udp_waiting_next = xfrd;
}
xfrhandler->udp_waiting_last = xfrd;
xfrd_unset_timer(xfrd);
}
/**
* Read packet from udp.
*
*/
static int
xfrd_udp_read_packet(xfrd_type* xfrd)
{
xfrhandler_type* xfrhandler = NULL;
ssize_t received = 0;
ods_log_assert(xfrd);
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
/* read the data */
buffer_clear(xfrhandler->packet);
received = recvfrom(xfrd->handler.fd, buffer_begin(xfrhandler->packet),
buffer_remaining(xfrhandler->packet), 0, NULL, NULL);
if (received == -1) {
ods_log_error("[%s] unable to read packet: recvfrom() failed fd %d "
"(%s)", xfrd_str, xfrd->handler.fd, strerror(errno));
return 0;
}
buffer_set_limit(xfrhandler->packet, received);
return 1;
}
/**
* Read from udp.
*
*/
static void
xfrd_udp_read(xfrd_type* xfrd)
{
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
xfrd_pkt_status res = XFRD_PKT_BAD;
ods_log_assert(xfrd);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_debug("[%s] zone %s read data from udp", xfrd_str,
zone->name);
if (!xfrd_udp_read_packet(xfrd)) {
ods_log_error("[%s] unable to read data from udp zone %s: "
"xfrd_udp_read_packet() failed", xfrd_str, zone->name);
xfrd_udp_release(xfrd);
return;
}
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
res = xfrd_handle_packet(xfrd, xfrhandler->packet);
switch (res) {
case XFRD_PKT_TC:
ods_log_verbose("[%s] truncation from %s",
xfrd_str, xfrd->master->address);
xfrd_udp_release(xfrd);
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_TCP_TIMEOUT);
xfrd_tcp_obtain(xfrd, xfrhandler->tcp_set);
break;
case XFRD_PKT_XFR:
case XFRD_PKT_NEWLEASE:
ods_log_verbose("[%s] xfr/newlease from %s",
xfrd_str, xfrd->master->address);
/* nothing more to do */
ods_log_assert(xfrd->round_num == -1);
xfrd_udp_release(xfrd);
break;
case XFRD_PKT_NOTIMPL:
xfrd->master->ixfr_disabled = time_now();
ods_log_verbose("[%s] disable ixfr requests for %s from now (%lu)",
xfrd_str, xfrd->master->address, (unsigned long)xfrd->master->ixfr_disabled);
/* break; */
case XFRD_PKT_BAD:
default:
ods_log_debug("[%s] bad ixfr packet from %s",
xfrd_str, xfrd->master->address);
xfrd_udp_release(xfrd);
xfrd_make_request(xfrd);
break;
}
}
/**
* Release udp.
*
*/
static void
xfrd_udp_release(xfrd_type* xfrd)
{
xfrhandler_type* xfrhandler = NULL;
ods_log_assert(xfrd);
ods_log_assert(xfrd->udp_waiting == 0);
if(xfrd->handler.fd != -1)
close(xfrd->handler.fd);
xfrd->handler.fd = -1;
xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
/* see if there are waiting zones */
if (xfrhandler->udp_use_num == XFRD_MAX_UDP) {
while (xfrhandler->udp_waiting_first) {
/* snip off waiting list */
xfrd_type* wf = xfrhandler->udp_waiting_first;
ods_log_assert(wf->udp_waiting);
wf->udp_waiting = 0;
xfrhandler->udp_waiting_first = wf->udp_waiting_next;
if (xfrhandler->udp_waiting_last == wf) {
xfrhandler->udp_waiting_last = NULL;
}
/* see if this zone needs udp connection */
if (wf->tcp_conn == -1) {
wf->handler.fd = xfrd_udp_send_request_ixfr(wf);
if (wf->handler.fd != -1) {
return;
}
}
}
}
/* no waiting zones */
if (xfrhandler->udp_use_num > 0) {
xfrhandler->udp_use_num --;
}
}
/**
* Make a zone transfer request.
*
*/
static void
xfrd_make_request(xfrd_type* xfrd)
{
zone_type* zone = NULL;
dnsin_type* dnsin = NULL;
if (!xfrd || !xfrd->xfrhandler) {
return;
}
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->adinbound);
ods_log_assert(zone->adinbound->type == ADAPTER_DNS);
ods_log_assert(zone->adinbound->config);
dnsin = (dnsin_type*) zone->adinbound->config;
if (xfrd->next_master != -1) {
/* we are told to use this next master */
xfrd->master_num = xfrd->next_master;
xfrd->master = NULL; /* acl_find_num(...) */
/* if there is no next master, fallback to use the first one */
if (!xfrd->master) {
xfrd->master = dnsin->request_xfr;
xfrd->master_num = 0;
}
/* fallback to cycle master */
xfrd->next_master = -1;
xfrd->round_num = 0; /* fresh set of retries after notify */
} else {
/* cycle master */
if (xfrd->round_num != -1 && xfrd->master &&
xfrd->master->next) {
/* try the next master */
xfrd->master = xfrd->master->next;
xfrd->master_num++;
} else {
/* start a new round */
xfrd->master = dnsin->request_xfr;
xfrd->master_num = 0;
xfrd->round_num++;
}
if (xfrd->round_num >= XFRD_MAX_ROUNDS) {
/* tried all servers that many times, wait */
xfrd->round_num = -1;
xfrd_set_timer_retry(xfrd);
ods_log_verbose("[%s] zone %s make request wait retry",
xfrd_str, zone->name);
return;
}
}
if (!xfrd->master) {
ods_log_debug("[%s] unable to make request for zone %s: no master",
xfrd_str, zone->name);
xfrd->round_num = -1;
xfrd_set_timer_retry(xfrd);
return;
}
/* cache ixfr_disabled only for XFRD_NO_IXFR_CACHE time */
if (xfrd->master->ixfr_disabled &&
(xfrd->master->ixfr_disabled + XFRD_NO_IXFR_CACHE) <=
xfrd_time(xfrd)) {
ods_log_verbose("[%s] clear negative caching ixfr disabled for "
"master %s", xfrd_str, xfrd->master->address);
ods_log_debug("[%s] clear negative caching calc: %lu + %lu <= %lu",
xfrd_str, (unsigned long) xfrd->master->ixfr_disabled, (unsigned long)XFRD_NO_IXFR_CACHE,
(unsigned long) xfrd_time(xfrd));
xfrd->master->ixfr_disabled = 0;
}
/* perform xfr request */
if (xfrd->serial_xfr_acquired && !xfrd->master->ixfr_disabled &&
!xfrd->serial_retransfer) {
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_UDP_TIMEOUT);
ods_log_verbose("[%s] zone %s make request [udp round %d master %s:%u]",
xfrd_str, zone->name, xfrd->round_num, xfrd->master->address,
xfrd->master->port);
xfrd_udp_obtain(xfrd);
} else if (!xfrd->serial_xfr_acquired || xfrd->master->ixfr_disabled ||
xfrd->serial_retransfer) {
xfrhandler_type* xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
if (xfrd->serial_retransfer) {
xfrd->msg_do_retransfer = 1;
xfrd->serial_retransfer = 0;
}
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_TCP_TIMEOUT);
ods_log_verbose("[%s] zone %s make request [tcp round %d master %s:%u]",
xfrd_str, zone->name, xfrd->round_num, xfrd->master->address,
xfrd->master->port);
xfrd_tcp_obtain(xfrd, xfrhandler->tcp_set);
}
}
/**
* Handle zone transfer.
*
*/
static void
xfrd_handle_zone(netio_type* ATTR_UNUSED(netio),
netio_handler_type* handler, netio_events_type event_types)
{
xfrd_type* xfrd = NULL;
zone_type* zone = NULL;
if (!handler) {
return;
}
xfrd = (xfrd_type*) handler->user_data;
ods_log_assert(xfrd);
zone = (zone_type*) xfrd->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
if (xfrd->tcp_conn != -1) {
/* busy in tcp transaction */
xfrhandler_type* xfrhandler = (xfrhandler_type*) xfrd->xfrhandler;
ods_log_assert(xfrhandler);
if (event_types & NETIO_EVENT_READ) {
ods_log_deeebug("[%s] zone %s event tcp read", xfrd_str, zone->name);
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_TCP_TIMEOUT);
xfrd_tcp_read(xfrd, xfrhandler->tcp_set);
return;
} else if (event_types & NETIO_EVENT_WRITE) {
ods_log_deeebug("[%s] zone %s event tcp write", xfrd_str,
zone->name);
xfrd_set_timer(xfrd, xfrd_time(xfrd) + XFRD_TCP_TIMEOUT);
xfrd_tcp_write(xfrd, xfrhandler->tcp_set);
return;
} else if (event_types & NETIO_EVENT_TIMEOUT) {
/* tcp connection timed out. Stop it. */
ods_log_deeebug("[%s] zone %s event tcp timeout", xfrd_str,
zone->name);
xfrd_tcp_release(xfrd, xfrhandler->tcp_set, 1);
/* continue to retry; as if a timeout happened */
event_types = NETIO_EVENT_TIMEOUT;
}
}
if (event_types & NETIO_EVENT_READ) {
/* busy in udp transaction */
ods_log_deeebug("[%s] zone %s event udp read", xfrd_str,
zone->name);
xfrd_set_timer_now(xfrd);
xfrd_udp_read(xfrd);
return;
}
/* timeout */
ods_log_deeebug("[%s] zone %s timeout", xfrd_str, zone->name);
if (handler->fd != -1) {
ods_log_assert(xfrd->tcp_conn == -1);
xfrd_udp_release(xfrd);
}
if (xfrd->tcp_waiting) {
ods_log_deeebug("[%s] zone %s skips retry: tcp connections full",
xfrd_str, zone->name);
xfrd_unset_timer(xfrd);
return;
}
if (xfrd->udp_waiting) {
ods_log_deeebug("[%s] zone %s skips retry: udp connections full",
xfrd_str, zone->name);
xfrd_unset_timer(xfrd);
return;
}
/* make a new request */
xfrd_make_request(xfrd);
}
/**
* Backup xfrd domain names.
*
*/
static void
xfrd_backup_dname(FILE* out, uint8_t* dname)
{
uint8_t* d= dname+1;
uint8_t len = *d++;
uint8_t i;
if (dname[0]<=1) {
fprintf(out, ".");
return;
}
while (len) {
ods_log_assert(d - (dname+1) <= dname[0]);
for (i=0; izone;
char* file = NULL;
int timeout = 0;
FILE* fd = NULL;
if (zone && zone->name) {
file = ods_build_path(zone->name, ".xfrd-state", 0, 1);
if (file) {
fd = ods_fopen(file, NULL, "w");
if (fd) {
if (xfrd->handler.timeout) {
timeout = xfrd->timeout.tv_sec;
}
fprintf(fd, "%s\n", ODS_SE_FILE_MAGIC_V3);
fprintf(fd, ";;Zone: name %s ttl %u mname ",
zone->name,
(unsigned) xfrd->soa.ttl);
xfrd_backup_dname(fd, xfrd->soa.mname),
fprintf(fd, " rname ");
xfrd_backup_dname(fd, xfrd->soa.rname),
fprintf(fd, " serial %u refresh %u retry %u expire %u "
"minimum %u\n",
(unsigned) xfrd->soa.serial,
(unsigned) xfrd->soa.refresh,
(unsigned) xfrd->soa.retry,
(unsigned) xfrd->soa.expire,
(unsigned) xfrd->soa.minimum);
fprintf(fd, ";;Master: num %d next %d round %d timeout %d\n",
xfrd->master_num,
xfrd->next_master,
xfrd->round_num,
timeout);
fprintf(fd, ";;Serial: xfr %u %u notify %u %u disk %u %u\n",
(unsigned) xfrd->serial_xfr,
(unsigned) xfrd->serial_xfr_acquired,
(unsigned) xfrd->serial_notify,
(unsigned) xfrd->serial_notify_acquired,
(unsigned) xfrd->serial_disk,
(unsigned) xfrd->serial_disk_acquired);
fprintf(fd, "%s\n", ODS_SE_FILE_MAGIC_V3);
ods_fclose(fd);
}
free(file);
}
}
}
/**
* Unlink xfrd file.
*
*/
static void
xfrd_unlink(xfrd_type* xfrd)
{
zone_type* zone = (zone_type*) xfrd->zone;
char* file = NULL;
if (zone && zone->name) {
ods_log_info("[%s] unlink zone %s xfrd state", xfrd_str, zone->name);
file = ods_build_path(zone->name, ".xfrd-state", 0, 1);
if (file) {
(void)unlink(file);
free(file);
}
}
}
/**
* Cleanup zone transfer structure.
*
*/
void
xfrd_cleanup(xfrd_type* xfrd, int backup)
{
if (!xfrd) {
return;
}
/* backup */
if (backup) {
xfrd_backup(xfrd);
} else {
xfrd_unlink(xfrd);
}
tsig_rr_cleanup(xfrd->tsig_rr);
lock_basic_destroy(&xfrd->serial_lock);
lock_basic_destroy(&xfrd->rw_lock);
free(xfrd);
}
opendnssec-2.0.4/signer/src/wire/acl.c 0000644 0001750 0001750 00000031702 13036123676 014540 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Access Control List.
*
*/
#include "config.h"
#include "log.h"
#include "file.h"
#include "status.h"
#include "wire/acl.h"
static const char* acl_str = "acl";
/**
* Returns range type.
* mask is the 2nd part of the range.
*
*/
static acl_range_type
acl_parse_range_type(char* ip, char** mask)
{
char *p;
if((p=strchr(ip, '&'))!=0) {
*p = 0;
*mask = p+1;
return ACL_RANGE_MASK;
}
if((p=strchr(ip, '/'))!=0) {
*p = 0;
*mask = p+1;
return ACL_RANGE_SUBNET;
}
if((p=strchr(ip, '-'))!=0) {
*p = 0;
*mask = p+1;
return ACL_RANGE_MINMAX;
}
*mask = 0;
return ACL_RANGE_SINGLE;
}
/**
* Parses subnet mask, fills 0 mask as well
*
*/
static ods_status
acl_parse_range_subnet(char* p, void* addr, int maxbits)
{
int subnet_bits = atoi(p);
uint8_t* addr_bytes = (uint8_t*)addr;
if (subnet_bits == 0 && strcmp(p, "0")!=0) {
return ODS_STATUS_ACL_SUBNET_BAD_RANGE;
}
if (subnet_bits < 0 || subnet_bits > maxbits) {
return ODS_STATUS_ACL_SUBNET_OUT_RANGE;
}
/* fill addr with n bits of 1s (struct has been zeroed) */
while(subnet_bits >= 8) {
*addr_bytes++ = 0xff;
subnet_bits -= 8;
}
if(subnet_bits > 0) {
uint8_t shifts[] =
{0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
*addr_bytes = shifts[subnet_bits];
}
return ODS_STATUS_OK;
}
/**
* Parse family from address.
*
*/
int
acl_parse_family(const char* a)
{
/* see if addr is ipv6 or ipv4 -- by : and . */
while (*a) {
if (*a == '.') {
return AF_INET;
}
if (*a == ':') {
return AF_INET6;
}
++a;
}
/* default to v4 */
return AF_INET;
}
/**
* Create ACL.
*
*/
acl_type*
acl_create(char* address, char* port,
char* tsig_name, tsig_type* tsig)
{
ods_status status = ODS_STATUS_OK;
acl_type* acl = NULL;
char* p = NULL;
CHECKALLOC(acl = (acl_type*) malloc(sizeof(acl_type)));
acl->address = NULL;
acl->next = NULL;
acl->tsig = NULL;
if (tsig_name) {
acl->tsig = tsig_lookup_by_name(tsig, tsig_name);
if (!acl->tsig) {
ods_log_error("[%s] unable to create acl: tsig %s not found",
acl_str, tsig_name);
acl_cleanup(acl);
return NULL;
}
}
acl->port = 0;
if (port) {
acl->port = atoi((const char*) port);
}
memset(&acl->addr, 0, sizeof(union acl_addr_storage));
memset(&acl->range_mask, 0, sizeof(union acl_addr_storage));
if (address) {
acl->family = acl_parse_family(address);
acl->range_type = acl_parse_range_type(address, &p);
acl->address = strdup(address);
if (!acl->address) {
ods_log_error("[%s] unable to create acl: allocator_strdup() "
"failed", acl_str);
acl_cleanup(acl);
return NULL;
}
if (acl->family == AF_INET6) {
if (inet_pton(AF_INET6, acl->address, &acl->addr.addr6) != 1) {
ods_log_error("[%s] unable to create acl: bad ipv6 address "
"(%s)", acl_str, acl->address);
acl_cleanup(acl);
return NULL;
}
if (acl->range_type == ACL_RANGE_MASK ||
acl->range_type == ACL_RANGE_MINMAX) {
if (inet_pton(AF_INET6, p, &acl->range_mask.addr6) != 1) {
ods_log_error("[%s] unable to create acl: bad ipv6 address"
" mask (%s)", acl_str, p);
acl_cleanup(acl);
return NULL;
}
} else if (acl->range_type == ACL_RANGE_SUBNET) {
status = acl_parse_range_subnet(p, &acl->range_mask.addr6, 128);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to create acl: %s (%s)",
acl_str, ods_status2str(status), p);
acl_cleanup(acl);
return NULL;
}
}
} else if (acl->family == AF_INET) {
if (inet_pton(AF_INET, acl->address, &acl->addr.addr) != 1) {
ods_log_error("[%s] unable to create acl: bad ipv4 address "
"(%s)", acl_str, acl->address);
acl_cleanup(acl);
return NULL;
}
if (acl->range_type == ACL_RANGE_MASK ||
acl->range_type == ACL_RANGE_MINMAX) {
if (inet_pton(AF_INET, p, &acl->range_mask.addr) != 1) {
ods_log_error("[%s] unable to create acl: bad ipv4 address"
" mask (%s)", acl_str, p);
acl_cleanup(acl);
return NULL;
}
} else if (acl->range_type == ACL_RANGE_SUBNET) {
status = acl_parse_range_subnet(p, &acl->range_mask.addr, 32);
if (status != ODS_STATUS_OK) {
ods_log_error("[%s] unable to create acl: %s (%s)",
acl_str, ods_status2str(status), p);
acl_cleanup(acl);
return NULL;
}
}
}
}
acl->ixfr_disabled = 0;
return acl;
}
/**
* ACL matches address mask.
*
*/
static int
acl_addr_matches_mask(uint32_t* a, uint32_t* b, uint32_t* mask, size_t sz)
{
size_t i = 0;
ods_log_assert(sz % 4 == 0);
sz /= 4;
for (i=0; i x[i]) {
return 0;
}
if (checkmax && maxval[i] < x[i]) {
return 0;
}
/* if x is equal to a bound, that bound needs further checks */
if (checkmin && minval[i] != x[i]) {
checkmin = 0;
}
if (checkmax && maxval[i]!=x[i]) {
checkmax = 0;
}
if (!checkmin && !checkmax) {
return 1; /* will always match */
}
}
return 1;
}
/**
* ACL matches address.
*
*/
static int
acl_addr_matches(acl_type* acl, struct sockaddr_storage* addr)
{
if (!acl) {
return 0;
}
if (!acl->address) {
/* all addresses match */
return 1;
}
if (acl->family == AF_INET6) {
struct sockaddr_in6* addr6 = (struct sockaddr_in6*) addr;
if (addr->ss_family != AF_INET6) {
return 0;
}
if (acl->port != 0 && acl->port != ntohs(addr6->sin6_port)) {
return 0;
}
switch(acl->range_type) {
case ACL_RANGE_MASK:
case ACL_RANGE_SUBNET:
if (!acl_addr_matches_mask((uint32_t*)&acl->addr.addr6,
(uint32_t*)&addr6->sin6_addr,
(uint32_t*)&acl->range_mask.addr6,
sizeof(struct in6_addr))) {
return 0;
}
break;
case ACL_RANGE_MINMAX:
if (!acl_addr_matches_range((uint32_t*)&acl->addr.addr6,
(uint32_t*)&addr6->sin6_addr,
(uint32_t*)&acl->range_mask.addr6,
sizeof(struct in6_addr))) {
return 0;
}
break;
case ACL_RANGE_SINGLE:
default:
if (memcmp(&addr6->sin6_addr, &acl->addr.addr6,
sizeof(struct in6_addr)) != 0) {
return 0;
}
break;
}
return 1;
} else {
struct sockaddr_in* addr4 = (struct sockaddr_in*)addr;
if (addr4->sin_family != AF_INET) {
return 0;
}
if (acl->port != 0 && acl->port != ntohs(addr4->sin_port)) {
return 0;
}
switch (acl->range_type) {
case ACL_RANGE_MASK:
case ACL_RANGE_SUBNET:
if (!acl_addr_matches_mask((uint32_t*)&acl->addr.addr,
(uint32_t*)&addr4->sin_addr,
(uint32_t*)&acl->range_mask.addr,
sizeof(struct in_addr))) {
return 0;
}
break;
case ACL_RANGE_MINMAX:
if (!acl_addr_matches_range((uint32_t*)&acl->addr.addr,
(uint32_t*)&addr4->sin_addr,
(uint32_t*)&acl->range_mask.addr,
sizeof(struct in_addr))) {
return 0;
}
break;
case ACL_RANGE_SINGLE:
default:
if (memcmp(&addr4->sin_addr, &acl->addr.addr,
sizeof(struct in_addr)) != 0) {
return 0;
}
break;
}
return 1;
}
/* not reached */
return 0;
}
/**
* ACL matches TSIG.
*
*/
static int
acl_tsig_matches(acl_type* acl, tsig_rr_type* tsig)
{
if (!acl || !tsig) {
ods_log_debug("[%s] no match: no acl or tsig", acl_str);
return 0; /* missing required elements */
}
if (!acl->tsig) {
if (tsig->status == TSIG_NOT_PRESENT) {
return 1;
}
ods_log_debug("[%s] no match: tsig present but no config", acl_str);
return 0; /* TSIG present but no config */
}
if (tsig->status != TSIG_OK) {
ods_log_debug("[%s] no match: tsig %s", acl_str,
tsig_status2str(tsig->status));
return 0; /* query has no TSIG */
}
if (tsig->error_code != LDNS_RCODE_NOERROR) {
ods_log_debug("[%s] no match: tsig error %d", acl_str,
tsig->error_code);
return 0; /* query has bork TSIG */
}
if (!tsig->key_name || !tsig->algo) {
ods_log_debug("[%s] no match: missing key/algo", acl_str);
return 0;
}
if (!acl->tsig->key) {
ods_log_debug("[%s] no match: no config", acl_str);
return 0; /* missing TSIG config */
}
if (ldns_dname_compare(tsig->key_name, acl->tsig->key->dname) != 0) {
ods_log_debug("[%s] no match: key names not the same", acl_str);
return 0; /* wrong key name */
}
if (ods_strlowercmp(tsig->algo->txt_name, acl->tsig->algorithm) != 0) {
ods_log_debug("[%s] no match: algorithms not the same", acl_str);
return 0; /* wrong algorithm name */
}
/* tsig matches */
return 1;
}
/**
* Address storage to IP string.
*
*/
int
addr2ip(struct sockaddr_storage addr, char* ip, size_t len)
{
if (addr.ss_family == AF_INET6) {
if (!inet_ntop(AF_INET6, &((struct sockaddr_in6 *)&addr)->sin6_addr,
ip, len)) {
return 0;
}
} else {
if (!inet_ntop(AF_INET, &((struct sockaddr_in *)&addr)->sin_addr,
ip, len))
return 0;
}
return 1;
}
/**
* Find ACL.
*
*/
acl_type*
acl_find(acl_type* acl, struct sockaddr_storage* addr, tsig_rr_type* trr)
{
acl_type* find = acl;
while (find) {
if (acl_addr_matches(find, addr) && acl_tsig_matches(find, trr)) {
ods_log_debug("[%s] match %s", acl_str, find->address);
return find;
}
find = find->next;
}
return NULL;
}
/**
* Clean up ACL.
*
*/
void
acl_cleanup(acl_type* acl)
{
if (!acl) {
return;
}
acl_cleanup(acl->next);
free(acl->address);
free(acl);
}
opendnssec-2.0.4/signer/src/wire/query.c 0000644 0001750 0001750 00000100711 13036123713 015133 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Query.
*
*/
#include "config.h"
#include "daemon/dnshandler.h"
#include "daemon/engine.h"
#include "file.h"
#include "util.h"
#include "wire/axfr.h"
#include "wire/query.h"
const char* query_str = "query";
/**
* Create query.
*
*/
query_type*
query_create(void)
{
query_type* q = NULL;
CHECKALLOC(q = (query_type*) malloc(sizeof(query_type)));
q->buffer = NULL;
q->tsig_rr = NULL;
q->axfr_fd = NULL;
q->buffer = buffer_create(PACKET_BUFFER_SIZE);
if (!q->buffer) {
query_cleanup(q);
return NULL;
}
q->tsig_rr = tsig_rr_create();
if (!q->tsig_rr) {
query_cleanup(q);
return NULL;
}
q->edns_rr = edns_rr_create();
if (!q->edns_rr) {
query_cleanup(q);
return NULL;
}
query_reset(q, UDP_MAX_MESSAGE_LEN, 0);
return q;
}
/**
* Reset query.
*
*/
void
query_reset(query_type* q, size_t maxlen, int is_tcp)
{
if (!q) {
return;
}
q->addrlen = sizeof(q->addr);
q->maxlen = maxlen;
q->reserved_space = 0;
buffer_clear(q->buffer);
tsig_rr_reset(q->tsig_rr, NULL, NULL);
edns_rr_reset(q->edns_rr);
q->tsig_prepare_it = 1;
q->tsig_update_it = 1;
q->tsig_sign_it = 1;
q->tcp = is_tcp;
/* qname, qtype, qclass */
q->zone = NULL;
/* domain, opcode, cname count, delegation, compression, temp */
q->axfr_is_done = 0;
if (q->axfr_fd) {
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
}
q->serial = 0;
q->startpos = 0;
}
/**
* Error.
*
*/
static query_state
query_error(query_type* q, ldns_pkt_rcode rcode)
{
size_t limit = 0;
if (!q) {
return QUERY_DISCARDED;
}
limit = buffer_limit(q->buffer);
buffer_clear(q->buffer);
buffer_pkt_set_qr(q->buffer);
buffer_pkt_set_rcode(q->buffer, rcode);
buffer_pkt_set_ancount(q->buffer, 0);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
buffer_set_position(q->buffer, limit);
return QUERY_PROCESSED;
}
/**
* FORMERR.
*
*/
static query_state
query_formerr(query_type* q)
{
ldns_pkt_opcode opcode = LDNS_PACKET_QUERY;
if (!q) {
return QUERY_DISCARDED;
}
opcode = buffer_pkt_opcode(q->buffer);
/* preserve the RD flag, clear the rest */
buffer_pkt_set_flags(q->buffer, buffer_pkt_flags(q->buffer) & 0x0100U);
buffer_pkt_set_opcode(q->buffer, opcode);
buffer_pkt_set_qdcount(q->buffer, 0);
ods_log_debug("[%s] formerr", query_str);
return query_error(q, LDNS_RCODE_FORMERR);
}
/**
* SERVFAIL.
*
*/
static query_state
query_servfail(query_type* q)
{
if (!q) {
return QUERY_DISCARDED;
}
ods_log_debug("[%s] servfail", query_str);
buffer_set_position(q->buffer, 0);
buffer_set_limit(q->buffer, BUFFER_PKT_HEADER_SIZE);
buffer_pkt_set_qdcount(q->buffer, 0);
return query_error(q, LDNS_RCODE_SERVFAIL);
}
/**
* NOTIMPL.
*
*/
static query_state
query_notimpl(query_type* q)
{
if (!q) {
return QUERY_DISCARDED;
}
ods_log_debug("[%s] notimpl", query_str);
return query_error(q, LDNS_RCODE_NOTIMPL);
}
/**
* REFUSED.
*
*/
static query_state
query_refused(query_type* q)
{
if (!q) {
return QUERY_DISCARDED;
}
ods_log_debug("[%s] refused", query_str);
return query_error(q, LDNS_RCODE_REFUSED);
}
/**
* NOTAUTH.
*
*/
static query_state
query_notauth(query_type* q)
{
if (!q) {
return QUERY_DISCARDED;
}
ods_log_debug("[%s] notauth", query_str);
return query_error(q, LDNS_RCODE_NOTAUTH);
}
/**
* Parse SOA RR in packet.
* (kind of similar to xfrd_parse_soa)
*
*/
static int
query_parse_soa(buffer_type* buffer, uint32_t* serial)
{
ldns_rr_type type = 0;
ods_log_assert(buffer);
if (!buffer_available(buffer, 10)) {
ods_log_error("[%s] bad soa: packet too short", query_str);
return 0;
}
type = (ldns_rr_type) buffer_read_u16(buffer);
if (type != LDNS_RR_TYPE_SOA) {
ods_log_error("[%s] bad soa: rr is not soa (%d)", query_str, type);
return 0;
}
(void)buffer_read_u16(buffer);
(void)buffer_read_u32(buffer);
/* rdata length */
if (!buffer_available(buffer, buffer_read_u16(buffer))) {
ods_log_error("[%s] bad soa: missing rdlength", query_str);
return 0;
}
/* MNAME */
if (!buffer_skip_dname(buffer)) {
ods_log_error("[%s] bad soa: missing mname", query_str);
return 0;
}
/* RNAME */
if (!buffer_skip_dname(buffer)) {
ods_log_error("[%s] bad soa: missing rname", query_str);
return 0;
}
if (serial) {
*serial = buffer_read_u32(buffer);
}
return 1;
}
/**
* NOTIFY.
* Parse notify query and initiate zone transfer if received serial is
* newer than serial on disk. On success return QUERY_PROCESSED and
* prepare notify reply packet in q->buffer.
*/
static query_state
query_process_notify(query_type* q, ldns_rr_type qtype, engine_type* engine)
{
dnsin_type* dnsin = NULL;
uint16_t count = 0;
uint16_t rrcount = 0;
uint32_t serial = 0;
size_t pos = 0;
char address[128];
if (!engine || !q || !q->zone) {
return QUERY_DISCARDED;
}
ods_log_assert(engine->dnshandler);
ods_log_assert(q->zone->name);
ods_log_verbose("[%s] incoming notify for zone %s", query_str,
q->zone->name);
if (buffer_pkt_rcode(q->buffer) != LDNS_RCODE_NOERROR ||
buffer_pkt_qr(q->buffer) ||
!buffer_pkt_aa(q->buffer) ||
buffer_pkt_tc(q->buffer) ||
buffer_pkt_rd(q->buffer) ||
buffer_pkt_ra(q->buffer) ||
buffer_pkt_ad(q->buffer) ||
buffer_pkt_cd(q->buffer) ||
buffer_pkt_qdcount(q->buffer) != 1 ||
buffer_pkt_ancount(q->buffer) > 1 ||
qtype != LDNS_RR_TYPE_SOA) {
return query_formerr(q);
}
if (!q->zone->adinbound || q->zone->adinbound->type != ADAPTER_DNS) {
ods_log_error("[%s] zone %s is not configured to have input dns "
"adapter", query_str, q->zone->name);
return query_notauth(q);
}
ods_log_assert(q->zone->adinbound->config);
dnsin = (dnsin_type*) q->zone->adinbound->config;
if (!acl_find(dnsin->allow_notify, &q->addr, q->tsig_rr)) {
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_info("[%s] unauthorized notify for zone %s from %s: "
"no acl matches", query_str, q->zone->name, address);
} else {
ods_log_info("[%s] unauthorized notify for zone %s from unknown "
"source: no acl matches", query_str, q->zone->name);
}
return query_notauth(q);
}
ods_log_assert(q->zone->xfrd);
/* skip header and question section */
buffer_skip(q->buffer, BUFFER_PKT_HEADER_SIZE);
count = buffer_pkt_qdcount(q->buffer);
for (rrcount = 0; rrcount < count; rrcount++) {
if (!buffer_skip_rr(q->buffer, 1)) {
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_info("[%s] dropped packet: zone %s received bad "
"notify from %s (bad question section)", query_str,
q->zone->name, address);
} else {
ods_log_info("[%s] dropped packet: zone %s received bad "
"notify from unknown source (bad question section)",
query_str, q->zone->name);
}
return QUERY_DISCARDED;
}
}
pos = buffer_position(q->buffer);
/* examine answer section */
count = buffer_pkt_ancount(q->buffer);
if (count) {
if (!buffer_skip_dname(q->buffer) ||
!query_parse_soa(q->buffer, &serial)) {
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_info("[%s] dropped packet: zone %s received bad "
"notify from %s (bad soa in answer section)", query_str,
q->zone->name, address);
} else {
ods_log_info("[%s] dropped packet: zone %s received bad "
"notify from unknown source (bad soa in answer section)",
query_str, q->zone->name);
}
return QUERY_DISCARDED;
}
lock_basic_lock(&q->zone->xfrd->serial_lock);
if (!util_serial_gt(serial, q->zone->xfrd->serial_disk)) {
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_info("[%s] ignore notify from %s: already got "
"zone %s serial %u on disk (received %u)", query_str,
address, q->zone->name, q->zone->xfrd->serial_disk,
serial);
} else {
ods_log_info("[%s] ignore notify: already got zone %s "
"serial %u on disk (received %u)", query_str,
q->zone->name, q->zone->xfrd->serial_disk, serial);
}
lock_basic_unlock(&q->zone->xfrd->serial_lock);
} else if (q->zone->xfrd->serial_notify_acquired) {
lock_basic_unlock(&q->zone->xfrd->serial_lock);
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_info("[%s] ignore notify from %s: zone %s "
"transfer in progress", query_str, address,
q->zone->name);
} else {
ods_log_info("[%s] ignore notify: zone %s transfer in "
"progress", query_str, q->zone->name);
}
} else {
q->zone->xfrd->serial_notify = serial;
q->zone->xfrd->serial_notify_acquired = time_now();
lock_basic_unlock(&q->zone->xfrd->serial_lock);
/* forward notify to xfrd */
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_verbose("[%s] forward notify for zone %s from client %s",
query_str, q->zone->name, address);
} else {
ods_log_verbose("[%s] forward notify for zone %s", query_str,
q->zone->name);
}
xfrd_set_timer_now(q->zone->xfrd);
dnshandler_fwd_notify(engine->dnshandler, buffer_begin(q->buffer),
buffer_remaining(q->buffer));
}
} else { /* Empty answer section, no SOA. We still need to process
the notify according to the RFC */
/* forward notify to xfrd */
if (addr2ip(q->addr, address, sizeof(address))) {
ods_log_verbose("[%s] forward notify for zone %s from client %s",
query_str, q->zone->name, address);
} else {
ods_log_verbose("[%s] forward notify for zone %s", query_str,
q->zone->name);
}
xfrd_set_timer_now(q->zone->xfrd);
dnshandler_fwd_notify(engine->dnshandler, buffer_begin(q->buffer),
buffer_remaining(q->buffer));
}
/* send notify ok */
buffer_pkt_set_qr(q->buffer);
buffer_pkt_set_aa(q->buffer);
buffer_pkt_set_ancount(q->buffer, 0);
buffer_clear(q->buffer); /* lim = pos, pos = 0; */
buffer_set_position(q->buffer, pos);
buffer_set_limit(q->buffer, buffer_capacity(q->buffer));
q->reserved_space = edns_rr_reserved_space(q->edns_rr);
q->reserved_space += tsig_rr_reserved_space(q->tsig_rr);
return QUERY_PROCESSED;
}
/**
* IXFR.
