OpenDNSSEC-signer 1.3.0
|
00001 /* 00002 * $Id: signconf.c 5320 2011-07-12 10:42:26Z jakob $ 00003 * 00004 * Copyright (c) 2009 NLNet Labs. All rights reserved. 00005 * 00006 * Redistribution and use in source and binary forms, with or without 00007 * modification, are permitted provided that the following conditions 00008 * are met: 00009 * 1. Redistributions of source code must retain the above copyright 00010 * notice, this list of conditions and the following disclaimer. 00011 * 2. Redistributions in binary form must reproduce the above copyright 00012 * notice, this list of conditions and the following disclaimer in the 00013 * documentation and/or other materials provided with the distribution. 00014 * 00015 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 00016 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 00017 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 00018 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 00019 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 00020 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE 00021 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 00022 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER 00023 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 00024 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN 00025 * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 00026 * 00027 */ 00028 00034 #include "parser/confparser.h" 00035 #include "parser/signconfparser.h" 00036 #include "scheduler/task.h" 00037 #include "shared/duration.h" 00038 #include "shared/file.h" 00039 #include "shared/hsm.h" 00040 #include "shared/log.h" 00041 #include "signer/backup.h" 00042 #include "shared/status.h" 00043 #include "signer/keys.h" 00044 #include "signer/signconf.h" 00045 00046 static const char* sc_str = "signconf"; 00047 00048 00053 signconf_type* 00054 signconf_create(void) 00055 { 00056 signconf_type* sc; 00057 allocator_type* allocator = allocator_create(malloc, free); 00058 if (!allocator) { 00059 ods_log_error("[%s] unable to create: create allocator failed", 00060 sc_str); 00061 return NULL; 00062 } 00063 ods_log_assert(allocator); 00064 00065 sc = (signconf_type*) allocator_alloc(allocator, sizeof(signconf_type)); 00066 if (!sc) { 00067 ods_log_error("[%s] unable to create: allocator failed", sc_str); 00068 allocator_cleanup(allocator); 00069 return NULL; 00070 } 00071 ods_log_assert(sc); 00072 sc->allocator = allocator; 00073 sc->filename = NULL; 00074 /* Signatures */ 00075 sc->sig_resign_interval = NULL; 00076 sc->sig_refresh_interval = NULL; 00077 sc->sig_validity_default = NULL; 00078 sc->sig_validity_denial = NULL; 00079 sc->sig_jitter = NULL; 00080 sc->sig_inception_offset = NULL; 00081 /* Denial of existence */ 00082 sc->nsec_type = 0; 00083 sc->nsec3_optout = 0; 00084 sc->nsec3_algo = 0; 00085 sc->nsec3_iterations = 0; 00086 sc->nsec3_salt = NULL; 00087 /* Keys */ 00088 sc->dnskey_ttl = NULL; 00089 sc->keys = NULL; 00090 /* Source of authority */ 00091 sc->soa_ttl = NULL; 00092 sc->soa_min = NULL; 00093 sc->soa_serial = NULL; 00094 /* Other useful information */ 00095 sc->last_modified = 0; 00096 sc->audit = 0; 00097 return sc; 00098 } 00099 00100 00105 static ods_status 00106 signconf_read(signconf_type* signconf, const char* scfile) 00107 { 00108 const char* rngfile = ODS_SE_RNGDIR "/signconf.rng"; 00109 ods_status status = ODS_STATUS_OK; 