From 7dba5eafe028bd9116fbc1eefa81920409b53c25 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Thu, 29 Mar 2012 16:05:03 -0400 Subject: [PATCH 01/37] * Initial release for el6 --- conf.xml | 84 ++++++++++++++++++++++++++ ods-enforcerd.init | 106 +++++++++++++++++++++++++++++++++ ods-signerd.init | 112 ++++++++++++++++++++++++++++++++++ ods.sysconfig | 2 + opendnssec-LICENSE | 25 ++++++++ opendnssec.spec | 145 +++++++++++++++++++++++++++++++++++++++++++++ sources | 1 + 7 files changed, 475 insertions(+) create mode 100644 conf.xml create mode 100644 ods-enforcerd.init create mode 100644 ods-signerd.init create mode 100644 ods.sysconfig create mode 100644 opendnssec-LICENSE create mode 100644 opendnssec.spec diff --git a/conf.xml b/conf.xml new file mode 100644 index 0000000..8d684e6 --- /dev/null +++ b/conf.xml @@ -0,0 +1,84 @@ + + + + + + + + /usr/lib64/softhsm/libsofthsm.so + OpenDNSSEC + 1234 + + + + + + + + + + local0 + + + /etc/opendnssec/kasp.xml + /etc/opendnssec/zonelist.xml + + + + + + + ods + ods + + + /var/opendnssec/kasp.db + PT3600S + + + + + + + + + + ods + ods + + + /var/opendnssec/tmp + 4 + + + + + + + diff --git a/ods-enforcerd.init b/ods-enforcerd.init new file mode 100644 index 0000000..c131e77 --- /dev/null +++ b/ods-enforcerd.init @@ -0,0 +1,106 @@ +#!/bin/bash +# +# ods-enforcerd: Starts the OpenDNSSEC Enforcer Daemon +# +# chkconfig: - 13 87 +# description: ods-enforcerd is the OpenDNSSEC DNSSEC policy enforcer daemon +# processname: /usr/sbin/ods-enforcerd +# config: /etc/opendnssec/conf.xml +# +### BEGIN INIT INFO +# Provides: ods-enforcerd +# Required-Start: $local_fs $network $syslog +# Required-Stop: $local_fs $network $syslog +# Default-Stop: 0 11 89 +# Short-Description: start|stop|status|restart|try-restart| OpenDNSSEC Enforcer Daemon +# Description: control OpenDNSSEC enforcer daemon +### END INIT INFO + +# Init script default settings +ODS_ENFORCERD_CONF="/etc/opendnssec/conf.xml" +ODS_ENFORCERD_OPT="" +ODS_ENFORCERD_PROG="/usr/sbin/ods-enforcerd" +ODS_ENFORCERD_PIDFILE="/var/run/opendnssec/enforcerd.pid" +PIDDIR="/var/run/opendnssec" + +# Source function library. +. /etc/rc.d/init.d/functions + +[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods + +# Check that networking is configured. +[ "${NETWORKING}" = "no" ] && exit 0 + +start() { + # Source networking configuration. + [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network + + # Check that networking is up + [ "${NETWORKING}" = "no" ] && exit 1 + + # Sanity checks. + [ -f $ODS_ENFORCERD_CONF ] || exit 5 + [ -x $ODS_ENFORCERD_PROG ] || exit 5 + # /var/run could (and should) be tmpfs + [ -d $PIDDIR ] || mkdir -p $PIDDIR + + echo -n $"Starting ods-enforcerd:" + $ODS_ENFORCERD_PROG -c $ODS_ENFORCERD_CONF $ODS_ENFORCERD_OPT + RETVAL=$? + if [ $RETVAL -eq 0 ]; then + touch /var/lock/subsys/ods-enforcerd; + success + echo + else + failure + echo + exit 7; + fi + return 0; +} + +stop() { + echo -n $"Stopping ods-enforcerd: " + killproc -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG + retval=$? + if [ $retval -eq 0 ] ; then + rm -f $ODS_ENFORCERD_PIDFILE + rm -f /var/lock/subsys/ods-enforcerd + success + else + failure + fi + echo + return $retval +} + +restart() { + stop + start +} + +RETVAL=0 + +# See how we were called. +case "$1" in + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart) + [ -f /var/lock/subsys/ods-enforcerd ] && restart || : + ;; + status) + status -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG + ;; + *) + echo $"Usage: $0 {start|stop|status|restart|condrestart}" + exit 1 +esac + +exit $? diff --git a/ods-signerd.init b/ods-signerd.init new file mode 100644 index 0000000..4e3289d --- /dev/null +++ b/ods-signerd.init @@ -0,0 +1,112 @@ +#!