39 static const char* sc_str =
"signconf";
91 const char* rngfile = ODS_SE_RNGDIR
"/signconf.rng";
92 ods_status status = ODS_STATUS_OK;
95 if (!scfile || !signconf) {
96 return ODS_STATUS_ASSERT_ERR;
98 ods_log_debug(
"[%s] read signconf file %s", sc_str, scfile);
100 if (status != ODS_STATUS_OK) {
101 ods_log_error(
"[%s] unable to read signconf: parse error in "
102 "file %s (%s)", sc_str, scfile, ods_status2str(status));
105 fd = ods_fopen(scfile, NULL,
"r");
107 signconf->
filename = strdup(scfile);
117 if (signconf->
nsec_type == LDNS_RR_TYPE_NSEC3) {
124 (uint8_t) signconf->nsec3_algo, (uint8_t) signconf->nsec3_optout,
125 (uint16_t)signconf->nsec3_iterations, signconf->nsec3_salt);
126 if (!signconf->nsec3params) {
127 ods_log_error(
"[%s] unable to read signconf %s: "
128 "nsec3params_create() failed", sc_str, scfile);
130 return ODS_STATUS_MALLOC_ERR;
141 return ODS_STATUS_OK;
143 ods_log_error(
"[%s] unable to read signconf: failed to open file %s",
145 return ODS_STATUS_ERR;
155 time_t last_modified)
159 ods_status status = ODS_STATUS_OK;
161 if (!scfile || !signconf) {
162 return ODS_STATUS_UNCHANGED;
165 st_mtime = ods_file_lastmodified(scfile);
166 if (st_mtime <= last_modified) {
167 return ODS_STATUS_UNCHANGED;
172 ods_log_error(
"[%s] unable to update signconf: signconf_create() "
174 return ODS_STATUS_ERR;
176 status = signconf_read(new_sc, scfile);
177 if (status == ODS_STATUS_OK) {
180 ods_log_error(
"[%s] unable to update signconf: signconf %s has "
181 "errors", sc_str, scfile);
183 return ODS_STATUS_CFG_ERR;
187 ods_log_error(
"[%s] unable to update signconf: failed to read file "
188 "%s (%s)", sc_str, scfile, ods_status2str(status));
200 signconf_backup_duration(FILE* fd,
const char* opt, duration_type* duration)
202 char* str = (duration == NULL ? NULL : duration2string(duration));
203 fprintf(fd,
"%s %s ", opt, (str?str:
"0"));
219 fprintf(fd,
";;Signconf: lastmod %u ", (
unsigned) sc->
last_modified);
220 if (strcmp(version, ODS_SE_FILE_MAGIC_V2) &&
221 strcmp(version, ODS_SE_FILE_MAGIC_V1)) {
223 fprintf(fd,
"maxzonettl 0 ");
230 signconf_backup_duration(fd,
"jitter", sc->
sig_jitter);
232 fprintf(fd,
"nsec %u ", (
unsigned) sc->
nsec_type);
233 signconf_backup_duration(fd,
"dnskeyttl", sc->
dnskey_ttl);
234 signconf_backup_duration(fd,
"soattl", sc->
soa_ttl);
235 signconf_backup_duration(fd,
"soamin", sc->
soa_min);
237 if (strcmp(version, ODS_SE_FILE_MAGIC_V2) == 0) {
238 fprintf(fd,
"audit 0");
249 signconf_soa_serial_check(
const char* serial) {
254 if (strlen(serial) == 4 && strncmp(serial,
"keep", 4) == 0) {
257 if (strlen(serial) == 7 && strncmp(serial,
"counter", 7) == 0) {
260 if (strlen(serial) == 8 && strncmp(serial,
"unixtime", 8) == 0) {
263 if (strlen(serial) == 11 && strncmp(serial,
"datecounter", 11) == 0) {
277 ods_status status = ODS_STATUS_OK;
280 ods_log_error(
"[%s] check failed: no signature resign interval found",
282 status = ODS_STATUS_CFG_ERR;
285 ods_log_error(
"[%s] check failed: no signature resign interval found",
287 status = ODS_STATUS_CFG_ERR;
290 ods_log_error(
"[%s] check failed: no signature default validity found",
292 status = ODS_STATUS_CFG_ERR;
295 ods_log_error(
"[%s] check failed: no signature denial validity found",
297 status = ODS_STATUS_CFG_ERR;
300 ods_log_error(
"[%s] check failed: no signature jitter found", sc_str);
301 status = ODS_STATUS_CFG_ERR;
304 ods_log_error(
"[%s] check failed: no signature inception offset found",
306 status = ODS_STATUS_CFG_ERR;
308 if (sc->
nsec_type == LDNS_RR_TYPE_NSEC3) {
310 ods_log_error(
"[%s] check failed: invalid nsec3 algorithm",
312 status = ODS_STATUS_CFG_ERR;
317 }
else if (sc->
nsec_type != LDNS_RR_TYPE_NSEC) {
318 ods_log_error(
"[%s] check failed: wrong nsec type %i", sc_str,
320 status = ODS_STATUS_CFG_ERR;
323 ods_log_error(
"[%s] check failed: no keys found", sc_str);
324 status = ODS_STATUS_CFG_ERR;
327 ods_log_error(
"[%s] check failed: no dnskey ttl found", sc_str);
328 status = ODS_STATUS_CFG_ERR;
331 ods_log_error(
"[%s] check failed: no soa ttl found", sc_str);
332 status = ODS_STATUS_CFG_ERR;
335 ods_log_error(
"[%s] check failed: no soa minimum found", sc_str);
336 status = ODS_STATUS_CFG_ERR;
339 ods_log_error(
"[%s] check failed: no soa serial type found", sc_str);
340 status = ODS_STATUS_CFG_ERR;
341 }
else if (signconf_soa_serial_check(sc->
soa_serial) != 0) {
342 ods_log_error(
"[%s] check failed: wrong soa serial type %s", sc_str,
344 status = ODS_STATUS_CFG_ERR;
357 task_id new_task = TASK_NONE;
365 new_task = TASK_NSECIFY;
367 new_task = TASK_NSECIFY;
368 }
else if (a->
nsec_type == LDNS_RR_TYPE_NSEC3) {
374 new_task = TASK_NSECIFY;
376 new_task = TASK_READ;
391 char* refresh = NULL;
392 char* validity = NULL;
397 char* dnskeyttl = NULL;
400 char* paramttl = NULL;
414 soattl = duration2string(sc->
soa_ttl);
415 soamin = duration2string(sc->
soa_min);
417 ods_log_info(
"[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] "
418 "%sVALIDITY[%s] DENIAL[%s] KEYSET[%s] JITTER[%s] OFFSET[%s] NSEC[%i] "
419 "DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s]",
422 resign?resign:
"(null)",
423 refresh?refresh:
"(null)",
425 validity?validity:
"(null)",
426 denial?denial:
"(null)",
427 keyset?keyset:
"(null)",
428 jitter?jitter:
"(null)",
429 offset?offset:
"(null)",
431 dnskeyttl?dnskeyttl:
"(null)",
432 soattl?soattl:
"(null)",
433 soamin?soamin:
"(null)",
436 if (sc->
nsec_type == LDNS_RR_TYPE_NSEC3) {
437 ods_log_debug(
"[%s] zone %s nsec3: PARAMTTL[%s] OPTOUT[%i] "
438 "ALGORITHM[%u] ITERATIONS[%u] SALT[%s]",
441 paramttl?paramttl:
"PT0S",
451 free((
void*)refresh);
452 free((
void*)validity);
457 free((
void*)dnskeyttl);
458 free((
void*)paramttl);