diff --git a/.gitignore b/.gitignore index 105f0cf..b4899c8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,3 @@ -/opendnssec-1.4.0a1.tar.gz -/opendnssec-1.4.0a2.tar.gz /opendnssec-1.4.0b1.tar.gz /opendnssec-1.4.0b2.tar.gz /opendnssec-1.4.0rc1.tar.gz @@ -7,7 +5,6 @@ /opendnssec-1.4.0rc3.tar.gz /opendnssec-1.4.0.tar.gz /opendnssec-1.4.1.tar.gz -/opendnssec-1.4.2.tar.gz /opendnssec-1.4.3.tar.gz /opendnssec-1.4.4.tar.gz /opendnssec-1.4.5.tar.gz @@ -15,14 +12,3 @@ /opendnssec-1.4.7.tar.gz /opendnssec-1.4.9.tar.gz /opendnssec-1.4.14.tar.gz -/opendnssec-2.1.6.tar.gz -/opendnssec-2.1.7.tar.gz -/opendnssec-2.1.8.tar.gz -/opendnssec-2.1.9.tar.gz -/opendnssec-2.1.9.tar.gz.sig -/opendnssec-2.1.10.tar.gz.sig -/opendnssec-2.1.10.tar.gz -/opendnssec-2.1.14rc1.tar.gz -/opendnssec-2.1.14rc1.tar.gz.sig -/opendnssec-2.1.14.tar.gz -/opendnssec-2.1.14.tar.gz.sig diff --git a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch deleted file mode 100644 index 68f46c5..0000000 --- a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Mon, 30 Jan 2023 11:44:49 +0200 -Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle - string fortification - -When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc -will cut few bytes off the string buffer for prevention of buffer -overruns. As a result, hsm_hex_unparse() will call into snprintf() with -a buffer length bigger than the size of the buffer as seen by the -GCC/glibc pair. - -See also: https://pagure.io/freeipa/issue/9312 - -Signed-off-by: Alexander Bokovoy ---- - libhsm/src/lib/libhsm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c -index 88dc79e31..8f1e0c3bc 100644 ---- a/libhsm/src/lib/libhsm.c -+++ b/libhsm/src/lib/libhsm.c -@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len) - size_t i; - - for (i = 0; i < len; i++) { -- snprintf(dst + (2*i), dst_len, "%02x", src[i]); -+ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]); - } - dst[len*2] = '\0'; - } --- -2.39.0 - diff --git a/conf.xml b/conf.xml index 8b42a62..577e6ba 100644 --- a/conf.xml +++ b/conf.xml @@ -48,6 +48,7 @@ /var/opendnssec/kasp.db + PT3600S diff --git a/kasp.xml b/kasp.xml new file mode 100644 index 0000000..caacca6 --- /dev/null +++ b/kasp.xml @@ -0,0 +1,88 @@ + + + + + + + + A default policy that will amaze you and your friends + + PT2H + P3D + + P7D + P7D + + PT12H + + PT7200S + + + + + + P100D + + 1 + 5 + + + + + + + + PT3600S + PT3600S + PT3600S + + P14D + + + + 8 + P1Y + AEP + + + + + 8 + P30D + AEP + + + + + + PT43200S + + PT3600S + PT3600S + unixtime + + + + + PT9999S + + PT3600S + + + PT172800S + PT10800S + + + + + + diff --git a/ods-enforcerd.service b/ods-enforcerd.service deleted file mode 100644 index 6a629c2..0000000 --- a/ods-enforcerd.service +++ /dev/null @@ -1,16 +0,0 @@ -[Unit] -Description=OpenDNSSEC Enforcer daemon -After=syslog.target network.target - -[Service] -Type=forking -User=ods -Group=ods -PIDFile=/run/opendnssec/enforcerd.pid -EnvironmentFile=-/etc/sysconfig/ods -ExecStart=/usr/sbin/ods-enforcerd $ODS_ENFORCERD_OPT -ExecStartPost=/bin/bash -c 'while [ ! -S /run/opendnssec/enforcer.sock ]; do sleep 1; echo "Waiting for socket"; done' -TimeoutStartSec=20 - -[Install] -WantedBy=multi-user.target diff --git a/ods-signerd.service b/ods-signerd.service deleted file mode 100644 index 49b50b5..0000000 --- a/ods-signerd.service +++ /dev/null @@ -1,14 +0,0 @@ -[Unit] -Description=OpenDNSSEC signer daemon -After=syslog.target network.target ods-enforcerd.service - -[Service] -Type=simple -User=ods -Group=ods -PIDFile=/run/opendnssec/signerd.pid -EnvironmentFile=-/etc/sysconfig/ods -ExecStart=/usr/sbin/ods-signerd -d $ODS_SIGNERD_OPT - -[Install] -WantedBy=multi-user.target diff --git a/opendnssec-1.4.0b1-nonempty-terminals.patch b/opendnssec-1.4.0b1-nonempty-terminals.patch new file mode 100644 index 0000000..8ad2135 --- /dev/null +++ b/opendnssec-1.4.0b1-nonempty-terminals.patch @@ -0,0 +1,54 @@ +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-11-23 11:17:00.752148535 -0500 ++++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-11-23 11:23:00.243158628 -0500 +@@ -399,6 +399,7 @@ + { + ldns_rbnode_t* n = LDNS_RBTREE_NULL; + domain_type* d = NULL; ++ int unsigned_delegpt = 1; + + ods_log_assert(domain); + if (domain->rrsets) { +@@ -411,20 +412,15 @@ + break; + } + if (d->rrsets) { +- if (domain_is_delegpt(d) == LDNS_RR_TYPE_NS) { +- /* domain has unsigned delegation */ +- return 1; +- } else { +- /* domain has authoritative data or signed delegation */ ++ if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS) { ++ /* domain has signed delegation/auth */ + return 0; + } + } + /* maybe there is data at the next domain */ + n = ldns_rbtree_next(n); + } +- ods_log_warning("[%s] encountered empty terminal that is treated as " +- "non-terminal", dname_str); +- return 0; ++ return unsigned_delegpt; + } + + +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c opendnssec-1.4.0b1/signer/src/signer/namedb.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c 2012-08-28 09:43:15.000000000 -0400 ++++ opendnssec-1.4.0b1/signer/src/signer/namedb.c 2012-11-23 11:23:39.420172841 -0500 +@@ -788,13 +788,13 @@ + if (!db || !db->domains) { + return; + } +- node = ldns_rbtree_first(db->domains); ++ node = ldns_rbtree_last(db->domains); + if (!node || node == LDNS_RBTREE_NULL) { + return; + } + while (node && node != LDNS_RBTREE_NULL) { + domain = (domain_type*) node->data; +- node = ldns_rbtree_next(node); ++ node = ldns_rbtree_previous(node); + domain_diff(domain, is_ixfr); + domain = namedb_del_denial_trigger(db, domain, 0); + if (domain) { diff --git a/opendnssec-1.4.0b1-r6816.patch b/opendnssec-1.4.0b1-r6816.patch new file mode 100644 index 0000000..5375fe1 --- /dev/null +++ b/opendnssec-1.4.0b1-r6816.patch @@ -0,0 +1,62 @@ +Index: OpenDNSSEC/enforcer/enforcerd/enforcer.c +=================================================================== +--- OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6815) ++++ OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6816) +@@ -1293,7 +1293,7 @@ + { + int NewDS; + status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS); +- if (status2 != 0) { ++ if (status2 == 0) { + /* If the DS set changed then log/do something about it */ + if (NewDS == 1) { + log_msg(config, LOG_INFO, "DSChanged"); +@@ -1655,8 +1655,11 @@ + if (system(signer_command)) + { + log_msg(NULL, LOG_ERR, "Could not call signer engine to update all zones"); +- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update --all' to manually update all zones"); ++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update all zones", signer_command); + } ++ else { ++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command); ++ } + + StrFree(signer_command); + } else { +@@ -1693,8 +1696,8 @@ + round potentially different behaviour of rename over existing + file.) */ + int gencnt; /* Number of keys in generate state */ ++ char *signer_command; /* how we will call the signer */ + #ifndef ENFORCER_USE_WORKERS +- char *signer_command; /* how we will call the signer */ + int NewDS = 0; /* Did we change the DS Set in any way? */ + #endif + char* datetime = DtParseDateTimeString("now"); +@@ -1954,7 +1957,6 @@ + return -1; + } + +-#ifndef ENFORCER_USE_WORKERS + if (*signer_flag == 1) { + /* call the signer engine to tell it that something changed */ + /* TODO for beta version connect straight to the socket +@@ -1970,13 +1972,15 @@ + if (status != 0) + { + log_msg(NULL, LOG_ERR, "Could not call signer engine"); +- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update' to manually update zones"); ++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update the zone", signer_command); + *signer_flag = 0; + } ++ else { ++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command); ++ } + + StrFree(signer_command); + } +-#endif + } + else { + log_msg(NULL, LOG_INFO, "No change to: %s", current_filename); diff --git a/opendnssec-1.4.0b1-r6817.patch b/opendnssec-1.4.0b1-r6817.patch new file mode 100644 index 0000000..6f74dea --- /dev/null +++ b/opendnssec-1.4.0b1-r6817.patch @@ -0,0 +1,48 @@ +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c opendnssec-1.4.0b1/signer/src/signer/rrset.