00110 FILE* fd = NULL; 00111 00112 ods_log_assert(scfile); 00113 ods_log_assert(signconf); 00114 ods_log_debug("[%s] read file %s", sc_str, scfile); 00115 00116 status = parse_file_check(scfile, rngfile); 00117 if (status != ODS_STATUS_OK) { 00118 ods_log_error("[%s] unable to parse file %s: %s", sc_str, scfile, 00119 ods_status2str(status)); 00120 return status; 00121 } 00122 00123 fd = ods_fopen(scfile, NULL, "r"); 00124 if (fd) { 00125 signconf->filename = allocator_strdup(signconf->allocator, scfile); 00126 signconf->sig_resign_interval = parse_sc_sig_resign_interval(scfile); 00127 signconf->sig_refresh_interval = parse_sc_sig_refresh_interval(scfile); 00128 signconf->sig_validity_default = parse_sc_sig_validity_default(scfile); 00129 signconf->sig_validity_denial = parse_sc_sig_validity_denial(scfile); 00130 signconf->sig_jitter = parse_sc_sig_jitter(scfile); 00131 signconf->sig_inception_offset = parse_sc_sig_inception_offset(scfile); 00132 signconf->nsec_type = parse_sc_nsec_type(scfile); 00133 if (signconf->nsec_type == LDNS_RR_TYPE_NSEC3) { 00134 signconf->nsec3_optout = parse_sc_nsec3_optout(scfile); 00135 signconf->nsec3_algo = parse_sc_nsec3_algorithm(scfile); 00136 signconf->nsec3_iterations = parse_sc_nsec3_iterations(scfile); 00137 signconf->nsec3_salt = parse_sc_nsec3_salt(signconf->allocator, 00138 scfile); 00139 } 00140 signconf->keys = parse_sc_keys(signconf->allocator, scfile); 00141 signconf->dnskey_ttl = parse_sc_dnskey_ttl(scfile); 00142 signconf->soa_ttl = parse_sc_soa_ttl(scfile); 00143 signconf->soa_min = parse_sc_soa_min(scfile); 00144 signconf->soa_serial = parse_sc_soa_serial(signconf->allocator, 00145 scfile); 00146 signconf->audit = parse_sc_audit(scfile); 00147 ods_fclose(fd); 00148 return ODS_STATUS_OK; 00149 } 00150 ods_log_error("[%s] unable to read signconf file %s", sc_str, scfile); 00151 return ODS_STATUS_ERR; 00152 } 00153 00154 00159 ods_status 00160 signconf_update(signconf_type** signconf, const char* scfile, 00161 time_t last_modified) 00162 { 00163 signconf_type* new_sc = NULL; 00164 time_t st_mtime = 0; 00165 ods_status status = ODS_STATUS_OK; 00166 00167 if (!signconf) { 00168 ods_log_error("[%s] no signconf storage", sc_str); 00169 return ODS_STATUS_UNCHANGED; 00170 } 00171 ods_log_assert(signconf); 00172 if (!scfile) { 00173 ods_log_error("[%s] no signconf filename", sc_str); 00174 return ODS_STATUS_UNCHANGED; 00175 } 00176 ods_log_assert(scfile); 00177 00178 /* is the file updated? */ 00179 st_mtime = ods_file_lastmodified(scfile); 00180 if (st_mtime <= last_modified) { 00181 return ODS_STATUS_UNCHANGED; 00182 } 00183 00184 new_sc = signconf_create(); 00185 if (!new_sc) { 00186 ods_log_error("[%s] error creating new signconf", sc_str); 00187 return ODS_STATUS_ERR; 00188 } 00189 00190 status = signconf_read(new_sc, scfile); 00191 if (status == ODS_STATUS_OK) { 00192 new_sc->last_modified = st_mtime; 00193 if (signconf_check(new_sc) != ODS_STATUS_OK) { 00194 ods_log_error("[%s] signconf %s has errors", sc_str, scfile); 00195 signconf_cleanup(new_sc); 00196 return ODS_STATUS_CFG_ERR; 00197 } 00198 *signconf = new_sc; 00199 } else { 00200 ods_log_error("[%s] unable to read file %s: %s", sc_str, scfile, 00201 ods_status2str(status)); 00202 signconf_cleanup(new_sc); 00203 } 00204 return status; 00205 } 00206 00207 00212 signconf_type* 00213 signconf_recover_from_backup(const char* filename) 00214 { 