51 #include <ldns/ldns.h>
53 static const char* zone_str =
"zone";
66 if (!name || !klass) {
74 ods_log_error(
"[%s] unable to create zone %s: create allocator "
75 "failed", zone_str, name);
82 ods_log_error(
"[%s] unable to create zone %s: allocator failed",
91 if (strlen(name) > 1 && name[strlen(name)-1] ==
'.') {
92 name[strlen(name)-1] =
'\0';
98 zone->
dname = ldns_dname_new_frm_str(name);
99 ldns_dname2canonical(zone->
dname);
117 ods_log_error(
"[%s] unable to create zone %s: create zonedata "
118 "failed", zone_str, name);
125 ods_log_error(
"[%s] unable to create zone %s: create signconf "
126 "failed", zone_str, name);
147 ldns_rdf* soa_min = NULL;
148 ldns_rr_type type = LDNS_RR_TYPE_FIRST;
158 ods_log_error(
"[%s] unable to add RR: no storage", zone_str);
165 ods_log_error(
"[%s] unable to add RR: no signconf", zone_str);
171 if (ldns_dname_compare(zone->
dname, ldns_rr_owner(rr)) != 0 &&
172 !ldns_dname_is_subdomain(ldns_rr_owner(rr), zone->
dname)) {
174 zone_str, zone->
name?zone->
name:
"(null)");
181 type = ldns_rr_get_type(rr);
185 zone_str, zone->
name?zone->
name:
"(null)", tmp);
186 ldns_rr_set_ttl(rr, tmp);
188 if (type == LDNS_RR_TYPE_SOA) {
192 zone_str, zone->
name?zone->
name:
"(null)", tmp);
193 ldns_rr_set_ttl(rr, tmp);
198 zone_str, zone->
name?zone->
name:
"(null)", tmp);
199 soa_min = ldns_rr_set_rdf(rr,
200 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32, tmp),
203 ldns_rdf_deep_free(soa_min);
206 "rdata", zone_str, zone->
name?zone->
name:
"(null)");
227 if (ldns_dname_compare(domain->
dname, zone->
dname) == 0) {
253 ods_log_error(
"[%s] unable to add RR: pend RR failed", zone_str);
258 if (zone->
stats && do_stats) {
282 ods_log_error(
"[%s] unable to del RR: no storage", zone_str);
307 if (
rrset_del_rr(rrset, rr, (ldns_rr_get_type(rr) == LDNS_RR_TYPE_DNSKEY))
309 ods_log_error(
"[%s] unable to del RR: pend RR failed", zone_str);
314 if (do_stats && zone->
stats) {
326 dnskey_withdraw(
zone_type* zone, ldns_rr_list* del)
328 ldns_rr* clone = NULL;
332 for (i=0; i < ldns_rr_list_rr_count(del); i++) {
333 clone = ldns_rr_clone(ldns_rr_list_rr(del, i));
348 nsec3param_withdraw(
zone_type* zone, ldns_rr* rr)
350 ldns_rr* clone = NULL;
356 clone = ldns_rr_clone(rr);
374 ldns_rr_list* del = NULL;
375 char* datestamp = NULL;
382 ods_log_error(
"[%s] unable to load signconf: no zone", zone_str);
388 "insecure?", zone_str, zone->
name);
398 ods_log_error(
"[%s] unable to load signconf: zone %s signconf "
399 "%s: storage empty", zone_str, zone->
name,
405 ods_log_debug(
"[%s] zone %s signconf file %s is modified since %s",
407 datestamp?datestamp:
"Unknown");
408 free((
void*)datestamp);
411 del = ldns_rr_list_new();
414 "signconf %s: ldns_rr_list_new() failed",
423 status = dnskey_withdraw(zone, del);
425 ldns_rr_list_free(del);
428 "signconf %s: failed to delete DNSKEY from RRset",
442 "signconf %s: failed to delete NSEC3PARAM RRset",
469 ods_log_debug(
"[%s] zone %s switch to new signconf", zone_str,
480 "%Y-%m-%d %T", &datestamp);
483 datestamp?datestamp:
"Unknown");
484 free((
void*)datestamp);
486 ods_log_error(
"[%s] unable to load signconf: zone %s signconf %s: "
501 hsm_ctx_t* ctx = NULL;
506 ldns_rr* dnskey = NULL;
510 ods_log_error(
"[%s] unable to publish dnskeys: no zone", zone_str);
516 ods_log_error(
"[%s] unable to publish dnskeys zone %s: no signconf",
517 zone_str, zone->