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c 2012-08-28 10:00:54.000000000 -0400 ++++ opendnssec-1.4.0b1/signer/src/signer/rrset.c 2012-11-10 17:16:44.250226281 -0500 +@@ -32,6 +32,7 @@ + */ + + #include "config.h" ++#include "shared/file.h" + #include "shared/hsm.h" + #include "shared/log.h" + #include "shared/util.h" +@@ -557,6 +558,26 @@ + + + /** ++ * Is the RRset signed with this locator? ++ * ++ */ ++static int ++rrset_siglocator(rrset_type* rrset, const char* locator) ++{ ++ size_t i = 0; ++ if (!rrset) { ++ return 0; ++ } ++ for (i=0; i < rrset->rrsig_count; i++) { ++ if (!ods_strcmp(locator, rrset->rrsigs[i].key_locator)) { ++ return 1; ++ } ++ } ++ return 0; ++} ++ ++ ++/** + * Transmogrify the RRset to a RRlist. + * + */ +@@ -702,6 +723,9 @@ + continue; + } + /* Additional rules for signatures */ ++ if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) { ++ continue; ++ } + if (rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) { + continue; + } diff --git a/opendnssec-1.4.13-openssl1.1.patch b/opendnssec-1.4.13-openssl1.1.patch deleted file mode 100644 index 44da95d..0000000 --- a/opendnssec-1.4.13-openssl1.1.patch +++ /dev/null @@ -1,95 +0,0 @@ -From e2bbb899195ea98b6b5f6c972ab764a53b387789 Mon Sep 17 00:00:00 2001 -From: Yuri Schaeffer -Date: Fri, 4 Nov 2016 15:35:06 +0100 -Subject: [PATCH] HMAC_CTX_init deprecated in openssl-1.1.0 - ---- - m4/acx_ssl.m4 | 12 +++++++++--- - signer/src/Makefile.am | 4 ++-- - signer/src/wire/tsig-openssl.c | 15 ++++++++++++--- - 3 files changed, 23 insertions(+), 8 deletions(-) - -diff --git a/m4/acx_ssl.m4 b/m4/acx_ssl.m4 -index 1dc6e40..3d64626 100644 ---- a/m4/acx_ssl.m4 -+++ b/m4/acx_ssl.m4 -@@ -35,12 +35,18 @@ AC_DEFUN([ACX_SSL], [ - if test x_$ssldir = x_/usr/sfw; then - SSL_LIBS="$SSL_LIBS -R$ssldir/lib"; - fi -- AC_CHECK_LIB(crypto, HMAC_CTX_init,, [ -- AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required]) -- ]) -+ AC_CHECK_LIB(crypto, HMAC_CTX_reset, [ -+ AC_DEFINE_UNQUOTED([HAVE_SSL_NEW_HMAC], [], [Define if you have the SSL libraries with new HMAC related functions.]) -+ SSL_LIBS="$SSL_LIBS -lcrypto"; -+ ], [ -+ AC_CHECK_LIB(crypto, HMAC_CTX_init,, [ -+ AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required]) -+ ]) -+ ] ) - AC_CHECK_FUNCS([EVP_sha1 EVP_sha256]) - fi - AC_SUBST(HAVE_SSL) -+ AC_SUBST(HAVE_SSL_NEW_HMAC) - AC_SUBST(SSL_INCLUDES) - AC_SUBST(SSL_LIBS) - fi -diff --git a/signer/src/Makefile.am b/signer/src/Makefile.am -index 60e8877..b39eac8 100644 ---- a/signer/src/Makefile.am -+++ b/signer/src/Makefile.am -@@ -133,7 +133,7 @@ ods_signer_SOURCES= ods-signer.c \ - wire/xfrd.c wire/xfrd.h - - ods_signer_LDADD= $(LIBHSM) --ods_signer_LDADD+= @LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@ -+ods_signer_LDADD+= @LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@ @SSL_LIBS@ - ods_signer_LDADD+= $(LIBCOMPAT) - - ods_getconf_SOURCES= ods-getconf.c \ -@@ -193,5 +193,5 @@ ods_getconf_SOURCES= ods-getconf.c \ - wire/xfrd.c wire/xfrd.h - - ods_getconf_LDADD= $(LIBHSM) --ods_getconf_LDADD+= @LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@ -+ods_getconf_LDADD+= @SSL_LIBS@ @LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@ - ods_getconf_LDADD+= $(LIBCOMPAT) -diff --git a/signer/src/wire/tsig-openssl.c b/signer/src/wire/tsig-openssl.c -index c26b1e7..24fd342 100644 ---- a/signer/src/wire/tsig-openssl.c -+++ b/signer/src/wire/tsig-openssl.c -@@ -131,8 +131,11 @@ static void - cleanup_context(void *data) - { - HMAC_CTX* context = (HMAC_CTX*) data; -+#ifdef HAVE_SSL_NEW_HMAC -+ HMAC_CTX_free(context); -+#else - HMAC_CTX_cleanup(context); -- return; -+#endif - } - - static void -@@ -155,9 +158,15 @@ context_add_cleanup(void* context) - static void* - create_context(allocator_type* allocator) - { -- HMAC_CTX* context = (HMAC_CTX*) allocator_alloc(allocator, -- sizeof(HMAC_CTX)); -+ HMAC_CTX* context; -+#ifdef HAVE_SSL_NEW_HMAC -+ context = HMAC_CTX_new(); -+ if (!context) return NULL; -+ HMAC_CTX_reset(context); -+#else -+ context = (HMAC_CTX*) allocator_alloc(allocator, sizeof(HMAC_CTX)); - HMAC_CTX_init(context); -+#endif - context_add_cleanup(context); - return context; - } --- -2.9.3 - diff --git a/opendnssec-1.4.6-extract.patch b/opendnssec-1.4.6-extract.patch deleted file mode 100644 index 6213d38..0000000 --- a/opendnssec-1.4.6-extract.patch +++ /dev/null @@ -1,168 +0,0 @@ -commit 672d2c75ccd3cd5f2317bb76af4c9cc4e5aa4a37 -Author: Petr Spacek -Date: Fri Jul 18 16:19:36 2014 +0200 - - add libhsm configuration option - - This option allows user to generate private keys with CKA_EXTRACTABLE - flag set to TRUE. Defaults to FALSE. - -diff --git a/NEWS b/NEWS -index 4db7038..2efa176 100644 ---- a/NEWS -+++ b/NEWS -@@ -1,3 +1,8 @@ -+* Enforcer: New repository option allows to generate keys -+ with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped -+ and extracted from HSM. -+ -+ - OpenDNSSEC 1.4.6 - 2014-07-21 - - * Signer Engine: Print secondary server address when logging notify reply -diff --git a/conf/conf.rnc b/conf/conf.rnc -index 71d527f..65f837e 100644 ---- a/conf/conf.rnc -+++ b/conf/conf.rnc -@@ -50,7 +50,10 @@ start = element Configuration { - element RequireBackup { empty }?, - - # Do not maintain public keys in the repository (optional) -- element SkipPublicKey { empty }? -+ element SkipPublicKey { empty }?, -+ -+ # Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional) -+ element AllowExtraction { empty }? - }* - }, - -diff --git a/conf/conf.xml.in b/conf/conf.xml.in -index 0ef2ab9..0536681 100644 ---- a/conf/conf.xml.in -+++ b/conf/conf.xml.in -@@ -9,6 +9,9 @@ - OpenDNSSEC - 1234 - -+ - - - -+ -+ -+ -+ - - - diff --git a/opendnssec-2.1.14rc1-gcc14.patch b/opendnssec-2.1.14rc1-gcc14.patch deleted file mode 100644 index 51b8095..0000000 --- a/opendnssec-2.1.14rc1-gcc14.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Thu, 8 Feb 2024 13:10:53 +0200 -Subject: [PATCH] Fix missing include -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -scheduler/task.c: In function ‘task_perform’: -scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration] - 137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF); - | ^~~~~ -make[2]: *** [Makefile:600: scheduler/task.o] Error 1 - -Signed-off-by: Alexander Bokovoy ---- - common/scheduler/task.