*
*/
static query_state
query_process_ixfr(query_type* q)
{
uint16_t count = 0;
ods_log_assert(q);
ods_log_assert(q->buffer);
ods_log_assert(buffer_pkt_qdcount(q->buffer) == 1);
/* skip header and question section */
buffer_skip(q->buffer, BUFFER_PKT_HEADER_SIZE);
if (!buffer_skip_rr(q->buffer, 1)) {
ods_log_error("[%s] dropped packet: zone %s received bad ixfr "
"request (bad question section)", query_str, q->zone->name);
return QUERY_DISCARDED;
}
/* answer section is empty */
ods_log_assert(buffer_pkt_ancount(q->buffer) == 0);
/* examine auth section */
q->startpos = buffer_position(q->buffer);
count = buffer_pkt_nscount(q->buffer);
if (count) {
if (!buffer_skip_dname(q->buffer) ||
!query_parse_soa(q->buffer, &(q->serial))) {
ods_log_error("[%s] dropped packet: zone %s received bad ixfr "
"request (bad soa in auth section)", query_str, q->zone->name);
return QUERY_DISCARDED;
}
ods_log_debug("[%s] found ixfr request zone %s serial=%u", query_str,
q->zone->name, q->serial);
return QUERY_PROCESSED;
}
ods_log_debug("[%s] ixfr request zone %s has no auth section", query_str,
q->zone->name);
q->serial = 0;
return QUERY_PROCESSED;
}
/**
* Add RRset to response.
*
*/
static int
response_add_rrset(response_type* r, rrset_type* rrset,
ldns_pkt_section section)
{
if (!r || !rrset || !section) {
return 0;
}
/* duplicates? */
r->sections[r->rrset_count] = section;
r->rrsets[r->rrset_count] = rrset;
++r->rrset_count;
return 1;
}
/**
* Encode RR.
*
*/
static int
response_encode_rr(query_type* q, ldns_rr* rr, ldns_pkt_section section)
{
uint8_t *data = NULL;
size_t size = 0;
ldns_status status = LDNS_STATUS_OK;
ods_log_assert(q);
ods_log_assert(rr);
ods_log_assert(section);
status = ldns_rr2wire(&data, rr, section, &size);
if (status != LDNS_STATUS_OK) {
ods_log_error("[%s] unable to send good response: ldns_rr2wire() "
"failed (%s)", query_str, ldns_get_errorstr_by_id(status));
return 0;
}
buffer_write(q->buffer, (const void*) data, size);
LDNS_FREE(data);
return 1;
}
/**
* Encode RRset.
*
*/
static uint16_t
response_encode_rrset(query_type* q, rrset_type* rrset, ldns_pkt_section section)
{
rrsig_type* rrsig;
uint16_t i = 0;
uint16_t added = 0;
ods_log_assert(q);
ods_log_assert(rrset);
ods_log_assert(section);
for (i = 0; i < rrset->rr_count; i++) {
added += response_encode_rr(q, rrset->rrs[i].rr, section);
}
if (q->edns_rr && q->edns_rr->dnssec_ok) {
while((rrsig = collection_iterator(rrset->rrsigs))) {
added += response_encode_rr(q, rrsig->rr, section);
}
}
/* truncation? */
return added;
}
/**
* Encode response.
*
*/
static void
response_encode(query_type* q, response_type* r)
{
uint16_t counts[LDNS_SECTION_ANY];
ldns_pkt_section s = LDNS_SECTION_QUESTION;
size_t i = 0;
ods_log_assert(q);
ods_log_assert(r);
for (s = LDNS_SECTION_ANSWER; s < LDNS_SECTION_ANY; s++) {
counts[s] = 0;
}
for (s = LDNS_SECTION_ANSWER; s < LDNS_SECTION_ANY; s++) {
for (i = 0; i < r->rrset_count; i++) {
if (r->sections[i] == s) {
counts[s] += response_encode_rrset(q, r->rrsets[i], s);
}
}
}
buffer_pkt_set_ancount(q->buffer, counts[LDNS_SECTION_ANSWER]);
buffer_pkt_set_nscount(q->buffer, counts[LDNS_SECTION_AUTHORITY]);
buffer_pkt_set_arcount(q->buffer, counts[LDNS_SECTION_ADDITIONAL]);
buffer_pkt_set_qr(q->buffer);
buffer_pkt_set_aa(q->buffer);
}
/**
* Query response.
*
*/
static query_state
query_response(query_type* q, ldns_rr_type qtype)
{
rrset_type* rrset = NULL;
response_type r;
if (!q || !q->zone) {
return QUERY_DISCARDED;
}
r.rrset_count = 0;
lock_basic_lock(&q->zone->zone_lock);
rrset = zone_lookup_rrset(q->zone, q->zone->apex, qtype);
if (rrset) {
if (!response_add_rrset(&r, rrset, LDNS_SECTION_ANSWER)) {
lock_basic_unlock(&q->zone->zone_lock);
return query_servfail(q);
}
/* NS RRset goes into Authority Section */
rrset = zone_lookup_rrset(q->zone, q->zone->apex, LDNS_RR_TYPE_NS);
if (rrset) {
if (!response_add_rrset(&r, rrset, LDNS_SECTION_AUTHORITY)) {
lock_basic_unlock(&q->zone->zone_lock);
return query_servfail(q);
}
}
} else if (qtype != LDNS_RR_TYPE_SOA) {
rrset = zone_lookup_rrset(q->zone, q->zone->apex, LDNS_RR_TYPE_SOA);
if (rrset) {
if (!response_add_rrset(&r, rrset, LDNS_SECTION_AUTHORITY)) {
lock_basic_unlock(&q->zone->zone_lock);
return query_servfail(q);
}
}
} else {
lock_basic_unlock(&q->zone->zone_lock);
return query_servfail(q);
}
lock_basic_unlock(&q->zone->zone_lock);
response_encode(q, &r);
/* compression */
return QUERY_PROCESSED;
}
/**
* Prepare response.
*
*/
void
query_prepare(query_type* q)
{
uint16_t limit = 0;
uint16_t flags = 0;
ods_log_assert(q);
ods_log_assert(q->buffer);
limit = buffer_limit(q->buffer);
flags = buffer_pkt_flags(q->buffer);
flags &= 0x0100U; /* preserve the rd flag */
flags |= 0x8000U; /* set the qr flag */
buffer_pkt_set_flags(q->buffer, flags);
buffer_clear(q->buffer);
buffer_set_position(q->buffer, limit);
buffer_set_limit(q->buffer, buffer_capacity(q->buffer));
q->reserved_space = edns_rr_reserved_space(q->edns_rr);
q->reserved_space += tsig_rr_reserved_space(q->tsig_rr);
}
/**
* QUERY.
*
*/
static query_state
query_process_query(query_type* q, ldns_rr_type qtype, engine_type* engine)
{
dnsout_type* dnsout = NULL;
if (!q || !q->zone) {
return QUERY_DISCARDED;
}
ods_log_assert(q->zone->name);
ods_log_debug("[%s] incoming query qtype=%s for zone %s", query_str,
rrset_type2str(qtype), q->zone->name);
/* sanity checks */
if (buffer_pkt_qdcount(q->buffer) != 1 || buffer_pkt_tc(q->buffer)) {
buffer_pkt_set_flags(q->buffer, 0);
return query_formerr(q);
}
if (buffer_pkt_ancount(q->buffer) != 0 ||
(qtype != LDNS_RR_TYPE_IXFR && buffer_pkt_nscount(q->buffer) != 0)) {
buffer_pkt_set_flags(q->buffer, 0);
return query_formerr(q);
}
/* acl */
if (!q->zone->adoutbound || q->zone->adoutbound->type != ADAPTER_DNS) {
ods_log_error("[%s] zone %s is not configured to have output dns "
"adapter", query_str, q->zone->name);
return query_refused(q);
}
ods_log_assert(q->zone->adoutbound->config);
dnsout = (dnsout_type*) q->zone->adoutbound->config;
/* acl also in use for soa and other queries */
if (!acl_find(dnsout->provide_xfr, &q->addr, q->tsig_rr)) {
ods_log_debug("[%s] zone %s acl query refused", query_str,
q->zone->name);
return query_refused(q);
}
query_prepare(q);
/* ixfr? */
if (qtype == LDNS_RR_TYPE_IXFR) {
ods_log_assert(q->zone->name);
ods_log_debug("[%s] incoming ixfr request serial=%u for zone %s",
query_str, q->serial, q->zone->name);
return ixfr(q, engine);
}
/* axfr? */
if (qtype == LDNS_RR_TYPE_AXFR) {
ods_log_assert(q->zone->name);
ods_log_debug("[%s] incoming axfr request for zone %s",
query_str, q->zone->name);
return axfr(q, engine, 0);
}
/* (soa) query */
if (qtype == LDNS_RR_TYPE_SOA) {
ods_log_assert(q->zone->name);
ods_log_debug("[%s] incoming soa request for zone %s",
query_str, q->zone->name);
return soa_request(q, engine);
}
/* other qtypes */
return query_response(q, qtype);
}
/**
* UPDATE.
*
*/
static query_state
query_process_update(query_type* q)
{
if (!q || !q->zone) {
return QUERY_DISCARDED;
}
ods_log_debug("[%s] dynamic update not implemented", query_str);
return query_notimpl(q);
}
/**
* Process TSIG RR.
*
*/
static ldns_pkt_rcode
query_process_tsig(query_type* q)
{
if (!q || !q->tsig_rr) {
return LDNS_RCODE_SERVFAIL;
}
if (q->tsig_rr->status == TSIG_ERROR) {
return LDNS_RCODE_FORMERR;
}
if (q->tsig_rr->status == TSIG_OK) {
if (!tsig_rr_lookup(q->tsig_rr)) {
ods_log_debug("[%s] tsig unknown key/algorithm", query_str);
return LDNS_RCODE_REFUSED;
}
buffer_set_limit(q->buffer, q->tsig_rr->position);
buffer_pkt_set_arcount(q->buffer, buffer_pkt_arcount(q->buffer)-1);
tsig_rr_prepare(q->tsig_rr);
tsig_rr_update(q->tsig_rr, q->buffer, buffer_limit(q->buffer));
if (!tsig_rr_verify(q->tsig_rr)) {
ods_log_debug("[%s] bad tsig signature", query_str);
return LDNS_RCODE_NOTAUTH;
}
}
return LDNS_RCODE_NOERROR;
}
/**
* Process EDNS OPT RR.
*
*/
static ldns_pkt_rcode
query_process_edns(query_type* q)
{
if (!q || !q->edns_rr) {
return LDNS_RCODE_SERVFAIL;
}
if (q->edns_rr->status == EDNS_ERROR) {
/* The only error is VERSION not implemented */
return LDNS_RCODE_FORMERR;
}
if (q->edns_rr->status == EDNS_OK) {
/* Only care about UDP size larger than normal... */
if (!q->tcp && q->edns_rr->maxlen > UDP_MAX_MESSAGE_LEN) {
if (q->edns_rr->maxlen < EDNS_MAX_MESSAGE_LEN) {
q->maxlen = q->edns_rr->maxlen;
} else {
q->maxlen = EDNS_MAX_MESSAGE_LEN;
}
}
/* Strip the OPT resource record off... */
buffer_set_position(q->buffer, q->edns_rr->position);
buffer_set_limit(q->buffer, q->edns_rr->position);
buffer_pkt_set_arcount(q->buffer, buffer_pkt_arcount(q->buffer) - 1);
}
return LDNS_RCODE_NOERROR;
}
/**
* Find TSIG RR.
*
*/
static int
query_find_tsig(query_type* q)
{
size_t saved_pos = 0;
size_t rrcount = 0;
size_t i = 0;
ods_log_assert(q);
ods_log_assert(q->tsig_rr);
ods_log_assert(q->buffer);
if (buffer_pkt_arcount(q->buffer) == 0) {
q->tsig_rr->status = TSIG_NOT_PRESENT;
return 1;
}
saved_pos = buffer_position(q->buffer);
rrcount = buffer_pkt_qdcount(q->buffer) + buffer_pkt_ancount(q->buffer) +
buffer_pkt_nscount(q->buffer);
buffer_set_position(q->buffer, BUFFER_PKT_HEADER_SIZE);
for (i=0; i < rrcount; i++) {
if (!buffer_skip_rr(q->buffer, i < buffer_pkt_qdcount(q->buffer))) {
buffer_set_position(q->buffer, saved_pos);
return 0;
}
}
rrcount = buffer_pkt_arcount(q->buffer);
ods_log_assert(rrcount != 0);
if (!tsig_rr_parse(q->tsig_rr, q->buffer)) {
ods_log_debug("[%s] got bad tsig", query_str);
return 0;
}
if (q->tsig_rr->status != TSIG_NOT_PRESENT) {
--rrcount;
}
if (rrcount) {
if (edns_rr_parse(q->edns_rr, q->buffer)) {
--rrcount;
}
}
if (rrcount && q->tsig_rr->status == TSIG_NOT_PRESENT) {
/* see if tsig is after the edns record */
if (!tsig_rr_parse(q->tsig_rr, q->buffer)) {
ods_log_debug("[%s] got bad tsig", query_str);
return 0;
}
if (q->tsig_rr->status != TSIG_NOT_PRESENT) {
--rrcount;
}
}
if (rrcount > 0) {
ods_log_debug("[%s] too many additional rrs", query_str);
return 0;
}
buffer_set_position(q->buffer, saved_pos);
return 1;
}
/**
* Process query.
*
*/
query_state
query_process(query_type* q, engine_type* engine)
{
ldns_status status = LDNS_STATUS_OK;
ldns_pkt* pkt = NULL;
ldns_rr* rr = NULL;
ldns_pkt_rcode rcode = LDNS_RCODE_NOERROR;
ldns_pkt_opcode opcode = LDNS_PACKET_QUERY;
ldns_rr_type qtype = LDNS_RR_TYPE_SOA;
ods_log_assert(engine);
ods_log_assert(q);
ods_log_assert(q->buffer);
if (!engine || !q || !q->buffer) {
ods_log_error("[%s] drop query: assertion error", query_str);
return QUERY_DISCARDED; /* should not happen */
}
if (buffer_limit(q->buffer) < BUFFER_PKT_HEADER_SIZE) {
ods_log_debug("[%s] drop query: packet too small", query_str);
return QUERY_DISCARDED; /* too small */
}
if (buffer_pkt_qr(q->buffer)) {
ods_log_debug("[%s] drop query: qr bit set", query_str);
return QUERY_DISCARDED; /* not a query */
}
/* parse packet */
status = ldns_wire2pkt(&pkt, buffer_current(q->buffer),
buffer_remaining(q->buffer));
if (status != LDNS_STATUS_OK) {
ods_log_debug("[%s] got bad packet: %s", query_str,
ldns_get_errorstr_by_id(status));
return query_formerr(q);
}
rr = ldns_rr_list_rr(ldns_pkt_question(pkt), 0);
if (!rr) {
ods_log_debug("[%s] no RRset in query section, ignoring", query_str);
return QUERY_DISCARDED; /* no RRset in query */
}
lock_basic_lock(&engine->zonelist->zl_lock);
/* we can just lookup the zone, because we will only handle SOA queries,
zone transfers, updates and notifies */
q->zone = zonelist_lookup_zone_by_dname(engine->zonelist, ldns_rr_owner(rr),
ldns_rr_get_class(rr));
/* don't answer for zones that are just added */
if (q->zone && q->zone->zl_status == ZONE_ZL_ADDED) {
ods_log_assert(q->zone->name);
ods_log_warning("[%s] zone %s just added, don't answer for now",
query_str, q->zone->name);
q->zone = NULL;
}
lock_basic_unlock(&engine->zonelist->zl_lock);
if (!q->zone) {
ods_log_debug("[%s] zone not found", query_str);
return query_servfail(q);
}
/* see if it is tsig signed */
if (!query_find_tsig(q)) {
return query_formerr(q);
}
/* else: valid tsig, or no tsig present */
ods_log_debug("[%s] tsig %s", query_str, tsig_status2str(q->tsig_rr->status));
/* get opcode, qtype, ixfr=serial */
opcode = ldns_pkt_get_opcode(pkt);
qtype = ldns_rr_get_type(rr);
if (qtype == LDNS_RR_TYPE_IXFR) {
ods_log_assert(q->zone->name);
ods_log_debug("[%s] incoming ixfr request for zone %s",
query_str, q->zone->name);
if (query_process_ixfr(q) != QUERY_PROCESSED) {
return query_formerr(q);
}
}
/* process tsig */
rcode = query_process_tsig(q);
if (rcode != LDNS_RCODE_NOERROR) {
return query_error(q, rcode);
}
/* process edns */
rcode = query_process_edns(q);
if (rcode != LDNS_RCODE_NOERROR) {
/* We should not return FORMERR, but BADVERS (=16).
* BADVERS is created with Ext. RCODE, followed by RCODE.
* Ext. RCODE is set to 1, RCODE must be 0 (getting 0x10 = 16).
* Thus RCODE = NOERROR = NSD_RC_OK. */
return query_error(q, LDNS_RCODE_NOERROR);
}
/* handle incoming request */
ldns_pkt_free(pkt);
switch (opcode) {
case LDNS_PACKET_NOTIFY:
return query_process_notify(q, qtype, engine);
case LDNS_PACKET_QUERY:
return query_process_query(q, qtype, engine);
case LDNS_PACKET_UPDATE:
return query_process_update(q);
default:
break;
}
return query_notimpl(q);
}
/**
* Check if query does not overflow.
*
*/
static int
query_overflow(query_type* q)
{
ods_log_assert(q);
ods_log_assert(q->buffer);
return buffer_position(q->buffer) > (q->maxlen - q->reserved_space);
}
/**
* Add optional RRs to query.
*
*/
void
query_add_optional(query_type* q, engine_type* engine)
{
edns_data_type* edns = NULL;
if (!q || !engine) {
return;
}
/** First EDNS */
if (q->edns_rr) {
edns = &engine->edns;
switch (q->edns_rr->status) {
case EDNS_NOT_PRESENT:
break;
case EDNS_OK:
ods_log_debug("[%s] add edns opt ok", query_str);
if (q->edns_rr->dnssec_ok) {
edns->ok[7] = 0x80;
} else {
edns->ok[7] = 0x00;
}
buffer_write(q->buffer, edns->ok, OPT_LEN);
/* fill with NULLs */
buffer_write(q->buffer, edns->rdata_none, OPT_RDATA);
buffer_pkt_set_arcount(q->buffer,
buffer_pkt_arcount(q->buffer) + 1);
break;
case EDNS_ERROR:
ods_log_debug("[%s] add edns opt err", query_str);
if (q->edns_rr->dnssec_ok) {
edns->ok[7] = 0x80;
} else {
edns->ok[7] = 0x00;
}
buffer_write(q->buffer, edns->error, OPT_LEN);
buffer_write(q->buffer, edns->rdata_none, OPT_RDATA);
buffer_pkt_set_arcount(q->buffer,
buffer_pkt_arcount(q->buffer) + 1);
break;
default:
break;
}
}
/** Then TSIG */
if (!q->tsig_rr) {
return;
}
if (q->tsig_rr->status != TSIG_NOT_PRESENT) {
if (q->tsig_rr->status == TSIG_ERROR ||
q->tsig_rr->error_code != LDNS_RCODE_NOERROR) {
ods_log_debug("[%s] add tsig err", query_str);
tsig_rr_error(q->tsig_rr);
tsig_rr_append(q->tsig_rr, q->buffer);
buffer_pkt_set_arcount(q->buffer,
buffer_pkt_arcount(q->buffer)+1);
} else if (q->tsig_rr->status == TSIG_OK &&
q->tsig_rr->error_code == LDNS_RCODE_NOERROR) {
ods_log_debug("[%s] add tsig ok", query_str);
if (q->tsig_prepare_it)
tsig_rr_prepare(q->tsig_rr);
if (q->tsig_update_it)
tsig_rr_update(q->tsig_rr, q->buffer,
buffer_position(q->buffer));
if (q->tsig_sign_it) {
tsig_rr_sign(q->tsig_rr);
tsig_rr_append(q->tsig_rr, q->buffer);
buffer_pkt_set_arcount(q->buffer,
buffer_pkt_arcount(q->buffer)+1);
}
}
}
}
/**
* Add RR to query.
*
*/
int
query_add_rr(query_type* q, ldns_rr* rr)
{
size_t i = 0;
size_t tc_mark = 0;
size_t rdlength_pos = 0;
uint16_t rdlength = 0;
ods_log_assert(q);
ods_log_assert(q->buffer);
ods_log_assert(rr);
/* set truncation mark, in case rr does not fit */
tc_mark = buffer_position(q->buffer);
/* owner type class ttl */
if (!buffer_available(q->buffer, ldns_rdf_size(ldns_rr_owner(rr)))) {
goto query_add_rr_tc;
}
buffer_write_rdf(q->buffer, ldns_rr_owner(rr));
if (!buffer_available(q->buffer, sizeof(uint16_t) + sizeof(uint16_t) +
sizeof(uint32_t) + sizeof(rdlength))) {
goto query_add_rr_tc;
}
buffer_write_u16(q->buffer, (uint16_t) ldns_rr_get_type(rr));
buffer_write_u16(q->buffer, (uint16_t) ldns_rr_get_class(rr));
buffer_write_u32(q->buffer, (uint32_t) ldns_rr_ttl(rr));
/* skip rdlength */
rdlength_pos = buffer_position(q->buffer);
buffer_skip(q->buffer, sizeof(rdlength));
/* write rdata */
for (i=0; i < ldns_rr_rd_count(rr); i++) {
if (!buffer_available(q->buffer, ldns_rdf_size(ldns_rr_rdf(rr, i)))) {
goto query_add_rr_tc;
}
buffer_write_rdf(q->buffer, ldns_rr_rdf(rr, i));
}
if (!query_overflow(q)) {
/* write rdlength */
rdlength = buffer_position(q->buffer) - rdlength_pos - sizeof(rdlength);
buffer_write_u16_at(q->buffer, rdlength_pos, rdlength);
/* position updated by buffer_write() */
return 1;
}
query_add_rr_tc:
buffer_set_position(q->buffer, tc_mark);
ods_log_assert(!query_overflow(q));
return 0;
}
/**
* Cleanup query.
*
*/
void
query_cleanup(query_type* q)
{
if (!q) {
return;
}
if (q->axfr_fd) {
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
}
buffer_cleanup(q->buffer);
tsig_rr_cleanup(q->tsig_rr);
edns_rr_cleanup(q->edns_rr);
free(q);
}
opendnssec-2.0.4/signer/src/wire/query.h 0000644 0001750 0001750 00000007251 13036123676 015155 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Query.
*
*/
#ifndef WIRE_QUERY_H
#define WIRE_QUERY_H
#include "config.h"
#include "status.h"
#include "signer/zone.h"
#include "wire/buffer.h"
#include "wire/edns.h"
#include "wire/tsig.h"
#define UDP_MAX_MESSAGE_LEN 512
#define TCP_MAX_MESSAGE_LEN 65535
#define QUERY_RESPONSE_MAX_RRSET 10 /* should be enough */
enum query_enum {
QUERY_PROCESSED = 0,
QUERY_DISCARDED,
QUERY_AXFR,
QUERY_IXFR
};
typedef enum query_enum query_state;
/**
* Query.
*
*/
typedef struct query_struct query_type;
struct query_struct {
/* Query from addres */
struct sockaddr_storage addr;
socklen_t addrlen;
/* Maximum supported query size */
size_t maxlen;
size_t reserved_space;
/* TSIG */
tsig_rr_type* tsig_rr;
/* EDNS */
edns_rr_type* edns_rr;
/* TCP */
int tcp;
uint16_t tcplen;
buffer_type* buffer;
/* QNAME, QTYPE, QCLASS */
/* Zone */
zone_type* zone;
/* Compression */
/* AXFR IXFR */
FILE* axfr_fd;
uint32_t serial;
size_t startpos;
/* Bits */
unsigned axfr_is_done : 1;
unsigned tsig_prepare_it : 1;
unsigned tsig_update_it : 1;
unsigned tsig_sign_it : 1;
};
/**
* Response.
*
*/
typedef struct response_struct response_type;
struct response_struct {
size_t rrset_count;
ldns_pkt_section sections[QUERY_RESPONSE_MAX_RRSET];
rrset_type* rrsets[QUERY_RESPONSE_MAX_RRSET];
};
/**
* Create query.
* \return query_type* query
*
*/
query_type* query_create(void);
/**
* Prepare response.
* \param[in] q query
*
*/
void query_prepare(query_type* q);
/**
* Process query.
* \param[in] q query
* \param[in] engine signer engine
* \return query_state state of the query
*
*/
query_state query_process(query_type* q, engine_type* engine);
/**
* Reset query.
* \param[in] q query
* \param[in] maxlen maximum message length
* \param[in] is_tcp 1 if tcp query
*
*/
void query_reset(query_type* q, size_t maxlen, int is_tcp);
/**
* Add optional RRs to query.
* \param[in] q query
* \param[in] engine signer engine
*
*/
void query_add_optional(query_type* q, engine_type* engine);
/**
* Add RR to query.
* \param[in] q query
* \param[in] rr RR
* \return int 1 if ok, 0 if overflow.
*
*/
int query_add_rr(query_type* q, ldns_rr* rr);
/**
* Cleanup query.
* \param[in] q query
*
*/
void query_cleanup(query_type* q);
#endif /* WIRE_QUERY_H */
opendnssec-2.0.4/signer/src/wire/notify.c 0000644 0001750 0001750 00000042012 13036123713 015275 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Notify sending.
*
*/
#include "config.h"
#include "adapter/addns.h"
#include "daemon/xfrhandler.h"
#include "signer/domain.h"
#include "signer/zone.h"
#include "wire/notify.h"
#include "wire/xfrd.h"
#include
static const char* notify_str = "notify";
static void notify_handle_zone(netio_type* netio,
netio_handler_type* handler, netio_events_type event_types);
/**
* Get time.
*
*/
static time_t
notify_time(notify_type* notify)
{
ods_log_assert(notify);
ods_log_assert(notify->xfrhandler);
return xfrhandler_time((xfrhandler_type*) notify->xfrhandler);
}
/**
* Set timer.
*
*/
static void
notify_set_timer(notify_type* notify, time_t t)
{
if (!notify || !notify->xfrhandler) {
return;
}
/**
* Randomize the time, within 90%-100% of original.
* Not later so zones cannot expire too late.
*/
if(t > notify_time(notify) + 10) {
time_t extra = t - notify_time(notify);
time_t base = extra*9/10;
#ifdef HAVE_ARC4RANDOM_UNIFORM
t = notify_time(notify) + base +
arc4random_uniform(extra-base);
#elif HAVE_ARC4RANDOM
t = notify_time(notify) + base +
arc4random()%(extra-base);
#else
t = notify_time(notify) + base +
random()%(extra-base);
#endif
}
notify->handler.timeout = ¬ify->timeout;
notify->timeout.tv_sec = t;
notify->timeout.tv_nsec = 0;
}
/**
* Create notify structure.
*
*/
notify_type*
notify_create(xfrhandler_type* xfrhandler, zone_type* zone)
{
notify_type* notify = NULL;
if (!xfrhandler || !zone) {
return NULL;
}
CHECKALLOC(notify = (notify_type*) malloc(sizeof(notify_type)));
if (!notify) {
ods_log_error("[%s] unable to create notify structure: "
" allocator_alloc() failed", notify_str);
return NULL;
}
notify->zone = zone;
notify->xfrhandler = xfrhandler;
notify->waiting_next = NULL;
notify->secondary = NULL;
notify->soa = NULL;
notify->tsig_rr = tsig_rr_create();
if (!notify->tsig_rr) {
notify_cleanup(notify);
return NULL;
}
notify->retry = 0;
notify->query_id = 0;
notify->is_waiting = 0;
notify->handler.fd = -1;
notify->timeout.tv_sec = 0;
notify->timeout.tv_nsec = 0;
notify->handler.timeout = NULL;
notify->handler.user_data = notify;
notify->handler.event_types =
NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT;
notify->handler.event_handler = notify_handle_zone;
return notify;
}
/**
* Setup notify.
*
*/
static void
notify_setup(notify_type* notify)
{
zone_type* zone = NULL;
dnsout_type* dnsout = NULL;
if (!notify) {
return;
}
zone = (zone_type*) notify->zone;
ods_log_assert(zone);
ods_log_assert(zone->adoutbound);
ods_log_assert(zone->adoutbound->config);
ods_log_assert(zone->adoutbound->type == ADAPTER_DNS);
dnsout = (dnsout_type*) zone->adoutbound->config;
notify->retry = 0;
notify->secondary = dnsout->do_notify;
ods_log_debug("[%s] setup notify for zone %s", notify_str, zone->name);
notify_set_timer(notify, notify_time(notify));
}
/**
* Disable notify.
*
*/
static void
notify_disable(notify_type* notify)
{
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
if (!notify) {
return;
}
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
ods_log_assert(xfrhandler);
zone = (zone_type*) notify->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
notify->secondary = NULL;
notify->handler.timeout = NULL;
if (notify->handler.fd != -1) {
close(notify->handler.fd);
notify->handler.fd = -1;
}
if (xfrhandler->notify_udp_num == NOTIFY_MAX_UDP) {
while (xfrhandler->notify_waiting_first) {
notify_type* wn = xfrhandler->notify_waiting_first;
ods_log_assert(wn->is_waiting);
wn->is_waiting = 0;
xfrhandler->notify_waiting_first = wn->waiting_next;
if (xfrhandler->notify_waiting_last == wn) {
xfrhandler->notify_waiting_last = NULL;
}
if (wn->secondary) {
ods_log_debug("[%s] zone %s notify off waiting list",
notify_str, zone->name);
notify_setup(wn);
return;
}
}
}
ods_log_debug("[%s] notify for zone %s disabled", notify_str, zone->name);
xfrhandler->notify_udp_num--;
}
/**
* Next secondary.
*
*/
static void
notify_next(notify_type* notify)
{
if (!notify || !notify->secondary) {
return;
}
notify->secondary = notify->secondary->next;
notify->retry = 0;
if (!notify->secondary) {
zone_type* zone = (zone_type*) notify->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_debug("[%s] zone %s no more secondaries, disable notify",
notify_str, zone->name);
notify_disable(notify);
}
}
/**
* Read packet from udp.
*
*/
static int
notify_udp_read_packet(notify_type* notify)
{
xfrhandler_type* xfrhandler = NULL;
ssize_t received = 0;
ods_log_assert(notify);
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
ods_log_assert(xfrhandler);
buffer_clear(xfrhandler->packet);
received = recvfrom(notify->handler.fd, buffer_begin(xfrhandler->packet),
buffer_remaining(xfrhandler->packet), 0, NULL, NULL);
if (received == -1) {
ods_log_error("[%s] unable to read packet: recvfrom() failed fd %d "
"(%s)", notify_str, notify->handler.fd, strerror(errno));
return 0;
}
buffer_set_limit(xfrhandler->packet, received);
return 1;
}
/**
* Handle notify reply.