00215 signconf_type* signconf = NULL; 00216 const char* zonename = NULL; 00217 FILE* scfd = NULL; 00218 00219 scfd = ods_fopen(filename, NULL, "r"); 00220 if (scfd) { 00221 signconf = signconf_create(); 00222 00223 if (!backup_read_check_str(scfd, ODS_SE_FILE_MAGIC) || 00224 !backup_read_check_str(scfd, ";name:") || 00225 !backup_read_str(scfd, &zonename) || 00226 !backup_read_check_str(scfd, ";filename:") || 00227 !backup_read_str(scfd, &signconf->filename) || 00228 !backup_read_check_str(scfd, ";last_modified:") || 00229 !backup_read_time_t(scfd, &signconf->last_modified) || 00230 !backup_read_check_str(scfd, ";sig_resign_interval:") || 00231 !backup_read_duration(scfd, &signconf->sig_resign_interval) || 00232 !backup_read_check_str(scfd, ";sig_refresh_interval:") || 00233 !backup_read_duration(scfd, &signconf->sig_refresh_interval) || 00234 !backup_read_check_str(scfd, ";sig_validity_default:") || 00235 !backup_read_duration(scfd, &signconf->sig_validity_default) || 00236 !backup_read_check_str(scfd, ";sig_validity_denial:") || 00237 !backup_read_duration(scfd, &signconf->sig_validity_denial) || 00238 !backup_read_check_str(scfd, ";sig_jitter:") || 00239 !backup_read_duration(scfd, &signconf->sig_jitter) || 00240 !backup_read_check_str(scfd, ";sig_inception_offset:") || 00241 !backup_read_duration(scfd, &signconf->sig_inception_offset) || 00242 !backup_read_check_str(scfd, ";nsec_type:") || 00243 !backup_read_rr_type(scfd, &signconf->nsec_type) || 00244 !backup_read_check_str(scfd, ";dnskey_ttl:") || 00245 !backup_read_duration(scfd, &signconf->dnskey_ttl) || 00246 !backup_read_check_str(scfd, ";soa_ttl:") || 00247 !backup_read_duration(scfd, &signconf->soa_ttl) || 00248 !backup_read_check_str(scfd, ";soa_min:") || 00249 !backup_read_duration(scfd, &signconf->soa_min) || 00250 !backup_read_check_str(scfd, ";soa_serial:") || 00251 !backup_read_str(scfd, &signconf->soa_serial) || 00252 !backup_read_check_str(scfd, ";audit:") || 00253 !backup_read_int(scfd, &signconf->audit) || 00254 !backup_read_check_str(scfd, ODS_SE_FILE_MAGIC)) 00255 { 00256 ods_log_error("[%s] unable to recover signconf backup file %s: corrupt " 00257 "backup file ", sc_str, filename?filename:"(null)"); 00258 signconf_cleanup(signconf); 00259 signconf = NULL; 00260 } 00261 00262 if (zonename) { 00263 free((void*) zonename); 00264 } 00265 ods_fclose(scfd); 00266 return signconf; 00267 } 00268 00269 ods_log_debug("[%s] unable to recover signconf backup file %s", sc_str, 00270 filename?filename:"(null)"); 00271 return NULL; 00272 } 00273 00274 00279 static void 00280 signconf_backup_duration(FILE* fd, const char* opt, duration_type* duration) 00281 { 00282 char* str = duration2string(duration); 00283 fprintf(fd, "%s %s ", opt, str); 00284 free((void*) str); 00285 return; 00286 } 00287 00288 00289 00294 void 00295 signconf_backup(FILE* fd, signconf_type* sc) 00296 { 00297 if (!fd || !sc) { 00298 return; 00299 } 00300 ods_log_assert(fd); 00301 ods_log_assert(sc); 00302 00303 fprintf(fd, ";;Signconf: lastmod %u ", (unsigned) sc->last_modified); 00304 signconf_backup_duration(fd, "resign", sc->sig_resign_interval); 00305 signconf_backup_duration(fd, "refresh", sc->sig_refresh_interval); 00306 signconf_backup_duration(fd, "valid", sc->sig_validity_default); 00307 signconf_backup_duration(fd, "denial", sc->sig_validity_denial); 00308 signconf_backup_duration(fd, "jitter", sc->sig_jitter); 