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/common/scheduler/task.c b/common/scheduler/task.c -index 4dcf9e900..0dfa496a2 100644 ---- a/common/scheduler/task.c -+++ b/common/scheduler/task.c -@@ -40,6 +40,7 @@ - #include "duration.h" - #include "file.h" - #include "log.h" -+#include "utilities.h" - - static const char* task_str = "task"; - static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER; --- -2.43.0 - diff --git a/opendnssec-2.1.sqlite_convert.sql b/opendnssec-2.1.sqlite_convert.sql deleted file mode 100644 index aed4d8f..0000000 --- a/opendnssec-2.1.sqlite_convert.sql +++ /dev/null @@ -1,842 +0,0 @@ -INSERT INTO databaseVersion VALUES (NULL, 1, 1); - --- ~ ************ --- ~ ** policy table --- ~ ** --- ~ ** --- ~ ** --- ~ ** --- ~ ************ - -INSERT INTO policy -SELECT id, 1, name, description, -0, 0, 0, -0, 0, 0, 0, -86400, 0, 0, -0, 0, 0, -0, 0, 0, -0, 0, 0, -0, 0, 0, -0, 0, 0, -0, 0, 0, -0, 0, 0, -0 -FROM REMOTE.policies; - -UPDATE policy -SET signaturesResign = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'resign'); - -UPDATE policy -SET signaturesRefresh = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'refresh') ; - -UPDATE policy -SET signaturesJitter = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'jitter'); - -UPDATE policy -SET signaturesInceptionOffset = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'clockskew'); - -UPDATE policy -SET signaturesValidityDefault = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'valdefault'); - -UPDATE policy -SET signaturesValidityDenial = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 1 - AND REMOTE.parameters.name = 'valdenial'); - ---MaxZoneTTL default 86400 - --- We need the following mapping 1.4 -> 2.0 for denialType --- 0 -> 1 --- 3 -> 0 - -UPDATE policy -SET denialType = ( - SELECT (~value)&1 - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'version'); - --- I'm pretty sure this is not the correct way to do it. It is aweful but --- I can't figure it out how it would work for sqlite. -UPDATE policy -SET denialOptout = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'optout') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'optout'); - -UPDATE policy -SET denialTtl = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'ttl') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'ttl'); - -UPDATE policy -SET denialResalt = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'resalt') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'resalt'); - -UPDATE policy -SET denialAlgorithm = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'algorithm') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'algorithm'); - -UPDATE policy -SET denialIterations = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'iterations') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'iterations'); - -UPDATE policy -SET denialSaltLength = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'saltlength') -WHERE null != ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 2 - AND REMOTE.parameters.name = 'saltlength'); - --- clumsy salt update. salt is optional in 1.4 but required in 2.0 --- sqlite is limited in what it can do in an update. I hope there is a --- better way for this? - -UPDATE policy -SET denialSalt = ( - SELECT salt - FROM REMOTE.policies - WHERE REMOTE.policies.id = policy.id) -WHERE ( - SELECT salt - FROM REMOTE.policies - WHERE REMOTE.policies.id = policy.id) != null; - -UPDATE policy -SET denialSaltLastChange = ( - SELECT salt_stamp - FROM REMOTE.policies - WHERE REMOTE.policies.id = policy.id) -WHERE ( - SELECT salt_stamp - FROM REMOTE.policies - WHERE REMOTE.policies.id = policy.id) != null; - -UPDATE policy -SET keysTtl = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 5 - AND REMOTE.parameters.name = 'ttl'); - -UPDATE policy -SET keysRetireSafety = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 5 - AND REMOTE.parameters.name = 'retiresafety'); - -UPDATE policy -SET keysPublishSafety = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 5 - AND REMOTE.parameters.name = 'publishsafety'); - -UPDATE policy -SET keysShared = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 5 - AND REMOTE.parameters.name = 'zones_share_keys'); - -UPDATE policy -SET keysPurgeAfter = COALESCE(( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 5 - AND REMOTE.parameters.name = 'purge'), 0); - -UPDATE policy -SET zonePropagationDelay = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 7 - AND REMOTE.parameters.name = 'propagationdelay'); - -UPDATE policy -SET zoneSoaTtl = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 7 - AND REMOTE.parameters.name = 'ttl'); - -UPDATE policy -SET zoneSoaMinimum = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 7 - AND REMOTE.parameters.name = 'min'); - --- Temporary mapping table between 1.4 and 2.0 SOA serial strategy -CREATE TABLE mapping ( - soa14 INTEGER, - soa20 INTEGER -); -INSERT INTO mapping SELECT 1, 2; -INSERT INTO mapping SELECT 2, 0; -INSERT INTO mapping SELECT 3, 1; -INSERT INTO mapping SELECT 4, 3; - -UPDATE policy -SET zoneSoaSerial = ( - SELECT mapping.soa20 - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - INNER JOIN mapping - ON REMOTE.parameters_policies.value = mapping.soa14 - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 7 - AND REMOTE.parameters.name = 'serial'); - -DROP TABLE mapping; - --- parentRegistrationDelay = 0 on 1.4 - -UPDATE policy -SET parentPropagationDelay = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 8 - AND REMOTE.parameters.name = 'propagationdelay'); - -UPDATE policy -SET parentDsTtl = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 8 - AND REMOTE.parameters.name = 'ttlds'); - -UPDATE policy -SET parentSoaTtl = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 8 - AND REMOTE.parameters.name = 'ttl'); - -UPDATE policy -SET parentSoaMinimum = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policy.id - AND REMOTE.parameters.category_id = 8 - AND REMOTE.parameters.name = 'min'); - --- passthrough = 0 - --- ~ ************ --- ~ ** policyKey table --- ~ ** --- ~ ** For each policy in 1.4 add two keys: KSK and ZSK --- ~ ** --- ~ ** --- ~ ************ - --- Insert each KSK -INSERT INTO policyKey -SELECT null, 1, id, - 1, 0, 0, - 0, 0, 0, - 0, 0, 4 -FROM REMOTE.policies; - --- Insert each ZSK -INSERT INTO policyKey -SELECT null, 1, id, - 2, 0, 0, - 0, 0, 0, - 0, 0, 1 -FROM REMOTE.policies; - -UPDATE policyKey -SET algorithm = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'algorithm') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET algorithm = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'algorithm') -WHERE policyKey.role = 2; - -UPDATE policyKey -SET bits = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'bits') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET bits = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'bits') -WHERE policyKey.role = 2; - -UPDATE policyKey -SET lifetime = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'lifetime') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET lifetime = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'lifetime') -WHERE policyKey.role = 2; - -UPDATE policyKey -SET repository = ( - SELECT REMOTE.securitymodules.name - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - INNER JOIN REMOTE.securitymodules - ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'repository') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET repository = ( - SELECT REMOTE.securitymodules.name - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - INNER JOIN REMOTE.securitymodules - ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'repository') -WHERE policyKey.role = 2; - -UPDATE policyKey -SET standby = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'standby') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET standby = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'standby') -WHERE policyKey.role = 2; - -UPDATE policyKey -SET manualRollover = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 3 - AND REMOTE.parameters.name = 'manual_rollover') -WHERE policyKey.role = 1; - -UPDATE policyKey -SET manualRollover = ( - SELECT value - FROM REMOTE.parameters_policies - INNER JOIN REMOTE.parameters - ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id - WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId - AND REMOTE.parameters.category_id = 4 - AND REMOTE.parameters.name = 'manual_rollover') -WHERE policyKey.role = 2; - --- rfc5011 = 0. 2.0 has no support --- minimize already set - --- ~ ************ --- ~ ** hsmKey table --- ~ ** --- ~ ** get from keypairs and dnsseckeys --- ~ ** --- ~ ** --- ~ ************ - -INSERT INTO hsmKey -SELECT DISTINCT REMOTE.keypairs.id, 1, REMOTE.keypairs.policy_id, -REMOTE.keypairs.HSMkey_id, 2, REMOTE.keypairs.size, -REMOTE.keypairs.algorithm, (~(REMOTE.dnsseckeys.keytype)&1)+1, -CASE WHEN REMOTE.keypairs.generate IS NOT NULL THEN - strftime('%s', REMOTE.keypairs.generate) - ELSE strftime("%s", "now") END, -0, -1, --only RSA supported - REMOTE.securitymodules.name, -0 --assume no backup -FROM REMOTE.keypairs -JOIN REMOTE.dnsseckeys - ON REMOTE.keypairs.id = REMOTE.dnsseckeys.keypair_id -JOIN REMOTE.securitymodules - ON REMOTE.securitymodules.id = REMOTE.keypairs.securitymodule_id; - --- For some policies put the keys in a shared state -UPDATE hsmKey -SET state = 3 -WHERE EXISTS - (SELECT * FROM hsmKey AS h - JOIN policy ON policy.id = h.policyId - WHERE policy.keysShared AND hsmKey.id = h.id); - --- ~ ************ --- ~ ** zone table --- ~ ** --- ~ ** --- ~ ** --- ~ ** --- ~ ************ - -INSERT INTO zone -SELECT zones.id, 1, zones.policy_id, - zones.name, 1, zones.signconf, 0, - 0,0,0, - 0,0,0, - zones.in_type, zones.input, - zones.out_type, zones.output, - 0,0,0 - FROM REMOTE.zones; - --- ~ ************ --- ~ ** keyData table --- ~ ** --- ~ ** --- ~ ** --- ~ ** --- ~ ************ - --- Temporary mapping table between 1.4 states and 2.0 ds_at_parent states --- We are ignoring the fact this may set a DS state for a ZSK; We don't care -CREATE TABLE mapping ( - state INTEGER, - ds_state INTEGER -); -INSERT INTO mapping SELECT 1, 0; -INSERT INTO mapping SELECT 2, 0; -INSERT INTO mapping SELECT 3, 1; -INSERT INTO mapping SELECT 4, 3; -INSERT INTO mapping SELECT 5, 5; -INSERT INTO mapping SELECT 6, 5; -INSERT INTO mapping SELECT 7, 5; -INSERT INTO mapping SELECT 8, 5; -INSERT INTO mapping SELECT 9, 5; -INSERT INTO mapping SELECT 10, 5; - -INSERT INTO keyData -SELECT - NULL, 1, REMOTE.dnsseckeys.zone_id, - REMOTE.dnsseckeys.keypair_id, REMOTE.keypairs.algorithm, - CASE WHEN REMOTE.dnsseckeys.publish IS NOT NULL THEN - strftime('%s', REMOTE.dnsseckeys.publish) - ELSE strftime("%s", "now") END, - (~REMOTE.dnsseckeys.keytype&1)+1, - REMOTE.dnsseckeys.state <= 4, -- introducing - 0, -- should revoke, not used - 0, -- standby - REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 256, --activeZSK: - REMOTE.dnsseckeys.state >= 2 AND REMOTE.dnsseckeys.state <= 5, --publish - REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 257, --activeKSK: - mapping.ds_state, --dsatparent - 1<<16, --keytag (crap, will 2.0 regenerate this?) - (REMOTE.dnsseckeys.keytype&1)*3+1 --minimize -FROM REMOTE.dnsseckeys -JOIN REMOTE.keypairs - ON REMOTE.dnsseckeys.keypair_id = REMOTE.keypairs.id -JOIN mapping - ON REMOTE.dnsseckeys.state = mapping.state -WHERE EXISTS(select REMOTE.zones.id FROM REMOTE.zones WHERE REMOTE.zones.id = REMOTE.dnsseckeys.zone_id); - --- Everything that is just a ZSK must not have dsatparent set. -UPDATE keyData -SET dsatparent = 0 -WHERE role = 2; - -DROP TABLE mapping; - --- If a active time is set for a ready KSK dsAtParent is submitted --- instead of submit -UPDATE keyData -SET dsatparent = 2 -WHERE keyData.dsAtParent = 1 AND keyData.id IN ( - SELECT keyData.id - FROM keyData - JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid - WHERE REMOTE.dnsseckeys.active IS NOT NULL); - - --- ~ ************ --- ~ ** Keystate table --- ~ ** --- ~ ** --- ~ ** --- ~ ** --- ~ ************ - -CREATE TABLE mapping ( - state INTEGER, - ds INTEGER, - dk INTEGER, - ks INTEGER, - rs INTEGER -); -INSERT INTO mapping SELECT 1, 0, 0, 0, 0; -INSERT INTO mapping SELECT 2, 0, 1, 1, 1; -INSERT INTO mapping SELECT 3, 0, 2, 2, 1; -INSERT INTO mapping SELECT 4, 2, 2, 2, 1; -INSERT INTO mapping SELECT 5, 3, 2, 2, 3; -INSERT INTO mapping SELECT 6, 0, 3, 3, 0; -INSERT INTO mapping SELECT 7, 3, 0, 0, 0; -INSERT INTO mapping SELECT 8, 3, 0, 0, 0; -INSERT INTO mapping SELECT 9, 3, 0, 0, 0; -INSERT INTO mapping SELECT 10, 3, 0, 0, 0; - --- DS RECORDS -INSERT INTO keyState -SELECT NULL, 1, keyData.id, 0, mapping.ds, strftime("%s", "now"), (keyData.minimize>>2)&1, policy.parentDsTtl -FROM keyData -JOIN zone - ON zone.id = keyData.zoneId -JOIN policy - ON policy.id = zone.policyId -JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid -JOIN mapping - ON mapping.state = REMOTE.dnsseckeys.state; - -UPDATE keyState -SET state = 1 -WHERE keyState.state = 0 AND keyState.type = 0 AND keyState.id IN ( - SELECT keyState.id - FROM keyState - JOIN keyData - ON keyData.id = keyState.keydataId - JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid - WHERE REMOTE.dnsseckeys.active IS NOT NULL); - --- DNSKEY RECORDS -INSERT INTO keyState -SELECT NULL, 1, keyData.id, 2, mapping.dk, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl -FROM keyData -JOIN zone - ON zone.id = keyData.zoneId -JOIN policy - ON policy.id = zone.policyId -JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid -JOIN mapping - ON mapping.state = REMOTE.dnsseckeys.state; - --- RRSIG DNSKEY RECORDS -INSERT INTO keyState -SELECT NULL, 1, keyData.id, 3, mapping.ks, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl -FROM keyData -JOIN zone - ON zone.id = keyData.zoneId -JOIN policy - ON policy.id = zone.policyId -JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid -JOIN mapping - ON mapping.state = REMOTE.dnsseckeys.state; - --- RRSIG RECORDS -INSERT INTO keyState -SELECT NULL, 1, keyData.id, 1, mapping.rs, strftime("%s", "now"), (keyData.minimize>>0)&1, policy.signaturesMaxZoneTtl -FROM keyData -JOIN zone - ON zone.id = keyData.zoneId -JOIN policy - ON policy.id = zone.policyId -JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid -JOIN mapping - ON mapping.state = REMOTE.dnsseckeys.state; - ---Set to OMN if Tactive + Dttl < Tnow -UPDATE keyState -SET state = 2 -WHERE keyState.state = 1 AND keyState.type = 1 AND keyState.id IN ( - SELECT keyState.id - FROM keyState - JOIN keyData - ON keyData.id = keyState.keydataId - JOIN REMOTE.dnsseckeys - ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid - JOIN zone - ON keyData.zoneId = zone.id - JOIN policy - ON policy.id = zone.policyId - WHERE CAST(strftime("%s", REMOTE.dnsseckeys.active) + policy.signaturesValidityDefault as INTEGER) < strftime("%s", "now")); - ---Force the RRSIG state in omnipresent if rumoured and there is no old ZSK --- unretentive -UPDATE keyState -SET state = 2 -WHERE keyState.id IN ( -SELECT rs.id FROM keyState AS rs -JOIN keystate AS dk ON dk.keyDataId == rs.keyDataId -WHERE rs.type == 1 AND dk.type == 2 AND rs.state == 1 AND dk.state == 2 -AND NOT EXISTS( - SELECT* FROM keystate AS rs2 - JOIN keystate AS dk2 ON dk2.keyDataId == rs2.keyDataId - WHERE rs2.type == 1 AND dk2.type == 2 AND rs2.state == 3 AND dk2.state == 2 -)); - -DROP TABLE mapping; - --- We need to create records in the keydependency table in case we are in a --- rollover. Only done for ZSK. For every introducing ZSK with RRSIG rumoured --- that has an outroducing ZSK with RRSIG unretentive, we add a record. -INSERT INTO keyDependency -SELECT NULL, 0, keyData.zoneID, SUB.IDout, keyData.id, 1 -FROM keyData -JOIN keyState AS KS1 - ON KS1.keyDataId == keyData.id -JOIN keyState AS KS2 - ON KS2.keyDataId == keyData.id -JOIN ( - SELECT keyData.id AS IDout, keyData.zoneID - FROM keyData - JOIN keyState AS KS1 - ON KS1.keyDataId == keyData.id - JOIN keyState AS KS2 - ON KS2.keyDataId == keyData.id - WHERE KS1.type == 2 - AND ks1.state = 2 - AND KS2.type == 1 - AND KS2.state == 3 - AND keyData.introducing == 0 - AND keyData.role == 2 -) AS SUB - ON SUB.zoneId == keyData.zoneId -WHERE - KS1.type == 2 - AND ks1.state = 2 - AND KS2.type == 1 - AND KS2.state == 1 - AND keyData.introducing == 1 - AND keyData.role == 2; - --- ZSK -UPDATE keyState -SET state = 4 -WHERE (keyState.type = 0 OR keyState.type = 3) AND keyDataId IN ( - SELECT keyData.id - FROM keyData - WHERE keyData.role = 2); - ---KSK -UPDATE keyState -SET state = 4 -WHERE keyState.type = 1 AND keyDataId IN ( - SELECT keyData.id - FROM keyData - WHERE keyData.role = 1); - --- For rpm based systems to see if db was migrated already. store opendnssec major minor version -CREATE TABLE rpm_migration ( - major INTEGER, - minor INTEGER -); -INSERT INTO rpm_migration VALUES(2, 1); - diff --git a/opendnssec-2.1.sqlite_rpmversion.sql b/opendnssec-2.1.sqlite_rpmversion.sql deleted file mode 100644 index 4107157..0000000 --- a/opendnssec-2.1.sqlite_rpmversion.sql +++ /dev/null @@ -1,7 +0,0 @@ --- For rpm based systems to see if db was migrated already. store opendnssec major minor version -CREATE TABLE rpm_migration ( - major INTEGER, - minor INTEGER -); -INSERT INTO rpm_migration VALUES(2, 1); - diff --git a/opendnssec-aggressive-retry.patch b/opendnssec-aggressive-retry.patch new file mode 100644 index 0000000..b45a2fc --- /dev/null +++ b/opendnssec-aggressive-retry.patch @@ -0,0 +1,15 @@ +diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c +--- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c 2012-08-02 16:57:01.000000000 -0400 ++++ opendnssec-1.4.0a3/signer/src/daemon/worker.c 2012-08-20 15:41:34.665175565 -0400 +@@ -173,7 +173,11 @@ + * lets take a small break to not hog CPU. + */ + if (status == ODS_STATUS_UNCHANGED) { ++#if 0 + worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60); ++#else ++ worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5); ++#endif + } + lock_basic_unlock(&q->q_lock); + } diff --git a/opendnssec-c99-2.patch b/opendnssec-c99-2.patch deleted file mode 100644 index db04f2b..0000000 --- a/opendnssec-c99-2.patch +++ /dev/null @@ -1,20 +0,0 @@ -commit 5422819c17c02e6069328b2f5e4bef6fe5c179df -Author: Mathieu Mirmont -Date: Sun Dec 1 17:57:36 2019 +0100 - - enforcer: remove remove strptime build warning - -diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c -index f1ee21b87529c136..5baef1b6ff7c4cc2 100644 ---- a/enforcer/src/daemon/time_leap_cmd.c -+++ b/enforcer/src/daemon/time_leap_cmd.c -@@ -26,8 +26,8 @@ - * - */ - --#include - #include "config.h" -+#include - - #include "file.h" - #include "duration.h" diff --git a/opendnssec-configure-c99.patch b/opendnssec-configure-c99.patch deleted file mode 100644 index 509462f..0000000 --- a/opendnssec-configure-c99.patch +++ /dev/null @@ -1,45 +0,0 @@ -Include for the setresuid and setresgid functions, -to avoid an implicit function declaration. - -Submitted upstream: - -diff --git a/configure b/configure -index bf515cde3d4fab71..52d2885d6a6ef546 100755 ---- a/configure -+++ b/configure -@@ -21101,6 +21101,7 @@ else - cat confdefs.h - <<_ACEOF >conftest.$ac_ext - /* end confdefs.h. */ - -+#include - #include - #include - int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -@@ -21143,6 +21144,7 @@ else - cat confdefs.h - <<_ACEOF >conftest.$ac_ext - /* end confdefs.h. */ - -+#include - #include - #include - int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4 -index 374cee0b0b8ef196..467db9170a319170 100644 ---- a/m4/acx_broken_setres.m4 -+++ b/m4/acx_broken_setres.m4 -@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[ - AC_MSG_CHECKING(if setresuid seems to work) - AC_RUN_IFELSE( - [AC_LANG_SOURCE([[ -+#include - #include - #include - int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} - AC_MSG_CHECKING(if setresgid seems to work) - AC_RUN_IFELSE( - [AC_LANG_SOURCE([[ -+#include - #include - #include - int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} diff --git a/opendnssec-implicit-declarations.patch b/opendnssec-implicit-declarations.patch deleted file mode 100644 index c2a6aed..0000000 --- a/opendnssec-implicit-declarations.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001 -From: Yaakov Selkowitz -Date: Tue, 26 Dec 2023 14:09:12 -0500 -Subject: [PATCH] Fix implicit function declarations -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’ -utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’ -utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’ -utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’ -utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’ -utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’ -utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’ -utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’ ---- - enforcer/src/utils/kaspcheck.c | 1 + - enforcer/src/utils/kc_helper.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c -index 9bac3b796..b3b808598 100644 ---- a/enforcer/src/utils/kaspcheck.c -+++ b/enforcer/src/utils/kaspcheck.c -@@ -26,6 +26,7 @@ - #define _GNU_SOURCE - #include - #include -+#include - #include - #include - -diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c -index 89e56c61e..e1704f6f9 100644 ---- a/enforcer/src/utils/kc_helper.c -+++ b/enforcer/src/utils/kc_helper.