*
*/
static int
notify_handle_reply(notify_type* notify)
{
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
ods_log_assert(notify);
ods_log_assert(notify->secondary);
ods_log_assert(notify->secondary->address);
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
zone = (zone_type*) notify->zone;
ods_log_assert(xfrhandler);
ods_log_assert(zone);
ods_log_assert(zone->name);
if (xfrhandler->packet->limit < 3 ||
(buffer_pkt_opcode(xfrhandler->packet) != LDNS_PACKET_NOTIFY) ||
(buffer_pkt_qr(xfrhandler->packet) == 0)) {
ods_log_error("[%s] zone %s received bad notify reply opcode/qr from %s",
notify_str, zone->name, notify->secondary->address);
return 0;
}
if (buffer_pkt_id(xfrhandler->packet) != notify->query_id) {
ods_log_error("[%s] zone %s received bad notify reply id from %s",
notify_str, zone->name, notify->secondary->address);
return 0;
}
/* could check tsig */
if (buffer_pkt_rcode(xfrhandler->packet) != LDNS_RCODE_NOERROR) {
const char* str = buffer_rcode2str(buffer_pkt_rcode(xfrhandler->packet));
ods_log_error("[%s] zone %s received bad notify rcode %s from %s",
notify_str, zone->name, str?str:"UNKNOWN",
notify->secondary->address);
if (buffer_pkt_rcode(xfrhandler->packet) != LDNS_RCODE_NOTIMPL) {
return 1;
}
return 0;
}
ods_log_debug("[%s] zone %s secondary %s notify reply ok", notify_str,
zone->name, notify->secondary->address);
return 1;
}
/**
* Send notify over udp.
*
*/
static int
notify_send_udp(notify_type* notify, buffer_type* buffer)
{
struct sockaddr_storage to;
socklen_t to_len = 0;
int fd = -1;
int family = PF_INET;
ssize_t nb = 0;
ods_log_assert(buffer);
ods_log_assert(notify);
ods_log_assert(notify->secondary);
ods_log_assert(notify->secondary->address);
/* this will set the remote port to acl->port or TCP_PORT */
to_len = xfrd_acl_sockaddr_to(notify->secondary, &to);
/* get the address family of the remote host */
if (notify->secondary->family == AF_INET6) {
family = PF_INET6;
}
/* create socket */
fd = socket(family, SOCK_DGRAM, IPPROTO_UDP);
if (fd == -1) {
ods_log_error("[%s] unable to send data over udp to %s: "
"socket() failed (%s)", notify_str, notify->secondary->address,
strerror(errno));
return -1;
}
/* bind it? */
/* send it (udp) */
ods_log_deeebug("[%s] send %ld bytes over udp to %s", notify_str,
(unsigned long)buffer_remaining(buffer), notify->secondary->address);
nb = sendto(fd, buffer_current(buffer), buffer_remaining(buffer), 0,
(struct sockaddr*)&to, to_len);
if (nb == -1) {
ods_log_error("[%s] unable to send data over udp to %s: "
"sendto() failed (%s)", notify_str, notify->secondary->address,
strerror(errno));
close(fd);
return -1;
}
return fd;
}
/**
* Sign notify.
*
*/
static void
notify_tsig_sign(notify_type* notify, buffer_type* buffer)
{
tsig_algo_type* algo = NULL;
if (!notify || !notify->tsig_rr || !notify->secondary ||
!notify->secondary->tsig || !notify->secondary->tsig->key ||
!buffer) {
return; /* no tsig configured */
}
algo = tsig_lookup_algo(notify->secondary->tsig->algorithm);
if (!algo) {
ods_log_error("[%s] unable to sign notify: tsig unknown algorithm "
"%s", notify_str, notify->secondary->tsig->algorithm);
return;
}
ods_log_assert(algo);
tsig_rr_reset(notify->tsig_rr, algo, notify->secondary->tsig->key);
notify->tsig_rr->original_query_id = buffer_pkt_id(buffer);
notify->tsig_rr->algo_name =
ldns_rdf_clone(notify->tsig_rr->algo->wf_name);
notify->tsig_rr->key_name = ldns_rdf_clone(notify->tsig_rr->key->dname);
log_dname(notify->tsig_rr->key_name, "tsig sign notify with key",
LOG_DEBUG);
log_dname(notify->tsig_rr->algo_name, "tsig sign notify with algorithm",
LOG_DEBUG);
tsig_rr_prepare(notify->tsig_rr);
tsig_rr_update(notify->tsig_rr, buffer, buffer_position(buffer));
tsig_rr_sign(notify->tsig_rr);
ods_log_debug("[%s] tsig append rr to notify id=%u", notify_str,
buffer_pkt_id(buffer));
tsig_rr_append(notify->tsig_rr, buffer);
buffer_pkt_set_arcount(buffer, buffer_pkt_arcount(buffer)+1);
tsig_rr_prepare(notify->tsig_rr);
}
/**
* Send notify.
*
*/
void
notify_send(notify_type* notify)
{
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
ods_log_assert(notify);
ods_log_assert(notify->secondary);
ods_log_assert(notify->secondary->address);
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
zone = (zone_type*) notify->zone;
ods_log_assert(xfrhandler);
ods_log_assert(zone);
ods_log_assert(zone->name);
if (notify->handler.fd != -1) {
close(notify->handler.fd);
}
notify->handler.fd = -1;
notify->timeout.tv_sec = notify_time(notify) + NOTIFY_RETRY_TIMEOUT;
buffer_pkt_notify(xfrhandler->packet, zone->apex, LDNS_RR_CLASS_IN);
notify->query_id = buffer_pkt_id(xfrhandler->packet);
buffer_pkt_set_aa(xfrhandler->packet);
/* add current SOA to answer section */
if (notify->soa) {
if (buffer_write_rr(xfrhandler->packet, notify->soa)) {
buffer_pkt_set_ancount(xfrhandler->packet, 1);
}
}
if (notify->secondary->tsig) {
notify_tsig_sign(notify, xfrhandler->packet);
}
buffer_flip(xfrhandler->packet);
notify->handler.fd = notify_send_udp(notify, xfrhandler->packet);
if (notify->handler.fd == -1) {
ods_log_error("[%s] unable to send notify retry %u for zone %s to "
"%s: notify_send_udp() failed", notify_str, notify->retry,
zone->name, notify->secondary->address);
return;
}
ods_log_verbose("[%s] notify retry %u for zone %s sent to %s", notify_str,
notify->retry, zone->name, notify->secondary->address);
}
/**
* Handle notify.
*
*/
static void
notify_handle_zone(netio_type* ATTR_UNUSED(netio),
netio_handler_type* handler, netio_events_type event_types)
{
notify_type* notify = NULL;
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
if (!handler) {
return;
}
notify = (notify_type*) handler->user_data;
ods_log_assert(notify);
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
zone = (zone_type*) notify->zone;
ods_log_assert(xfrhandler);
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_debug("[%s] handle notify for zone %s", notify_str, zone->name);
if (notify->is_waiting) {
ods_log_debug("[%s] already waiting, skipping notify for zone %s",
notify_str, zone->name);
ods_log_assert(notify->handler.fd == -1);
return;
}
if (event_types & NETIO_EVENT_READ) {
ods_log_debug("[%s] read notify ok for zone %s", notify_str,
zone->name);
ods_log_assert(notify->handler.fd != -1);
if (notify_udp_read_packet(notify)) {
if (notify_handle_reply(notify)) {
notify_next(notify);
}
}
} else if(event_types & NETIO_EVENT_TIMEOUT) {
ods_log_debug("[%s] notify timeout for zone %s", notify_str,
zone->name);
/* timeout, try again */
}
/* see if notify is still enabled */
if (notify->secondary) {
ods_log_assert(notify->secondary->address);
notify->retry++;
if (notify->retry > NOTIFY_MAX_RETRY) {
ods_log_verbose("[%s] notify max retry for zone %s, %s unreachable",
notify_str, zone->name, notify->secondary->address);
notify_next(notify);
} else {
notify_send(notify);
}
}
}
/**
* Update current SOA.
*
*/
static void
notify_update_soa(notify_type* notify, ldns_rr* soa)
{
if (!notify) {
return;
}
if (notify->soa) {
ldns_rr_free(notify->soa);
}
notify->soa = soa;
}
/**
* Enable notify.
*
*/
void
notify_enable(notify_type* notify, ldns_rr* soa)
{
xfrhandler_type* xfrhandler = NULL;
zone_type* zone = NULL;
dnsout_type* dnsout = NULL;
if (!notify) {
return;
}
xfrhandler = (xfrhandler_type*) notify->xfrhandler;
ods_log_assert(xfrhandler);
zone = (zone_type*) notify->zone;
ods_log_assert(zone);
ods_log_assert(zone->name);
ods_log_assert(zone->adoutbound);
ods_log_assert(zone->adoutbound->config);
ods_log_assert(zone->adoutbound->type == ADAPTER_DNS);
dnsout = (dnsout_type*) zone->adoutbound->config;
if (!dnsout->do_notify) {
ods_log_warning("[%s] zone %s has no notify acl", notify_str,
zone->name);
return; /* nothing to do */
}
if (notify->is_waiting || notify->handler.fd != -1) {
ods_log_debug("[%s] zone %s already on waiting list", notify_str,
zone->name);
return;
}
notify_update_soa(notify, soa);
if (xfrhandler->notify_udp_num < NOTIFY_MAX_UDP) {
notify_setup(notify);
xfrhandler->notify_udp_num++;
ods_log_debug("[%s] zone %s notify enabled", notify_str,
zone->name);
return;
}
/* put it in waiting list */
notify->secondary = dnsout->do_notify;
notify->is_waiting = 1;
notify->waiting_next = NULL;
if (xfrhandler->notify_waiting_last) {
xfrhandler->notify_waiting_last->waiting_next = notify;
} else {
xfrhandler->notify_waiting_first = notify;
}
xfrhandler->notify_waiting_last = notify;
notify->handler.timeout = NULL;
ods_log_debug("[%s] zone %s notify on waiting list", notify_str,
zone->name);
}
/**
* Cleanup notify structure.
*
*/
void
notify_cleanup(notify_type* notify)
{
if (!notify) {
return;
}
if (notify->handler.fd != -1) {
close(notify->handler.fd);
notify->handler.fd = -1;
}
if (notify->soa) {
ldns_rr_free(notify->soa);
}
tsig_rr_cleanup(notify->tsig_rr);
free(notify);
}
opendnssec-2.0.4/signer/src/wire/sock.c 0000644 0001750 0001750 00000062431 13036123676 014743 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Sockets.
*
*/
#include "config.h"
#include "daemon/engine.h"
#include "log.h"
#include "signer/zone.h"
#include "wire/axfr.h"
#include "wire/netio.h"
#include "wire/sock.h"
#include "wire/xfrd.h"
#include
#include
#include
#include
#define SOCK_TCP_BACKLOG 5
static const char* sock_str = "socket";
/**
* Set udp socket to non-blocking and bind.
*
*/
static ods_status
sock_fcntl_and_bind(sock_type* sock, const char* node, const char* port,
const char* stype, const char* fam)
{
ods_log_assert(sock);
ods_log_assert(port);
ods_log_assert(stype);
ods_log_assert(fam);
if (fcntl(sock->s, F_SETFL, O_NONBLOCK) == -1) {
ods_log_error("[%s] unable to set %s/%s socket '%s:%s' to "
"non-blocking: fcntl() failed (%s)", sock_str, stype, fam,
node?node:"localhost", port, strerror(errno));
return ODS_STATUS_SOCK_FCNTL_NONBLOCK;
}
ods_log_debug("[%s] bind %s/%s socket '%s:%s': %s", sock_str, stype, fam,
node?node:"localhost", port, strerror(errno));
if (bind(sock->s, (struct sockaddr *) sock->addr->ai_addr,
sock->addr->ai_addrlen) != 0) {
ods_log_error("[%s] unable to bind %s/%s socket '%s:%s': bind() "
"failed (%s)", sock_str, stype, fam, node?node:"localhost",
port, strerror(errno));
return ODS_STATUS_SOCK_BIND;
}
return ODS_STATUS_OK;
}
/**
* Set socket to v6 only.
*
*/
static ods_status
sock_v6only(sock_type* sock, const char* node, const char* port, int on,
const char* stype)
{
ods_log_assert(sock);
ods_log_assert(port);
ods_log_assert(stype);
#ifdef IPV6_V6ONLY
#if defined(IPPROTO_IPV6)
ods_log_debug("[%s] set %s/ipv6 socket '%s:%s' v6only", sock_str,
stype, node?node:"localhost", port);
if (setsockopt(sock->s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0) {
ods_log_error("[%s] unable to set %s/ipv6 socket '%s:%s' to "
"ipv6-only: setsockopt() failed (%s)", sock_str, stype,
node?node:"localhost", port, strerror(errno));
return ODS_STATUS_SOCK_SETSOCKOPT_V6ONLY;
}
#endif
#endif /* IPV6_V6ONLY */
return ODS_STATUS_OK;
}
/**
* Set tcp socket to reusable.
*
*/
static void
sock_tcp_reuseaddr(sock_type* sock, const char* node, const char* port,
int on, const char* fam)
{
ods_log_assert(sock);
ods_log_assert(port);
ods_log_assert(fam);
if (setsockopt(sock->s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0) {
ods_log_error("[%s] unable to set tcp/%s socket '%s:%s' to "
"reuse-addr: setsockopt() failed (%s)", sock_str, fam,
node?node:"localhost", port, strerror(errno));
}
}
/**
* Listen on tcp socket.
*
*/
static ods_status
sock_tcp_listen(sock_type* sock, const char* node, const char* port,
const char* fam)
{
ods_log_assert(sock);
ods_log_assert(port);
ods_log_assert(fam);
if (listen(sock->s, SOCK_TCP_BACKLOG) == -1) {
ods_log_error("[%s] unable to listen on tcp/%s socket '%s:%s': "
"listen() failed (%s)", sock_str, fam, node?node:"localhost",
port, strerror(errno));
return ODS_STATUS_SOCK_LISTEN;
}
return ODS_STATUS_OK;
}
/**
* Create server udp socket.
*
*/
static ods_status
sock_server_udp(sock_type* sock, const char* node, const char* port,
unsigned* ip6_support)
{
int on = 0;
ods_status status = ODS_STATUS_OK;
ods_log_assert(sock);
ods_log_assert(port);
#if defined(SO_REUSEADDR) || defined(IPV6_V6ONLY)
on = 1;
#endif
*ip6_support = 1;
/* socket */
ods_log_debug("[%s] create udp socket '%s:%s': %s", sock_str,
node?node:"localhost", port, strerror(errno));
if ((sock->s = socket(sock->addr->ai_family, SOCK_DGRAM, 0))== -1) {
ods_log_error("[%s] unable to create udp/ipv4 socket '%s:%s': "
"socket() failed (%s)", sock_str, node?node:"localhost", port,
strerror(errno));
if (sock->addr->ai_family == AF_INET6 && errno == EAFNOSUPPORT) {
*ip6_support = 0;
}
return ODS_STATUS_SOCK_SOCKET_UDP;
}
/* ipv4 */
if (sock->addr->ai_family == AF_INET) {
status = sock_fcntl_and_bind(sock, node, port, "udp", "ipv4");
}
/* ipv6 */
else if (sock->addr->ai_family == AF_INET6) {
status = sock_v6only(sock, node, port, on, "udp");
if (status != ODS_STATUS_OK) {
return status;
}
status = sock_fcntl_and_bind(sock, node, port, "udp", "ipv6");
}
return status;
}
/**
* Create server tcp socket.
*
*/
static ods_status
sock_server_tcp(sock_type* sock, const char* node, const char* port,
unsigned* ip6_support)
{
int on = 0;
ods_status status = ODS_STATUS_OK;
ods_log_assert(sock);
ods_log_assert(port);
#if defined(SO_REUSEADDR) || defined(IPV6_V6ONLY)
on = 1;
#endif
*ip6_support = 1;
/* socket */
ods_log_debug("[%s] create tcp socket '%s:%s': %s", sock_str,
node?node:"localhost", port, strerror(errno));
if ((sock->s = socket(sock->addr->ai_family, SOCK_STREAM, 0))== -1) {
ods_log_error("[%s] unable to create tcp/ipv4 socket '%s:%s': "
"socket() failed (%s)", sock_str, node?node:"localhost", port,
strerror(errno));
if (sock->addr->ai_family == AF_INET6 && errno == EAFNOSUPPORT) {
*ip6_support = 0;
}
return ODS_STATUS_SOCK_SOCKET_TCP;
}
/* ipv4 */
if (sock->addr->ai_family == AF_INET) {
sock_tcp_reuseaddr(sock, node, port, on, "ipv4");
status = sock_fcntl_and_bind(sock, node, port, "tcp", "ipv4");
if (status == ODS_STATUS_OK) {
status = sock_tcp_listen(sock, node, port, "ipv4");
}
}
/* ipv6 */
else if (sock->addr->ai_family == AF_INET6) {
status = sock_v6only(sock, node, port, on, "tcp");
if (status != ODS_STATUS_OK) {
return status;
}
sock_tcp_reuseaddr(sock, node, port, on, "ipv6");
status = sock_fcntl_and_bind(sock, node, port, "tcp", "ipv6");
if (status == ODS_STATUS_OK) {
status = sock_tcp_listen(sock, node, port, "ipv6");
}
}
return status;
}
/**
* Create listening socket.
*
*/
static ods_status
socket_listen(sock_type* sock, struct addrinfo hints, int socktype,
const char* node, const char* port, unsigned* ip6_support)
{
ods_status status = ODS_STATUS_OK;
int r = 0;
ods_log_assert(sock);
ods_log_assert(port);
*ip6_support = 1;
hints.ai_socktype = socktype;
/* getaddrinfo */
if ((r = getaddrinfo(node, port, &hints, &sock->addr)) != 0 ||
!sock->addr) {
ods_log_error("[%s] unable to parse address '%s:%s': getaddrinfo() "
"failed (%s %s)", sock_str, node?node:"localhost", port,
gai_strerror(r),
#ifdef EAI_SYSTEM
r==EAI_SYSTEM?(char*)strerror(errno):"");
#else
"");
#endif
if (hints.ai_family == AF_INET6 && r==EAFNOSUPPORT) {
*ip6_support = 0;
}
return ODS_STATUS_SOCK_GETADDRINFO;
}
/* socket */
if (socktype == SOCK_DGRAM) {
status = sock_server_udp(sock, node, port, ip6_support);
} else if (socktype == SOCK_STREAM) {
status = sock_server_tcp(sock, node, port, ip6_support);
}
ods_log_debug("[%s] socket listening to %s:%s", sock_str,
node?node:"localhost", port);
return status;
}
/**
* Create sockets and listen.
*
*/
ods_status
sock_listen(socklist_type* sockets, listener_type* listener)
{
ods_status status = ODS_STATUS_OK;
struct addrinfo hints[MAX_INTERFACES];
const char* node = NULL;
const char* port = NULL;
size_t i = 0;
unsigned ip6_support = 1;
if (!sockets || !listener) {
return ODS_STATUS_ASSERT_ERR;
}
/* Initialize values */
for (i = 0; i < MAX_INTERFACES; i++) {
memset(&hints[i], 0, sizeof(hints[i]));
hints[i].ai_family = AF_UNSPEC;
hints[i].ai_flags = AI_PASSIVE;
sockets->udp[i].s = -1;
sockets->tcp[i].s = -1;
}
/* Walk interfaces */
for (i=0; i < listener->count; i++) {
node = NULL;
if (strlen(listener->interfaces[i].address) > 0) {
node = listener->interfaces[i].address;
}
port = DNS_PORT_STRING;
if (listener->interfaces[i].port) {
port = listener->interfaces[i].port;
}
if (node != NULL) {
hints[i].ai_flags |= AI_NUMERICHOST;
} else {
hints[i].ai_family = listener->interfaces[i].family;
}
/* udp */
status = socket_listen(&sockets->udp[i], hints[i], SOCK_DGRAM,
node, port, &ip6_support);
if (status != ODS_STATUS_OK) {
if (!ip6_support) {
ods_log_warning("[%s] fallback to udp/ipv4, no udp/ipv6: "
"not supported", sock_str);
status = ODS_STATUS_OK;
} else {
return status;
}
}
/* tcp */
status = socket_listen(&sockets->tcp[i], hints[i], SOCK_STREAM,
node, port, &ip6_support);
if (status != ODS_STATUS_OK) {
if (!ip6_support) {
ods_log_warning("[%s] fallback to udp/ipv4, no udp/ipv6: "
"not supported", sock_str);
status = ODS_STATUS_OK;
} else {
return status;
}
}
}
/* All ok */
return ODS_STATUS_OK;
}
/**
* Send data over udp.
*
*/
static void
send_udp(struct udp_data* data, query_type* q)
{
ssize_t nb;
ods_log_deeebug("[%s] sending %d bytes over udp", sock_str,
(int)buffer_remaining(q->buffer));
nb = sendto(data->socket->s, buffer_begin(q->buffer),
buffer_remaining(q->buffer), 0,
(struct sockaddr*) &q->addr, q->addrlen);
if (nb == -1) {
ods_log_error("[%s] unable to send data over udp: sendto() failed "
"(%s)", sock_str, strerror(errno));
ods_log_debug("[%s] len=%lu", sock_str, (unsigned long)buffer_remaining(q->buffer));
} else if ((size_t) nb != buffer_remaining(q->buffer)) {
ods_log_error("[%s] unable to send data over udp: only sent %d of %d "
"octets", sock_str, (int)nb,
(int)buffer_remaining(q->buffer));
}
}
/**
* Handle incoming udp queries.
*
*/
void
sock_handle_udp(netio_type* ATTR_UNUSED(netio), netio_handler_type* handler,
netio_events_type event_types)
{
struct udp_data* data = (struct udp_data*) handler->user_data;
int received = 0;
query_type* q = data->query;
query_state qstate = QUERY_PROCESSED;
if (!(event_types & NETIO_EVENT_READ)) {
return;
}
ods_log_debug("[%s] incoming udp message", sock_str);
query_reset(q, UDP_MAX_MESSAGE_LEN, 0);
received = recvfrom(handler->fd, buffer_begin(q->buffer),
buffer_remaining(q->buffer), 0, (struct sockaddr*) &q->addr,
&q->addrlen);
if (received < 1) {
if (errno != EAGAIN && errno != EINTR) {
ods_log_error("[%s] recvfrom() failed: %s", sock_str,
strerror(errno));
}
return;
}
buffer_skip(q->buffer, received);
buffer_flip(q->buffer);
qstate = query_process(q, data->engine);
if (qstate != QUERY_DISCARDED) {
ods_log_debug("[%s] query processed qstate=%d", sock_str, qstate);
query_add_optional(q, data->engine);
buffer_flip(q->buffer);
send_udp(data, q);
}
}
/**
* Cleanup tcp handler data.
*
*/
static void
cleanup_tcp_handler(netio_type* netio, netio_handler_type* handler)
{
struct tcp_data* data = (struct tcp_data*) handler->user_data;
netio_remove_handler(netio, handler);
close(handler->fd);
free(handler->timeout);
free(handler);
query_cleanup(data->query);
free(data);
}
/**
* Handle incoming tcp connections.
*
*/
void
sock_handle_tcp_accept(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types)
{
struct tcp_accept_data* accept_data = (struct tcp_accept_data*)
handler->user_data;
int s = 0;
struct tcp_data* tcp_data = NULL;
netio_handler_type* tcp_handler = NULL;
struct sockaddr_storage addr;
socklen_t addrlen = 0;
if (!(event_types & NETIO_EVENT_READ)) {
return;
}
ods_log_debug("[%s] handle incoming tcp connection", sock_str);
addrlen = sizeof(addr);
s = accept(handler->fd, (struct sockaddr *) &addr, &addrlen);
if (s == -1) {
if (errno != EINTR && errno != EWOULDBLOCK) {
ods_log_error("[%s] unable to handle incoming tcp connection: "
"accept() failed (%s)", sock_str, strerror(errno));
}
return;
}
if (fcntl(s, F_SETFL, O_NONBLOCK) == -1) {
ods_log_error("[%s] unable to handle incoming tcp connection: "
"fcntl() failed: %s", sock_str, strerror(errno));
close(s);
return;
}
/* create tcp handler data */
CHECKALLOC(tcp_data = (struct tcp_data*) malloc(sizeof(struct tcp_data)));
tcp_data->query = query_create();
if (!tcp_data->query) {
ods_log_error("[%s] unable to handle incoming tcp connection: "
"query_create() failed", sock_str);
free(tcp_data);
close(s);
return;
}
tcp_data->engine = accept_data->engine;
tcp_data->tcp_accept_handler_count =
accept_data->tcp_accept_handler_count;
tcp_data->tcp_accept_handlers = accept_data->tcp_accept_handlers;
tcp_data->qstate = QUERY_PROCESSED;
tcp_data->bytes_transmitted = 0;
memcpy(&tcp_data->query->addr, &addr, addrlen);
tcp_data->query->addrlen = addrlen;
CHECKALLOC(tcp_handler = (netio_handler_type*) malloc(sizeof(netio_handler_type)));
tcp_handler->fd = s;
CHECKALLOC(tcp_handler->timeout = (struct timespec*) malloc(sizeof(struct timespec)));
if (!tcp_handler->timeout) {
ods_log_error("[%s] unable to handle incoming tcp connection: "
"allocator_alloc() timeout failed", sock_str);
free(tcp_handler);
query_cleanup(tcp_data->query);
free(tcp_data);
close(s);
return;
}
tcp_handler->timeout->tv_sec = XFRD_TCP_TIMEOUT;
tcp_handler->timeout->tv_nsec = 0L;
timespec_add(tcp_handler->timeout, netio_current_time(netio));
tcp_handler->user_data = tcp_data;
tcp_handler->event_types = NETIO_EVENT_READ | NETIO_EVENT_TIMEOUT;
tcp_handler->event_handler = sock_handle_tcp_read;
netio_add_handler(netio, tcp_handler);
}
/**
* Handle incoming tcp queries.
*
*/
void
sock_handle_tcp_read(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types)
{
struct tcp_data* data = (struct tcp_data *) handler->user_data;
ssize_t received = 0;
query_state qstate = QUERY_PROCESSED;
if (event_types & NETIO_EVENT_TIMEOUT) {
cleanup_tcp_handler(netio, handler);
return;
}
ods_log_assert(event_types & NETIO_EVENT_READ);
ods_log_debug("[%s] incoming tcp message", sock_str);
if (data->bytes_transmitted == 0) {
ods_log_debug("[%s] TCP_READ: reset query", sock_str);
query_reset(data->query, TCP_MAX_MESSAGE_LEN, 1);
}
/* check if we received the leading packet length bytes yet. */
if (data->bytes_transmitted < sizeof(uint16_t)) {
received = read(handler->fd,
(char *) &data->query->tcplen + data->bytes_transmitted,
sizeof(uint16_t) - data->bytes_transmitted);
if (received == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* read would block, wait until more data is available. */
return;
} else {
ods_log_error("[%s] unable to handle incoming tcp query: "
"read() failed (%s)", sock_str, strerror(errno));
cleanup_tcp_handler(netio, handler);
return;
}
} else if (received == 0) {
cleanup_tcp_handler(netio, handler);
return;
}
data->bytes_transmitted += received;
ods_log_debug("[%s] TCP_READ: bytes transmitted %lu (received %lu)",
sock_str, (unsigned long)data->bytes_transmitted, (unsigned long)received);
if (data->bytes_transmitted < sizeof(uint16_t)) {
/* not done with the tcplen yet, wait for more. */
ods_log_debug("[%s] TCP_READ: bytes transmitted %lu, while "
"sizeof uint16_t %lu", sock_str, (unsigned long)data->bytes_transmitted,
(unsigned long)sizeof(uint16_t));
return;
}
ods_log_assert(data->bytes_transmitted == sizeof(uint16_t));
data->query->tcplen = ntohs(data->query->tcplen);
/* minimum query size is: 12 + 1 + 2 + 2:
* header size + root dname + qclass + qtype */
if (data->query->tcplen < 17) {
ods_log_warning("[%s] unable to handle incoming tcp query: "
"packet too small", sock_str);
cleanup_tcp_handler(netio, handler);
return;
}
if (data->query->tcplen > data->query->maxlen) {
ods_log_warning("[%s] unable to handle incoming tcp query: "
"insufficient tcp buffer", sock_str);
cleanup_tcp_handler(netio, handler);
return;
}
buffer_set_limit(data->query->buffer, data->query->tcplen);
}
ods_log_assert(buffer_remaining(data->query->buffer) > 0);
/* read the (remaining) query data. */
received = read(handler->fd, buffer_current(data->query->buffer),
buffer_remaining(data->query->buffer));
if (received == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* read would block, wait until more data is available. */
return;
} else {
ods_log_error("[%s] unable to handle incoming tcp query: "
"read() failed (%s)", sock_str, strerror(errno));
cleanup_tcp_handler(netio, handler);
return;
}
} else if (received == 0) {
cleanup_tcp_handler(netio, handler);
return;
}
data->bytes_transmitted += received;
ods_log_debug("[%s] TCP_READ: bytes transmitted %lu (received %lu)",
sock_str, (unsigned long)data->bytes_transmitted, (unsigned long)received);
buffer_skip(data->query->buffer, received);
if (buffer_remaining(data->query->buffer) > 0) {
/* not done with message yet, wait for more. */
ods_log_debug("[%s] TCP_READ: remaining %lu", sock_str,
(unsigned long)buffer_remaining(data->query->buffer));
return;
}
ods_log_assert(buffer_position(data->query->buffer) ==
data->query->tcplen);
/* we have a complete query, process it. */
buffer_flip(data->query->buffer);
qstate = query_process(data->query, data->engine);
if (qstate == QUERY_DISCARDED) {
cleanup_tcp_handler(netio, handler);
return;
}
ods_log_debug("[%s] query processed qstate=%d", sock_str, qstate);
data->qstate = qstate;
/* edns, tsig */
query_add_optional(data->query, data->engine);
/* switch to tcp write handler. */
buffer_flip(data->query->buffer);
data->query->tcplen = buffer_remaining(data->query->buffer);
ods_log_debug("[%s] TCP_READ: new tcplen %u", sock_str,
data->query->tcplen);
data->bytes_transmitted = 0;
handler->timeout->tv_sec = XFRD_TCP_TIMEOUT;
handler->timeout->tv_nsec = 0L;
timespec_add(handler->timeout, netio_current_time(netio));
handler->event_types = NETIO_EVENT_WRITE | NETIO_EVENT_TIMEOUT;
handler->event_handler = sock_handle_tcp_write;
}
/**
* Handle outgoing tcp responses.
*
*/
void
sock_handle_tcp_write(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types)
{
struct tcp_data* data = (struct tcp_data *) handler->user_data;
ssize_t sent = 0;
query_type* q = data->query;
if (event_types & NETIO_EVENT_TIMEOUT) {
cleanup_tcp_handler(netio, handler);
return;
}
ods_log_assert(event_types & NETIO_EVENT_WRITE);
if (data->bytes_transmitted < sizeof(q->tcplen)) {
uint16_t n_tcplen = htons(q->tcplen);
sent = write(handler->fd,
(const char*) &n_tcplen + data->bytes_transmitted,
sizeof(n_tcplen) - data->bytes_transmitted);
if (sent == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* write would block, wait until socket becomes writeable. */
return;
} else {
ods_log_error("[%s] unable to handle outgoing tcp response: "
"write() failed (%s)", sock_str, strerror(errno));
cleanup_tcp_handler(netio, handler);
return;
}
} else if (sent == 0) {
cleanup_tcp_handler(netio, handler);
return;
}
data->bytes_transmitted += sent;
ods_log_debug("[%s] TCP_WRITE: bytes transmitted %lu (sent %ld)",
sock_str, (unsigned long)data->bytes_transmitted, (long)sent);
if (data->bytes_transmitted < sizeof(q->tcplen)) {
/* writing not complete, wait until socket becomes writable. */
ods_log_debug("[%s] TCP_WRITE: bytes transmitted %lu, while "
"sizeof tcplen %lu", sock_str, (unsigned long)data->bytes_transmitted,
(unsigned long)sizeof(q->tcplen));
return;
}
ods_log_assert(data->bytes_transmitted == sizeof(q->tcplen));
}
ods_log_assert(data->bytes_transmitted < q->tcplen + sizeof(q->tcplen));
sent = write(handler->fd, buffer_current(q->buffer),
buffer_remaining(q->buffer));
if (sent == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* write would block, wait until socket becomes writeable. */
return;
} else {
ods_log_error("[%s] unable to handle outgoing tcp response: "
"write() failed (%s)", sock_str, strerror(errno));
cleanup_tcp_handler(netio, handler);
return;
}
} else if (sent == 0) {
cleanup_tcp_handler(netio, handler);
return;
}
buffer_skip(q->buffer, sent);
data->bytes_transmitted += sent;
if (data->bytes_transmitted < q->tcplen + sizeof(q->tcplen)) {
/* still more data to write when socket becomes writable. */
ods_log_debug("[%s] TCP_WRITE: bytes transmitted %lu, while tcplen "
"%u and sizeof tcplen %lu", sock_str, (unsigned long) data->bytes_transmitted,
q->tcplen, (unsigned long)sizeof(q->tcplen));
return;
}
ods_log_debug("[%s] TCP_WRITE: bytes transmitted %lu",
sock_str, (unsigned long)data->bytes_transmitted);
ods_log_debug("[%s] TCP_WRITE: tcplen %u", sock_str, q->tcplen);
ods_log_debug("[%s] TCP_WRITE: sizeof tcplen %lu", sock_str,
(unsigned long)sizeof(q->tcplen));
ods_log_assert(data->bytes_transmitted == q->tcplen + sizeof(q->tcplen));
if (data->qstate == QUERY_AXFR || data->qstate == QUERY_IXFR) {
/* continue processing AXFR and writing back results. */
buffer_clear(q->buffer);
if (data->qstate == QUERY_IXFR) {
data->qstate = ixfr(q, data->engine);
} else {
data->qstate = axfr(q, data->engine, 0);
}
if (data->qstate != QUERY_PROCESSED) {
/* edns, tsig */
query_add_optional(q, data->engine);
buffer_flip(q->buffer);
q->tcplen = buffer_remaining(q->buffer);
data->bytes_transmitted = 0;
handler->timeout->tv_sec = XFRD_TCP_TIMEOUT;
handler->timeout->tv_nsec = 0L;
timespec_add(handler->timeout, netio_current_time(netio));
return;
}
}
/* done sending, wait for the next request. */
data->bytes_transmitted = 0;
handler->timeout->tv_sec = XFRD_TCP_TIMEOUT;
handler->timeout->tv_nsec = 0L;
timespec_add(handler->timeout, netio_current_time(netio));
handler->event_types = NETIO_EVENT_READ | NETIO_EVENT_TIMEOUT;
handler->event_handler = sock_handle_tcp_read;
}
opendnssec-2.0.4/signer/src/wire/acl.h 0000644 0001750 0001750 00000006367 13036123676 014556 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Access Control List.