name);
523 ods_log_error(
"[%s] unable to publish dnskeys zone %s: no keys",
524 zone_str, zone->
name);
530 ods_log_error(
"[%s] unable to publish dnskeys zone %s: no zonedata",
531 zone_str, zone->
name);
542 ctx = hsm_create_context();
544 ods_log_error(
"[%s] unable to publish dnskeys for zone %s: error "
545 "creating libhsm context", zone_str, zone->
name);
560 "error creating DNSKEY for key %s", zone_str,
567 dnskey = ldns_rr_clone(key->
dnskey);
569 }
else if (do_publish) {
570 ldns_rr_set_ttl(key->
dnskey, ttl);
572 ldns_rr2canonical(key->
dnskey);
573 dnskey = ldns_rr_clone(key->
dnskey);
581 "error adding DNSKEY[%u] for key %s", zone_str,
582 zone->
name, ldns_calc_keytag(dnskey),
594 hsm_destroy_context(ctx);
607 ldns_rr* nsec3params_rr = NULL;
609 int doe_rollover = 0;
612 ods_log_error(
"[%s] unable to prepare NSEC3: no zone", zone_str);
618 ods_log_error(
"[%s] unable to prepare NSEC3: no signconf", zone_str);
639 ods_log_error(
"[%s] unable to prepare zone %s for NSEC3: failed "
640 "to create NSEC3 parameters", zone_str, zone->
name);
648 }
else if (doe_rollover) {
649 nsec3params_rr = ldns_rr_new_frm_type(LDNS_RR_TYPE_NSEC3PARAMS);
650 if (!nsec3params_rr) {
651 ods_log_error(
"[%s] unable to prepare zone %s for NSEC3: failed "
652 "to create NSEC3PARAM RR", zone_str, zone->
name);
659 ldns_rr_set_class(nsec3params_rr, zone->
klass);
661 ldns_rr_set_owner(nsec3params_rr, ldns_rdf_clone(zone->
dname));
662 ldns_nsec3_add_param_rdfs(nsec3params_rr,
671 ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3params_rr, 1)), 7, 0);
673 ldns_rr2canonical(nsec3params_rr);
680 zone_str, zone->
name);
683 ldns_rr_free(nsec3params_rr);
698 char* filename = NULL;
707 free((
void*)filename);
710 fprintf(fd,
"%s\n", ODS_SE_FILE_MAGIC);
712 fprintf(fd,
";;Zone: name %s class %i ttl %u inbound %u internal "
741 fprintf(fd,
"%s\n", ODS_SE_FILE_MAGIC);
757 char* filename = NULL;
759 const char* token = NULL;
764 uint32_t inbound = 0;
765 uint32_t
internal = 0;
766 uint32_t outbound = 0;
778 const char* salt = NULL;
779 ldns_rr* nsec3params_rr = NULL;
792 free((
void*)filename);
872 ldns_rr_new_frm_fp(&nsec3params_rr, fd, NULL, NULL, NULL) ||
903 free((
void*)filename);
908 zone->
klass = (ldns_rr_class) klass;
929 nsec3params->
rr = nsec3params_rr;
932 zone->
task = (
void*) task;
985 free((
void*)filename);
1006 zone->
klass = (ldns_rr_class) klass;
1027 ods_log_error(
"[%s] unable to recover zone %s: corrupted file",
1028 zone_str, zone->
name);
1044 ldns_rr_free(nsec3params_rr);
1045 nsec3params_rr = NULL;
1047 nsec3params->
rr = NULL;
1090 ods_log_error(
"[%s] failed to merge policy %s name to zone "
1109 ods_log_error(
"[%s] failed to merge signconf filename %s to "
1150 ldns_rdf* serial = NULL;
1175 ods_log_error(
"[%s] unable to update serial: failed to increment",
1183 ods_log_error(
"[%s] unable to update serial: apex not found",
1192 ods_log_error(
"[%s] unable to update serial: SOA RRset not found",
1199 if (rrset->
rrs && rrset->
rrs->rr) {
1200 serial = ldns_rr_set_rdf(rrset->
rrs->rr,
1201 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
1204 if (ldns_rdf2native_int32(serial) !=
1208 ldns_rdf_deep_free(serial);
1210 ods_log_error(
"[%s] unable to update serial: failed to replace "
1211 "SOA SERIAL rdata", zone_str);
1226 if (fd && zone && zone->
zonedata) {
1265 ldns_rdf_deep_free(zone->
dname);