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - #include - #include - #include --- -2.43.0 - diff --git a/opendnssec-ksk-premature-retirement.patch b/opendnssec-ksk-premature-retirement.patch new file mode 100644 index 0000000..0b59af8 --- /dev/null +++ b/opendnssec-ksk-premature-retirement.patch @@ -0,0 +1,20 @@ +--- enforcer/enforcerd/enforcer.c (revision 6951) ++++ enforcer/enforcerd/enforcer.c (revision 6952) +@@ -1291,7 +1291,7 @@ + /* turn this zone and policy into a file */ + #ifdef ENFORCER_USE_WORKERS + { +- int NewDS; ++ int NewDS = 0; + status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS); + if (status2 == 0) { + /* If the DS set changed then log/do something about it */ +--- NEWS (revision 6951) ++++ NEWS (revision 6952) +@@ -1,5 +1,7 @@ + $Id: NEWS 6934 2013-01-10 14:32:16Z jerry $ + ++* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired. ++ + + OpenDNSSEC 1.4.0rc1 - 2013-01-10 diff --git a/opendnssec-sysusers.conf b/opendnssec-sysusers.conf deleted file mode 100644 index b47c25f..0000000 --- a/opendnssec-sysusers.conf +++ /dev/null @@ -1 +0,0 @@ -u ods - "opendnssec daemon account" diff --git a/opendnssec.spec b/opendnssec.spec index f11d67a..8cfd9d4 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,50 +1,35 @@ +#global prever rc3 %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.14 -Release: 2%{?dist} -License: BSD-2-Clause +Version: 1.4.14 +Release: 1%{?prever}%{?dist} +License: BSD Url: http://www.opendnssec.org/ -Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz -Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig -Source1: ods-enforcerd.service -Source2: ods-signerd.service +Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source1: ods-enforcerd.init +Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml -Source5: tmpfiles-opendnssec.conf -Source6: opendnssec.cron -Source7: opendnssec-2.1.sqlite_convert.sql -Source8: opendnssec-2.1.sqlite_rpmversion.sql -Source9: %{name}-sysusers.conf -Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch -Patch2: opendnssec-configure-c99.patch -Patch3: opendnssec-2.1.14rc1-gcc14.patch -Patch4: opendnssec-c99-2.patch -Patch5: opendnssec-implicit-declarations.patch +Source5: opendnssec.cron +Source6: kasp.xml -Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units -Requires: libxml2, libxslt sqlite -BuildRequires: make -BuildRequires: gcc -BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel +Group: Applications/System +Requires: opencryptoki, softhsm +BuildRequires: libxml2, libxslt +Requires: libxml2, libxslt +BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen # It tests for pkill/killall and would use /bin/false if not found -BuildRequires: procps-ng -BuildRequires: perl-interpreter -BuildRequires: libmicrohttpd-devel jansson-devel libyaml-devel +BuildRequires: procps +# or else no debug package on epel6 +BuildRequires: redhat-rpm-config -BuildRequires: systemd-units Requires(pre): shadow-utils -Requires(post): systemd-units -Requires(preun): systemd-units -Requires(postun): systemd-units %if 0%{?prever:1} -# For building development snapshots -Buildrequires: autoconf, automake, libtool -%ifarch %{java_arches} -Buildrequires: java -%endif +# For building snapshots +Buildrequires: autoconf, automake, libtool, java %endif %description @@ -54,28 +39,15 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch -P1 -p1 -%patch -P2 -p1 -%patch -P3 -p1 -%patch -P4 -p1 -%patch -P5 -p1 - -# Prevent re-running autoconf. -touch -r aclocal.m4 configure* m4/* - # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in %build -export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" +export LDFLAGS="-Wl,-z,relro,-z,now -pie" export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security" -export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" -%if 0%{?prever:1} -# for development snapshots -autoreconf -%endif + %configure --with-ldns=%{_libdir} -%make_build +make %{?_smp_mflags} %check # Requires sample db not shipped with upstream @@ -83,338 +55,143 @@ autoreconf %install rm -rf %{buildroot} -%make_install -mkdir -p %{buildroot}%{_localstatedir}/opendnssec/{tmp,signed,signconf,enforcer} +make DESTDIR=%{buildroot} install +mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} +mkdir -p %{buildroot}/%{_initrddir} +install -p -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd +install -p -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ -install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec +install -p -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec + +# cleanup sample files rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig -install -d -m 0755 %{buildroot}%{_unitdir} -install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ -install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ -install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods -install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ -install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf -mkdir -p %{buildroot}%{_tmpfilesdir}/ -install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf +install -p -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods +install -p -m 0644 %{SOURCE4} %{SOURCE6} %{buildroot}/%{_sysconfdir}/opendnssec/ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec -mkdir -p %{buildroot}%{_datadir}/opendnssec/ -cp -a enforcer/utils %{buildroot}%{_datadir}/opendnssec/migration -cp -a enforcer/src/db/schema.* %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/ -# fixup path for mysql/sqlite. Use our replacement sqlite_convert.sql to detect previous migration -cp -a %{SOURCE7} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql -cp -a %{SOURCE8} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql -sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite -sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite -sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql -sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql -sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite - %files -%{_unitdir}/ods-enforcerd.service -%{_unitdir}/ods-signerd.service -%config(noreplace) %{_tmpfilesdir}/opendnssec.conf -%attr(0770,root,ods) %dir %{_sysconfdir}/opendnssec +%attr(0755,root,root) %{_initrddir}/ods-enforcerd +%attr(0755,root,root) %{_initrddir}/ods-signerd +%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp -%attr(0775,root,ods) %dir %{_localstatedir}/opendnssec/signed +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signed %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf -%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/enforcer %attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec -%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec -%doc NEWS README.md -%license LICENSE +%attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec +%doc NEWS README.md LICENSE %{_mandir}/*/* %{_sbindir}/* %{_bindir}/* -%attr(0755,root,root) %dir %{_datadir}/opendnssec -%{_datadir}/opendnssec/* -%{_sysusersdir}/%{name}.conf +%attr(0755,root,root) %dir %{_datadir}/%{name} +%{_datadir}/%{name}/* %pre - -%sysusers_create_package %{name} %{SOURCE9} +getent group ods >/dev/null || groupadd -r ods +getent passwd ods >/dev/null || \ +useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ +-c "opendnssec daemon account" ods +exit 0 %post +/sbin/chkconfig --add ods-enforcerd +/sbin/chkconfig --add ods-signerd # Initialise a slot on the softhsm on first install if [ "$1" -eq 1 ]; then - %{_sbindir}/runuser -u ods -- %{_bindir}/softhsm2-util --init-token \ - --free --label "OpenDNSSEC" --pin 1234 --so-pin 1234 - if [ ! -s %{_localstatedir}/opendnssec/kasp.db ]; then - echo y | %{_sbindir}/ods-enforcer-db-setup - %{_bindir}/sqlite3 -batch %{_localstatedir}/opendnssec/kasp.db < %{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql - fi - -elif [ -z "$(%{_bindir}/sqlite3 %{_localstatedir}/opendnssec/kasp.db 'select * from rpm_migration;')" ]; then - # Migrate version 1.4 db to version 2.1 db - if [ -e %{_localstatedir}/opendnssec/rpm-migration-in-progress ]; then - echo "previous (partial?) migration found - human intervention is needed" - else - echo "opendnssec 1.4 database found, migrating to 2.x" - touch %{_localstatedir}/opendnssec/rpm-migration-in-progress - mv -n %{_localstatedir}/opendnssec/kasp.db %{_localstatedir}/opendnssec/kasp.db-1.4 - echo "migrating conf.xml from 1.4 to 2.1 schema" - cp -n %{_sysconfdir}/opendnssec/conf.xml %{_sysconfdir}/opendnssec/conf.xml-1.4 - # fixup incompatibilities inflicted upon us by upstream :( - sed -i "/.*Interval>/d" %{_sysconfdir}/opendnssec/conf.xml - echo "Converting kasp.db" - ERR="" - %{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite -i %{_localstatedir}/opendnssec/kasp.db-1.4 -o %{_localstatedir}/opendnssec/kasp.db || ERR="convert_sqlite error" - chown ods.ods %{_localstatedir}/opendnssec/kasp.db - cp -n %{_sysconfdir}/opendnssec/zonelist.xml %{_localstatedir}/opendnssec/enforcer/zones.xml - if [ -z "$ERR" ]; then - echo "calling ods-migrate" - ods-migrate || ERR="ods-migrate failed" - if [ -z "$ERR" ]; then - echo "opendnssec 1.4 to 2.x migration completed" - rm %{_localstatedir}/opendnssec/rpm-migration-in-progress - else - echo "ods-migrate process failed - human intervention is needed" - fi - else - echo "%{_localstatedir}/opendnssec/kasp.db conversion failed - not calling ods-migrate to complete migration. human intervention is needed" - fi - fi + if [ ! -f /var/softhsm/slot0.db ]; then + %{_sbindir}/runuser -u ods -- softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234 + fi fi - # in case we update any xml conf file -ods-enforcer update all >/dev/null 2>/dev/null ||: - -%systemd_post ods-enforcerd.service -%systemd_post ods-signerd.service +ods-ksmutil update all >/dev/null 2>/dev/null ||: %preun -%systemd_preun ods-enforcerd.service -%systemd_preun ods-signerd.service +if [ $1 -eq 0 ]; then + /sbin/service ods-signerd stop >/dev/null 2>&1 ||: + /sbin/service ods-enforcerd stop >/dev/null 2>&1 ||: + /sbin/chkconfig --del ods-enforcerd + /sbin/chkconfig --del ods-signerd +fi %postun -%systemd_postun_with_restart ods-enforcerd.service -%systemd_postun_with_restart ods-signerd.service +if [ "$1" -ge "1" ]; then + ods-ksmutil update all >/dev/null 2>/dev/null ||: + /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 ||: + /sbin/service ods-signerd condrestart >/dev/null 2>&1 ||: +fi %changelog -* Thu Jul 24 2025 Fedora Release Engineering - 2.1.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jan 21 2025 Rafel Jeffman - 2.1.14-1 -- Upstream release 2.1.14 -- Use systemd-sysusers - -* Fri Jan 17 2025 Fedora Release Engineering - 2.1.14-0.4rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Oct 22 2024 Richard W.M. Jones - 2.1.14-0.3rc1 -- Rebuild for Jansson 2.14 - (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) - -* Thu Jul 18 2024 Fedora Release Engineering - 2.1.14-0.2rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Thu Feb 08 2024 Alexander Bokovoy - 2.1.14-0.1rc1 -- Upstream release 2.1.14RC1 -- Fix build with gcc 14 -- Resolves: rhbz#2261421 - -* Thu Jan 25 2024 Fedora Release Engineering - 2.1.10-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 2.1.10-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Jul 20 2023 Fedora Release Engineering - 2.1.10-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Fri Feb 24 2023 Florian Weimer - 2.1.10-6 -- Port to C99 - -* Mon Jan 30 2023 Alexander Bokovoy - 2.1.10-5 -- Fix fortification issues leading to crash in FreeIPA setup - Upstream PR: https://github.com/opendnssec/opendnssec/pull/842 - -* Thu Jan 19 2023 Fedora Release Engineering - 2.1.10-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Fri Jul 22 2022 Fedora Release Engineering - 2.1.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 2.1.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Mon Oct 18 2021 François Cami - 2.1.10-1 -- Update to 2.1.10 (rhbz#2003250). - -* Tue Sep 14 2021 Sahana Prasad - 2.1.9-3 -- Rebuilt with OpenSSL 3.0.0 - -* Thu Jul 22 2021 Fedora Release Engineering - 2.1.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Tue Jul 06 2021 François Cami - 2.1.9-1 -- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956. -- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.1.8-2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Sat Feb 20 2021 Fedora Release Monitoring - 2.1.8-1 -- Update to 2.1.8 (#1931143) - -* Tue Jan 26 2021 Fedora Release Engineering - 2.1.7-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3 -- Rebuild for libldns soname bump - -* Tue Dec 8 21:09:23 EST 2020 Paul Wouters - 2.1.7-2 -- Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready - -* Fri Dec 04 2020 Alexander Bokovoy - 2.1.7-1 -- Upstream release 2.1.7 - -* Tue Jul 28 2020 Fedora Release Engineering - 2.1.6-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 14 2020 Tom Stellard - 2.1.6-7 -- Use make macros -- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Thu May 28 2020 Paul Wouters - 2.1.6-6 -- Resolves: rhbz#1833718 ods-signerd.service missing .service - -* Mon Apr 20 2020 Paul Wouters - 2.1.6-5 -- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd - -* Wed Mar 11 2020 Paul Wouters - 2.1.6-4 -- Fix migration check to not attempt to check on first install with no db - -* Tue Mar 03 2020 Alexander Bokovoy - 2.1.6-3 -- Create and manage /var/opendnssec/enforcer directory -- Resolves rhbz#1809492 - -* Wed Feb 19 2020 Paul Wouters - 2.1.6-2 -- Update to 2.1.6 (major upgrade, supports migration from 1.4.x) -- gcc10 compile fixups -- Fix trying to use unversioned libsqlite3.so file - -* Wed Jan 29 2020 Fedora Release Engineering - 1.4.14-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Thu Jul 25 2019 Fedora Release Engineering - 1.4.14-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Fri Feb 01 2019 Fedora Release Engineering - 1.4.14-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Fri Jul 13 2018 Fedora Release Engineering - 1.4.14-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Thu Feb 08 2018 Fedora Release Engineering - 1.4.