*
*/
#ifndef WIRE_ACL_H
#define WIRE_ACL_H
#include "config.h"
#include "status.h"
#include "wire/listener.h"
#include "wire/tsig.h"
/**
* Address range type.
*
*/
enum acl_range_enum {
ACL_RANGE_SINGLE = 0, /* single adress */
ACL_RANGE_MASK = 1, /* 10.20.30.40&255.255.255.0 */
ACL_RANGE_SUBNET = 2, /* 10.20.30.40/28 */
ACL_RANGE_MINMAX = 3 /* 10.20.30.40-10.20.30.60 (mask=max) */
};
typedef enum acl_range_enum acl_range_type;
/**
* ACL.
*
*/
typedef struct acl_struct acl_type;
struct acl_struct {
acl_type* next;
/* address */
char* address;
unsigned int port;
int family;
union acl_addr_storage addr;
union acl_addr_storage range_mask;
acl_range_type range_type;
/* tsig */
const char* tsig_name;
tsig_type* tsig;
/* cache */
time_t ixfr_disabled;
};
/**
* Create ACL.
* \param[in] allocator memory allocator
* \param[in] address IP address
* \param[in] port port
* \param[in] tsig_name TSIG name
* \param[in] tsig list of TSIGs
* \return acl_type* ACL
*
*/
acl_type* acl_create(char* address,
char* port, char* tsig_name, tsig_type* tsig);
/**
* Find ACL.
* \param[in] acl ACL
* \param[in] addr remote address storage
* \param[in] tsig tsig credentials
* \return acl_type* ACL that matches
*
*/
acl_type* acl_find(acl_type* acl, struct sockaddr_storage* addr,
tsig_rr_type* tsig);
/**
* Parse family from address.
* \param[in] a address in string format
* \return int address family
*
*/
int acl_parse_family(const char* a);
/**
* Address storage to IP string.
* \param[in] addr socket address storage
* \param[out] ip ip address
* \param[in] len max strlen of ip address
* \return int 0 if failed, 1 otherwise
*
*/
int addr2ip(struct sockaddr_storage addr, char* ip, size_t len);
/**
* Clean up ACL.
* \param[in] acl ACL
* \param[in] allocator memory allocator
*
*/
void acl_cleanup(acl_type* acl);
#endif /* WIRE_ACL_H */
opendnssec-2.0.4/signer/src/wire/buffer.c 0000644 0001750 0001750 00000052644 13036123676 015262 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Packet buffer.
*
* 1 1 1 1 1 1
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 01 | ID |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 23 |QR| Opcode |AA|TC|RD|RA| Z|AD|CD| RCODE |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 45 | QDCOUNT |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 67 | ANCOUNT |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 89 | NSCOUNT |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
* 01 | ARCOUNT |
* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
*
*/
#include "config.h"
#include "log.h"
#include "wire/buffer.h"
#include
static const char* buffer_str = "buffer";
ods_lookup_table ods_rcode_str[] = {
{ LDNS_RCODE_NOERROR, "NOERROR" },
{ LDNS_RCODE_FORMERR, "FORMERR" },
{ LDNS_RCODE_SERVFAIL, "SERVFAIL" },
{ LDNS_RCODE_NXDOMAIN, "NXDOMAIN" },
{ LDNS_RCODE_NOTIMPL, "NOTIMPL" },
{ LDNS_RCODE_REFUSED, "REFUSED" },
{ LDNS_RCODE_YXDOMAIN, "YXDOMAIN" },
{ LDNS_RCODE_YXRRSET, "YXRRSET" },
{ LDNS_RCODE_NXRRSET, "NXRRSET" },
{ LDNS_RCODE_NOTAUTH, "NOTAUTH" },
{ LDNS_RCODE_NOTZONE, "NOTZONE" },
{ 0, NULL }
};
/**
* Create a new buffer with the specified capacity.
*
*/
buffer_type*
buffer_create(size_t capacity)
{
buffer_type* buffer = NULL;
if (!capacity) {
return NULL;
}
CHECKALLOC(buffer = (buffer_type *) malloc(sizeof(buffer_type)));
buffer->data = (uint8_t*) calloc(capacity, sizeof(uint8_t));
buffer->position = 0;
buffer->limit = capacity;
buffer->capacity = capacity;
buffer->fixed = 0;
return buffer;
}
/**
* Clear the buffer and make it ready for writing.
*
*/
void
buffer_clear(buffer_type* buffer)
{
ods_log_assert(buffer);
buffer->position = 0;
buffer->limit = buffer->capacity;
}
/**
* Flip the buffer and make it ready for reading.
*
*/
void
buffer_flip(buffer_type* buffer)
{
ods_log_assert(buffer);
buffer->limit = buffer->position;
buffer->position = 0;
}
/**
* Get the buffer's position.
*
*/
size_t
buffer_position(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer->position;
}
/**
* Set the buffer's position.
*
*/
void
buffer_set_position(buffer_type* buffer, size_t pos)
{
ods_log_assert(buffer);
ods_log_assert(pos <= buffer->limit);
buffer->position = pos;
}
/**
* Change the buffer's position.
*
*/
void
buffer_skip(buffer_type* buffer, ssize_t count)
{
ods_log_assert(buffer);
ods_log_assert(buffer->position + count <= buffer->limit);
buffer->position += count;
}
/**
* Get bit.
*
*/
static int
get_bit(uint8_t bits[], size_t index)
{
return bits[index / 8] & (1 << (7 - index % 8));
}
/**
* Set bit.
*
*/
static void
set_bit(uint8_t bits[], size_t index)
{
bits[index / 8] |= (1 << (7 - index % 8));
}
/**
* Is pointer label>
*
*/
static int
label_is_pointer(const uint8_t* label)
{
ods_log_assert(label);
return (label[0] & 0xc0) == 0xc0;
}
/**
* Pointer label location.
*
*/
static uint16_t
label_pointer_location(const uint8_t* label)
{
ods_log_assert(label);
ods_log_assert(label_is_pointer(label));
return ((uint16_t) (label[0] & ~0xc0) << 8) | (uint16_t) label[1];
}
/**
* Is normal label?
*
*/
static int
label_is_normal(const uint8_t* label)
{
ods_log_assert(label);
return (label[0] & 0xc0) == 0;
}
/*
* Is root label?
*
*/
static inline int
label_is_root(const uint8_t* label)
{
ods_log_assert(label);
return label[0] == 0;
}
/*
* Label length.
*
*/
static uint8_t
label_length(const uint8_t* label)
{
ods_log_assert(label);
ods_log_assert(label_is_normal(label));
return label[0];
}
/**
* Read dname from buffer.
*
*/
size_t
buffer_read_dname(buffer_type* buffer, uint8_t* dname, unsigned allow_pointers)
{
int done = 0;
uint8_t visited[(MAX_PACKET_SIZE+7)/8];
size_t dname_length = 0;
const uint8_t *label = NULL;
ssize_t mark = -1;
ods_log_assert(buffer);
memset(visited, 0, (buffer_limit(buffer)+7)/8);
while (!done) {
if (!buffer_available(buffer, 1)) {
return 0;
}
if (get_bit(visited, buffer_position(buffer))) {
ods_log_error("[%s] dname loop!", buffer_str);
return 0;
}
set_bit(visited, buffer_position(buffer));
label = buffer_current(buffer);
if (label_is_pointer(label)) {
size_t pointer = 0;
if (!allow_pointers) {
return 0;
}
if (!buffer_available(buffer, 2)) {
return 0;
}
pointer = label_pointer_location(label);
if (pointer >= buffer_limit(buffer)) {
return 0;
}
buffer_skip(buffer, 2);
if (mark == -1) {
mark = buffer_position(buffer);
}
buffer_set_position(buffer, pointer);
} else if (label_is_normal(label)) {
size_t length = label_length(label) + 1;
done = label_is_root(label);
if (!buffer_available(buffer, length)) {
return 0;
}
if (dname_length + length >= MAXDOMAINLEN+1) {
return 0;
}
buffer_read(buffer, dname + dname_length, length);
dname_length += length;
} else {
return 0;
}
}
if (mark != -1) {
buffer_set_position(buffer, mark);
}
return dname_length;
}
/**
* Change the buffer's position so that one dname is skipped.
*
*/
int
buffer_skip_dname(buffer_type* buffer)
{
ods_log_assert(buffer);
while (1) {
uint8_t label_size = 0;
if (!buffer_available(buffer, 1)) {
return 0;
}
label_size = buffer_read_u8(buffer);
if (label_size == 0) {
break;
} else if ((label_size & 0xc0) != 0) {
if (!buffer_available(buffer, 1)) {
return 0;
}
buffer_skip(buffer, 1);
break;
} else if (!buffer_available(buffer, label_size)) {
return 0;
} else {
buffer_skip(buffer, label_size);
}
}
return 1;
}
/**
* Change the buffer's position so that one RR is skipped.
*
*/
int
buffer_skip_rr(buffer_type* buffer, unsigned qrr)
{
if (!buffer_skip_dname(buffer)) {
return 0;
}
if (qrr) {
if (!buffer_available(buffer, 4)) {
return 0;
}
buffer_skip(buffer, 4);
} else {
uint16_t rdata_size;
if (!buffer_available(buffer, 10)) {
return 0;
}
buffer_skip(buffer, 8);
rdata_size = buffer_read_u16(buffer);
if (!buffer_available(buffer, rdata_size)) {
return 0;
}
buffer_skip(buffer, rdata_size);
}
return 1;
}
/**
* Get the buffer's limit.
*
*/
size_t
buffer_limit(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer->limit;
}
/**
* Set the buffer's limit.
*
*/
void
buffer_set_limit(buffer_type* buffer, size_t limit)
{
ods_log_assert(buffer);
ods_log_assert(limit <= buffer->capacity);
buffer->limit = limit;
if (buffer->position > buffer->limit) {
buffer->position = buffer->limit;
}
}
/**
* Get the buffer's capacity.
*
*/
size_t
buffer_capacity(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer->capacity;
}
/**
* Return a pointer to the data at the indicated position.
*
*/
uint8_t*
buffer_at(buffer_type* buffer, size_t at)
{
ods_log_assert(buffer);
ods_log_assert(at <= buffer->limit);
return buffer->data + at;
}
/**
* Return a pointer to the data at the beginning of the buffer.
*
*/
uint8_t*
buffer_begin(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_at(buffer, 0);
}
/**
* Return a pointer to the data at the buffer's current position.
*
*/
uint8_t*
buffer_current(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_at(buffer, buffer->position);
}
/**
* The number of bytes remaining between the at and limit.
*
*/
static size_t
buffer_remaining_at(buffer_type* buffer, size_t at)
{
ods_log_assert(buffer);
ods_log_assert(at <= buffer->limit);
return buffer->limit - at;
}
/**
* The number of bytes remaining between the buffer's position and limit.
*
*/
size_t
buffer_remaining(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_remaining_at(buffer, buffer->position);
}
/**
* Check if the buffer has enough bytes available at indicated position.
*
*/
static int
buffer_available_at(buffer_type *buffer, size_t at, size_t count)
{
ods_log_assert(buffer);
return count <= buffer_remaining_at(buffer, at);
}
/**
* Check if the buffer has enough bytes available.
*
*/
int
buffer_available(buffer_type *buffer, size_t count)
{
ods_log_assert(buffer);
return buffer_available_at(buffer, buffer->position, count);
}
/**
* Write to buffer at indicated position.
*
*/
static void
buffer_write_u8_at(buffer_type* buffer, size_t at, uint8_t data)
{
ods_log_assert(buffer);
ods_log_assert(buffer_available_at(buffer, at, sizeof(data)));
buffer->data[at] = data;
}
/**
* Write to buffer at indicated position.
*
*/
void
buffer_write_u16_at(buffer_type* buffer, size_t at, uint16_t data)
{
ods_log_assert(buffer);
ods_log_assert(buffer_available_at(buffer, at, sizeof(data)));
write_uint16(buffer->data + at, data);
}
/**
* Write to buffer at indicated position.
*
*/
static void
buffer_write_u32_at(buffer_type* buffer, size_t at, uint32_t data)
{
ods_log_assert(buffer);
ods_log_assert(buffer_available_at(buffer, at, sizeof(data)));
write_uint32(buffer->data + at, data);
}
/**
* Write to buffer.
*
*/
void
buffer_write(buffer_type* buffer, const void* data, size_t count)
{
ods_log_assert(buffer);
ods_log_assert(buffer_available(buffer, count));
memcpy(buffer->data + buffer->position, data, count);
buffer->position += count;
}
/**
* Write uint8_t to buffer.
*
*/
void
buffer_write_u8(buffer_type* buffer, uint8_t data)
{
ods_log_assert(buffer);
buffer_write_u8_at(buffer, buffer->position, data);
buffer->position += sizeof(data);
}
/**
* Write uint16_t to buffer.
*
*/
void
buffer_write_u16(buffer_type* buffer, uint16_t data)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, buffer->position, data);
buffer->position += sizeof(data);
}
/**
* Write uint32_t to buffer.
*
*/
void
buffer_write_u32(buffer_type* buffer, uint32_t data)
{
ods_log_assert(buffer);
buffer_write_u32_at(buffer, buffer->position, data);
buffer->position += sizeof(data);
}
/**
* Write rdf to buffer.
*
*/
void
buffer_write_rdf(buffer_type* buffer, ldns_rdf* rdf)
{
ods_log_assert(buffer);
ods_log_assert(rdf);
buffer_write(buffer, ldns_rdf_data(rdf), ldns_rdf_size(rdf));
/* position updated by buffer_write() */
}
/**
* Write rr to buffer.
*
*/
int
buffer_write_rr(buffer_type* buffer, ldns_rr* rr)
{
size_t i = 0;
size_t tc_mark = 0;
size_t rdlength_pos = 0;
uint16_t rdlength = 0;
ods_log_assert(buffer);
ods_log_assert(rr);
/* set truncation mark, in case rr does not fit */
tc_mark = buffer_position(buffer);
/* owner type class ttl */
if (!buffer_available(buffer, ldns_rdf_size(ldns_rr_owner(rr)))) {
goto buffer_tc;
}
buffer_write_rdf(buffer, ldns_rr_owner(rr));
if (!buffer_available(buffer, sizeof(uint16_t) + sizeof(uint16_t) +
sizeof(uint32_t) + sizeof(rdlength))) {
goto buffer_tc;
}
buffer_write_u16(buffer, (uint16_t) ldns_rr_get_type(rr));
buffer_write_u16(buffer, (uint16_t) ldns_rr_get_class(rr));
buffer_write_u32(buffer, (uint32_t) ldns_rr_ttl(rr));
/* skip rdlength */
rdlength_pos = buffer_position(buffer);
buffer_skip(buffer, sizeof(rdlength));
/* write rdata */
for (i=0; i < ldns_rr_rd_count(rr); i++) {
if (!buffer_available(buffer, ldns_rdf_size(ldns_rr_rdf(rr, i)))) {
goto buffer_tc;
}
buffer_write_rdf(buffer, ldns_rr_rdf(rr, i));
}
/* write rdlength */
rdlength = buffer_position(buffer) - rdlength_pos - sizeof(rdlength);
buffer_write_u16_at(buffer, rdlength_pos, rdlength);
/* position updated by buffer_write() */
return 1;
buffer_tc:
buffer_set_position(buffer, tc_mark);
return 0;
}
/**
* Read uint8_t from buffer at indicated position.
*
*/
static uint8_t
buffer_read_u8_at(buffer_type* buffer, size_t at)
{
ods_log_assert(buffer);
ods_log_assert(at < buffer->capacity);
return buffer->data[at];
}
/**
* Read uint16_t from buffer at indicated position.
*
*/
static uint16_t
buffer_read_u16_at(buffer_type* buffer, size_t at)
{
ods_log_assert(buffer);
return read_uint16(buffer->data + at);
}
/**
* Read uint32_t from buffer at indicated position.
*
*/
static uint32_t
buffer_read_u32_at(buffer_type* buffer, size_t at)
{
ods_log_assert(buffer);
return read_uint32(buffer->data + at);
}
/**
* Read from buffer.
*
*/
void
buffer_read(buffer_type* buffer, void* data, size_t count)
{
ods_log_assert(buffer);
ods_log_assert(buffer_available(buffer, count));
memcpy(data, buffer->data + buffer->position, count);
buffer->position += count;
}
/**
* Read uint8_t from buffer.
*
*/
uint8_t
buffer_read_u8(buffer_type* buffer)
{
uint16_t result = 0;
ods_log_assert(buffer);
result = buffer_read_u8_at(buffer, buffer->position);
buffer->position += sizeof(uint8_t);
return result;
}
/**
* Read uint16_t from buffer.
*
*/
uint16_t
buffer_read_u16(buffer_type* buffer)
{
uint16_t result = 0;
ods_log_assert(buffer);
result = buffer_read_u16_at(buffer, buffer->position);
buffer->position += sizeof(uint16_t);
return result;
}
/**
* Read uint32_t from buffer.
*
*/
uint32_t
buffer_read_u32(buffer_type* buffer)
{
uint32_t result = 0;
ods_log_assert(buffer);
result = buffer_read_u32_at(buffer, buffer->position);
buffer->position += sizeof(uint32_t);
return result;
}
/**
* Get query id from buffer.
*
*/
uint16_t
buffer_pkt_id(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_read_u16_at(buffer, 0);
}
/**
* Get a random query id.
*
*/
static uint16_t
random_id(void)
{
return ldns_get_random();
}
/**
* Set random query id in buffer.
*
*/
void
buffer_pkt_set_random_id(buffer_type* buffer)
{
uint16_t qid = 0;
ods_log_assert(buffer);
qid = random_id();
buffer_write_u16_at(buffer, 0, qid);
}
/**
* Get flags from buffer.
*
*/
uint16_t
buffer_pkt_flags(buffer_type* buffer)
{
ods_log_assert(buffer);
return (uint16_t) buffer_read_u16_at(buffer, 2);
}
/**
* Set flags in buffer.
*
*/
void
buffer_pkt_set_flags(buffer_type* buffer, uint16_t flags)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, 2, flags);
}
/**
* Get QR bit from buffer.
*
*/
int
buffer_pkt_qr(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) QR(buffer);
}
/**
* Set QR bit in buffer.
*
*/
void
buffer_pkt_set_qr(buffer_type* buffer)
{
ods_log_assert(buffer);
QR_SET(buffer);
}
/**
* Clear QR bit in buffer.
*
*/
void
buffer_pkt_clear_qr(buffer_type* buffer)
{
ods_log_assert(buffer);
QR_CLR(buffer);
}
/**
* Get OPCODE from buffer.
*
*/
ldns_pkt_opcode
buffer_pkt_opcode(buffer_type* buffer)
{
ods_log_assert(buffer);
return (ldns_pkt_opcode) OPCODE(buffer);
}
/**
* Set OPCODE in buffer.
*
*/
void
buffer_pkt_set_opcode(buffer_type* buffer, ldns_pkt_opcode opcode)
{
ods_log_assert(buffer);
OPCODE_SET(buffer, opcode);
}
/**
* Get AA bit from buffer.
*
*/
int
buffer_pkt_aa(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) AA(buffer);
}
/**
* Set AA bit in buffer.
*
*/
void
buffer_pkt_set_aa(buffer_type* buffer)
{
ods_log_assert(buffer);
AA_SET(buffer);
}
/**
* Get TC bit from buffer.
*
*/
int
buffer_pkt_tc(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) TC(buffer);
}
/**
* Get RD bit from buffer.
*
*/
int
buffer_pkt_rd(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) RD(buffer);
}
/**
* Get RA bit from buffer.
*
*/
int
buffer_pkt_ra(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) RA(buffer);
}
/**
* Get AD bit from buffer.
*
*/
int
buffer_pkt_ad(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) AD(buffer);
}
/**
* Get CD bit from buffer.
*
*/
int
buffer_pkt_cd(buffer_type* buffer)
{
ods_log_assert(buffer);
return (int) CD(buffer);
}
/**
* Get RCODE from buffer.
*
*/
ldns_pkt_rcode
buffer_pkt_rcode(buffer_type* buffer)
{
ods_log_assert(buffer);
return (ldns_pkt_rcode) RCODE(buffer);
}
/**
* Set RCODE in buffer.
*
*/
void
buffer_pkt_set_rcode(buffer_type* buffer, ldns_pkt_rcode rcode)
{
ods_log_assert(buffer);
RCODE_SET(buffer, rcode);
}
/**
* Look up a descriptive text by each rcode.
*
*/
const char*
buffer_rcode2str(ldns_pkt_rcode rcode)
{
ods_lookup_table *lt;
lt = ods_lookup_by_id(ods_rcode_str, rcode);
if (lt) {
return lt->name;
}
return NULL;
}
/**
* Get QDCOUNT from buffer.
*
*/
uint16_t
buffer_pkt_qdcount(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_read_u16_at(buffer, 4);
}
/**
* Set QDCOUNT in buffer.
*
*/
void
buffer_pkt_set_qdcount(buffer_type* buffer, uint16_t count)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, 4, count);
}
/**
* Get ANCOUNT from buffer.
*
*/
uint16_t
buffer_pkt_ancount(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_read_u16_at(buffer, 6);
}
/**
* Set ANCOUNT in buffer.
*
*/
void
buffer_pkt_set_ancount(buffer_type* buffer, uint16_t count)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, 6, count);
}
/**
* Get NSCOUNT from buffer.
*
*/
uint16_t
buffer_pkt_nscount(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_read_u16_at(buffer, 8);
}
/**
* Set NSCOUNT in buffer.
*
*/
void
buffer_pkt_set_nscount(buffer_type* buffer, uint16_t count)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, 8, count);
}
/**
* Get ARCOUNT from buffer.
*
*/
uint16_t
buffer_pkt_arcount(buffer_type* buffer)
{
ods_log_assert(buffer);
return buffer_read_u16_at(buffer, 10);
}
/**
* Set ARCOUNT in buffer.
*
*/
void
buffer_pkt_set_arcount(buffer_type* buffer, uint16_t count)
{
ods_log_assert(buffer);
buffer_write_u16_at(buffer, 10, count);
}
/**
* Make a new packet.
*
*/
static void
buffer_pkt_new(buffer_type* buffer, ldns_rdf* qname, ldns_rr_type qtype,
ldns_rr_class qclass, ldns_pkt_opcode opcode)
{
ods_log_assert(buffer);
ods_log_assert(qname);
ods_log_assert(qtype);
ods_log_assert(qclass);
/* The header */
buffer_clear(buffer);
buffer_pkt_set_random_id(buffer);
buffer_pkt_set_opcode(buffer, opcode);
buffer_pkt_clear_qr(buffer);
buffer_pkt_set_rcode(buffer, LDNS_RCODE_NOERROR);
buffer_pkt_set_qdcount(buffer, 1);
buffer_pkt_set_ancount(buffer, 0);
buffer_pkt_set_nscount(buffer, 0);
buffer_pkt_set_arcount(buffer, 0);
buffer_skip(buffer, BUFFER_PKT_HEADER_SIZE);
/* The question record */
buffer_write_rdf(buffer, qname);
buffer_write_u16(buffer, qtype);
buffer_write_u16(buffer, qclass);
}
/**
* Make a new query.
*
*/
void
buffer_pkt_query(buffer_type* buffer, ldns_rdf* qname, ldns_rr_type qtype,
ldns_rr_class qclass)
{
buffer_pkt_new(buffer, qname, qtype, qclass, LDNS_PACKET_QUERY);
buffer_pkt_set_flags(buffer, 0);
}
/**
* Make a new notify.
*
*/
void
buffer_pkt_notify(buffer_type* buffer, ldns_rdf* qname, ldns_rr_class qclass)
{
buffer_pkt_new(buffer, qname, LDNS_RR_TYPE_SOA, qclass,
LDNS_PACKET_NOTIFY);
}
/**
* Clean up buffer.
*
*/
void
buffer_cleanup(buffer_type* buffer)
{
if (!buffer) {
return;
}
free(buffer->data);
free(buffer);
}
opendnssec-2.0.4/signer/src/wire/buffer.h 0000644 0001750 0001750 00000037023 13036123676 015261 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Packet buffer.
*
*/
#ifndef WIRE_BUFFER_H
#define WIRE_BUFFER_H
#include "config.h"
#include "status.h"
#include "log.h"
#include "status.h"
#include
#include
#define BUFFER_PKT_HEADER_SIZE 12
#define MAXDOMAINLEN 255
#define MAXLABELLEN 63
#define MAX_RDLENGTH 65535
#define MAX_RR_SIZE \
(MAXDOMAINLEN + sizeof(uint32_t) + 4*sizeof(uint16_t) + MAX_RDLENGTH)
#define MAX_PACKET_SIZE 65535
#define PACKET_BUFFER_SIZE (MAX_PACKET_SIZE + MAX_RR_SIZE)
#define QR_MASK 0x80U
#define QR_SHIFT 7
#define QR(packet) (*buffer_at((packet), 2) & QR_MASK)
#define QR_SET(packet) (*buffer_at((packet), 2) |= QR_MASK)
#define QR_CLR(packet) (*buffer_at((packet), 2) &= ~QR_MASK)
#define OPCODE_MASK 0x78U
#define OPCODE_SHIFT 3
#define OPCODE(packet) ((*buffer_at((packet), 2) & OPCODE_MASK) >> OPCODE_SHIFT)
#define OPCODE_SET(packet, opcode) \
(*buffer_at((packet), 2) = (*buffer_at((packet), 2) & ~OPCODE_MASK) | ((opcode) << OPCODE_SHIFT))
#define AA_MASK 0x04U
#define AA_SHIFT 2
#define AA(packet) (*buffer_at((packet), 2) & AA_MASK)
#define AA_SET(packet) (*buffer_at((packet), 2) |= AA_MASK)
#define AA_CLR(packet) (*buffer_at((packet), 2) &= ~AA_MASK)
#define TC_MASK 0x02U
#define TC_SHIFT 1
#define TC(packet) (*buffer_at((packet), 2) & TC_MASK)
#define TC_SET(packet) (*buffer_at((packet), 2) |= TC_MASK)
#define TC_CLR(packet) (*buffer_at((packet), 2) &= ~TC_MASK)
#define RD_MASK 0x01U
#define RD_SHIFT 0
#define RD(packet) (*buffer_at((packet), 2) & RD_MASK)
#define RD_SET(packet) (*buffer_at((packet), 2) |= RD_MASK)
#define RD_CLR(packet) (*buffer_at((packet), 2) &= ~RD_MASK)
#define RA_MASK 0x80U
#define RA_SHIFT 7
#define RA(packet) (*buffer_at((packet), 3) & RA_MASK)
#define RA_SET(packet) (*buffer_at((packet), 3) |= RA_MASK)
#define RA_CLR(packet) (*buffer_at((packet), 3) &= ~RA_MASK)
#define AD_MASK 0x20U
#define AD_SHIFT 5
#define AD(packet) (*buffer_at((packet), 3) & AD_MASK)
#define AD_SET(packet) (*buffer_at((packet), 3) |= AD_MASK)
#define AD_CLR(packet) (*buffer_at((packet), 3) &= ~AD_MASK)
#define CD_MASK 0x10U
#define CD_SHIFT 4
#define CD(packet) (*buffer_at((packet), 3) & CD_MASK)
#define CD_SET(packet) (*buffer_at((packet), 3) |= CD_MASK)
#define CD_CLR(packet) (*buffer_at((packet), 3) &= ~CD_MASK)
#define RCODE_MASK 0x0fU
#define RCODE_SHIFT 0
#define RCODE(packet) (*buffer_at((packet), 3) & RCODE_MASK)
#define RCODE_SET(packet, rcode) \
(*buffer_at((packet), 3) = (*buffer_at((packet), 3) & ~RCODE_MASK) | (rcode))
extern ods_lookup_table ods_rcode_str[];
/**
* Buffer.
*/
typedef struct buffer_struct buffer_type;
struct buffer_struct {
size_t position;
size_t limit;
size_t capacity;
uint8_t* data;
unsigned fixed : 1;
};
/**
* Create a new buffer with the specified capacity.
* \param[in] allocator memory allocator
* \param[in] capacity specified capacity
* \return buffer_type* buffer
*
*/
buffer_type* buffer_create(size_t capacity);
/**
* Clear the buffer and make it ready for writing.
* The buffer's limit is set to the capacity and the position is set to 0.
* \param[in] buffer buffer
*
*/
void buffer_clear(buffer_type* buffer);
/**
* Flip the buffer and make it ready for reading.
* The data that has been written to the buffer.
* The buffer's limit is set to the current position and the position is set
* to 0.
* \param[in] buffer buffer
*
*/
void buffer_flip(buffer_type* buffer);
/**
* Get the buffer's position.
* \param[in] buffer buffer
* \return size_t position
*
*/
size_t buffer_position(buffer_type* buffer);
/**
* Set the buffer's position.
* The position must be less than or equal to the buffer's limit.
* \param[in] buffer buffer
* \param[in] pos position
*
*/
void buffer_set_position(buffer_type* buffer, size_t pos);
/**
* Change the buffer's position.
* The position must not be moved behind the buffer's limit or before the
* beginning of the buffer.
* \param[in] buffer buffer
* \param[in] count number of bytes to skip
*
*/
void buffer_skip(buffer_type* buffer, ssize_t count);
/**
* Change the buffer's position so that one dname is skipped.
* \param[in] buffer buffer
* \return int 0 if dname skipping failed
* 1 otherwise
*
*/
int buffer_skip_dname(buffer_type* buffer);
/**
* Change the buffer's position so that one RR is skipped.
* \param[in] buffer buffer
* \param[in] qrr 1 if we skip RRs in the question section.
* \return int 0 if RR skipping failed
* 1 otherwise
*
*/
int buffer_skip_rr(buffer_type* buffer, unsigned qrr);
/**
* Get the buffer's limit.
* \param[in] buffer buffer
* \return size_t limit
*
*/
size_t buffer_limit(buffer_type* buffer);
/**
* Set the buffer's limit. If the buffer's position is greater
* than the new limit, the position is set to the limit.
* \param[in] buffer buffer
* \param[in] limit limit
*
*/
void buffer_set_limit(buffer_type* buffer, size_t limit);
/**
* Get the buffer's capacity.
* \param[in] buffer buffer
* \return size_t capacity
*
*/
size_t buffer_capacity(buffer_type* buffer);
/**
* Return a pointer to the data at the indicated position.
* \param[in] buffer buffer
* \param[in] at indicated position
* \return uint8_t* pointer to the data at the indicated position
*
*/
uint8_t* buffer_at(buffer_type* buffer, size_t at);
/**
* Return a pointer to the data at the beginning of the buffer.
* \param[in] buffer buffer
* \return uint8_t* pointer to the data at the begin of the buffer
*
*/
uint8_t* buffer_begin(buffer_type* buffer);
/**
* Return a pointer to the data at the buffer's current position.
* \param[in] buffer buffer
* \return uint8_t* pointer to the data at the buffer's current position
*
*/
uint8_t* buffer_current(buffer_type* buffer);
/**
* The number of bytes remaining between the buffer's position and limit.
* \param[in] buffer buffer
* \return size_t remaining number of bytes
*
*/
size_t buffer_remaining(buffer_type* buffer);
/**
* Check if the buffer has enough bytes available.
* \param[in] buffer buffer
* \param[in] count number of bytes that needs to be available
* \return int 0 if not enough bytes are available
* 1 otherwise
*
*/
int buffer_available(buffer_type* buffer, size_t count);
/**
* Write to buffer.