/bin/bash +# +# ods-signerd: Starts the OpenDNSSEC Signer Daemon +# +# chkconfig: - 13 87 +# description: ods-signerd is the OpenDNSSEC DNSSEC zone signer daemon +# processname: /usr/sbin/ods-signerd +# config: /etc/opendnssec/conf.xml +# +### BEGIN INIT INFO +# Provides: ods-signerd +# Required-Start: $local_fs $network $syslog +# Required-Stop: $local_fs $network $syslog +# Default-Stop: 0 11 89 +# Short-Description: start|stop|status|restart|try-restart|reload|force-reload OpenDNSSEC Signer Daemon +# Description: control OpenDNSSEC signer daemon +### END INIT INFO + +# Init script default settings +ODS_SIGNERD_CONF="/etc/opendnssec/conf.xml" +ODS_SIGNERD_OPT="" +ODS_SIGNERD_PROG="/usr/sbin/ods-signerd" +ODS_SIGNER_PROG="/usr/sbin/ods-signer" +ODS_SIGNERD_PIDFILE="/var/run/opendnssec/signerd.pid" +PIDDIR="/var/run/opendnssec" + +# Source function library. +. /etc/rc.d/init.d/functions + +[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods + +# Check that networking is configured. +[ "${NETWORKING}" = "no" ] && exit 0 + +start() { + # Source networking configuration. + [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network + + # Check that networking is up + [ "${NETWORKING}" = "no" ] && exit 1 + + # Sanity checks. + [ -f $ODS_SIGNERD_CONF ] || exit 5 + [ -x $ODS_SIGNERD_PROG ] || exit 5 + # /var/run could (and should) be tmpfs + [ -d $PIDDIR ] || mkdir -p $PIDDIR + + echo -n $"Starting ods-signerd:" +# ods-signerd is lying about supporting -c conf.file option :( +# $ODS_SIGNERD_PROG -c $ODS_SIGNERD_CONF $ODS_SIGNERD_OPT + $ODS_SIGNERD_PROG $ODS_SIGNERD_OPT + RETVAL=$? + if [ $RETVAL -eq 0 ]; then + touch /var/lock/subsys/ods-signerd; + success + echo + else + failure + echo + exit 7; + fi + return 0; +} + +stop() { + echo -n $"Stopping ods-signerd: " + #$ODS_SIGNER_PROG -c $ODS_SIGNERD_CONF stop + # seems that this loses our settings :( + /usr/sbin/ods-signer stop + RETVAL=$? + [ "$RETVAL" -eq 0 ] || killproc $ODS_SIGNERD_PROG -TERM >/dev/null 2>&1 + if [ $RETVAL -eq 0 ] ; then + rm -f $ODS_SIGNERD_PIDFILE + rm -f /var/lock/subsys/ods-signerd + success + else + failure + fi + echo + return $RETVAL +} + +restart() { + stop + start +} + +RETVAL=0 + +# See how we were called. +case "$1" in + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart) + [ -f /var/lock/subsys/ods-signerd ] && restart || : + ;; + status) + status -p $ODS_SIGNERD_PIDFILE $ODS_SIGNERD_PROG + ;; + *) + echo $"Usage: $0 {start|stop|status|restart|condrestart}" + exit 1 +esac + +exit $? diff --git a/ods.sysconfig b/ods.sysconfig new file mode 100644 index 0000000..1cf67f2 --- /dev/null +++ b/ods.sysconfig @@ -0,0 +1,2 @@ +ODS_SIGNERD_OPT="" +ODS_ENFORCERD_OPT="" diff --git a/opendnssec-LICENSE b/opendnssec-LICENSE new file mode 100644 index 0000000..2cadc1e --- /dev/null +++ b/opendnssec-LICENSE @@ -0,0 +1,25 @@ +$Id: LICENSE 6226 2012-03-26 17:25:52Z jakob $ + +Copyright (c) 2012 OpenDNSSEC AB (svb). All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE +GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER +IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/opendnssec.spec b/opendnssec.spec new file mode 100644 index 0000000..02fc8ab --- /dev/null +++ b/opendnssec.spec @@ -0,0 +1,145 @@ +Summary: DNSSEC key and zone management software +Name: opendnssec +Version: 1.4.0 +Release: 0.a1%{?dist}.2 +License: BSD +Url: http://www.opendnssec.org/ +#Source: http://www.opendnssec.org/files/source/% {name}-% {version}a1.tar.gz +Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}a1.tar.gz +Source1: ods-enforcerd.init +Source2: ods-signerd.init +Source3: ods.sysconfig +Source4: conf.xml +Source6: opendnssec-LICENSE +Group: Applications/System +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires: opencryptoki, softhsm, systemd-units +BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel +BuildRequires: libxml2-devel CUnit-devel, doxygen +Requires(pre): shadow-utils + +%description +OpenDNSSEC was created as an open-source turn-key solution for DNSSEC. +It secures zone data just before it is published in an authoritative +name server. It requires a PKCS#11 crypto module library, such as softhsm + +%prep +%setup -q -n %{name}-%{version}a1 + +%build +%configure --with-ldns=%{_libdir} +make %{?_smp_mflags} +cp %{SOURCE6} LICENSE + +%check +# Requires sample db not shipped with upstream +# make check + +%install +rm -rf %{buildroot} +make DESTDIR=%{buildroot} install +mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} +install -d -m 0755 %{buildroot}%{_initrddir} +install -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd +install -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd + +# cleanup sample files +rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample +install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig +install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods +install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ +mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec + + +%clean +rm -rf %{buildroot} + +%files +%defattr(-,root,root) +%attr(0755,root,root) %{_initrddir}/ods-enforcerd +%attr(0755,root,root) %{_initrddir}/ods-signerd +%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signed +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf +%attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods +%attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec +%doc NEWS README LICENSE +%{_mandir}/*/* +%{_sbindir}/* +%{_bindir}/* +%attr(0755,root,root) %dir %{_prefix}/share/%{name} +%{_prefix}/share/%{name}/* + +%pre +getent group ods >/dev/null || groupadd -r ods +getent passwd ods >/dev/null || \ +useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ +-c "opendnssec daemon account" ods +exit 0 + +%post +/sbin/chkconfig --add ods-enforcerd +/sbin/chkconfig --add ods-signerd +# Initialise a slot on the softhsm on first install +if [ "$1" -eq 1 ]; then + softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234 +fi + +%preun +if [ $1 -eq 0 ]; then + /sbin/service ods-signerd stop >/dev/null 2>&1 + /sbin/service ods-enforcerd stop >/dev/null 2>&1 + /sbin/chkconfig --del ods-enforcerd + /sbin/chkconfig --del ods-signerd +fi + +%postun +if [ "$1" -ge "1" ]; then + /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 || : + /sbin/service ods-signerd condrestart >/dev/null 2>&1 || : +fi + +%changelog +* Thu Mar 29 2012 Paul Wouters - 1.4.0-0.a1.2 +- Added opendnssec LICENSE file from trunk (Thanks Jakob!) +- Convert back to sysv for EL5/EL6 repos + +* Mon Mar 26 2012 Paul Wouters - 1.4.0-0.a1.1 +- Fix macros in comment +- Added missing -m to install target + +* Sun Mar 25 2012 Paul Wouters - 1.4.0-0.a1 +- The 1.4.x branch no longer needs ruby, as the auditor has been removed +- Added missing openssl-devel BuildRequire +- Comment out so keys generated by ods can be used by bind + +* Fri Feb 24 2012 Paul Wouters - 1.3.6-3 +- Requires rubygem-soap4r when using ruby-1.9 +- Don't ghost /var/run/opendnssec +- Converted initd to systemd + +* Thu Nov 24 2011 root - 1.3.2-6 +- Added rubygem-dnsruby requires as rpm does not pick it up automatically + +* Tue Nov 22 2011 root - 1.3.2-5 +- Added /var/opendnssec/signconf/ /as this temp dir is needed + +* Mon Nov 21 2011 Paul Wouters - 1.3.2-4 +- Added /var/opendnssec/signed/ as this is the default output dir + +* Sun