00309 signconf_backup_duration(fd, "offset", sc->sig_inception_offset); 00310 fprintf(fd, "nsec %u ", (unsigned) sc->nsec_type); 00311 signconf_backup_duration(fd, "dnskeyttl", sc->dnskey_ttl); 00312 signconf_backup_duration(fd, "soattl", sc->soa_ttl); 00313 signconf_backup_duration(fd, "soamin", sc->soa_min); 00314 fprintf(fd, "serial %s ", sc->soa_serial?sc->soa_serial:"(null)"); 00315 fprintf(fd, "audit %i\n", sc->audit); 00316 return; 00317 } 00318 00319 00324 static int 00325 signconf_soa_serial_check(const char* serial) { 00326 if (!serial) { 00327 return 1; 00328 } 00329 00330 if (strlen(serial) == 4 && strncmp(serial, "keep", 4) == 0) { 00331 return 0; 00332 } 00333 if (strlen(serial) == 7 && strncmp(serial, "counter", 7) == 0) { 00334 return 0; 00335 } 00336 if (strlen(serial) == 8 && strncmp(serial, "unixtime", 8) == 0) { 00337 return 0; 00338 } 00339 if (strlen(serial) == 11 && strncmp(serial, "datecounter", 11) == 0) { 00340 return 0; 00341 } 00342 return 1; 00343 } 00344 00349 ods_status 00350 signconf_check(signconf_type* sc) 00351 { 00352 ods_status status = ODS_STATUS_OK; 00353 00354 if (!sc->sig_resign_interval) { 00355 ods_log_error("[%s] check failed: no signature resign interval found", 00356 sc_str); 00357 status = ODS_STATUS_CFG_ERR; 00358 } 00359 if (!sc->sig_refresh_interval) { 00360 ods_log_error("[%s] check failed: no signature resign interval found", 00361 sc_str); 00362 status = ODS_STATUS_CFG_ERR; 00363 } 00364 if (!sc->sig_validity_default) { 00365 ods_log_error("[%s] check failed: no signature default validity found", 00366 sc_str); 00367 status = ODS_STATUS_CFG_ERR; 00368 } 00369 if (!sc->sig_validity_denial) { 00370 ods_log_error("[%s] check failed: no signature denial validity found", 00371 sc_str); 00372 status = ODS_STATUS_CFG_ERR; 00373 } 00374 if (!sc->sig_jitter) { 00375 ods_log_error("[%s] check failed: no signature jitter found", sc_str); 00376 status = ODS_STATUS_CFG_ERR; 00377 } 00378 if (!sc->sig_inception_offset) { 00379 ods_log_error("[%s] check failed: no signature inception offset found", 00380 sc_str); 00381 status = ODS_STATUS_CFG_ERR; 00382 } 00383 if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) { 00384 if (sc->nsec3_algo == 0) { 00385 ods_log_error("[%s] check failed: no nsec3 algorithm found", 00386 sc_str); 00387 status = ODS_STATUS_CFG_ERR; 00388 } 00389 /* iterations */ 00390 /* salt */ 00391 /* optout */ 00392 } else if (sc->nsec_type != LDNS_RR_TYPE_NSEC) { 00393 ods_log_error("[%s] check failed: wrong nsec type %i", sc_str, 00394 sc->nsec_type); 00395 status = ODS_STATUS_CFG_ERR; 00396 } 00397 if (!sc->keys || sc->keys->count == 0) { 00398 ods_log_error("[%s] check failed: no keys found", sc_str); 00399 status = ODS_STATUS_CFG_ERR; 00400 } 00401 if (!sc->dnskey_ttl) { 00402 ods_log_error("[%s] check failed: no dnskey ttl found", sc_str); 00403 status = ODS_STATUS_CFG_ERR; 00404 } 00405 if (!sc->soa_ttl) { 00406 ods_log_error("[%s] check failed: no soa ttl found", sc_str); 00407 status = ODS_STATUS_CFG_ERR; 00408 } 00409 if (!sc->soa_min) { 00410 ods_log_error("[%s] check failed: no soa minimum found", sc_str); 00411 status = ODS_STATUS_CFG_ERR; 00412 } 00413 if (!sc->soa_serial) { 00414 ods_log_error("[%s] check failed: no soa serial type found", sc_str); 00415 status = ODS_STATUS_CFG_ERR; 00416 } else if (signconf_soa_serial_check(sc->soa_serial) != 0) { 00417 