* \param[in] buffer buffer
* \param[in] data data to write
* \param[in] count number of bytes to write
*
*/
void buffer_write(buffer_type* buffer, const void* data, size_t count);
/**
* Write uint8_t to buffer.
* \param[in] buffer buffer
* \param[in] data data to write
*
*/
void buffer_write_u8(buffer_type* buffer, uint8_t data);
/**
* Write uint16_t to buffer.
* \param[in] buffer buffer
* \param[in] data data to write
*
*/
void buffer_write_u16(buffer_type* buffer, uint16_t data);
/**
* Write uint16_t to buffer at indicated position.
* \param[in] buffer buffer
* \param[in] at indicated position
* \param[in] data data to write
*
*/
void buffer_write_u16_at(buffer_type* buffer, size_t at, uint16_t data);
/**
* Write uint32_t to buffer.
* \param[in] buffer buffer
* \param[in] data data to write
*
*/
void buffer_write_u32(buffer_type* buffer, uint32_t data);
/**
* Write rdf to buffer.
* \param[in] buffer buffer
* \param[in] rdf data to write
*
*/
void buffer_write_rdf(buffer_type* buffer, ldns_rdf* rdf);
/**
* Write rr to buffer.
* \param[in] buffer buffer
* \param[in] rr data to write
* \return int 1 if rr fits, 0 otherwise
*
*/
int buffer_write_rr(buffer_type* buffer, ldns_rr* rr);
/**
* Read from buffer.
* \param[in] buffer buffer
* \param[in] data read data
* \param[in] count number of bytes to read
*
*/
void buffer_read(buffer_type* buffer, void* data, size_t count);
/**
* Read uint8_t from buffer.
* \param[in] buffer buffer
* \return uint8_t read data
*
*/
uint8_t buffer_read_u8(buffer_type* buffer);
/**
* Read uint16_t from buffer.
* \param[in] buffer buffer
* \return uint16_t read data
*
*/
uint16_t buffer_read_u16(buffer_type* buffer);
/**
* Read uint32_t from buffer.
* \param[in] buffer buffer
* \return uint32_t read data
*
*/
uint32_t buffer_read_u32(buffer_type* buffer);
/**
* Read dname from buffer.
* \param[in] buffer buffer
* \param[out] dname dname
* \param[in] allow_pointers allow pointer labels
* \return int dname length
*
*/
size_t buffer_read_dname(buffer_type* buffer, uint8_t* dname,
unsigned allow_pointers);
/**
* Get query id from buffer.
* \param[in] buffer buffer
* \return uint16_t query id
*
*/
uint16_t buffer_pkt_id(buffer_type* buffer);
/**
* Set random query id in buffer.
* \param[in] buffer buffer
*
*/
void buffer_pkt_set_random_id(buffer_type* buffer);
/**
* Get flags from buffer.
* \param[in] buffer buffer
* \return uint16_t flags
*
*/
uint16_t buffer_pkt_flags(buffer_type* buffer);
/**
* Set flags in buffer.
* \param[in] buffer buffer
* \param[in] flags flags
*
*/
void buffer_pkt_set_flags(buffer_type* buffer, uint16_t flags);
/**
* Get QR bit from buffer.
* \param[in] buffer buffer
* \return int 0 if QR bit is clear
* 1 if QR bit is set
*
*/
int buffer_pkt_qr(buffer_type* buffer);
/**
* Set QR bit in buffer.
* \param[in] buffer buffer
*
*/
void buffer_pkt_set_qr(buffer_type* buffer);
/**
* Clear QR bit in buffer.
* \param[in] buffer buffer
*
*/
void buffer_pkt_clear_qr(buffer_type* buffer);
/**
* Get AA bit from buffer.
* \param[in] buffer buffer
* \return int 0 if AA bit is clear
* 1 if AA bit is set
*
*/
int buffer_pkt_aa(buffer_type* buffer);
/**
* Set AA bit in buffer.
* \param[in] buffer buffer
*
*/
void buffer_pkt_set_aa(buffer_type* buffer);
/**
* Get TC bit from buffer.
* \param[in] buffer buffer
* \return int 0 if TC bit is clear
* 1 if TC bit is set
*
*/
int buffer_pkt_tc(buffer_type* buffer);
/**
* Get RD bit from buffer.
* \param[in] buffer buffer
* \return int 0 if RD bit is clear
* 1 if RD bit is set
*
*/
int buffer_pkt_rd(buffer_type* buffer);
/**
* Get RA bit from buffer.
* \param[in] buffer buffer
* \return int 0 if RA bit is clear
* 1 if RA bit is set
*
*/
int buffer_pkt_ra(buffer_type* buffer);
/**
* Get AD bit from buffer.
* \param[in] buffer buffer
* \return int 0 if AD bit is clear
* 1 if AD bit is set
*
*/
int buffer_pkt_ad(buffer_type* buffer);
/**
* Get CD bit from buffer.
* \param[in] buffer buffer
* \return int 0 if CD bit is clear
* 1 if CD bit is set
*
*/
int buffer_pkt_cd(buffer_type* buffer);
/**
* Get OPCODE from buffer.
* \param[in] buffer buffer
* \return ldns_pkt_opcode OPCODE
*
*/
ldns_pkt_opcode buffer_pkt_opcode(buffer_type* buffer);
/**
* Set OPCODE in buffer.
* \param[in] buffer buffer
* \param[in] opcode OPCODE
*
*/
void buffer_pkt_set_opcode(buffer_type* buffer, ldns_pkt_opcode opcode);
/**
* Get RCODE from buffer.
* \param[in] buffer buffer
* \return ldns_pkt_rcode RCODE
*
*/
ldns_pkt_rcode buffer_pkt_rcode(buffer_type* buffer);
/**
* Set RCODE in buffer.
* \param[in] buffer buffer
* \param[in] rcode RCODE
*
*/
void buffer_pkt_set_rcode(buffer_type* buffer, ldns_pkt_rcode rcode);
/**
* Look up a descriptive text by each rcode.
* \param[in] rcode rcode
* \return const char* descriptive text
*
*/
const char* buffer_rcode2str(ldns_pkt_rcode rcode);
/**
* Get QDCOUNT from buffer.
* \param[in] buffer buffer
* \return uint16_t QDCOUNT
*
*/
uint16_t buffer_pkt_qdcount(buffer_type* buffer);
/**
* Set QDCOUNT in buffer.
* \param[in] buffer buffer
* \param[in] count QDCOUNT
*
*/
void buffer_pkt_set_qdcount(buffer_type* buffer, uint16_t count);
/**
* Get ANCOUNT from buffer.
* \param[in] buffer buffer
* \return uint16_t ANCOUNT
*
*/
uint16_t buffer_pkt_ancount(buffer_type* buffer);
/**
* Set ANCOUNT in buffer.
* \param[in] buffer buffer
* \param[in] count ANCOUNT
*
*/
void buffer_pkt_set_ancount(buffer_type* buffer, uint16_t count);
/**
* Get NSCOUNT from buffer.
* \param[in] buffer buffer
* \return uint16_t NSCOUNT
*
*/
uint16_t buffer_pkt_nscount(buffer_type* buffer);
/**
* Set NSCOUNT in buffer.
* \param[in] buffer buffer
* \param[in] count NSCOUNT
*
*/
void buffer_pkt_set_nscount(buffer_type* buffer, uint16_t count);
/**
* Get ARCOUNT from buffer.
* \param[in] buffer buffer
* \return uint16_t ARCOUNT
*
*/
uint16_t buffer_pkt_arcount(buffer_type* buffer);
/**
* Set ARCOUNT in buffer.
* \param[in] buffer buffer
* \param[in] count ARCOUNT
*
*/
void buffer_pkt_set_arcount(buffer_type* buffer, uint16_t count);
/**
* Make a new query.
* \param[in] buffer buffer
* \param[in] qname qname
* \param[in] qtype qtype
* \param[in] qclass qclass
*
*/
void
buffer_pkt_query(buffer_type* buffer, ldns_rdf* qname, ldns_rr_type qtype,
ldns_rr_class qclass);
/**
* Make a new notify.
* \param[in] buffer buffer
* \param[in] qname qname
* \param[in] qclass qclass
*
*/
void
buffer_pkt_notify(buffer_type* buffer, ldns_rdf* qname, ldns_rr_class qclass);
/**
* Clean up buffer.
* \param[in] buffer buffer
* \param[in] allocator memory allocator
*
*/
void buffer_cleanup(buffer_type* buffer);
/** UTIL **/
/*
* Copy data allowing for unaligned accesses in network byte order
* (big endian).
*/
static inline uint16_t
read_uint16(const void *src)
{
#ifdef ALLOW_UNALIGNED_ACCESSES
return ntohs(* (uint16_t *) src);
#else
uint8_t *p = (uint8_t *) src;
return (p[0] << 8) | p[1];
#endif
}
static inline uint32_t
read_uint32(const void *src)
{
#ifdef ALLOW_UNALIGNED_ACCESSES
return ntohl(* (uint32_t *) src);
#else
uint8_t *p = (uint8_t *) src;
return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
#endif
}
static inline void
write_uint16(void *dst, uint16_t data)
{
#ifdef ALLOW_UNALIGNED_ACCESSES
* (uint16_t *) dst = htons(data);
#else
uint8_t *p = (uint8_t *) dst;
p[0] = (uint8_t) ((data >> 8) & 0xff);
p[1] = (uint8_t) (data & 0xff);
#endif
}
static inline void
write_uint32(void *dst, uint32_t data)
{
#ifdef ALLOW_UNALIGNED_ACCESSES
* (uint32_t *) dst = htonl(data);
#else
uint8_t *p = (uint8_t *) dst;
p[0] = (uint8_t) ((data >> 24) & 0xff);
p[1] = (uint8_t) ((data >> 16) & 0xff);
p[2] = (uint8_t) ((data >> 8) & 0xff);
p[3] = (uint8_t) (data & 0xff);
#endif
}
#endif /* WIRE_BUFFER_H */
opendnssec-2.0.4/signer/src/wire/tsig.h 0000644 0001750 0001750 00000016477 13036123676 014770 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Taken from NSD3 and adjusted for OpenDNSSEC, NLnet Labs.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* TSIG.
*
*/
#ifndef WIRE_TSIG_H
#define WIRE_TSIG_H
#include "config.h"
#include "status.h"
#include "wire/buffer.h"
#include
#define TSIG_ERROR_BADSIG 16
#define TSIG_ERROR_BADKEY 17
#define TSIG_ERROR_BADTIME 18
#define TSIG_HMAC_MD5 157
#define TSIG_HMAC_SHA1 158
#define TSIG_HMAC_SHA256 159
/**
* TSIG status.
*
*/
enum tsig_status_enum {
TSIG_NOT_PRESENT,
TSIG_OK,
TSIG_ERROR
};
typedef enum tsig_status_enum tsig_status;
/**
* TSIG lookup table.
*
*/
typedef struct tsig_lookup_table_struct tsig_lookup_table;
struct tsig_lookup_table_struct
{
uint8_t id;
const char* short_name;
};
/**
* TSIG key.
*
*/
typedef struct tsig_key_struct tsig_key_type;
struct tsig_key_struct {
ldns_rdf* dname;
size_t size;
const uint8_t* data;
};
/**
* TSIG algorithm.
*
*/
typedef struct tsig_algo_struct tsig_algo_type;
struct tsig_algo_struct {
const char* txt_name;
ldns_rdf* wf_name;
size_t max_digest_size;
const void* data;
/* create a new HMAC context */
void*(*hmac_create)(void);
/* initialize an HMAC context */
void(*hmac_init)(void* context, tsig_algo_type* algo,
tsig_key_type* key);
/* update the HMAC context */
void(*hmac_update)(void* context, const void* data, size_t size);
/* finalize digest */
void(*hmac_final)(void* context, uint8_t* digest, size_t* size);
};
/**
* TSIG configuration.
*
*/
typedef struct tsig_struct tsig_type;
struct tsig_struct {
tsig_type* next;
const char* name;
const char* algorithm;
const char* secret;
tsig_key_type* key;
};
/**
* TSIG RR.
*
*/
typedef struct tsig_rr_struct tsig_rr_type;
struct tsig_rr_struct {
tsig_status status;
size_t position;
size_t response_count;
size_t update_since_last_prepare;
void* context;
tsig_algo_type* algo;
tsig_key_type* key;
size_t prior_mac_size;
uint8_t* prior_mac_data;
ldns_rdf* key_name;
ldns_rdf* algo_name;
uint16_t signed_time_high;
uint32_t signed_time_low;
uint16_t signed_time_fudge;
uint16_t mac_size;
uint8_t* mac_data;
uint16_t original_query_id;
uint16_t error_code;
uint16_t other_size;
uint8_t* other_data;
};
/**
* Initialize TSIG handler.
* \param[in] allocator memory allocator
* \return ods_status status
*
*/
ods_status tsig_handler_init(void);
/**
* Clean up TSIG handler.
*
*/
void tsig_handler_cleanup(void);
/**
* Add key to TSIG handler.
* \param[in] key tsig key
*
*/
void tsig_handler_add_key(tsig_key_type* key);
/**
* Add algorithm to TSIG handler.
* \param[in] algo tsig algorithm
*
*/
void tsig_handler_add_algo(tsig_algo_type* algo);
/**
* Create new TSIG.
* \param[in] allocator memory allocator
* \param[in] name tsig name
* \param[in] algo tsig algorithm
* \param[in] secret tsig secret
* \return tsig_type* TSIG
*
*/
tsig_type* tsig_create(char* name, char* algo,
char* secret);
/**
* Lookup TSIG by key name.
* \param[in] tsig TSIG list
* \param[in] naem TSIG name
* \return tsig_type* TSIG
*
*/
tsig_type* tsig_lookup_by_name(tsig_type* tsig, const char* name);
/**
* Lookup TSIG algorithm by name.
* \param[in] name algorithm name
* \return tsig_algo_type* TSIG algorithm
*
*/
tsig_algo_type* tsig_lookup_algo(const char* name);
/**
* Create new TSIG RR.
* \param[in] allocator memory allocator
* \return tsig_rr_type* TSIG RR
*
*/
tsig_rr_type* tsig_rr_create(void);
/**
* Reset TSIG RR.
* \param[in] trr TSIG RR
* \param[in] algo tsig algorithm
* \param[in] key tsig key
*
*/
void tsig_rr_reset(tsig_rr_type* trr, tsig_algo_type* algo, tsig_key_type* key);
/**
* Find TSIG RR.
* \param[in] trr TSIG RR
* \param[in] buffer packet buffer
* \return int 1 if not present or present and valid, 0 otherwise.
*
*/
int tsig_rr_find(tsig_rr_type* trr, buffer_type* buffer);
/**
* Parse TSIG RR.
* \param[in] trr TSIG RR
* \param[in] buffer packet buffer
* \return int 1 if not TSIG RR or TSIG RR and valid, 0 otherwise.
*
*/
int tsig_rr_parse(tsig_rr_type* trr, buffer_type* buffer);
/**
* Lookup TSIG RR.
* \param[in] trr TSIG RR
* \return int 1 if succeeded, 0 if unknown
*
*/
int tsig_rr_lookup(tsig_rr_type* trr);
/**
* Prepare TSIG RR.
* \param[in] trr TSIG RR
*
*/
void tsig_rr_prepare(tsig_rr_type* trr);
/**
* Update TSIG RR.
* \param[in] trr TSIG RR
* \param[in] buffer packet buffer
* \param[in] length number of octets of buffer to add to the TSIG hash,
* replacing the buffer's id with the original
* query idfrom TSIG.
*
*/
void tsig_rr_update(tsig_rr_type* trr, buffer_type* buffer, size_t length);
/**
* Sign TSIG RR.
* \param[in] trr TSIG RR
*
*/
void tsig_rr_sign(tsig_rr_type* trr);
/**
* Verify TSIG RR.
* \param[in] trr TSIG RR
* \return int 1 if verified, 0 on error
*
*/
int tsig_rr_verify(tsig_rr_type* trr);
/**
* Append TSIG RR.
* \param[in] trr TSIG RR
* \param[in] buffer packet buffer
*
*/
void tsig_rr_append(tsig_rr_type* trr, buffer_type* buffer);
/*
* The amount of space to reserve in the response for the TSIG data.
* \param[in] trr TSIG RR
* \return size_t reserved space size
*
*/
size_t tsig_rr_reserved_space(tsig_rr_type *trr);
/**
* Reply with error TSIG RR.
* \param[in] trr TSIG RR
*
*/
void tsig_rr_error(tsig_rr_type* trr);
/**
* Get human readable TSIG error code.
* \param[in] status TSIG status
* \return const char* TSIG status
*
*/
const char* tsig_status2str(tsig_status status);
/**
* Get human readable TSIG error code.
* \param[in] error TSIG error code
* \return const char* readable error code
*
*/
const char* tsig_strerror(uint16_t error);
/**
* Free TSIG RR.
* \param[in] trr TSIG RR
*
*/
void tsig_rr_free(tsig_rr_type* trr);
/**
* Cleanup TSIG RR
* \param[in] trr TSIG RR
*
*/
void tsig_rr_cleanup(tsig_rr_type* trr);
/**
* Clean up TSIG.
* \param[in] tsig TSIG
* \param[in] allocator memory allocator
*
*/
void tsig_cleanup(tsig_type* tsig);
#endif /* WIRE_TSIG_H */
opendnssec-2.0.4/signer/src/wire/tsig-openssl.c 0000644 0001750 0001750 00000013142 13036124634 016421 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Interface to OpenSSL for TSIG support.
*
*/
#include "config.h"
#ifdef HAVE_SSL
#include "log.h"
#include "wire/tsig.h"
#include "wire/tsig-openssl.h"
static const char* tsig_str = "tsig-ssl";
/** helper funcgtions */
static void *create_context();
static void init_context(void *context,
tsig_algo_type *algorithm,
tsig_key_type *key);
static void update(void *context, const void *data, size_t size);
static void final(void *context, uint8_t *digest, size_t *size);
typedef struct tsig_cleanup_table_struct tsig_cleanup_table_type;
struct tsig_cleanup_table_struct {
tsig_cleanup_table_type* next;
void* cleanup;
};
static tsig_cleanup_table_type* tsig_cleanup_table = NULL;
/**
* Initiallize algorithm.
*
*/
static int
tsig_openssl_init_algorithm(const char* digest, const char* name, const char* wireformat)
{
tsig_algo_type* algorithm = NULL;
const EVP_MD *hmac_algorithm = NULL;
ods_log_assert(digest);
ods_log_assert(name);
ods_log_assert(wireformat);
hmac_algorithm = EVP_get_digestbyname(digest);
if (!hmac_algorithm) {
ods_log_error("[%s] %s digest not available", tsig_str, digest);
return 0;
}
CHECKALLOC(algorithm = (tsig_algo_type *) malloc(sizeof(tsig_algo_type)));
algorithm->txt_name = name;
algorithm->wf_name = ldns_dname_new_frm_str(wireformat);
if (!algorithm->wf_name) {
ods_log_error("[%s] unable to parse %s algorithm", tsig_str,
wireformat);
free(algorithm);
return 0;
}
algorithm->max_digest_size = EVP_MAX_MD_SIZE;
algorithm->data = hmac_algorithm;
algorithm->hmac_create = create_context;
algorithm->hmac_init = init_context;
algorithm->hmac_update = update;
algorithm->hmac_final = final;
tsig_handler_add_algo(algorithm);
return 1;
}
/**
* Initialize OpenSSL support for TSIG.
*
*/
ods_status
tsig_handler_openssl_init()
{
tsig_cleanup_table = NULL;
OpenSSL_add_all_digests();
ods_log_debug("[%s] add md5", tsig_str);
if (!tsig_openssl_init_algorithm("md5", "hmac-md5",
"hmac-md5.sig-alg.reg.int.")) {
return ODS_STATUS_ERR;
}
#ifdef HAVE_EVP_SHA1
ods_log_debug("[%s] add sha1", tsig_str);
if (!tsig_openssl_init_algorithm("sha1", "hmac-sha1",
"hmac-sha1.")) {
return ODS_STATUS_ERR;
}
#endif /* HAVE_EVP_SHA1 */
#ifdef HAVE_EVP_SHA256
ods_log_debug("[%s] add sha256", tsig_str);
if (!tsig_openssl_init_algorithm("sha256", "hmac-sha256",
"hmac-sha256.")) {
return ODS_STATUS_ERR;
}
#endif /* HAVE_EVP_SHA256 */
return ODS_STATUS_OK;
}
static void
cleanup_context(void *data)
{
HMAC_CTX* context = (HMAC_CTX*) data;
#ifdef HAVE_SSL_NEW_HMAC
HMAC_CTX_free(context);
#else
HMAC_CTX_cleanup(context);
#endif
}
static void
context_add_cleanup(void* context)
{
tsig_cleanup_table_type* entry = NULL;
if (!context) {
return;
}
CHECKALLOC(entry = (tsig_cleanup_table_type *) malloc(sizeof(tsig_cleanup_table_type)));
entry->cleanup = context;
entry->next = tsig_cleanup_table;
tsig_cleanup_table = entry;
}
static void*
create_context()
{
HMAC_CTX* context;
#ifdef HAVE_SSL_NEW_HMAC
CHECKALLOC(context = HMAC_CTX_new());
HMAC_CTX_reset(context);
#else
CHECKALLOC(context = (HMAC_CTX*) malloc(sizeof(HMAC_CTX)));
HMAC_CTX_init(context);
#endif
context_add_cleanup(context);
return context;
}
static void
init_context(void* context, tsig_algo_type *algorithm, tsig_key_type *key)
{
HMAC_CTX* ctx = (HMAC_CTX*) context;
const EVP_MD* md = (const EVP_MD*) algorithm->data;
HMAC_Init_ex(ctx, key->data, key->size, md, NULL);
}
static void
update(void* context, const void* data, size_t size)
{
HMAC_CTX* ctx = (HMAC_CTX*) context;
HMAC_Update(ctx, (unsigned char*) data, (int) size);
}
static void
final(void* context, uint8_t* digest, size_t* size)
{
HMAC_CTX* ctx = (HMAC_CTX*) context;
unsigned len = (unsigned) *size;
HMAC_Final(ctx, digest, &len);
*size = (size_t) len;
}
/**
* Finalize OpenSSL support for TSIG.
*
*/
void
tsig_handler_openssl_finalize(void)
{
tsig_cleanup_table_type* entry = tsig_cleanup_table;
while (entry) {
cleanup_context(entry->cleanup);
entry = entry->next;
}
EVP_cleanup();
}
#endif /* HAVE_SSL */
opendnssec-2.0.4/signer/src/wire/edns.c 0000644 0001750 0001750 00000011071 13036123676 014727 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Taken from NSD3 and adjusted for OpenDNSSEC, NLnet Labs.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* TSIG.
*
*/
#include "config.h"
#include "compat.h"
#include "wire/buffer.h"
#include "wire/edns.h"
#include
static const char* edns_str = "edns";
/**
* Create new EDNS RR.
*
*/
edns_rr_type*
edns_rr_create()
{
edns_rr_type* err = NULL;
CHECKALLOC(err = (edns_rr_type*) malloc(sizeof(edns_rr_type))) ;
edns_rr_reset(err);
return err;
}
/**
* Initialize EDNS.
*
*/
void
edns_init(edns_data_type* data, uint16_t max_length)
{
if (!data) {
return;
}
memset(data, 0, sizeof(edns_data_type));
/* record type: OPT */
data->ok[1] = (LDNS_RR_TYPE_OPT & 0xff00) >> 8; /* type_hi */
data->ok[2] = LDNS_RR_TYPE_OPT & 0x00ff; /* type_lo */
/* udp payload size */
data->ok[3] = (max_length & 0xff00) >> 8; /* size_hi */
data->ok[4] = max_length & 0x00ff; /* size_lo */
data->error[1] = (LDNS_RR_TYPE_OPT & 0xff00) >> 8; /* type_hi */
data->error[2] = LDNS_RR_TYPE_OPT & 0x00ff; /* type_lo */
data->error[3] = (max_length & 0xff00) >> 8; /* size_hi */
data->error[4] = max_length & 0x00ff; /* size_lo */
data->error[5] = 1; /* Extended RCODE=BAD VERS */
}
/**
* Reset EDNS OPT RR.
*
*/
void
edns_rr_reset(edns_rr_type* err)
{
if (!err) {
return;
}
err->status = EDNS_NOT_PRESENT;
err->position = 0;
err->maxlen = 0;
err->dnssec_ok = 0;
}
/**
* Parse EDNS OPT RR.
*
*/
int
edns_rr_parse(edns_rr_type* err, buffer_type* buffer)
{
/* OPT record type... */
uint8_t opt_owner;
uint16_t opt_type;
uint16_t opt_class;
uint8_t opt_version;
uint16_t opt_flags;
if (!err || !buffer) {
ods_log_debug("[%s] parse: no edns rr or no packet buffer available",
edns_str);
return 0;
}
err->position = buffer_position(buffer);
if (!buffer_available(buffer, (OPT_LEN + OPT_RDATA))) {
ods_log_debug("[%s] parse: edns rr too small", edns_str);
return 0;
}
opt_owner = buffer_read_u8(buffer);
opt_type = buffer_read_u16(buffer);
if (opt_owner != 0 || opt_type != LDNS_RR_TYPE_OPT) {
/* Not EDNS. */
ods_log_debug("[%s] parse: not OPT: owner=%02x, type=%02x", edns_str,
opt_owner, opt_type);
buffer_set_position(buffer, err->position);
return 0;
}
opt_class = buffer_read_u16(buffer);
(void)buffer_read_u8(buffer); /* opt_extended_rcode */
opt_version = buffer_read_u8(buffer);
opt_flags = buffer_read_u16(buffer);
(void)buffer_read_u16(buffer); /* opt_rdlen */
if (opt_version != 0) {
/* The only error is VERSION not implemented */
ods_log_debug("[%s] parse: wrong edns version", edns_str);
err->status = EDNS_ERROR;
return 1;
}
err->status = EDNS_OK;
err->maxlen = opt_class;
err->dnssec_ok = opt_flags & DNSSEC_OK_MASK;
return 1;
}
/**
* The amount of space to reserve in the response for the EDNS data.
*
*/
size_t
edns_rr_reserved_space(edns_rr_type* err)
{
if (!err) {
return 0;
}
return err->status == EDNS_NOT_PRESENT ? 0 : (OPT_LEN + OPT_RDATA);
}
void
edns_rr_cleanup(edns_rr_type* err)
{
if (!err)
return;
free(err);
}
opendnssec-2.0.4/signer/src/wire/xfrd.h 0000644 0001750 0001750 00000012360 13036123713 014740 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Zone transfers.
*
*/
#ifndef WIRE_XFRD_H
#define WIRE_XFRD_H
#include "config.h"
#include
#include
/**
* Packet status.
*
*/
enum xfrd_pkt_enum {
XFRD_PKT_BAD, /* drop the packet/connection */
XFRD_PKT_MORE, /* more packets to follow on tcp */
XFRD_PKT_NOTIMPL, /* server responded with NOTIMPL or FORMATERR */
XFRD_PKT_TC, /* try tcp connection */
XFRD_PKT_XFR, /* server responded with transfer*/
XFRD_PKT_NEWLEASE /* no changes, soa OK */
};
typedef enum xfrd_pkt_enum xfrd_pkt_status;
typedef struct soa_struct soa_type;
typedef struct xfrd_struct xfrd_type;
#include "locks.h"
#include "status.h"
#include "wire/acl.h"
#include "wire/buffer.h"
#include "wire/netio.h"
#include "wire/tsig.h"
#include "daemon/xfrhandler.h"
#define XFRD_MAX_ROUNDS 3 /* max number of rounds along the masters */
#define XFRD_MAX_UDP 100 /* max number of udp sockets at a time for ixfr */
#define XFRD_NO_IXFR_CACHE 172800 /* 48h before retrying ixfr after notimpl */
#define XFRD_TCP_TIMEOUT 120 /* seconds, before a tcp request times out */
#define XFRD_UDP_TIMEOUT 5 /* seconds, before a udp request times out */
/*
* Zone transfer SOA information.
*/
struct soa_struct {
/* owner equals zone apex */
/* class equals zone klass */
/* type is SOA */
uint32_t ttl;
/* rdata count = 7 */
uint8_t mname[MAXDOMAINLEN + 2];
uint8_t rname[MAXDOMAINLEN + 2];
uint32_t serial;
uint32_t refresh;
uint32_t retry;
uint32_t expire;
uint32_t minimum;
};
/**
* Zone transfer state.
*
*/
struct xfrd_struct
{
xfrhandler_type* xfrhandler;
zone_type* zone;
lock_basic_type serial_lock; /* mutexes soa serial management */
lock_basic_type rw_lock; /* mutexes .xfrd file */
/* transfer request handling */
int tcp_conn;
int round_num;
int master_num;
int next_master;
acl_type* master;
/* soa serial management */
uint32_t serial_xfr;
/* Last received serial via notify. Only valid if
* serial_notify_acquired is not 0 */
uint32_t serial_notify;
/* current serial on inbound side */
uint32_t serial_disk;
time_t serial_xfr_acquired;
/* time of last received notify that is being handled. If non-zero
* it indicates a transfer is in progress */
time_t serial_notify_acquired;
time_t serial_disk_acquired;
uint8_t serial_retransfer;
soa_type soa;
/* timeout and event handling */
struct timespec timeout;
netio_handler_type handler;
/* packet handling */
uint16_t query_id;
uint32_t msg_seq_nr;
uint32_t msg_old_serial;
uint32_t msg_new_serial;
size_t msg_rr_count;
uint8_t msg_is_ixfr;
uint8_t msg_do_retransfer;
tsig_rr_type* tsig_rr;
xfrd_type* tcp_waiting_next;
xfrd_type* udp_waiting_next;
unsigned tcp_waiting : 1;
unsigned udp_waiting : 1;
};
/**
* Create zone transfer structure.
* \param[in] xfrhandler zone transfer handler
* \param[in] zone zone reference
* \return xfrd_type* zone transfer structure.
*
*/
xfrd_type* xfrd_create(xfrhandler_type* xfrhandler, zone_type* zone);
/**
* Set timeout for zone transfer to now.
* \param[in] xfrd zone transfer structure.
*
*/
void xfrd_set_timer_now(xfrd_type* xfrd);
/**
* Set timeout for zone transfer to RETRY.
* \param[in] xfrd zone transfer structure.
*
*/
void xfrd_set_timer_retry(xfrd_type* xfrd);
/**
* Set timeout for zone transfer to REFRESH.
* \param[in] xfrd zone transfer structure.
*
*/
void xfrd_set_timer_refresh(xfrd_type* xfrd);
/**
* Use acl address to setup remote sockaddr struct.
* \param[in] acl acl
* \param[in] to remote address storage
* \return socklen_t length of address
*
*/
socklen_t xfrd_acl_sockaddr_to(acl_type* acl,
struct sockaddr_storage* to);
/**
* Cleanup zone transfer structure.
* \param[in] xfrd zone transfer structure.
* \param[in] backup backup transfer variables.
*
*/
void xfrd_cleanup(xfrd_type* xfrd, int backup);
#endif /* WIRE_XFRD_H */
opendnssec-2.0.4/signer/src/wire/tsig.c 0000644 0001750 0001750 00000055442 13036123713 014746 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Taken from NSD3 and adjusted for OpenDNSSEC, NLnet Labs.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* TSIG.
*
*/
#include "config.h"
#include "compat.h"
#include "duration.h"
#include "file.h"
#include "log.h"
#include "status.h"
#include "util.h"
#include "wire/buffer.h"
#include "wire/tsig.h"
#include "wire/tsig-openssl.h"
#include
#define TSIG_SIGNED_TIME_FUDGE 300
static const char* tsig_str = "tsig";
/** key table */
typedef struct tsig_key_table_struct tsig_key_table_type;
struct tsig_key_table_struct {
tsig_key_table_type* next;
tsig_key_type* key;
};
static tsig_key_table_type* tsig_key_table = NULL;
/** algorithm table */
typedef struct tsig_algo_table_struct tsig_algo_table_type;
struct tsig_algo_table_struct {
tsig_algo_table_type* next;
tsig_algo_type* algorithm;
};
static tsig_algo_table_type* tsig_algo_table = NULL;
/** maximum algorithm digest size */
static size_t max_algo_digest_size = 0;
/**
* Add key to TSIG handler.
*
*/
void
tsig_handler_add_key(tsig_key_type* key)
{
tsig_key_table_type* entry = NULL;
if (!key) {
return;
}
CHECKALLOC(entry = (tsig_key_table_type *) malloc(sizeof(tsig_key_table_type)));
if (entry) {
entry->key = key;
entry->next = tsig_key_table;
tsig_key_table = entry;
}
}
/**
* Add algorithm to TSIG handler.
*
*/
void
tsig_handler_add_algo(tsig_algo_type* algo)
{
tsig_algo_table_type* entry = NULL;
if (!algo) {
return;
}
CHECKALLOC(entry = (tsig_algo_table_type *) malloc(sizeof(tsig_algo_table_type)));
if (entry) {
entry->algorithm = algo;
entry->next = tsig_algo_table;
tsig_algo_table = entry;
if (algo->max_digest_size > max_algo_digest_size) {
max_algo_digest_size = algo->max_digest_size;
}
}
}
/**
* Initialize TSIG handler.