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - * Tue Dec 12 2017 Paul Wouters - 1.4.14-1 - Update to 1.4.14 as first steop to migrating to 2.x -- Resolves: rhbz#1413254 Move tmpfiles.d config to %%{_tmpfilesdir}, install LICENSE as %%license - -* Thu Aug 03 2017 Fedora Release Engineering - 1.4.9-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 1.4.9-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed Mar 08 2017 Tomas Hozza - 1.4.9-5 -- Fix FTBFS (#1424019) in order to rebuild against new ldns - -* Sat Feb 11 2017 Fedora Release Engineering - 1.4.9-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Feb 18 2016 Paul Wouters - 1.4.9-3 -- Resolves: rbz#1303965 upgrade to opendnssec-1.4.9-1.fc23 breaks old installations -- On initial install, after token init, also run ods-ksmutil setup - -* Thu Feb 04 2016 Fedora Release Engineering - 1.4.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + [this version cannot be build until ldns-1.6.17 appears in el6] * Mon Feb 01 2016 Paul Wouters - 1.4.9-1 - Updated to 1.4.9 - Removed merged in patch -* Wed Jun 17 2015 Fedora Release Engineering - 1.4.7-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Tue Jun 09 2015 Paul Wouters - 1.4.7-2 -- Resolves rhbz#1219746 ods-signerd.service misplaced After= in section Service -- Resolves rhbz#1220443 OpenDNSSEC fails to initialise a slot in softhsm on first install - -* Tue Dec 09 2014 Paul Wouters - 1.4.7-1 +* Tue Jun 09 2015 Paul Wouters - 1.4.7-1 - Updated to 1.4.7 (fix zone update can get stuck, crash on retransfer cmd) +- Create slot as ods user, not root. +- Added the extract patches from the fedora branch -* Wed Oct 15 2014 Paul Wouters - 1.4.6-4 -- Change /etc/opendnssec to be ods group writable - -* Wed Oct 08 2014 Paul Wouters - 1.4.6-3 -- Added Petr Spacek's patch that adds the config option (rhbz#1123354) - -* Sun Aug 17 2014 Fedora Release Engineering - 1.4.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Mon Jul 28 2014 Paul Wouters - 1.4.6-1 +* Wed Aug 20 2014 Paul Wouters - 1.4.6-1 - Updated to 1.4.6 -- Removed incorporated patch upstream -- Remove Wants= from ods-signerd.service (rhbz#1098205) - -* Sat Jun 07 2014 Fedora Release Engineering - 1.4.5-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild +- Removed merged in patch * Fri Apr 18 2014 Paul Wouters - 1.4.5-2 -- Updated to 1.4.5 - Added patch for serial 0 bug in XFR adapter +- Add redhat-rpm-config buildrequire to ensure debug package + +* Fri Apr 18 2014 Paul Wouters - 1.4.5-1 +- Updated to 1.4.5 * Tue Apr 01 2014 Paul Wouters - 1.4.4-3 - Add buildrequires for ods-kasp2html (rhbz#1073313) -* Sat Mar 29 2014 Paul Wouters - 1.4.4-2 +* Fri Mar 28 2014 Paul Wouters - 1.4.4-2 - Add requires for ods-kasp2html (rhbz#1073313) - -* Thu Mar 27 2014 Paul Wouters - 1.4.4-1 -- Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441) +- Updated to 1.4.4 (rhbz#1080862) + (compatibility with non RFC 5155 errata 3441 implementations) - Change the default ZSK policy from 1024 to 2048 bit RSA keys - Fix post to be quiet when upgrading opendnssec * Thu Jan 09 2014 Paul Wouters - 1.4.3-1 - Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements -- rhel#1025985 OpenDNSSEC signer cannot be started due to a typo in service file * Wed Sep 11 2013 Paul Wouters - 1.4.2-1 - Updated to 1.4.2, bugfix release -* Sat Aug 03 2013 Fedora Release Engineering - 1.4.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - * Fri Jun 28 2013 Paul Wouters - 1.4.1-1 -- Updated to 1.4.1. NSEC3 handling and serial number handling fixes -- Add BuildRequire for systemd-units +- Updated to 1.4.1, bugfixes for NSEC3 and serial handling * Sat May 11 2013 Paul Wouters - 1.4.0-1 - Updated to 1.4.0 +- Enabled full relro/pie protection -* Fri Apr 12 2013 Paul Wouters - 1.4.20-0.8.rc3 +* Mon Apr 15 2013 Paul Wouters - 1.4.0-0.8.rc3 - Updated to 1.4.0rc3 -- Enabled hardened compile, full relzo/pie -* Fri Jan 25 2013 Patrick Uiterwijk - 1.4.0-0.7.rc2 -- Updated to 1.4.0rc2, which includes svn r6952 +* Mon Jan 28 2013 Paul Wouters - 1.4.0-0.7.rc2 +- Updaed to 1.4.0rc2 +- This merges in r6952 * Fri Jan 18 2013 Patrick Uiterwijk - 1.4.0-0.6.rc1 - Updated to 1.4.0rc1 - Applied opendnssec-ksk-premature-retirement.patch (svn r6952) -* Tue Dec 18 2012 Paul Wouters - 1.4.0-0.5.b2 +* Tue Dec 18 2012 Paul Wouters - 1.4.0-0.6.b2 - Updated to 1.4.0b2 -- All patches have been merged upstream -- cron job should be marked as config file +- All patches synced to/from with new release + +* Fri Nov 23 2012 Paul Wouters - 1.4.0-0.6.b1 +- Patch for empty nonterminal NSEC3 records + +* Sat Nov 10 2012 Paul Wouters - 1.4.0-0.5.b1 +- Patch r6816 fixes enforcer/signer communication +- Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 - Added BuildRequires: procps-ng for bug OPENDNSSEC-345 @@ -422,34 +199,32 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: daylight saving issues on resolvers - Patch to prevent removal of occluded data -* Wed Sep 26 2012 Paul Wouters - 1.4.0-0.3.b1 +* Wed Sep 26 2012 Paul Wouters - 1.4.0-0.2.b1 - Just an EVR fix to the proper standard -- Cleanup of spec file -- Introduce new systemd-rpm macros (rhbz#850242) +- Remove accidentally added (but not released) Epoch: +- Minor spec file cleanup * Wed Sep 12 2012 Paul Wouters - 1.4.0-0.b1.1 - Updated to 1.4.0b1 -- Patch for NSEC3PARAM TTL -- Cron job to assist narrowing ods-enforcerd timing differences +- Patch to more aggressively try to take lock for resigning +- Patch to give NSEC3PARAM record a TTL=0 -* Wed Aug 29 2012 Paul Wouters - 1.4.0-0.a3.1 +* Tue Aug 07 2012 Paul Wouters - 1.4.0-0.a3.2 - Updated to 1.4.0a3 -- Patch to more aggressively try to resign -- Patch to fix locking issue eating up cpu +- Added opendnssec.cron to sync key rollovers over multiple servers +- Removed merged in patch. +- Added patch for cpu lock from trunk +- Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade) -* Fri Jul 20 2012 Fedora Release Engineering - 1.4.0-0.a2.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild +* Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.4 +- Missed the actual patch line, so previous build did not have the patch -* Tue Jun 12 2012 Paul Wouters - 1.4.0-0.a2.1 -- Updated to 1.4.0a2 -- ksm-utils patch for ods-ksmutil to die sooner when it can't lock - the HSM. +* Tue Apr 17 2012 Paul Wouters - 1.4.0-0.a1.3 +- Remove bad artifact dependancy on systemd-units from Fedora branch -* Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.3 -- Patch for crasher with deleted RRsets and NSEC3/OPTOUT chains - -* Mon Mar 26 2012 Paul Wouters - 1.4.0-0.a1.2 +* Thu Mar 29 2012 Paul Wouters - 1.4.0-0.a1.2 - Added opendnssec LICENSE file from trunk (Thanks Jakob!) +- Convert back to sysv for EL5/EL6 repos * Mon Mar 26 2012 Paul Wouters - 1.4.0-0.a1.1 - Fix macros in comment diff --git a/sources b/sources index 1f2ad74..418303a 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620 -SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f +SHA512 (opendnssec-1.4.14.tar.gz) = b814d13ef95dcf238f3e9d6bb3dc489328d7a4a5db9e32214ac29716043f9e635e62fb3795b9d5d75e8215373f9330ea5a17840830f5e467067f305a610bee6b diff --git a/tmpfiles-opendnssec.conf b/tmpfiles-opendnssec.conf deleted file mode 100644 index 56795e1..0000000 --- a/tmpfiles-opendnssec.conf +++ /dev/null @@ -1 +0,0 @@ -D /run/opendnssec 0755 ods ods -