ods_log_error("[%s] check failed: wrong soa serial type %s", sc_str, 00418 sc->soa_serial); 00419 status = ODS_STATUS_CFG_ERR; 00420 } 00421 00422 return status; 00423 } 00424 00425 00430 task_id 00431 signconf_compare_denial(signconf_type* a, signconf_type* b) 00432 { 00433 task_id new_task = TASK_NONE; 00434 if (!a || !b) { 00435 return TASK_NONE; 00436 } 00437 ods_log_assert(a); 00438 ods_log_assert(b); 00439 00440 if (a->nsec_type != b->nsec_type) { 00441 new_task = TASK_NSECIFY; 00442 } else if (a->nsec_type == LDNS_RR_TYPE_NSEC3) { 00443 if ((ods_strcmp(a->nsec3_salt, b->nsec3_salt) != 0) || 00444 (a->nsec3_algo != b->nsec3_algo) || 00445 (a->nsec3_iterations != b->nsec3_iterations) || 00446 (a->nsec3_optout != b->nsec3_optout)) { 00447 00448 new_task = TASK_NSECIFY; 00449 } 00450 } 00451 return new_task; 00452 } 00453 00454 00459 task_id 00460 signconf_compare_keys(signconf_type* a, signconf_type* b, ldns_rr_list* del) 00461 { 00462 task_id new_task = TASK_NONE; 00463 ods_status status = ODS_STATUS_OK; 00464 key_type* walk = NULL; 00465 key_type* ka = NULL; 00466 key_type* kb = NULL; 00467 int remove = 0; 00468 int copy = 0; 00469 00470 if (!a || !b) { 00471 return TASK_NONE; 00472 } 00473 ods_log_assert(a); 00474 ods_log_assert(b); 00475 00476 /* keys deleted? */ 00477 if (a->keys) { 00478 walk = a->keys->first_key; 00479 } 00480 while (walk && walk->locator) { 00481 remove = 0; 00482 copy = 0; 00483 00484 kb = keylist_lookup(b->keys, walk->locator); 00485 if (!kb) { 00486 remove = 1; /* [DEL] key removed from signconf */ 00487 } else { 00488 if (duration_compare(a->dnskey_ttl, b->dnskey_ttl) != 0) { 00489 remove = 1; /* [DEL] consider to be different key */ 00490 } else if (walk->flags != kb->flags) { 00491 remove = 1; /* [DEL] consider to be different key */ 00492 } else if (walk->algorithm != kb->algorithm) { 00493 remove = 1; /* [DEL] consider to be different key */ 00494 } else if (walk->publish != kb->publish) { 00495 if (walk->publish) { 00496 remove = 1; /* [DEL] withdraw dnskey from zone */ 00497 } else { 00498 new_task = TASK_READ; /* [ADD] introduce key to zone */ 00499 } 00500 } else if (walk->ksk != kb->ksk) { 00501 copy = 1; /* [UNCHANGED] same key, different role */ 00502 } else if (walk->zsk != kb->zsk) { 00503 copy = 1; /* [UNCHANGED] same key, different role */ 00504 } else { 00505 /* [UNCHANGED] identical key credentials */ 00506 copy = 1; 00507 } 00508 } 00509 00510 if (remove) { 00511 new_task = TASK_READ; 00512 if (del && walk->dnskey) { 00513 if (!ldns_rr_list_push_rr(del, walk->dnskey)) { 00514 ods_log_error("[%s] del key failed", sc_str); 00515 new_task = TASK_SIGNCONF; 00516 break; 00517 } 00518 } 00519 } else if (copy) { 00520 if (walk->dnskey && !kb->dnskey) { 00521 kb->dnskey = walk->dnskey; 00522 kb->hsmkey = walk->hsmkey; 00523 status = lhsm_get_key(NULL, ldns_rr_owner(walk->dnskey), kb); 00524 walk->hsmkey = NULL; 00525 walk->dnskey = NULL; 00526 } 00527 if (status != ODS_STATUS_OK) { 00528 ods_log_error("[%s] copy key failed", sc_str); 00529 new_task = TASK_SIGNCONF; 00530 break; 00531 } 00532 } 00533 walk = walk->next; 00534 } 00535 00536 if (new_task == TASK_NONE) { 00537 /* no error and no keys were deleted, perhaps keys were added */ 00538 walk = NULL; 00539 if (b->keys) { 00540 walk = b->keys->first_key; 00541 } 00542 while (walk) { 00543 ka = keylist_lookup(a->keys, walk->locator); 00544 if (!ka) { 