*
*/
ods_status
tsig_handler_init()
{
tsig_key_table = NULL;
tsig_algo_table = NULL;
#ifdef HAVE_SSL
ods_log_debug("[%s] init openssl", tsig_str);
return tsig_handler_openssl_init();
#else
ods_log_debug("[%s] openssl disabled", tsig_str);
return ODS_STATUS_OK;
#endif
}
/**
* Clean up TSIG handler.
*
*/
void
tsig_handler_cleanup(void)
{
tsig_algo_table_type* aentry = NULL, *anext = NULL;
tsig_key_table_type* kentry = NULL, *knext = NULL;
#ifdef HAVE_SSL
tsig_handler_openssl_finalize();
#endif
aentry = tsig_algo_table;
while (aentry) {
anext = aentry->next;
ldns_rdf_deep_free(aentry->algorithm->wf_name);
free(aentry->algorithm);
free(aentry);
aentry = anext;
}
kentry = tsig_key_table;
while (kentry) {
knext = kentry->next;
ldns_rdf_deep_free(kentry->key->dname);
free((void*)kentry->key->data);
free((void*)kentry->key);
free(kentry);
kentry = knext;
}
}
/**
* Create new TSIG key.
*
*/
static tsig_key_type*
tsig_key_create(tsig_type* tsig)
{
tsig_key_type* key = NULL;
ldns_rdf* dname = NULL;
uint8_t* data = NULL;
int size = 0;
if (!tsig || !tsig->name || !tsig->secret) {
return NULL;
}
CHECKALLOC(key = (tsig_key_type*) malloc(sizeof(tsig_key_type)));
dname = ldns_dname_new_frm_str(tsig->name);
if (!dname) {
free(key);
return NULL;
}
CHECKALLOC(data = malloc(sizeof(uint8_t) * util_b64_pton_calculate_size(strlen(tsig->secret))));
size = b64_pton(tsig->secret, data,
util_b64_pton_calculate_size(strlen(tsig->secret)));
if (size < 0) {
ods_log_error("[%s] unable to create tsig key %s: failed to parse "
"secret", tsig_str, tsig->name);
ldns_rdf_deep_free(dname);
free(data);
return NULL;
}
key->dname = dname;
key->size = size;
key->data = data;
tsig_handler_add_key(key);
return key;
}
/**
* Create new TSIG.
*
*/
tsig_type*
tsig_create(char* name, char* algo, char* secret)
{
tsig_type* tsig = NULL;
if (!name || !algo || !secret) {
return NULL;
}
CHECKALLOC(tsig = (tsig_type*) malloc(sizeof(tsig_type)));
tsig->next = NULL;
tsig->name = strdup(name);
tsig->algorithm = strdup(algo);
tsig->secret = strdup(secret);
tsig->key = tsig_key_create(tsig);
if (!tsig->key) {
ods_log_error("[%s] unable to create tsig: tsig_key_create() "
"failed", tsig_str);
tsig_cleanup(tsig);
return NULL;
}
return tsig;
}
/**
* Lookup TSIG by key name.
*
*/
tsig_type*
tsig_lookup_by_name(tsig_type* tsig, const char* name)
{
tsig_type* find = NULL;
if (!tsig || !name) {
return NULL;
}
find = tsig;
while (find) {
if (ods_strlowercmp(find->name, name) == 0) {
return find;
}
find = find->next;
}
return NULL;
}
/**
* Lookup TSIG algorithm by name.
*
*/
tsig_algo_type*
tsig_lookup_algo(const char* name)
{
tsig_algo_table_type* entry = NULL;
for (entry = tsig_algo_table; entry; entry = entry->next) {
if (ods_strlowercmp(name, entry->algorithm->txt_name) == 0) {
return entry->algorithm;
}
}
return NULL;
}
/**
* Create new TSIG RR.
*
*/
tsig_rr_type*
tsig_rr_create()
{
tsig_rr_type* trr = NULL;
CHECKALLOC(trr = (tsig_rr_type*) malloc(sizeof(tsig_rr_type)));
trr->key_name = NULL;
trr->algo_name = NULL;
trr->mac_data = NULL;
trr->other_data = NULL;
tsig_rr_reset(trr, NULL, NULL);
return trr;
}
/**
* Reset TSIG RR.
*
*/
void
tsig_rr_reset(tsig_rr_type* trr, tsig_algo_type* algo, tsig_key_type* key)
{
if (!trr) {
return;
}
tsig_rr_free(trr);
trr->status = TSIG_NOT_PRESENT;
trr->position = 0;
trr->response_count = 0;
trr->update_since_last_prepare = 0;
trr->context = NULL;
trr->algo = algo;
trr->key = key;
trr->prior_mac_size = 0;
trr->prior_mac_data = NULL;
trr->signed_time_high = 0;
trr->signed_time_low = 0;
trr->signed_time_fudge = 0;
trr->mac_size = 0;
trr->original_query_id = 0;
trr->error_code = LDNS_RCODE_NOERROR;
trr->other_size = 0;
}
/**
* Parse TSIG RR.
*
*/
int
tsig_rr_parse(tsig_rr_type* trr, buffer_type* buffer)
{
uint16_t dname_len = 0;
ldns_rr_type type = 0;
ldns_rr_class klass = 0;
uint32_t ttl = 0;
uint16_t rdlen = 0;
uint16_t curpos = 0;
ods_log_assert(trr);
ods_log_assert(buffer);
trr->status = TSIG_NOT_PRESENT;
trr->position = buffer_position(buffer);
curpos = trr->position;
if (!buffer_skip_dname(buffer)) {
buffer_set_position(buffer, trr->position);
ods_log_debug("[%s] parse: skip key name failed", tsig_str);
return 0;
}
dname_len = buffer_position(buffer) - curpos;
buffer_set_position(buffer, curpos);
trr->key_name = ldns_dname_new_frm_data(dname_len,
(const void*) buffer_current(buffer));
if (!trr->key_name) {
buffer_set_position(buffer, trr->position);
ods_log_debug("[%s] parse: read key name failed", tsig_str);
return 0;
}
buffer_set_position(buffer, curpos + dname_len);
if (!buffer_available(buffer, 10)) {
ods_log_debug("[%s] parse: not enough available", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
type = (ldns_rr_type) buffer_read_u16(buffer);
klass = (ldns_rr_class) buffer_read_u16(buffer);
if (type != LDNS_RR_TYPE_TSIG || klass != LDNS_RR_CLASS_ANY) {
/* not present */
ods_log_debug("[%s] parse: not TSIG or not ANY but %d:%d", tsig_str,
klass, type);
buffer_set_position(buffer, trr->position);
return 1;
}
ttl = buffer_read_u32(buffer);
rdlen = buffer_read_u16(buffer);
/* default to error */
trr->status = TSIG_ERROR;
trr->error_code = LDNS_RCODE_FORMERR;
if (ttl || !buffer_available(buffer, rdlen)) {
ods_log_debug("[%s] parse: TTL!=0 or RDLEN=0", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
curpos = buffer_position(buffer);
if (!buffer_skip_dname(buffer)) {
ods_log_debug("[%s] parse: skip algo name failed", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
dname_len = buffer_position(buffer) - curpos;
buffer_set_position(buffer, curpos);
trr->algo_name = ldns_dname_new_frm_data(dname_len,
(const void*) buffer_current(buffer));
if (!trr->algo_name) {
ods_log_debug("[%s] parse: read algo name failed", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
buffer_set_position(buffer, curpos + dname_len);
if (!buffer_available(buffer, 10)) {
ods_log_debug("[%s] parse: not enough available", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
trr->signed_time_high = buffer_read_u16(buffer);
trr->signed_time_low = buffer_read_u32(buffer);
trr->signed_time_fudge = buffer_read_u16(buffer);
trr->mac_size = buffer_read_u16(buffer);
if (!buffer_available(buffer, trr->mac_size)) {
ods_log_debug("[%s] parse: wrong mac size", tsig_str);
buffer_set_position(buffer, trr->position);
trr->mac_size = 0;
return 0;
}
CHECKALLOC(trr->mac_data = (uint8_t *) malloc(trr->mac_size));
memcpy(trr->mac_data, (const void*) buffer_current(buffer), trr->mac_size);
buffer_skip(buffer, trr->mac_size);
if (!buffer_available(buffer, 6)) {
ods_log_debug("[%s] parse: not enough available", tsig_str);
buffer_set_position(buffer, trr->position);
return 0;
}
trr->original_query_id = buffer_read_u16(buffer);
trr->error_code = buffer_read_u16(buffer);
trr->other_size = buffer_read_u16(buffer);
if (!buffer_available(buffer, trr->other_size) || trr->other_size > 16) {
ods_log_debug("[%s] parse: not enough available", tsig_str);
trr->other_size = 0;
buffer_set_position(buffer, trr->position);
return 0;
}
CHECKALLOC(trr->other_data = (uint8_t *) malloc(trr->other_size));
memcpy(trr->other_data, (const void*) buffer_current(buffer), trr->other_size);
buffer_skip(buffer, trr->other_size);
trr->status = TSIG_OK;
return 1;
}
/**
* Find TSIG RR.
*
*/
int
tsig_rr_find(tsig_rr_type* trr, buffer_type* buffer)
{
size_t saved_pos = 0;
size_t rrcount = 0;
size_t i = 0;
int result = 0;
ods_log_assert(trr);
ods_log_assert(buffer);
if (buffer_pkt_arcount(buffer) == 0) {
trr->status = TSIG_NOT_PRESENT;
return 1;
}
saved_pos = buffer_position(buffer);
rrcount = buffer_pkt_qdcount(buffer) + buffer_pkt_ancount(buffer) +
buffer_pkt_nscount(buffer) + buffer_pkt_arcount(buffer);
buffer_set_position(buffer, BUFFER_PKT_HEADER_SIZE);
for (i=0; i < rrcount - 1; i++) {
if (!buffer_skip_rr(buffer, i < buffer_pkt_qdcount(buffer))) {
buffer_set_position(buffer, saved_pos);
return 0;
}
}
result = tsig_rr_parse(trr, buffer);
buffer_set_position(buffer, saved_pos);
return result;
}
/**
* Lookup TSIG RR.
*
*/
int
tsig_rr_lookup(tsig_rr_type* trr)
{
tsig_key_table_type* kentry = NULL;
tsig_key_type* key = NULL;
tsig_algo_table_type* aentry = NULL;
tsig_algo_type* algorithm = NULL;
uint64_t current_time = 0;
uint64_t signed_time = 0;
ods_log_assert(trr);
ods_log_assert(trr->status == TSIG_OK);
ods_log_assert(!trr->algo);
ods_log_assert(!trr->key);
for (kentry = tsig_key_table; kentry; kentry = kentry->next) {
if (ldns_dname_compare(trr->key_name, kentry->key->dname) == 0) {
key = kentry->key;
break;
}
}
for (aentry = tsig_algo_table; aentry; aentry = aentry->next) {
if (ldns_dname_compare(trr->algo_name,
aentry->algorithm->wf_name) == 0) {
algorithm = aentry->algorithm;
break;
}
}
if (!key || !algorithm) {
/* algorithm or key is unknown, cannot authenticate. */
ods_log_debug("[%s] algorithm or key missing", tsig_str);
trr->error_code = TSIG_ERROR_BADKEY;
return 0;
}
if ((trr->algo && algorithm != trr->algo) ||
(trr->key && key != trr->key)) {
/* algorithm or key changed during a single connection, error. */
ods_log_debug("[%s] algorithm or key has changed", tsig_str);
trr->error_code = TSIG_ERROR_BADKEY;
return 0;
}
signed_time = ((((uint64_t) trr->signed_time_high) << 32) |
((uint64_t) trr->signed_time_low));
current_time = (uint64_t) time_now();
if ((current_time < signed_time - trr->signed_time_fudge) ||
(current_time > signed_time + trr->signed_time_fudge)) {
uint16_t current_time_high;
uint32_t current_time_low;
trr->error_code = TSIG_ERROR_BADTIME;
current_time_high = (uint16_t) (current_time >> 32);
current_time_low = (uint32_t) current_time;
trr->other_size = 6;
CHECKALLOC(trr->other_data = (uint8_t *) malloc(sizeof(uint16_t) + sizeof(uint32_t)));
write_uint16(trr->other_data, current_time_high);
write_uint32(trr->other_data + 2, current_time_low);
ods_log_debug("[%s] bad time", tsig_str);
return 0;
}
trr->algo = algorithm;
trr->key = key;
trr->response_count = 0;
trr->prior_mac_size = 0;
return 1;
}
/**
* Prepare TSIG RR.
*
*/
void
tsig_rr_prepare(tsig_rr_type* trr)
{
ods_log_assert(trr->algo);
if (!trr->context) {
trr->context = trr->algo->hmac_create();
CHECKALLOC(trr->prior_mac_data = (uint8_t *) malloc(trr->algo->max_digest_size));
}
trr->algo->hmac_init(trr->context, trr->algo, trr->key);
if (trr->prior_mac_size > 0) {
uint16_t mac_size = htons(trr->prior_mac_size);
trr->algo->hmac_update(trr->context, &mac_size, sizeof(mac_size));
trr->algo->hmac_update(trr->context, trr->prior_mac_data,
trr->prior_mac_size);
}
trr->update_since_last_prepare = 0;
}
/**
* Update TSIG RR.
*
*/
void
tsig_rr_update(tsig_rr_type* trr, buffer_type* buffer, size_t length)
{
uint16_t original_query_id = 0;
ods_log_assert(trr);
ods_log_assert(trr->algo);
ods_log_assert(trr->context);
ods_log_assert(buffer);
ods_log_assert(length <= buffer_limit(buffer));
original_query_id = htons(trr->original_query_id);
trr->algo->hmac_update(trr->context, &original_query_id,
sizeof(original_query_id));
trr->algo->hmac_update(trr->context,
buffer_at(buffer, sizeof(original_query_id)),
length - sizeof(original_query_id));
if (buffer_pkt_qr(buffer)) {
++trr->response_count;
}
++trr->update_since_last_prepare;
}
/**
* Digest variables.
*
*/
static void
tsig_rr_digest_variables(tsig_rr_type* trr, int tsig_timers_only)
{
uint16_t klass = htons(LDNS_RR_CLASS_ANY);
uint32_t ttl = htonl(0);
uint16_t signed_time_high = htons(trr->signed_time_high);
uint32_t signed_time_low = htonl(trr->signed_time_low);
uint16_t signed_time_fudge = htons(trr->signed_time_fudge);
uint16_t error_code = htons(trr->error_code);
uint16_t other_size = htons(trr->other_size);
ods_log_assert(trr->context);
ods_log_assert(trr->algo);
ods_log_assert(trr->key_name);
if (!tsig_timers_only) {
ods_log_assert(trr->key_name);
ods_log_assert(trr->algo_name);
trr->algo->hmac_update(trr->context, ldns_rdf_data(trr->key_name),
ldns_rdf_size(trr->key_name));
trr->algo->hmac_update(trr->context, &klass, sizeof(klass));
trr->algo->hmac_update(trr->context, &ttl, sizeof(ttl));
trr->algo->hmac_update(trr->context, ldns_rdf_data(trr->algo_name),
ldns_rdf_size(trr->algo_name));
}
trr->algo->hmac_update(trr->context, &signed_time_high,
sizeof(signed_time_high));
trr->algo->hmac_update(trr->context, &signed_time_low,
sizeof(signed_time_low));
trr->algo->hmac_update(trr->context, &signed_time_fudge,
sizeof(signed_time_fudge));
if (!tsig_timers_only) {
trr->algo->hmac_update(trr->context, &error_code,
sizeof(error_code));
trr->algo->hmac_update(trr->context, &other_size,
sizeof(other_size));
trr->algo->hmac_update(trr->context, trr->other_data,
trr->other_size);
}
}
/**
* Sign TSIG RR.
*
*/
void
tsig_rr_sign(tsig_rr_type* trr)
{
uint64_t current_time = (uint64_t) time_now();
ods_log_assert(trr);
ods_log_assert(trr->context);
trr->signed_time_high = (uint16_t) (current_time >> 32);
trr->signed_time_low = (uint32_t) current_time;
trr->signed_time_fudge = TSIG_SIGNED_TIME_FUDGE;
tsig_rr_digest_variables(trr, trr->response_count > 1);
trr->algo->hmac_final(trr->context, trr->prior_mac_data,
&trr->prior_mac_size);
trr->mac_size = trr->prior_mac_size;
trr->mac_data = trr->prior_mac_data;
}
/**
* Verify TSIG RR.
*
*/
int
tsig_rr_verify(tsig_rr_type* trr)
{
ods_log_assert(trr);
ods_log_assert(trr->algo);
tsig_rr_digest_variables(trr, trr->response_count > 1);
trr->algo->hmac_final(trr->context, trr->prior_mac_data,
&trr->prior_mac_size);
if (trr->mac_size != trr->prior_mac_size ||
memcmp(trr->mac_data, trr->prior_mac_data, trr->mac_size) != 0) {
/* digest is incorrect, cannot authenticate. */
trr->error_code = TSIG_ERROR_BADSIG;
return 0;
}
return 1;
}
/**
* Append TSIG RR.
*
*/
void
tsig_rr_append(tsig_rr_type* trr, buffer_type* buffer)
{
size_t rdlength_pos = 0;
if (!trr || !buffer) {
return;
}
/* [TODO] key name compression? */
if (trr->key_name) {
buffer_write_rdf(buffer, trr->key_name);
} else {
buffer_write_u8(buffer, 0);
}
buffer_write_u16(buffer, (uint16_t)LDNS_RR_TYPE_TSIG);
buffer_write_u16(buffer, (uint16_t)LDNS_RR_CLASS_ANY);
buffer_write_u32(buffer, 0); /* TTL */
rdlength_pos = buffer_position(buffer);
buffer_skip(buffer, sizeof(uint16_t));
if (trr->algo_name) {
buffer_write_rdf(buffer, trr->algo_name);
} else {
buffer_write_u8(buffer, 0);
}
buffer_write_u16(buffer, trr->signed_time_high);
buffer_write_u32(buffer, trr->signed_time_low);
buffer_write_u16(buffer, trr->signed_time_fudge);
buffer_write_u16(buffer, trr->mac_size);
buffer_write(buffer, trr->mac_data, trr->mac_size);
buffer_write_u16(buffer, trr->original_query_id);
buffer_write_u16(buffer, trr->error_code);
buffer_write_u16(buffer, trr->other_size);
buffer_write(buffer, trr->other_data, trr->other_size);
buffer_write_u16_at(buffer, rdlength_pos,
buffer_position(buffer) - rdlength_pos - sizeof(uint16_t));
}
/*
* The amount of space to reserve in the response for the TSIG data.
*
*/
size_t
tsig_rr_reserved_space(tsig_rr_type* trr)
{
if (!trr || trr->status == TSIG_NOT_PRESENT) {
return 0;
}
return (
(trr->key_name?ldns_rdf_size(trr->key_name):1)
+ sizeof(uint16_t) /* Type */
+ sizeof(uint16_t) /* Class */
+ sizeof(uint32_t) /* TTL */
+ sizeof(uint16_t) /* RDATA length */
+ (trr->algo_name?ldns_rdf_size(trr->algo_name):1)
+ sizeof(uint16_t) /* Signed time (high) */
+ sizeof(uint32_t) /* Signed time (low) */
+ sizeof(uint16_t) /* Signed time fudge */
+ sizeof(uint16_t) /* MAC size */
+ max_algo_digest_size /* MAC data */
+ sizeof(uint16_t) /* Original query ID */
+ sizeof(uint16_t) /* Error code */
+ sizeof(uint16_t) /* Other size */
+ trr->other_size); /* Other data */
}
/**
* Reply with error TSIG RR.
*
*/
void
tsig_rr_error(tsig_rr_type* trr)
{
if (!trr) {
return;
}
if (trr->mac_data) {
memset(trr->mac_data, 0, trr->mac_size);
}
trr->mac_size = 0;
}
/**
* Print TSIG status.
*
*/
const char*
tsig_status2str(tsig_status status)
{
switch (status) {
case TSIG_NOT_PRESENT:
return "NOT PRESENT";
case TSIG_OK:
return "OK";
case TSIG_ERROR:
return "ERROR";
}
return "UNKNOWN";
}
/**
* Get human readable TSIG error code.
*
*/
const char*
tsig_strerror(uint16_t error)
{
static char message[1000];
switch (error) {
case 0:
return "No Error";
break;
case TSIG_ERROR_BADSIG:
return "Bad Signature";
break;
case TSIG_ERROR_BADKEY:
return "Bad Key";
break;
case TSIG_ERROR_BADTIME:
return "Bad Time";
break;
default:
if (error < 16) {
/* DNS rcodes */
return (const char*) ldns_pkt_rcode2str(error);
}
snprintf(message, sizeof(message), "Unknown Error %d", error);
break;
}
return message;
}
/**
* Free TSIG RR.
*
*/
void
tsig_rr_free(tsig_rr_type* trr)
{
if (!trr) {
return;
}
ldns_rdf_deep_free(trr->key_name);
ldns_rdf_deep_free(trr->algo_name);
free(trr->mac_data);
free(trr->other_data);
trr->key_name = NULL;
trr->algo_name = NULL;
trr->mac_data = NULL;
trr->other_data = NULL;
}
/**
* Cleanup TSIG RR.
*
*/
void
tsig_rr_cleanup(tsig_rr_type* trr)
{
if (!trr) {
return;
}
tsig_rr_free(trr);
free(trr);
}
/**
* Clean up TSIG.
*
*/
void
tsig_cleanup(tsig_type* tsig)
{
if (!tsig) {
return;
}
tsig_cleanup(tsig->next);
free((void*)tsig->name);
free((void*)tsig->algorithm);
free((void*)tsig->secret);
free(tsig);
}
opendnssec-2.0.4/signer/src/wire/netio.h 0000644 0001750 0001750 00000014232 13036123713 015113 0000000 0000000 /*
* Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
*
* The netio module implements event based I/O handling using
* pselect(2). Multiple event handlers can wait for a certain event
* to occur simultaneously. Each event handler is called when an
* event occurs that the event handler has indicated that it is
* willing to handle.
*
* There are four types of events that can be handled:
*
* NETIO_EVENT_READ: reading will not block.
* NETIO_EVENT_WRITE: writing will not block.
* NETIO_EVENT_EXCEPT: an exception occurred.
* NETIO_EVENT_TIMEOUT: the timeout expired.
*
* A file descriptor must be specified if the handler is interested in
* the first three event types. A timeout must be specified if the
* event handler is interested in timeouts. These event types can be
* OR'ed together if the handler is willing to handle multiple types
* of events.
*
* The special event type NETIO_EVENT_NONE is available if you wish to
* temporarily disable the event handler without removing and adding
* the handler to the netio structure.
*
* The event callbacks are free to modify the netio_handler_type
* structure to change the file descriptor, timeout, event types, user
* data, or handler functions.
*
* The main loop of the program must call netio_dispatch to check for
* events and dispatch them to the handlers. An additional timeout
* can be specified as well as the signal mask to install while
* blocked in pselect(2).
*/
/**
* Network I/O Support.
*
*/
#ifndef WIRE_NETIO_H_
#define WIRE_NETIO_H_
#ifdef HAVE_SYS_SELECT_H
#include
#endif
#include
#include "config.h"
#include "status.h"
#ifndef PF_INET
#define PF_INET AF_INET
#endif
#ifndef PF_INET6
#define PF_INET6 AF_INET6
#endif
/*
* The type of events a handler is interested in.
* These can be OR'ed together to specify multiple event types.
*
*/
enum netio_events_enum {
NETIO_EVENT_NONE = 0,
NETIO_EVENT_READ = 1,
NETIO_EVENT_WRITE = 2,
NETIO_EVENT_EXCEPT = 4,
NETIO_EVENT_TIMEOUT = 8
};
typedef enum netio_events_enum netio_events_type;
typedef struct netio_struct netio_type;
typedef struct netio_handler_struct netio_handler_type;
typedef struct netio_handler_list_struct netio_handler_list_type;
/**
* Network I/O event handler function.
*
*/
typedef void (*netio_event_handler_type)(netio_type *netio,
netio_handler_type* handler, netio_events_type event_types);
/**
* Network I/O event handler list.
*
*/
struct netio_handler_list_struct {
netio_handler_list_type* next;
netio_handler_type* handler;
};
/**
* Network I/O event handler.
*
*/
struct netio_handler_struct {
/*
* The file descriptor that should be checked for events. If
* the file descriptor is negative only timeout events are
* checked for.
*/
int fd;
/*
* The time when no events should be checked for and the
* handler should be called with the NETIO_EVENT_TIMEOUT
* event type. Unlike most timeout parameters the time should
* be absolute, not relative!
*/
struct timespec* timeout;
/*
* User data.
*/
void* user_data;
/*
* The type of events that should be checked for. These types
* can be OR'ed together to wait for multiple types of events.
*/
netio_events_type event_types;
/*
* The event handler. The event_types parameter contains the
* OR'ed set of event types that actually triggered. The
* event handler is allowed to modify this handler object.
* The event handler SHOULD NOT block.
*/
netio_event_handler_type event_handler;
};
/**
* Network I/O instance.
*
*/
struct netio_struct {
netio_handler_list_type* handlers;
netio_handler_list_type* deallocated;
/*
* Cached value of the current time. The cached value is
* cleared at the start of netio_dispatch to calculate the
* relative timeouts of the event handlers and after calling
* pselect(2) so handlers can use it to calculate a new
* absolute timeout.
*
* Use netio_current_time() to read the current time.
*/
int have_current_time;
struct timespec cached_current_time;
/*
* Next handler in the dispatch. Only valid during callbacks.
* To make sure that deletes respect the state of the iterator.
*/
netio_handler_list_type* dispatch_next;
};
/*
* Create a new netio instance.
* \param[in] allocator memory allocator
* \return netio_type* netio instance
*
*/
netio_type* netio_create(void);
/*
* Add a new handler to netio.
* \param[in] netio netio instance
* \param[in] handler handler
*
*/
void netio_add_handler(netio_type* netio, netio_handler_type* handler);
/*
* Remove the handler from netio.
* \param[in] netio netio instance
* \param[in] handler handler
*
*/
void netio_remove_handler(netio_type* netio, netio_handler_type* handler);
/*
* Retrieve the current time (using gettimeofday(2)).
* \param[in] netio netio instance
* \return const struct timespec* current time
*
*/
const struct timespec* netio_current_time(netio_type* netio);
/*
* Check for events and dispatch them to the handlers.
* \param[in] netio netio instance
* \param[in] timeout if specified, the maximum time to wait for an
* event to arrive.
* \param[in] sigmask is passed to the underlying pselect(2) call
* \return int the number of non-timeout events dispatched, 0 on timeout,
* and -1 on error (with errno set appropriately).
*
*/
int netio_dispatch(netio_type* netio, const struct timespec* timeout,
const sigset_t* sigmask);
/**
* Clean up netio instance
* \param[in] netio netio instance
*
*/
void netio_cleanup(netio_type* netio);
/**
* Add timespecs.
* \param[in] left left
* \param[in] right right
*
*/
void timespec_add(struct timespec* left, const struct timespec* right);
#ifdef __cplusplus
inline netio_events_type
operator | (netio_events_type lhs, netio_events_type rhs) {
return (netio_events_type) (lhs | rhs);
}
inline netio_events_type
operator |= (netio_events_type &lhs, netio_events_type rhs) {
lhs = (netio_events_type) (lhs | rhs);
return lhs;
}
#endif /* __cplusplus */
#endif /* WIRE_NETIO_H_ */
opendnssec-2.0.4/signer/src/wire/sock.h 0000644 0001750 0001750 00000007411 13036123676 014745 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Sockets.
*
*/
#ifndef WIRE_SOCK_H
#define WIRE_SOCK_H
#include "config.h"
#include "status.h"
#include "wire/listener.h"
#include "wire/netio.h"
#include "wire/query.h"
/**
* Socket.
*
*/
typedef struct sock_struct sock_type;
struct sock_struct {
struct addrinfo* addr;
int s;
};
/**
* List of sockets.
*
*/
typedef struct socklist_struct socklist_type;
struct socklist_struct {
sock_type tcp[MAX_INTERFACES];
sock_type udp[MAX_INTERFACES];
};
/**
* Data for udp handlers.
*
*/
struct udp_data {
engine_type* engine;
sock_type* socket;
query_type* query;
};
/**
* Data for tcp accept handlers.
*
*/
struct tcp_accept_data {
engine_type* engine;
sock_type* socket;
size_t tcp_accept_handler_count;
netio_handler_type* tcp_accept_handlers;
};
/**
* Data for tcp handlers.
*
*/
struct tcp_data {
engine_type* engine;
query_type* query;
size_t tcp_accept_handler_count;
netio_handler_type* tcp_accept_handlers;
query_state qstate;
size_t bytes_transmitted;
};
/**
* Create sockets and listen.
* \param[out] sockets sockets
* \param[in] listener interfaces
* \return ods_status status
*
*/
ods_status sock_listen(socklist_type* sockets, listener_type* listener);
/**
* Handle incoming udp queries.
* \param[in] netio network I/O event handler
* \param[in] handler event handler
* \param[in] event_types the types of events that should be checked for
*
*/
void sock_handle_udp(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types);
/**
* Handle incoming tcp connections.
* \param[in] netio network I/O event handler
* \param[in] handler event handler
* \param[in] event_types the types of events that should be checked for
*
*/
void sock_handle_tcp_accept(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types);
/**
* Handle incoming tcp queries.
* \param[in] netio network I/O event handler
* \param[in] handler event handler
* \param[in] event_types the types of events that should be checked for
*
*/
void sock_handle_tcp_read(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types);
/**
* Handle outgoing tcp responses.
* \param[in] netio network I/O event handler
* \param[in] handler event handler
* \param[in] event_types the types of events that should be checked for
*
*/
void sock_handle_tcp_write(netio_type* netio, netio_handler_type* handler,
netio_events_type event_types);
#endif /* WIRE_SOCK_H */
opendnssec-2.0.4/signer/src/wire/tsig-openssl.h 0000644 0001750 0001750 00000003450 13036123676 016434 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Interface to OpenSSL for TSIG support.
*
*/
#ifndef WIRE_TSIG_OPENSSL_H
#define WIRE_TSIG_OPENSSL_H
#ifdef HAVE_SSL
#include "status.h"
#include
#include
/**
* Initialize OpenSSL support for TSIG.
* \param[in] allocator memory allocator
* \return ods_status status
*
*/
ods_status tsig_handler_openssl_init(void);
/**
* Finalize OpenSSL support for TSIG.
*
*/
void tsig_handler_openssl_finalize(void);
#endif /* HAVE_SSL */
#endif /* WIRE_TSIG_OPENSSL_H */
opendnssec-2.0.4/signer/src/wire/tcpset.c 0000644 0001750 0001750 00000015362 13036123676 015307 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* TCP connections.
*
*/
#include "config.h"
#include "wire/tcpset.h"
#include
static const char* tcp_str = "tcp";
/**
* Create a tcp connection.
*
*/
tcp_conn_type*
tcp_conn_create()
{
tcp_conn_type* tcp_conn = NULL;
CHECKALLOC(tcp_conn = (tcp_conn_type*) malloc(sizeof(tcp_conn_type)));
memset(tcp_conn, 0, sizeof(tcp_conn_type));
tcp_conn->packet = buffer_create(PACKET_BUFFER_SIZE);
if (!tcp_conn->packet) {
free(tcp_conn);
return NULL;
}
tcp_conn->msglen = 0;
tcp_conn->total_bytes = 0;
tcp_conn->fd = -1;
return tcp_conn;
}
/**
* Create a set of tcp connections.
*
*/
tcp_set_type*
tcp_set_create()
{
size_t i = 0;
tcp_set_type* tcp_set = NULL;
CHECKALLOC(tcp_set = (tcp_set_type*) malloc(sizeof(tcp_set_type)));
memset(tcp_set, 0, sizeof(tcp_set_type));
tcp_set->tcp_count = 0;
for (i=0; i < TCPSET_MAX; i++) {
tcp_set->tcp_conn[i] = tcp_conn_create();
}
tcp_set->tcp_waiting_first = NULL;
tcp_set->tcp_waiting_last = NULL;
return tcp_set;
}
/**
* Make tcp connection ready for reading.
* \param[in] tcp tcp connection
*
*/
void
tcp_conn_ready(tcp_conn_type* tcp)
{
ods_log_assert(tcp);
tcp->total_bytes = 0;
tcp->msglen = 0;
buffer_clear(tcp->packet);
}
/*
* Read from a tcp connection.
*
*/
int
tcp_conn_read(tcp_conn_type* tcp)
{
ssize_t received = 0;
ods_log_assert(tcp);
ods_log_assert(tcp->fd != -1);
/* receive leading packet length bytes */
if (tcp->total_bytes < sizeof(tcp->msglen)) {
received = read(tcp->fd, (char*) &tcp->msglen + tcp->total_bytes,
sizeof(tcp->msglen) - tcp->total_bytes);
if (received == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* read would block, try later */
return 0;
} else {
if (errno != ECONNRESET) {
ods_log_error("[%s] error read() sz: %s", tcp_str,
strerror(errno));
}
return -1;
}
} else if (received == 0) {
/* EOF */
return -1;
}
tcp->total_bytes += received;
if (tcp->total_bytes < sizeof(tcp->msglen)) {
/* not complete yet, try later */
return 0;
}
ods_log_assert(tcp->total_bytes == sizeof(tcp->msglen));
tcp->msglen = ntohs(tcp->msglen);
if (tcp->msglen > buffer_capacity(tcp->packet)) {
/* packet to big, drop connection */
ods_log_error("[%s] packet too big, dropping connection", tcp_str);
return 0;
}
buffer_set_limit(tcp->packet, tcp->msglen);
}
ods_log_assert(buffer_remaining(tcp->packet) > 0);
received = read(tcp->fd, buffer_current(tcp->packet),
buffer_remaining(tcp->packet));
if (received == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* read would block, try later */
return 0;
} else {
if (errno != ECONNRESET) {
ods_log_error("[%s] error read(): %s", tcp_str,
strerror(errno));
}
return -1;
}
} else if (received == 0) {
/* EOF */
return -1;
}
tcp->total_bytes += received;
buffer_skip(tcp->packet, received);
if (buffer_remaining(tcp->packet) > 0) {
/* not complete yet, wait for more */
return 0;
}
/* completed */
ods_log_assert(buffer_position(tcp->packet) == tcp->msglen);
return 1;
}
/*
* Write to a tcp connection.
*
*/
int
tcp_conn_write(tcp_conn_type* tcp)
{
ssize_t sent = 0;
ods_log_assert(tcp);
ods_log_assert(tcp->fd != -1);
if (tcp->total_bytes < sizeof(tcp->msglen)) {
uint16_t sendlen = htons(tcp->msglen);
sent = write(tcp->fd, (const char*)&sendlen + tcp->total_bytes,
sizeof(tcp->msglen) - tcp->total_bytes);
if (sent == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* write would block, try later */
return 0;
} else {
return -1;
}
}
tcp->total_bytes += sent;
if (tcp->total_bytes < sizeof(tcp->msglen)) {
/* incomplete write, resume later */
return 0;
}
ods_log_assert(tcp->total_bytes == sizeof(tcp->msglen));
}
ods_log_assert(tcp->total_bytes < tcp->msglen + sizeof(tcp->msglen));
sent = write(tcp->fd, buffer_current(tcp->packet),
buffer_remaining(tcp->packet));
if (sent == -1) {
if (errno == EAGAIN || errno == EINTR) {
/* write would block, try later */
return 0;
} else {
return -1;
}
}
buffer_skip(tcp->packet, sent);
tcp->total_bytes += sent;
if (tcp->total_bytes < tcp->msglen + sizeof(tcp->msglen)) {
/* more to write when socket becomes writable again */
return 0;
}
ods_log_assert(tcp->total_bytes == tcp->msglen + sizeof(tcp->msglen));
return 1;
}
/**
* Clean up tcp connection.
*
*/
static void
tcp_conn_cleanup(tcp_conn_type* conn)
{
if (!conn) {
return;
}
buffer_cleanup(conn->packet);
free(conn);
}
/**
* Clean up set of tcp connections.
*
*/
void
tcp_set_cleanup(tcp_set_type* set)
{
size_t i = 0;
if (!set) {
return;
}
for (i=0; i < TCPSET_MAX; i++) {
tcp_conn_cleanup(set->tcp_conn[i]);
}
free(set);
}
opendnssec-2.0.4/signer/src/wire/axfr.c 0000644 0001750 0001750 00000054324 13036123676 014746 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* AXFR.
*
*/
#include "config.h"
#include "adapter/addns.h"
#include "adapter/adutil.h"
#include "file.h"
#include "util.h"
#include "wire/axfr.h"
#include "wire/buffer.h"
#include "wire/edns.h"
#include "wire/query.h"
#include "wire/sock.h"
#define AXFR_TSIG_SIGN_EVERY_NTH 96 /* tsig sign every N packets. */
const char* axfr_str = "axfr";
/**
* Handle SOA request.
*
*/
query_state
soa_request(query_type* q, engine_type* engine)
{
char* xfrfile = NULL;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
uint32_t ttl = 0;
time_t expire = 0;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
unsigned l = 0;
FILE* fd = NULL;
ods_log_assert(q);
ods_log_assert(q->buffer);
ods_log_assert(q->zone);
ods_log_assert(q->zone->name);
ods_log_assert(engine);
xfrfile = ods_build_path(q->zone->name, ".axfr", 0, 1);
if (xfrfile) {
fd = ods_fopen(xfrfile, NULL, "r");
}
if (!fd) {
ods_log_error("[%s] unable to open file %s for zone %s",
axfr_str, xfrfile, q->zone->name);
free((void*)xfrfile);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
free((void*)xfrfile);
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1; /* sign first packet in stream */
}
/* compression? */
/* add SOA RR */
rr = addns_read_rr(fd, line, &orig, &prev, &ttl, &status, &l);
if (!rr) {
/* no SOA no transfer */
ods_log_error("[%s] bad axfr zone %s, corrupted file", axfr_str,
q->zone->name);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(fd);
return QUERY_PROCESSED;
}
/* first RR must be SOA */
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_SOA) {
ods_log_error("[%s] bad axfr zone %s, first rr is not soa",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(fd);
return QUERY_PROCESSED;
}
/* zone not expired? */
if (q->zone->xfrd) {
expire = q->zone->xfrd->serial_xfr_acquired;
expire += ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_EXPIRE));
if (expire < time_now()) {
ods_log_warning("[%s] zone %s expired at %lld, and it is now %lld: "
"not serving soa", axfr_str, q->zone->name, (long long)expire, (long long)time_now());
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(fd);
return QUERY_PROCESSED;
}
}
/* does it fit? */
if (query_add_rr(q, rr)) {
ods_log_debug("[%s] set soa in response %s", axfr_str,
q->zone->name);
buffer_pkt_set_ancount(q->buffer, buffer_pkt_ancount(q->buffer)+1);
ldns_rr_free(rr);
rr = NULL;
} else {
ods_log_error("[%s] soa does not fit in response %s",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(fd);
return QUERY_PROCESSED;
}
ods_fclose(fd);
buffer_pkt_set_ancount(q->buffer, 1);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
buffer_pkt_set_aa(q->buffer);
/* check if it needs TSIG signatures */
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1;
}
return QUERY_PROCESSED;
}
/**
* Do AXFR.
*
*/
query_state
axfr(query_type* q, engine_type* engine, int fallback)
{
char* xfrfile = NULL;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
uint16_t total_added = 0;
uint32_t ttl = 0;
time_t expire = 0;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
unsigned l = 0;
long fpos = 0;
size_t bufpos = 0;
ods_log_assert(q);
ods_log_assert(q->buffer);
ods_log_assert(q->zone);
ods_log_assert(q->zone->name);
ods_log_assert(engine);
if (q->axfr_is_done) {
ods_log_debug("[%s] zone transfer %s completed", axfr_str,
q->zone->name);
return QUERY_PROCESSED;
}
if (q->maxlen > AXFR_MAX_MESSAGE_LEN) {
q->maxlen = AXFR_MAX_MESSAGE_LEN;
}
/* prepare TSIG */
if (!fallback) {
q->tsig_prepare_it = 0;
q->tsig_update_it = 1;
if (q->tsig_sign_it) {
q->tsig_prepare_it = 1;
q->tsig_sign_it = 0;
}
}
ods_log_assert(q->tsig_rr);
if (q->axfr_fd == NULL) {
/* start AXFR */
xfrfile = ods_build_path(q->zone->name, ".axfr", 0, 1);
if (xfrfile) {
q->axfr_fd = ods_fopen(xfrfile, NULL, "r");
}
if (!q->axfr_fd) {
ods_log_error("[%s] unable to open axfr file %s for zone %s",
axfr_str, xfrfile, q->zone->name);
free((void*)xfrfile);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
free((void*)xfrfile);
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1; /* sign first packet in stream */
}
/* compression? */
/* add SOA RR */
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read axfr for zone %s: "
"ftell() failed (%s)", axfr_str, q->zone->name,
strerror(errno));
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
rr = addns_read_rr(q->axfr_fd, line, &orig, &prev, &ttl, &status,
&l);
if (!rr) {
/* no SOA no transfer */
ods_log_error("[%s] bad axfr zone %s, corrupted file",
axfr_str, q->zone->name);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
/* first RR must be SOA */
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_SOA) {
ods_log_error("[%s] bad axfr zone %s, first rr is not soa",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
/* zone not expired? */
if (q->zone->xfrd) {
expire = q->zone->xfrd->serial_xfr_acquired;
expire += ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_EXPIRE));
if (expire < time_now()) {
ods_log_warning("[%s] zone %s expired, not transferring zone",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
}
/* does it fit? */
if (query_add_rr(q, rr)) {
ods_log_debug("[%s] set soa in axfr zone %s", axfr_str,
q->zone->name);
buffer_pkt_set_ancount(q->buffer, buffer_pkt_ancount(q->buffer)+1);
total_added++;
ldns_rr_free(rr);
rr = NULL;
bufpos = buffer_position(q->buffer);
} else {
ods_log_error("[%s] soa does not fit in axfr zone %s",
axfr_str, q->zone->name);
ldns_rr_free(rr);
rr = NULL;
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
} else if (q->tcp) {
/* subsequent AXFR packets */
ods_log_debug("[%s] subsequent axfr packet zone %s", axfr_str,
q->zone->name);
q->edns_rr->status = EDNS_NOT_PRESENT;
buffer_set_limit(q->buffer, BUFFER_PKT_HEADER_SIZE);
buffer_pkt_set_qdcount(q->buffer, 0);
query_prepare(q);
}
/* add as many records as fit */
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read axfr for zone %s: "
"ftell() failed (%s)", axfr_str, q->zone->name,
strerror(errno));
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
while ((rr = addns_read_rr(q->axfr_fd, line, &orig, &prev, &ttl,
&status, &l)) != NULL) {
ods_log_deeebug("[%s] read rr at line %d", axfr_str, l);
if (status != LDNS_STATUS_OK) {
ldns_rr_free(rr);
rr = NULL;
ods_log_error("[%s] error reading rr at line %i (%s): %s",
axfr_str, l, ldns_get_errorstr_by_id(status), line);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
/* does it fit? */
if (query_add_rr(q, rr)) {
ods_log_deeebug("[%s] add rr at line %d", axfr_str, l);
ldns_rr_free(rr);
rr = NULL;
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read axfr for zone %s: "
"ftell() failed (%s)", axfr_str, q->zone->name,
strerror(errno));
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
buffer_pkt_set_ancount(q->buffer, buffer_pkt_ancount(q->buffer)+1);
total_added++;
} else {
ods_log_deeebug("[%s] rr at line %d does not fit", axfr_str, l);
ldns_rr_free(rr);
rr = NULL;
if (fseek(q->axfr_fd, fpos, SEEK_SET) != 0) {
ods_log_error("[%s] unable to reset file position in axfr "
"file: fseek() failed (%s)", axfr_str, strerror(errno));
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
} else if (q->tcp) {
goto return_axfr;
} else {
goto udp_overflow;
}
}
}
ods_log_debug("[%s] axfr zone %s is done", axfr_str, q->zone->name);
q->tsig_sign_it = 1; /* sign last packet */
q->axfr_is_done = 1;
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return_axfr:
if (q->tcp) {
ods_log_debug("[%s] return part axfr zone %s", axfr_str,
q->zone->name);
buffer_pkt_set_aa(q->buffer);
buffer_pkt_set_ancount(q->buffer, total_added);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
/* check if it needs TSIG signatures */
if (q->tsig_rr->status == TSIG_OK) {
if (q->tsig_rr->update_since_last_prepare >=
AXFR_TSIG_SIGN_EVERY_NTH) {
q->tsig_sign_it = 1;
}
}
return QUERY_AXFR;
}
ods_log_error("[%s] zone transfer %s not tcp", axfr_str,
q->zone->name);
udp_overflow:
/* UDP Overflow */
ods_log_info("[%s] axfr udp overflow zone %s", axfr_str, q->zone->name);
buffer_set_position(q->buffer, bufpos);
buffer_pkt_set_aa(q->buffer);
buffer_pkt_set_ancount(q->buffer, 1);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
/* check if it needs TSIG signatures */
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1;
}
ods_log_debug("[%s] zone transfer %s udp overflow", axfr_str,
q->zone->name);
return QUERY_PROCESSED;
}
/**
* Do IXFR (equal to AXFR for now).
*
*/
query_state
ixfr(query_type* q, engine_type* engine)
{
char* xfrfile = NULL;
ldns_rr* rr = NULL;
ldns_rdf* prev = NULL;
ldns_rdf* orig = NULL;
uint16_t total_added = 0;
uint32_t ttl = 0;
time_t expire = 0;
ldns_status status = LDNS_STATUS_OK;
char line[SE_ADFILE_MAXLINE];
unsigned l = 0;
long fpos = 0;
size_t bufpos = 0;
uint32_t new_serial = 0;
unsigned del_mode = 0;
unsigned soa_found = 0;
ods_log_assert(engine);
ods_log_assert(q);
ods_log_assert(q->buffer);
ods_log_assert(q->zone);
ods_log_assert(q->zone->name);
if (q->axfr_is_done) {
return QUERY_PROCESSED;
}
if (q->maxlen > AXFR_MAX_MESSAGE_LEN) {
q->maxlen = AXFR_MAX_MESSAGE_LEN;
}
/* prepare TSIG */
q->tsig_prepare_it = 0;
q->tsig_update_it = 1;
if (q->tsig_sign_it) {
q->tsig_prepare_it = 1;
q->tsig_sign_it = 0;
}
ods_log_assert(q->tsig_rr);
if (q->axfr_fd == NULL) {
/* start IXFR */
xfrfile = ods_build_path(q->zone->name, ".ixfr", 0, 1);
if (xfrfile) {
q->axfr_fd = ods_fopen(xfrfile, NULL, "r");
}
if (!q->axfr_fd) {
ods_log_error("[%s] unable to open ixfr file %s for zone %s",
axfr_str, xfrfile, q->zone->name);
ods_log_info("[%s] axfr fallback zone %s", axfr_str,
q->zone->name);
free((void*)xfrfile);
buffer_set_position(q->buffer, q->startpos);
return axfr(q, engine, 1);
}
free((void*)xfrfile);
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1; /* sign first packet in stream */
}
/* compression? */
/* add SOA RR */
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read ixfr for zone %s: ftell() "
"failed (%s)", axfr_str, q->zone->name, strerror(errno));
ods_log_info("[%s] axfr fallback zone %s", axfr_str,
q->zone->name);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
buffer_set_position(q->buffer, q->startpos);
return axfr(q, engine, 1);
}
rr = addns_read_rr(q->axfr_fd, line, &orig, &prev, &ttl, &status,
&l);
if (!rr) {
/* no SOA no transfer */
ods_log_error("[%s] bad ixfr zone %s, corrupted file",
axfr_str, q->zone->name);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
/* first RR must be SOA */
if (ldns_rr_get_type(rr) != LDNS_RR_TYPE_SOA) {
ods_log_error("[%s] bad ixfr zone %s, first rr is not soa",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
/* zone not expired? */
if (q->zone->xfrd) {
expire = q->zone->xfrd->serial_xfr_acquired;
expire += ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_EXPIRE));
if (expire < time_now()) {
ods_log_warning("[%s] zone %s expired, not transferring zone",
axfr_str, q->zone->name);
ldns_rr_free(rr);
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return QUERY_PROCESSED;
}
}
/* newest serial */
new_serial = ldns_rdf2native_int32(
ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
/* does it fit? */
buffer_set_position(q->buffer, q->startpos);
if (query_add_rr(q, rr)) {
ods_log_debug("[%s] set soa in ixfr zone %s", axfr_str,
q->zone->name);
buffer_pkt_set_ancount(q->buffer, buffer_pkt_ancount(q->buffer)+1);
total_added++;
ldns_rr_free(rr);
rr = NULL;
bufpos = buffer_position(q->buffer);
} else {
ods_log_error("[%s] soa does not fit in ixfr zone %s",
axfr_str, q->zone->name);
ldns_rr_free(rr);
rr = NULL;
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
}
if (util_serial_gt(q->serial, new_serial)) {
goto axfr_fallback;
}
} else if (q->tcp) {
/* subsequent IXFR packets */
ods_log_debug("[%s] subsequent ixfr packet zone %s", axfr_str,
q->zone->name);
buffer_set_limit(q->buffer, BUFFER_PKT_HEADER_SIZE);
buffer_pkt_set_qdcount(q->buffer, 0);
query_prepare(q);
soa_found = 1;
}
/* add as many records as fit */
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read ixfr for zone %s: ftell() failed "
"(%s)", axfr_str, q->zone->name, strerror(errno));
ods_log_info("[%s] axfr fallback zone %s", axfr_str,
q->zone->name);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
buffer_set_position(q->buffer, q->startpos);
return axfr(q, engine, 1);
}
while ((rr = addns_read_rr(q->axfr_fd, line, &orig, &prev, &ttl,
&status, &l)) != NULL) {
ods_log_deeebug("[%s] read rr at line %d", axfr_str, l);
if (status != LDNS_STATUS_OK) {
ldns_rr_free(rr);
rr = NULL;
ods_log_error("[%s] error reading rr at line %i (%s): %s",
axfr_str, l, ldns_get_errorstr_by_id(status), line);
goto axfr_fallback;
}
if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
del_mode = !del_mode;
}
if (!soa_found) {
if (del_mode && ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA &&
q->serial == ldns_rdf2native_int32(
ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL))) {
soa_found = 1;
} else {
ods_log_deeebug("[%s] soa serial %u not found for rr at line %d",
axfr_str, q->serial, l);
ldns_rr_free(rr);
rr = NULL;
continue;
}
}
/* does it fit? */
if (query_add_rr(q, rr)) {
ods_log_deeebug("[%s] add rr at line %d", axfr_str, l);
ldns_rr_free(rr);
rr = NULL;
fpos = ftell(q->axfr_fd);
if (fpos < 0) {
ods_log_error("[%s] unable to read ixfr for zone %s: ftell() "
"failed (%s)", axfr_str, q->zone->name, strerror(errno));
ods_log_info("[%s] axfr fallback zone %s", axfr_str,
q->zone->name);
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
buffer_set_position(q->buffer, q->startpos);
return axfr(q, engine, 1);
}
buffer_pkt_set_ancount(q->buffer, buffer_pkt_ancount(q->buffer)+1);
total_added++;
} else {
ods_log_deeebug("[%s] rr at line %d does not fit", axfr_str, l);
ldns_rr_free(rr);
rr = NULL;
if (fseek(q->axfr_fd, fpos, SEEK_SET) != 0) {
ods_log_error("[%s] unable to reset file position in ixfr "
"file: fseek() failed (%s)", axfr_str, strerror(errno));
buffer_pkt_set_rcode(q->buffer, LDNS_RCODE_SERVFAIL);
return QUERY_PROCESSED;
} else if (q->tcp) {
goto return_ixfr;
} else {
goto axfr_fallback;
}
}
}
if (!soa_found) {
ods_log_warning("[%s] zone %s journal not found for serial %u",
axfr_str, q->zone->name, q->serial);
goto axfr_fallback;
}
ods_log_debug("[%s] ixfr zone %s is done", axfr_str, q->zone->name);
q->tsig_sign_it = 1; /* sign last packet */
q->axfr_is_done = 1;
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
return_ixfr:
ods_log_debug("[%s] return part ixfr zone %s", axfr_str, q->zone->name);
buffer_pkt_set_ancount(q->buffer, total_added);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
/* check if it needs TSIG signatures */
if (q->tsig_rr->status == TSIG_OK) {
if (q->tsig_rr->update_since_last_prepare >= AXFR_TSIG_SIGN_EVERY_NTH) {
q->tsig_sign_it = 1;
}
}
return QUERY_IXFR;
axfr_fallback:
if (q->tcp) {
ods_log_info("[%s] axfr fallback zone %s", axfr_str, q->zone->name);
if (q->axfr_fd) {
ods_fclose(q->axfr_fd);
q->axfr_fd = NULL;
}
buffer_set_position(q->buffer, q->startpos);
return axfr(q, engine, 1);
}
/* UDP Overflow */
ods_log_info("[%s] ixfr udp overflow zone %s", axfr_str, q->zone->name);
buffer_set_position(q->buffer, bufpos);
buffer_pkt_set_ancount(q->buffer, 1);
buffer_pkt_set_nscount(q->buffer, 0);
buffer_pkt_set_arcount(q->buffer, 0);
/* check if it needs TSIG signatures */
if (q->tsig_rr->status == TSIG_OK) {
q->tsig_sign_it = 1;
}
return QUERY_PROCESSED;
}
opendnssec-2.0.4/signer/src/wire/notify.h 0000644 0001750 0001750 00000005237 13036123676 015322 0000000 0000000 /*
* Copyright (c) 2011 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Notify sending.
*
*/
#ifndef WIRE_NOTIFY_H
#define WIRE_NOTIFY_H
#include "config.h"
#include
typedef struct notify_struct notify_type;
#include "status.h"
#include "wire/acl.h"
#include "wire/buffer.h"
#include "wire/netio.h"
#include "wire/tsig.h"
#include "daemon/xfrhandler.h"
#include "signer/zone.h"
#define NOTIFY_MAX_UDP 50
#define NOTIFY_MAX_RETRY 5
#define NOTIFY_RETRY_TIMEOUT 15
/**
* Notify.
*
*/
struct notify_struct {
notify_type* waiting_next;
ldns_rr* soa;
tsig_rr_type* tsig_rr;
acl_type* secondary;
zone_type* zone;
xfrhandler_type* xfrhandler;
netio_handler_type handler;
struct timespec timeout;
uint16_t query_id;
uint8_t retry;
unsigned is_waiting : 1;
};
/**
* Create notify structure.
* \param[in] xfrhandler zone transfer handler
* \param[in] zone zone reference
* \return notify_type* notify structure.
*
*/
notify_type* notify_create(xfrhandler_type* xfrhandler, zone_type* zone);
/**
* Enable notify.
* \param[in] notify notify structure
* \param[in] soa current soa
*
*/
void notify_enable(notify_type* notify, ldns_rr* soa);
/**
* Send notify.
* \param[in] notify notify structure
*
*/
void notify_send(notify_type* notify);
/**
* Cleanup notify structure.
* \param[in] notify notify structure.
*
*/
void notify_cleanup(notify_type* notify);
#endif /* WIRE_NOTIFY_H */
opendnssec-2.0.4/signer/src/Makefile.in 0000644 0001750 0001750 00000110237 13036124713 014726 0000000 0000000 # Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
*) echo "am__make_running_with_option: internal error: invalid" \
"target option '$${target_option-}' specified" >&2; \
exit 1;; \
esac; \
has_opt=no; \
sane_makeflags=$$MAKEFLAGS; \
if $(am__is_gnu_make); then \
sane_makeflags=$$MFLAGS; \
else \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
bs=\\; \
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
esac; \
fi; \
skip_next=no; \
strip_trailopt () \
{ \
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
}; \
for flg in $$sane_makeflags; do \
test $$skip_next = yes && { skip_next=no; continue; }; \
case $$flg in \
*=*|--*) continue;; \
-*I) strip_trailopt 'I'; skip_next=yes;; \
-*I?*) strip_trailopt 'I';; \
-*O) strip_trailopt 'O'; skip_next=yes;; \
-*O?*) strip_trailopt 'O';; \
-*l) strip_trailopt 'l'; skip_next=yes;; \
-*l?*) strip_trailopt 'l';; \
-[dEDm]) skip_next=yes;; \
-[JT]) skip_next=yes;; \
esac; \
case $$flg in \
*$$target_option*) has_opt=yes; break;; \
esac; \
done; \
test $$has_opt = yes
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
sbin_PROGRAMS = ods-signerd$(EXEEXT) ods-signer$(EXEEXT)
subdir = signer/src
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/acx_broken_setres.m4 \
$(top_srcdir)/m4/acx_check_strptime.m4 \
$(top_srcdir)/m4/acx_cunit.m4 $(top_srcdir)/m4/acx_dlopen.m4 \
$(top_srcdir)/m4/acx_enforcer_database.m4 \
$(top_srcdir)/m4/acx_ldns.m4 $(top_srcdir)/m4/acx_libc.m4 \
$(top_srcdir)/m4/acx_libreadline.m4 \
$(top_srcdir)/m4/acx_libxml2.m4 \
$(top_srcdir)/m4/acx_pedantic.m4 \
$(top_srcdir)/m4/acx_pkcs11_modules.m4 \
$(top_srcdir)/m4/acx_prefixhack.m4 \
$(top_srcdir)/m4/acx_rpath.m4 $(top_srcdir)/m4/acx_rt.m4 \
$(top_srcdir)/m4/acx_ssl.m4 \
$(top_srcdir)/m4/ax_append_compile_flags.m4 \
$(top_srcdir)/m4/ax_append_flag.m4 \
$(top_srcdir)/m4/ax_c___attribute__.m4 \
$(top_srcdir)/m4/ax_cflags_warn_all.m4 \
$(top_srcdir)/m4/ax_check_compile_flag.m4 \
$(top_srcdir)/m4/ax_compiler_flags_cflags.m4 \
$(top_srcdir)/m4/ax_lib_mysql.m4 \
$(top_srcdir)/m4/ax_lib_sqlite3.m4 \
$(top_srcdir)/m4/ax_prog_doxygen.m4 \
$(top_srcdir)/m4/ax_pthread.m4 \
$(top_srcdir)/m4/ax_require_defined.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
$(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \
$(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/opendnssec_common.m4 $(top_srcdir)/version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/common/config.h
CONFIG_CLEAN_FILES =
CONFIG_CLEAN_VPATH_FILES =
am__installdirs = "$(DESTDIR)$(sbindir)"
PROGRAMS = $(sbin_PROGRAMS)
am_ods_signer_OBJECTS = ods-signer.$(OBJEXT)
ods_signer_OBJECTS = $(am_ods_signer_OBJECTS)
ods_signer_DEPENDENCIES = $(LIBHSM) $(LIBCOMPAT)
AM_V_lt = $(am__v_lt_@AM_V@)
am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
am__v_lt_0 = --silent
am__v_lt_1 =
am__dirstamp = $(am__leading_dot)dirstamp
am_ods_signerd_OBJECTS = ods-signerd.$(OBJEXT) adapter/adapi.$(OBJEXT) \
adapter/adapter.$(OBJEXT) adapter/addns.$(OBJEXT) \
adapter/adfile.$(OBJEXT) adapter/adutil.$(OBJEXT) \
daemon/cfg.$(OBJEXT) daemon/cmdhandler.$(OBJEXT) \
daemon/dnshandler.$(OBJEXT) daemon/xfrhandler.$(OBJEXT) \
daemon/engine.$(OBJEXT) daemon/signal.$(OBJEXT) \
daemon/worker.$(OBJEXT) parser/addnsparser.$(OBJEXT) \
parser/confparser.$(OBJEXT) parser/signconfparser.$(OBJEXT) \
parser/zonelistparser.$(OBJEXT) scheduler/fifoq.$(OBJEXT) \
scheduler/schedule.$(OBJEXT) scheduler/task.$(OBJEXT) \
signer/backup.$(OBJEXT) hsm.$(OBJEXT) signer/denial.$(OBJEXT) \
signer/domain.$(OBJEXT) signer/ixfr.$(OBJEXT) \
signer/keys.$(OBJEXT) signer/namedb.$(OBJEXT) \
signer/nsec3params.$(OBJEXT) signer/rrset.$(OBJEXT) \
signer/signconf.$(OBJEXT) signer/stats.$(OBJEXT) \
signer/tools.$(OBJEXT) signer/zone.$(OBJEXT) \
signer/zonelist.$(OBJEXT) wire/acl.$(OBJEXT) \
wire/axfr.$(OBJEXT) wire/buffer.$(OBJEXT) wire/edns.$(OBJEXT) \
wire/listener.$(OBJEXT) wire/netio.$(OBJEXT) \
wire/notify.$(OBJEXT) wire/query.$(OBJEXT) wire/sock.$(OBJEXT) \
wire/tcpset.$(OBJEXT) wire/tsig.$(OBJEXT) \
wire/tsig-openssl.$(OBJEXT) wire/xfrd.$(OBJEXT)
ods_signerd_OBJECTS = $(am_ods_signerd_OBJECTS)
ods_signerd_DEPENDENCIES = $(LIBHSM) $(LIBCOMPAT)
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
am__v_P_1 = :
AM_V_GEN = $(am__v_GEN_@AM_V@)
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
am__v_GEN_0 = @echo " GEN " $@;
am__v_GEN_1 =
AM_V_at = $(am__v_at_@AM_V@)
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
am__v_at_0 = @
am__v_at_1 =
DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)/common
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
$(AM_CFLAGS) $(CFLAGS)
AM_V_CC = $(am__v_CC_@AM_V@)
am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
am__v_CC_0 = @echo " CC " $@;
am__v_CC_1 =
CCLD = $(CC)
LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
$(AM_LDFLAGS) $(LDFLAGS) -o $@
AM_V_CCLD = $(am__v_CCLD_@AM_V@)
am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
am__v_CCLD_0 = @echo " CCLD " $@;
am__v_CCLD_1 =
SOURCES = $(ods_signer_SOURCES) $(ods_signerd_SOURCES)
DIST_SOURCES = $(ods_signer_SOURCES) $(ods_signerd_SOURCES)
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
# Read a list of newline-separated strings from the standard input,
# and print each of them once, without duplicates. Input order is
# *not* preserved.
am__uniquify_input = $(AWK) '\
BEGIN { nonempty = 0; } \
{ items[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in items) print i; }; } \
'