00545 new_task = TASK_READ; /* [ADD] key added to signconf */ 00546 break; 00547 } 00552 walk = walk->next; 00553 } 00554 } 00555 return new_task; 00556 } 00557 00558 00563 task_id 00564 signconf_compare(signconf_type* a, signconf_type* b) 00565 { 00566 task_id new_task = TASK_NONE; 00567 task_id tmp_task = TASK_NONE; 00568 00569 new_task = signconf_compare_denial(a, b); 00570 tmp_task = signconf_compare_keys(a, b, NULL); 00571 if (tmp_task != TASK_NONE) { 00572 new_task = tmp_task; 00573 } 00574 /* not like python: reschedule if resign/refresh differs */ 00575 /* this needs review, tasks correct on signconf changes? */ 00576 return new_task; 00577 } 00578 00579 00584 void 00585 signconf_cleanup(signconf_type* sc) 00586 { 00587 allocator_type* allocator; 00588 if (!sc) { 00589 return; 00590 } 00591 duration_cleanup(sc->sig_resign_interval); 00592 duration_cleanup(sc->sig_refresh_interval); 00593 duration_cleanup(sc->sig_validity_default); 00594 duration_cleanup(sc->sig_validity_denial); 00595 duration_cleanup(sc->sig_jitter); 00596 duration_cleanup(sc->sig_inception_offset); 00597 duration_cleanup(sc->dnskey_ttl); 00598 duration_cleanup(sc->soa_ttl); 00599 duration_cleanup(sc->soa_min); 00600 keylist_cleanup(sc->keys); 00601 00602 allocator = sc->allocator; 00603 allocator_deallocate(allocator, (void*) sc->filename); 00604 allocator_deallocate(allocator, (void*) sc->nsec3_salt); 00605 allocator_deallocate(allocator, (void*) sc->soa_serial); 00606 allocator_deallocate(allocator, (void*) sc); 00607 allocator_cleanup(allocator); 00608 return; 00609 } 00610 00611 00616 void 00617 signconf_print(FILE* out, signconf_type* sc, const char* name) 00618 { 00619 char* s = NULL; 00620 00621 fprintf(out, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"); 00622 00623 if (sc) { 00624 fprintf(out, "<SignerConfiguration>\n"); 00625 fprintf(out, "\t<Zone name=\"%s\">\n", name?name:"(null)"); 00626 00627 /* Signatures */ 00628 fprintf(out, "\t\t<Signatures>\n"); 00629 s = duration2string(sc->sig_resign_interval); 00630 fprintf(out, "\t\t\t<Resign>%s</Resign>\n", s?s:"(null)"); 00631 free((void*)s); 00632 00633 s = duration2string(sc->sig_refresh_interval); 00634 fprintf(out, "\t\t\t<Refresh>%s</Refresh>\n", s?s:"(null)"); 00635 free((void*)s); 00636 00637 fprintf(out, "\t\t\t<Validity>\n"); 00638 00639 s = duration2string(sc->sig_validity_default); 00640 fprintf(out, "\t\t\t\t<Default>%s</Default>\n", s?s:"(null)"); 00641 free((void*)s); 00642 00643 s = duration2string(sc->sig_validity_denial); 00644 fprintf(out, "\t\t\t\t<Denial>%s</Denial>\n", s?s:"(null)"); 00645 free((void*)s); 00646 00647 fprintf(out, "\t\t\t</Validity>\n"); 00648 00649 s = duration2string(sc->sig_jitter); 00650 fprintf(out, "\t\t\t<Jitter>%s</Jitter>\n", s?s:"(null)"); 00651 free((void*)s); 00652 00653 s = duration2string(sc->sig_inception_offset); 00654 fprintf(out, "\t\t\t<InceptionOffset>%s</InceptionOffset>\n", 00655 s?s:"(null)"); 00656 free((void*)s); 00657 00658 fprintf(out, "\t\t</Signatures>\n"); 00659 fprintf(out, "\n"); 00660 00661 /* Denial */ 00662 fprintf(out, "\t\t<Denial>\n"); 00663 if (sc->nsec_type == LDNS_RR_TYPE_NSEC) { 00664 fprintf(out, "\t\t\t<NSEC />\n"); 00665 } else if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) { 00666 fprintf(out, "\t\t\t<NSEC3>\n"); 00667 if (sc->nsec3_optout) { 00668 fprintf(out, "\t\t\t\t<OptOut />\n"); 00669 } 00670 fprintf(out, "\t\t\t\t<Hash>\n"); 00671 fprintf(out, "\t\t\t\t\t<Algorithm>%i</Algorithm>\n", 00672 sc->nsec3_algo); 00673 fprintf(out, "\t\t\t\t\t<Iterations>%i</Iterations>\n", 00674 sc->nsec3_iterations); 00675 fprintf(out, "\t\t\t\t\t<Salt>%s</Salt>\n", 00676 sc->nsec3_salt?sc->nsec3_salt:"(null)"); 00677 fprintf(out, "\t\t\t\t</Hash>\n"); 00678 fprintf(out, "\t\t\t</NSEC3>\n"); 00679 } 00680 fprintf(out, "\t\t</Denial>\n"); 00681 fprintf(out, "\n"); 00682 00683 /* Keys */ 00684 fprintf(out, "\t\t<Keys>\n"); 00685 s = duration2string(sc->dnskey_ttl); 00686 fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)"); 00687 free((void*)s); 00688 fprintf(out, "\n"); 00689 keylist_print(out, sc->keys); 00690 fprintf(out, "\t\t</Keys>\n"); 00691 fprintf(out, "\n"); 00692 00693 /* SOA */ 00694 fprintf(out, "\t\t<SOA>\n"); 00695 s = duration2string(sc->soa_ttl); 00696 fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)"); 00697 free((void*)s); 00698 00699 s = duration2string(sc->soa_min); 00700 fprintf(out, "\t\t\t<Minimum>%s</Minimum>\n", s?s:"(null)"); 00701 free((void*)s); 00702 00703 fprintf(out, "\t\t\t<Serial>%s</Serial>\n", 00704 sc->soa_serial?sc->soa_serial:"(null)"); 00705 fprintf(out, "\t\t</SOA>\n"); 00706 fprintf(out, "\n"); 00707 00708 /* Audit */ 00709 if (sc->audit) { 00710 fprintf(out, "\t\t<Audit />\n"); 00711 fprintf(out, "\n"); 00712 } 00713 00714 fprintf(out, "\t</Zone>\n"); 00715 fprintf(out, "</SignerConfiguration>\n"); 00716 } 00717 return; 00718 } 00719 00720 00725 void 00726 signconf_log(signconf_type* sc, const char* name) 00727 { 00728 char* resign = NULL; 00729 char* refresh = NULL; 00730 char* validity = NULL; 00731 char* denial = NULL; 00732 char* jitter = NULL; 00733 char* offset = NULL; 00734 char* dnskeyttl = NULL; 00735 char* soattl = NULL; 00736 char* soamin = NULL; 00737 00738 if (sc) { 00739 resign = duration2string(sc->sig_resign_interval); 00740 refresh = duration2string(sc->sig_refresh_interval); 00741 validity = duration2string(sc->sig_validity_default); 00742 denial = duration2string(sc->sig_validity_denial); 00743 jitter = duration2string(sc->sig_jitter); 00744 offset = duration2string(sc->sig_inception_offset); 00745 dnskeyttl = duration2string(sc->dnskey_ttl); 00746 soattl = duration2string(sc->soa_ttl); 00747 soamin = duration2string(sc->soa_min); 00748 00749 ods_log_info("[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] " 00750 "VALIDITY[%s] DENIAL[%s] JITTER[%s] OFFSET[%s] NSEC[%i] " 00751 "DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s] AUDIT[%i]", 00752 sc_str, name?name:"(null)", resign, refresh, validity, denial, 00753 jitter, offset, (int) sc->nsec_type, dnskeyttl, soattl, 00754 soamin, sc->soa_serial?sc->soa_serial:"(null)", 00755 (int) sc->audit); 00756 00757 if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) { 00758 ods_log_debug("[%s] zone %s nsec3: OPTOUT[%i] ALGORITHM[%u] " 00759 "ITERATIONS[%u] SALT[%s]", sc_str, name, sc->nsec3_optout, 00760 sc->nsec3_algo, sc->nsec3_iterations, 00761 sc->nsec3_salt?sc->nsec3_salt:"(null)"); 00762 } 00763 00764 /* Keys */ 00765 keylist_log(sc->keys, name); 00766 00767 free((void*)resign); 00768 free((void*)refresh); 00769 free((void*)validity); 00770 free((void*)denial); 00771 free((void*)jitter); 00772 free((void*)offset); 00773 free((void*)dnskeyttl); 00774 free((void*)soattl); 00775 free((void*)soamin); 00776 } 00777 return; 00778 }