# Make sure the list of sources is unique. This is necessary because,
# e.g., the same source file might be shared among _SOURCES variables
# for different programs/libraries.
am__define_uniq_tagged_files = \
list='$(am__tagged_files)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | $(am__uniquify_input)`
ETAGS = etags
CTAGS = ctags
am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CP = @CP@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CUNIT_INCLUDES = @CUNIT_INCLUDES@
CUNIT_LIBS = @CUNIT_LIBS@
CXX = @CXX@
CXXCPP = @CXXCPP@
CXXDEPMODE = @CXXDEPMODE@
CXXFLAGS = @CXXFLAGS@
CYGPATH_W = @CYGPATH_W@
C_LIBS = @C_LIBS@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLTOOL = @DLLTOOL@
DOXYGEN_PAPER_SIZE = @DOXYGEN_PAPER_SIZE@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
DX_CONFIG = @DX_CONFIG@
DX_DOCDIR = @DX_DOCDIR@
DX_DOT = @DX_DOT@
DX_DOXYGEN = @DX_DOXYGEN@
DX_DVIPS = @DX_DVIPS@
DX_EGREP = @DX_EGREP@
DX_ENV = @DX_ENV@
DX_FLAG_chi = @DX_FLAG_chi@
DX_FLAG_chm = @DX_FLAG_chm@
DX_FLAG_doc = @DX_FLAG_doc@
DX_FLAG_dot = @DX_FLAG_dot@
DX_FLAG_html = @DX_FLAG_html@
DX_FLAG_man = @DX_FLAG_man@
DX_FLAG_pdf = @DX_FLAG_pdf@
DX_FLAG_ps = @DX_FLAG_ps@
DX_FLAG_rtf = @DX_FLAG_rtf@
DX_FLAG_xml = @DX_FLAG_xml@
DX_HHC = @DX_HHC@
DX_LATEX = @DX_LATEX@
DX_MAKEINDEX = @DX_MAKEINDEX@
DX_PDFLATEX = @DX_PDFLATEX@
DX_PERL = @DX_PERL@
DX_PROJECT = @DX_PROJECT@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
ENFORCER_DB_DATABASE = @ENFORCER_DB_DATABASE@
ENFORCER_DB_HOST = @ENFORCER_DB_HOST@
ENFORCER_DB_INCLUDES = @ENFORCER_DB_INCLUDES@
ENFORCER_DB_LIBS = @ENFORCER_DB_LIBS@
ENFORCER_DB_PASSWORD = @ENFORCER_DB_PASSWORD@
ENFORCER_DB_PORT = @ENFORCER_DB_PORT@
ENFORCER_DB_PORT_TEXT = @ENFORCER_DB_PORT_TEXT@
ENFORCER_DB_USERNAME = @ENFORCER_DB_USERNAME@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GREP = @GREP@
HAVE_SSL = @HAVE_SSL@
HAVE_SSL_NEW_HMAC = @HAVE_SSL_NEW_HMAC@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
JAVA = @JAVA@
LD = @LD@
LDFLAGS = @LDFLAGS@
LDNS_CONFIG = @LDNS_CONFIG@
LDNS_INCLUDES = @LDNS_INCLUDES@
LDNS_LIBS = @LDNS_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MYSQL_CFLAGS = @MYSQL_CFLAGS@
MYSQL_CONFIG = @MYSQL_CONFIG@
MYSQL_LDFLAGS = @MYSQL_LDFLAGS@
MYSQL_VERSION = @MYSQL_VERSION@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
OPENDNSSEC_BIN_DIR = @OPENDNSSEC_BIN_DIR@
OPENDNSSEC_CONFIG_DIR = @OPENDNSSEC_CONFIG_DIR@
OPENDNSSEC_CONFIG_FILE = @OPENDNSSEC_CONFIG_FILE@
OPENDNSSEC_DATA_DIR = @OPENDNSSEC_DATA_DIR@
OPENDNSSEC_ENFORCER_PIDFILE = @OPENDNSSEC_ENFORCER_PIDFILE@
OPENDNSSEC_ENFORCER_SOCKETFILE = @OPENDNSSEC_ENFORCER_SOCKETFILE@
OPENDNSSEC_FETCH_PIDFILE = @OPENDNSSEC_FETCH_PIDFILE@
OPENDNSSEC_LIBEXEC_DIR = @OPENDNSSEC_LIBEXEC_DIR@
OPENDNSSEC_LIB_DIR = @OPENDNSSEC_LIB_DIR@
OPENDNSSEC_LOCALSTATE_DIR = @OPENDNSSEC_LOCALSTATE_DIR@
OPENDNSSEC_PID_DIR = @OPENDNSSEC_PID_DIR@
OPENDNSSEC_SBIN_DIR = @OPENDNSSEC_SBIN_DIR@
OPENDNSSEC_SCHEMA_DIR = @OPENDNSSEC_SCHEMA_DIR@
OPENDNSSEC_SIGNER_CLI = @OPENDNSSEC_SIGNER_CLI@
OPENDNSSEC_SIGNER_ENGINE = @OPENDNSSEC_SIGNER_ENGINE@
OPENDNSSEC_SIGNER_PIDFILE = @OPENDNSSEC_SIGNER_PIDFILE@
OPENDNSSEC_SIGNER_SOCKET = @OPENDNSSEC_SIGNER_SOCKET@
OPENDNSSEC_STATE_DIR = @OPENDNSSEC_STATE_DIR@
OPENDNSSEC_SYSCONF_DIR = @OPENDNSSEC_SYSCONF_DIR@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PTHREAD_CC = @PTHREAD_CC@
PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
PTHREAD_LIBS = @PTHREAD_LIBS@
RANLIB = @RANLIB@
READLINE_LIBS = @READLINE_LIBS@
RT_LIBS = @RT_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SQLITE3_CFLAGS = @SQLITE3_CFLAGS@
SQLITE3_LDFLAGS = @SQLITE3_LDFLAGS@
SQLITE3_VERSION = @SQLITE3_VERSION@
SSL_INCLUDES = @SSL_INCLUDES@
SSL_LIBS = @SSL_LIBS@
STRIP = @STRIP@
VERSION = @VERSION@
WARN_CFLAGS = @WARN_CFLAGS@
XML2_CONFIG = @XML2_CONFIG@
XML2_INCLUDES = @XML2_INCLUDES@
XML2_LIBS = @XML2_LIBS@
XMLLINT = @XMLLINT@
XSLTPROC = @XSLTPROC@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_CXX = @ac_ct_CXX@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
ax_pthread_config = @ax_pthread_config@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkcs11_aepkeyper_module = @pkcs11_aepkeyper_module@
pkcs11_etoken_module = @pkcs11_etoken_module@
pkcs11_ncipher_module = @pkcs11_ncipher_module@
pkcs11_opensc_module = @pkcs11_opensc_module@
pkcs11_sca6000_module = @pkcs11_sca6000_module@
pkcs11_softhsm_module = @pkcs11_softhsm_module@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
runstatedir = @runstatedir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
LIBHSM = ${top_builddir}/libhsm/src/lib/libhsm.a
LIBCOMPAT = ${top_builddir}/common/libcompat.a
AM_CPPFLAGS = \
-I$(top_srcdir)/common \
-I$(top_builddir)/common \
-I$(top_srcdir)/libhsm/src/lib \
@SSL_INCLUDES@ \
@XML2_INCLUDES@ \
@LDNS_INCLUDES@
signerdir = @libdir@/opendnssec/signer
# man8_MANS = man/ods-signer.8 man/ods-signerd.8
ods_signerd_SOURCES = ods-signerd.c \
adapter/adapi.c adapter/adapi.h \
adapter/adapter.c adapter/adapter.h \
adapter/addns.c adapter/addns.h \
adapter/adfile.c adapter/adfile.h \
adapter/adutil.c adapter/adutil.h \
daemon/cfg.c daemon/cfg.h \
daemon/cmdhandler.c daemon/cmdhandler.h \
daemon/dnshandler.c daemon/dnshandler.h \
daemon/xfrhandler.c daemon/xfrhandler.h \
daemon/engine.c daemon/engine.h \
daemon/signal.c daemon/signal.h \
daemon/worker.c daemon/worker.h \
parser/addnsparser.c parser/addnsparser.h \
parser/confparser.c parser/confparser.h \
parser/signconfparser.c parser/signconfparser.h \
parser/zonelistparser.c parser/zonelistparser.h \
scheduler/fifoq.c scheduler/fifoq.h \
scheduler/schedule.c scheduler/schedule.h \
scheduler/task.c scheduler/task.h \
signer/backup.c signer/backup.h \
hsm.c hsm.h \
signer/denial.c signer/denial.h \
signer/domain.c signer/domain.h \
signer/ixfr.c signer/ixfr.h \
signer/keys.c signer/keys.h \
signer/namedb.c signer/namedb.h \
signer/nsec3params.c signer/nsec3params.h \
signer/rrset.c signer/rrset.h \
signer/signconf.c signer/signconf.h \
signer/stats.c signer/stats.h \
signer/tools.c signer/tools.h \
signer/zone.c signer/zone.h \
signer/zonelist.c signer/zonelist.h \
wire/acl.c wire/acl.h \
wire/axfr.c wire/axfr.h \
wire/buffer.c wire/buffer.h \
wire/edns.c wire/edns.h \
wire/listener.c wire/listener.h \
wire/netio.c wire/netio.h \
wire/notify.c wire/notify.h \
wire/query.c wire/query.h \
wire/sock.c wire/sock.h \
wire/tcpset.c wire/tcpset.h \
wire/tsig.c wire/tsig.h \
wire/tsig-openssl.c wire/tsig-openssl.h \
wire/xfrd.c wire/xfrd.h
ods_signerd_LDADD = $(LIBHSM) $(LIBCOMPAT) @LDNS_LIBS@ @XML2_LIBS@ \
@PTHREAD_LIBS@ @RT_LIBS@ @SSL_LIBS@ @C_LIBS@ $(am__empty)
ods_signer_SOURCES = ods-signer.c
ods_signer_LDADD = $(LIBHSM) $(LIBCOMPAT) @LDNS_LIBS@ @XML2_LIBS@
all: all-am
.SUFFIXES:
.SUFFIXES: .c .lo .o .obj
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
&& { if test -f $@; then exit 0; else break; fi; }; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign signer/src/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign signer/src/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
install-sbinPROGRAMS: $(sbin_PROGRAMS)
@$(NORMAL_INSTALL)
@list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(sbindir)'"; \
$(MKDIR_P) "$(DESTDIR)$(sbindir)" || exit 1; \
fi; \
for p in $$list; do echo "$$p $$p"; done | \
sed 's/$(EXEEXT)$$//' | \
while read p p1; do if test -f $$p \
|| test -f $$p1 \
; then echo "$$p"; echo "$$p"; else :; fi; \
done | \
sed -e 'p;s,.*/,,;n;h' \
-e 's|.*|.|' \
-e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \
sed 'N;N;N;s,\n, ,g' | \
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
if ($$2 == $$4) files[d] = files[d] " " $$1; \
else { print "f", $$3 "/" $$4, $$1; } } \
END { for (d in files) print "f", d, files[d] }' | \
while read type dir files; do \
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
test -z "$$files" || { \
echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(sbindir)$$dir'"; \
$(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(sbindir)$$dir" || exit $$?; \
} \
; done
uninstall-sbinPROGRAMS:
@$(NORMAL_UNINSTALL)
@list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \
-e 's/$$/$(EXEEXT)/' \
`; \
test -n "$$list" || exit 0; \
echo " ( cd '$(DESTDIR)$(sbindir)' && rm -f" $$files ")"; \
cd "$(DESTDIR)$(sbindir)" && rm -f $$files
clean-sbinPROGRAMS:
@list='$(sbin_PROGRAMS)'; test -n "$$list" || exit 0; \
echo " rm -f" $$list; \
rm -f $$list || exit $$?; \
test -n "$(EXEEXT)" || exit 0; \
list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
echo " rm -f" $$list; \
rm -f $$list
ods-signer$(EXEEXT): $(ods_signer_OBJECTS) $(ods_signer_DEPENDENCIES) $(EXTRA_ods_signer_DEPENDENCIES)
@rm -f ods-signer$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(ods_signer_OBJECTS) $(ods_signer_LDADD) $(LIBS)
adapter/$(am__dirstamp):
@$(MKDIR_P) adapter
@: > adapter/$(am__dirstamp)
adapter/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) adapter/$(DEPDIR)
@: > adapter/$(DEPDIR)/$(am__dirstamp)
adapter/adapi.$(OBJEXT): adapter/$(am__dirstamp) \
adapter/$(DEPDIR)/$(am__dirstamp)
adapter/adapter.$(OBJEXT): adapter/$(am__dirstamp) \
adapter/$(DEPDIR)/$(am__dirstamp)
adapter/addns.$(OBJEXT): adapter/$(am__dirstamp) \
adapter/$(DEPDIR)/$(am__dirstamp)
adapter/adfile.$(OBJEXT): adapter/$(am__dirstamp) \
adapter/$(DEPDIR)/$(am__dirstamp)
adapter/adutil.$(OBJEXT): adapter/$(am__dirstamp) \
adapter/$(DEPDIR)/$(am__dirstamp)
daemon/$(am__dirstamp):
@$(MKDIR_P) daemon
@: > daemon/$(am__dirstamp)
daemon/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) daemon/$(DEPDIR)
@: > daemon/$(DEPDIR)/$(am__dirstamp)
daemon/cfg.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/cmdhandler.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/dnshandler.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/xfrhandler.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/engine.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/signal.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
daemon/worker.$(OBJEXT): daemon/$(am__dirstamp) \
daemon/$(DEPDIR)/$(am__dirstamp)
parser/$(am__dirstamp):
@$(MKDIR_P) parser
@: > parser/$(am__dirstamp)
parser/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) parser/$(DEPDIR)
@: > parser/$(DEPDIR)/$(am__dirstamp)
parser/addnsparser.$(OBJEXT): parser/$(am__dirstamp) \
parser/$(DEPDIR)/$(am__dirstamp)
parser/confparser.$(OBJEXT): parser/$(am__dirstamp) \
parser/$(DEPDIR)/$(am__dirstamp)
parser/signconfparser.$(OBJEXT): parser/$(am__dirstamp) \
parser/$(DEPDIR)/$(am__dirstamp)
parser/zonelistparser.$(OBJEXT): parser/$(am__dirstamp) \
parser/$(DEPDIR)/$(am__dirstamp)
scheduler/$(am__dirstamp):
@$(MKDIR_P) scheduler
@: > scheduler/$(am__dirstamp)
scheduler/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) scheduler/$(DEPDIR)
@: > scheduler/$(DEPDIR)/$(am__dirstamp)
scheduler/fifoq.$(OBJEXT): scheduler/$(am__dirstamp) \
scheduler/$(DEPDIR)/$(am__dirstamp)
scheduler/schedule.$(OBJEXT): scheduler/$(am__dirstamp) \
scheduler/$(DEPDIR)/$(am__dirstamp)
scheduler/task.$(OBJEXT): scheduler/$(am__dirstamp) \
scheduler/$(DEPDIR)/$(am__dirstamp)
signer/$(am__dirstamp):
@$(MKDIR_P) signer
@: > signer/$(am__dirstamp)
signer/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) signer/$(DEPDIR)
@: > signer/$(DEPDIR)/$(am__dirstamp)
signer/backup.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/denial.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/domain.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/ixfr.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/keys.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/namedb.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/nsec3params.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/rrset.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/signconf.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/stats.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/tools.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/zone.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
signer/zonelist.$(OBJEXT): signer/$(am__dirstamp) \
signer/$(DEPDIR)/$(am__dirstamp)
wire/$(am__dirstamp):
@$(MKDIR_P) wire
@: > wire/$(am__dirstamp)
wire/$(DEPDIR)/$(am__dirstamp):
@$(MKDIR_P) wire/$(DEPDIR)
@: > wire/$(DEPDIR)/$(am__dirstamp)
wire/acl.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/axfr.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/buffer.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/edns.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/listener.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/netio.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/notify.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/query.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/sock.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/tcpset.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/tsig.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/tsig-openssl.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
wire/xfrd.$(OBJEXT): wire/$(am__dirstamp) \
wire/$(DEPDIR)/$(am__dirstamp)
ods-signerd$(EXEEXT): $(ods_signerd_OBJECTS) $(ods_signerd_DEPENDENCIES) $(EXTRA_ods_signerd_DEPENDENCIES)
@rm -f ods-signerd$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(ods_signerd_OBJECTS) $(ods_signerd_LDADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
-rm -f adapter/*.$(OBJEXT)
-rm -f daemon/*.$(OBJEXT)
-rm -f parser/*.$(OBJEXT)
-rm -f scheduler/*.$(OBJEXT)
-rm -f signer/*.$(OBJEXT)
-rm -f wire/*.$(OBJEXT)
distclean-compile:
-rm -f *.tab.c
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/hsm.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ods-signer.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ods-signerd.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@adapter/$(DEPDIR)/adapi.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@adapter/$(DEPDIR)/adapter.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@adapter/$(DEPDIR)/addns.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@adapter/$(DEPDIR)/adfile.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@adapter/$(DEPDIR)/adutil.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/cfg.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/cmdhandler.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/dnshandler.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/engine.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/signal.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/worker.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@daemon/$(DEPDIR)/xfrhandler.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@parser/$(DEPDIR)/addnsparser.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@parser/$(DEPDIR)/confparser.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@parser/$(DEPDIR)/signconfparser.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@parser/$(DEPDIR)/zonelistparser.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@scheduler/$(DEPDIR)/fifoq.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@scheduler/$(DEPDIR)/schedule.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@scheduler/$(DEPDIR)/task.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/backup.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/denial.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/domain.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/ixfr.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/keys.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/namedb.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/nsec3params.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/rrset.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/signconf.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/stats.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/tools.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/zone.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@signer/$(DEPDIR)/zonelist.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/acl.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/axfr.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/buffer.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/edns.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/listener.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/netio.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/notify.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/query.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/sock.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/tcpset.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/tsig-openssl.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/tsig.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@wire/$(DEPDIR)/xfrd.Po@am__quote@
.c.o:
@am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
@am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
.c.obj:
@am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\
@am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
@am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
ID: $(am__tagged_files)
$(am__define_uniq_tagged_files); mkid -fID $$unique
tags: tags-am
TAGS: tags
tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
set x; \
here=`pwd`; \
$(am__define_uniq_tagged_files); \
shift; \
if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
if test $$# -gt 0; then \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
"$$@" $$unique; \
else \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
$$unique; \
fi; \
fi
ctags: ctags-am
CTAGS: ctags
ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
$(am__define_uniq_tagged_files); \
test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
$$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
&& $(am__cd) $(top_srcdir) \
&& gtags -i $(GTAGS_ARGS) "$$here"
cscopelist: cscopelist-am
cscopelist-am: $(am__tagged_files)
list='$(am__tagged_files)'; \
case "$(srcdir)" in \
[\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
*) sdir=$(subdir)/$(srcdir) ;; \
esac; \
for i in $$list; do \
if test -f "$$i"; then \
echo "$(subdir)/$$i"; \
else \
echo "$$sdir/$$i"; \
fi; \
done >> $(top_builddir)/cscope.files
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
dist_files=`for file in $$list; do echo $$file; done | \
sed -e "s|^$$srcdirstrip/||;t" \
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
case $$dist_files in \
*/*) $(MKDIR_P) `echo "$$dist_files" | \
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
sort -u` ;; \
esac; \
for file in $$dist_files; do \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
if test -d "$(distdir)/$$file"; then \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
test -f "$(distdir)/$$file" \
|| cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
all-am: Makefile $(PROGRAMS)
installdirs:
for dir in "$(DESTDIR)$(sbindir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-am
install-strip:
if test -z '$(STRIP)'; then \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
install; \
else \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
fi
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
-rm -f adapter/$(DEPDIR)/$(am__dirstamp)
-rm -f adapter/$(am__dirstamp)
-rm -f daemon/$(DEPDIR)/$(am__dirstamp)
-rm -f daemon/$(am__dirstamp)
-rm -f parser/$(DEPDIR)/$(am__dirstamp)
-rm -f parser/$(am__dirstamp)
-rm -f scheduler/$(DEPDIR)/$(am__dirstamp)
-rm -f scheduler/$(am__dirstamp)
-rm -f signer/$(DEPDIR)/$(am__dirstamp)
-rm -f signer/$(am__dirstamp)
-rm -f wire/$(DEPDIR)/$(am__dirstamp)
-rm -f wire/$(am__dirstamp)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-am
clean-am: clean-generic clean-libtool clean-sbinPROGRAMS \
mostlyclean-am
distclean: distclean-am
-rm -rf ./$(DEPDIR) adapter/$(DEPDIR) daemon/$(DEPDIR) parser/$(DEPDIR) scheduler/$(DEPDIR) signer/$(DEPDIR) wire/$(DEPDIR)
-rm -f Makefile
distclean-am: clean-am distclean-compile distclean-generic \
distclean-tags
dvi: dvi-am
dvi-am:
html: html-am
html-am:
info: info-am
info-am:
install-data-am:
install-dvi: install-dvi-am
install-dvi-am:
install-exec-am: install-sbinPROGRAMS
install-html: install-html-am
install-html-am:
install-info: install-info-am
install-info-am:
install-man:
install-pdf: install-pdf-am
install-pdf-am:
install-ps: install-ps-am
install-ps-am:
installcheck-am:
maintainer-clean: maintainer-clean-am
-rm -rf ./$(DEPDIR) adapter/$(DEPDIR) daemon/$(DEPDIR) parser/$(DEPDIR) scheduler/$(DEPDIR) signer/$(DEPDIR) wire/$(DEPDIR)
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-compile mostlyclean-generic \
mostlyclean-libtool
pdf: pdf-am
pdf-am:
ps: ps-am
ps-am:
uninstall-am: uninstall-sbinPROGRAMS
.MAKE: install-am install-strip
.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
clean-libtool clean-sbinPROGRAMS cscopelist-am ctags ctags-am \
distclean distclean-compile distclean-generic \
distclean-libtool distclean-tags distdir dvi dvi-am html \
html-am info info-am install install-am install-data \
install-data-am install-dvi install-dvi-am install-exec \
install-exec-am install-html install-html-am install-info \
install-info-am install-man install-pdf install-pdf-am \
install-ps install-ps-am install-sbinPROGRAMS install-strip \
installcheck installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-compile \
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags tags-am uninstall uninstall-am uninstall-sbinPROGRAMS
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
opendnssec-2.0.4/signer/src/parser/ 0000755 0001750 0001750 00000000000 13036124774 014240 5 0000000 0000000 opendnssec-2.0.4/signer/src/parser/addnsparser.c 0000644 0001750 0001750 00000026436 13036123676 016645 0000000 0000000 /*
* Copyright (c) 2009 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Parsing DNS Adapter.
*
*/
#include "parser/addnsparser.h"
#include "log.h"
#include
#include
#include
#include
static const char* parser_str = "parser";
/**
* Parse the remote servers.
*
*/
static acl_type*
parse_addns_remote(const char* filename,
tsig_type* tsig, char* expr)
{
acl_type* acl = NULL;
acl_type* new_acl = NULL;
int i = 0;
char* address = NULL;
char* port = NULL;
char* key = NULL;
xmlDocPtr doc = NULL;
xmlXPathContextPtr xpathCtx = NULL;
xmlXPathObjectPtr xpathObj = NULL;
xmlNode* curNode = NULL;
xmlChar* xexpr = NULL;
if (!filename || !expr) {
return NULL;
}
/* Load XML document */
doc = xmlParseFile(filename);
if (doc == NULL) {
ods_log_error("[%s] could not parse %s: xmlParseFile() failed",
parser_str, expr);
return NULL;
}
/* Create xpath evaluation context */
xpathCtx = xmlXPathNewContext(doc);
if(xpathCtx == NULL) {
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathNewContext() failed",
parser_str, expr);
return NULL;
}
/* Evaluate xpath expression */
xexpr = (xmlChar*) expr;
xpathObj = xmlXPathEvalExpression(xexpr, xpathCtx);
if(xpathObj == NULL) {
xmlXPathFreeContext(xpathCtx);
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathEvalExpression() "
"failed", parser_str, expr);
return NULL;
}
/* Parse interfaces */
if (xpathObj->nodesetval && xpathObj->nodesetval->nodeNr > 0) {
for (i = 0; i < xpathObj->nodesetval->nodeNr; i++) {
address = NULL;
port = NULL;
key = NULL;
curNode = xpathObj->nodesetval->nodeTab[i]->xmlChildrenNode;
while (curNode) {
if (xmlStrEqual(curNode->name, (const xmlChar *)"Address")) {
address = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name,
(const xmlChar *)"Port")) {
port = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name,
(const xmlChar *)"Key")) {
key = (char *) xmlNodeGetContent(curNode);
}
curNode = curNode->next;
}
if (address) {
new_acl = acl_create(address, port, key, tsig);
if (!new_acl) {
ods_log_error("[%s] unable to add server %s:%s %s to list "
"%s: acl_create() failed", parser_str, address,
port?port:"", key?key:"", (char*) expr);
} else {
new_acl->next = acl;
acl = new_acl;
ods_log_debug("[%s] added server %s:%s %s to list %s",
parser_str, address, port?port:"", key?key:"",
(char*) expr);
}
}
free((void*)address);
free((void*)port);
free((void*)key);
}
}
xmlXPathFreeObject(xpathObj);
xmlXPathFreeContext(xpathCtx);
if (doc) {
xmlFreeDoc(doc);
}
return acl;
}
/**
* Parse the ACL interfaces.
*
*/
static acl_type*
parse_addns_acl(const char* filename,
tsig_type* tsig, char* expr)
{
acl_type* acl = NULL;
acl_type* new_acl = NULL;
int i = 0;
char* prefix = NULL;
char* key = NULL;
xmlDocPtr doc = NULL;
xmlXPathContextPtr xpathCtx = NULL;
xmlXPathObjectPtr xpathObj = NULL;
xmlNode* curNode = NULL;
xmlChar* xexpr = NULL;
if (!filename || !expr) {
return NULL;
}
/* Load XML document */
doc = xmlParseFile(filename);
if (doc == NULL) {
ods_log_error("[%s] could not parse %s: xmlParseFile() failed",
parser_str, expr);
return NULL;
}
/* Create xpath evaluation context */
xpathCtx = xmlXPathNewContext(doc);
if(xpathCtx == NULL) {
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathNewContext() failed",
parser_str, expr);
return NULL;
}
/* Evaluate xpath expression */
xexpr = (xmlChar*) expr;
xpathObj = xmlXPathEvalExpression(xexpr, xpathCtx);
if(xpathObj == NULL) {
xmlXPathFreeContext(xpathCtx);
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathEvalExpression() "
"failed", parser_str, expr);
return NULL;
}
/* Parse interfaces */
if (xpathObj->nodesetval && xpathObj->nodesetval->nodeNr > 0) {
for (i = 0; i < xpathObj->nodesetval->nodeNr; i++) {
prefix = NULL;
key = NULL;
curNode = xpathObj->nodesetval->nodeTab[i]->xmlChildrenNode;
while (curNode) {
if (xmlStrEqual(curNode->name, (const xmlChar *)"Prefix")) {
prefix = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name,
(const xmlChar *)"Key")) {
key = (char *) xmlNodeGetContent(curNode);
}
curNode = curNode->next;
}
if (prefix || key) {
new_acl = acl_create(prefix, NULL, key, tsig);
if (!new_acl) {
ods_log_error("[%s] unable to add acl for %s %s to list "
"%s: acl_create() failed", parser_str, prefix?prefix:"",
key?key:"", (char*) expr);
} else {
new_acl->next = acl;
acl = new_acl;
ods_log_debug("[%s] added %s %s interface to list %s",
parser_str, prefix?prefix:"", key?key:"", (char*) expr);
}
}
free((void*)prefix);
free((void*)key);
}
}
xmlXPathFreeObject(xpathObj);
xmlXPathFreeContext(xpathCtx);
if (doc) {
xmlFreeDoc(doc);
}
return acl;
}
/**
* Parse the TSIG credentials.
*
*/
static tsig_type*
parse_addns_tsig_static(const char* filename,
char* expr)
{
tsig_type* tsig = NULL;
tsig_type* new_tsig = NULL;
int i = 0;
char* name = NULL;
char* algo = NULL;
char* secret = NULL;
xmlDocPtr doc = NULL;
xmlXPathContextPtr xpathCtx = NULL;
xmlXPathObjectPtr xpathObj = NULL;
xmlNode* curNode = NULL;
xmlChar* xexpr = NULL;
if (!filename || !expr) {
return NULL;
}
/* Load XML document */
doc = xmlParseFile(filename);
if (doc == NULL) {
ods_log_error("[%s] could not parse %s: xmlParseFile() failed",
parser_str, expr);
return NULL;
}
/* Create xpath evaluation context */
xpathCtx = xmlXPathNewContext(doc);
if(xpathCtx == NULL) {
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathNewContext() failed",
parser_str, expr);
return NULL;
}
/* Evaluate xpath expression */
xexpr = (xmlChar*) expr;
xpathObj = xmlXPathEvalExpression(xexpr, xpathCtx);
if(xpathObj == NULL) {
xmlXPathFreeContext(xpathCtx);
xmlFreeDoc(doc);
ods_log_error("[%s] could not parse %s: xmlXPathEvalExpression() "
"failed", parser_str, expr);
return NULL;
}
/* Parse interfaces */
if (xpathObj->nodesetval && xpathObj->nodesetval->nodeNr > 0) {
for (i = 0; i < xpathObj->nodesetval->nodeNr; i++) {
name = NULL;
algo = NULL;
secret = NULL;
curNode = xpathObj->nodesetval->nodeTab[i]->xmlChildrenNode;
while (curNode) {
if (xmlStrEqual(curNode->name, (const xmlChar *)"Name")) {
name = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name,
(const xmlChar *)"Algorithm")) {
algo = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name,
(const xmlChar *)"Secret")) {
secret = (char *) xmlNodeGetContent(curNode);
}
curNode = curNode->next;
}
if (name && algo && secret) {
new_tsig = tsig_create(name, algo, secret);
if (!new_tsig) {
ods_log_error("[%s] unable to add tsig %s: "
"tsig_create() failed", parser_str, name);
} else {
new_tsig->next = tsig;
tsig = new_tsig;
ods_log_debug("[%s] added %s tsig to list %s",
parser_str, name, (char*) expr);
}
}
free((void*)name);
free((void*)algo);
free((void*)secret);
}
}
xmlXPathFreeObject(xpathObj);
xmlXPathFreeContext(xpathCtx);
if (doc) {
xmlFreeDoc(doc);
}
return tsig;
}
/**
* Parse
#include
/**
* Parse adapter.
* \param[in] xpathCtx XPath Context Pointer
* \param[in] expr expression
* \param[in] inbound true if Input Adapter
*
*/
adapter_type* parse_zonelist_adapter(xmlXPathContextPtr xpathCtx,
xmlChar* expr, int inbound);
/**
* Parse the zonelist file.
* \param[in] zlist zone list storage
* \param[in] zlfile zonelist file name
* \return ods_status status
*
*/
ods_status parse_zonelist_zones(void* zlist, const char* zlfile);
#endif /* PARSER_ZONELISTPARSER_H */
opendnssec-2.0.4/signer/src/parser/signconfparser.c 0000644 0001750 0001750 00000035067 13036123676 017362 0000000 0000000 /*
* Copyright (c) 2009-2016 NLNet Labs. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
* IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* Parsing signer configuration files.
*
*/
#include "parser/confparser.h"
#include "parser/signconfparser.h"
#include "duration.h"
#include "log.h"
#include
#include
#include
#include
#include
static const char* parser_str = "parser";
/**
* Parse keys from the signer configuration file.
*
*/
keylist_type*
parse_sc_keys(void* sc, const char* cfgfile)
{
xmlDocPtr doc = NULL;
xmlXPathContextPtr xpathCtx = NULL;
xmlXPathObjectPtr xpathObj = NULL;
xmlNode* curNode = NULL;
xmlChar* xexpr = NULL;
key_type* new_key = NULL;
keylist_type* kl = NULL;
char* resourcerecord;
char* locator;
char* flags;
char* algorithm;
int configerr;
int ksk, zsk, publish, i;
if (!cfgfile || !sc) {
return NULL;
}
/* Load XML document */
doc = xmlParseFile(cfgfile);
if (doc == NULL) {
ods_log_error("[%s] unable to parse : "
"xmlParseFile() failed", parser_str);
return NULL;
}
/* Create xpath evaluation context */
xpathCtx = xmlXPathNewContext(doc);
if(xpathCtx == NULL) {
xmlFreeDoc(doc);
ods_log_error("[%s] unable to parse : "
"xmlXPathNewContext() failed", parser_str);
return NULL;
}
/* Evaluate xpath expression */
xexpr = (xmlChar*) "//SignerConfiguration/Zone/Keys/Key";
xpathObj = xmlXPathEvalExpression(xexpr, xpathCtx);
if(xpathObj == NULL) {
xmlXPathFreeContext(xpathCtx);
xmlFreeDoc(doc);
ods_log_error("[%s] unable to parse : "
"xmlXPathEvalExpression() failed", parser_str);
return NULL;
}
/* Parse keys */
kl = keylist_create(sc);
ods_log_assert(kl);
if (xpathObj->nodesetval && xpathObj->nodesetval->nodeNr > 0) {
for (i = 0; i < xpathObj->nodesetval->nodeNr; i++) {
resourcerecord = NULL;
locator = NULL;
flags = NULL;
algorithm = NULL;
ksk = 0;
zsk = 0;
publish = 0;
configerr = 0;
curNode = xpathObj->nodesetval->nodeTab[i]->xmlChildrenNode;
while (curNode) {
if (xmlStrEqual(curNode->name, (const xmlChar *)"Locator")) {
locator = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"Algorithm")) {
algorithm = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"Flags")) {
flags = (char *) xmlNodeGetContent(curNode);
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"KSK")) {
ksk = 1;
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"ZSK")) {
zsk = 1;
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"Publish")) {
publish = 1;
} else if (xmlStrEqual(curNode->name, (const xmlChar *)"ResourceRecord")) {
resourcerecord = (char *) xmlNodeGetContent(curNode);
}
curNode = curNode->next;
}
if (!algorithm)
configerr = 1;
if (!flags)
configerr = 1;
if (!locator && !resourcerecord)
configerr = 1;
if (!configerr) {
/* search for duplicates */
new_key = keylist_lookup_by_locator(kl, locator);
if (new_key &&
new_key->algorithm == (uint8_t) atoi(algorithm) &&
new_key->flags == (uint32_t) atoi(flags) &&
new_key->publish == publish &&
new_key->ksk == ksk &&
new_key->zsk == zsk) {
/* duplicate */
ods_log_warning("[%s] unable to push duplicate key %s "
"to keylist, skipping", parser_str, locator);
} else {
(void) keylist_push(kl, locator, resourcerecord,
(uint8_t) atoi(algorithm), (uint32_t) atoi(flags),
publish, ksk, zsk);
}
} else {
ods_log_error("[%s] unable to push key to keylist: "
"is missing required elements, skipping",
parser_str);
}
free((void*)algorithm);
free((void*)flags);
}
}
xmlXPathFreeObject(xpathObj);
xmlXPathFreeContext(xpathCtx);
if (doc) {
xmlFreeDoc(doc);
}
return kl;
}
/**
* Parse elements from the configuration file.
*
*/
duration_type*
parse_sc_sig_resign_interval(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Resign",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_refresh_interval(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Refresh",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_validity_default(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Validity/Default",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_validity_denial(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Validity/Denial",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_validity_keyset(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Validity/Keyset",
0);
/* Even if the value is 0 or NULL we want to write it in duration format.
The value is written in backup file and read during startup*/
/*if (!str || *str == 0 || *str == '0') {
return NULL;
}*/
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_jitter(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/Jitter",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_sig_inception_offset(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Signatures/InceptionOffset",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
duration_type*
parse_sc_dnskey_ttl(const char* cfgfile)
{
duration_type* duration = NULL;
const char* str = parse_conf_string(cfgfile,
"//SignerConfiguration/Zone/Keys/TTL",
1);
if (!str) {
return NULL;
}
duration = duration_create_from_string(str);
free((void*)str);
return duration;
}
const char**
parse_sc_dnskey_sigrrs(const char* cfgfile)
{
xmlDocPtr doc = NULL;
xmlXPathContextPtr xpathCtx = NULL;
xmlXPathObjectPtr xpathObj = NULL;
xmlNode* curNode = NULL;
xmlChar* xexpr = NULL;
const char **signatureresourcerecords;
int i;
if (!cfgfile) {
return NULL;
}
/* Load XML document */
doc = xmlParseFile(cfgfile);
if (doc == NULL) {
ods_log_error("[%s] unable to parse : "
"xmlParseFile() failed", parser_str);
return NULL;
}
/* Create xpath evaluation context */
xpathCtx = xmlXPathNewContext(doc);
if(xpathCtx == NULL) {
xmlFreeDoc(doc);
ods_log_error("[%s] unable to parse