Nov 20 2011 Paul Wouters - 1.3.2-3 +- Add ods user for opendnssec tasks +- Added initscripts and services for ods-signerd and ods-enforcerd +- Initialise OpenDNSSEC softhsm token on first install + +* Wed Oct 05 2011 Paul Wouters - 1.3.2-1 +- Updated to 1.3.2 +- Added dependancies on opencryptoki and softhsm +- Don't install duplicate unreadable .sample files +- Fix upstream conf.xml to point to actually used library paths + +* Thu Mar 3 2011 Paul Wouters - 1.2.0-1 +- Initial package for Fedora diff --git a/sources b/sources index e69de29..e57d259 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +c7e00424dbbf87ccf4667f3b397b0aa1 opendnssec-1.4.0a1.tar.gz From ac5723143fc63155d99c548c4d0454f477fba976 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 17 Apr 2012 13:17:03 -0400 Subject: [PATCH 02/37] * Remove bad artifact dependancy on systemd-units from Fedora branch --- opendnssec.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 02fc8ab..7b61a95 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,7 +1,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.a1%{?dist}.2 +Release: 0.a1%{?dist}.3 License: BSD Url: http://www.opendnssec.org/ #Source: http://www.opendnssec.org/files/source/% {name}-% {version}a1.tar.gz @@ -13,7 +13,7 @@ Source4: conf.xml Source6: opendnssec-LICENSE Group: Applications/System BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) -Requires: opencryptoki, softhsm, systemd-units +Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen Requires(pre): shadow-utils @@ -103,6 +103,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Tue Apr 17 2012 Paul Wouters - 1.4.0-0.a1.3 +- Remove bad artifact dependancy on systemd-units from Fedora branch + * Thu Mar 29 2012 Paul Wouters - 1.4.0-0.a1.2 - Added opendnssec LICENSE file from trunk (Thanks Jakob!) - Convert back to sysv for EL5/EL6 repos From ea882ee8bb20e7e59969523e51494140a555a654 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Wed, 16 May 2012 17:48:18 -0400 Subject: [PATCH 03/37] * Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.4 - Missed the actual patch line, so previous build did not have the patch --- opendnssec.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 7b61a95..0f0c562 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,7 +1,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.a1%{?dist}.3 +Release: 0.a1%{?dist}.4 License: BSD Url: http://www.opendnssec.org/ #Source: http://www.opendnssec.org/files/source/% {name}-% {version}a1.tar.gz @@ -11,8 +11,8 @@ Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml Source6: opendnssec-LICENSE +Patch1: opendnssec-1.4.0a1-deleterr.patch Group: Applications/System -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen @@ -25,6 +25,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}a1 +%patch1 -p1 -b .deleterr %build %configure --with-ldns=%{_libdir} @@ -55,7 +56,6 @@ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec rm -rf %{buildroot} %files -%defattr(-,root,root) %attr(0755,root,root) %{_initrddir}/ods-enforcerd %attr(0755,root,root) %{_initrddir}/ods-signerd %attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec @@ -103,6 +103,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.4 +- Missed the actual patch line, so previous build did not have the patch + * Tue Apr 17 2012 Paul Wouters - 1.4.0-0.a1.3 - Remove bad artifact dependancy on systemd-units from Fedora branch From dbd650b607bfbc9c84910cd17f6cf8587da98133 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Wed, 16 May 2012 17:52:27 -0400 Subject: [PATCH 04/37] add source file --- opendnssec-1.4.0a1-deleterr.patch | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 opendnssec-1.4.0a1-deleterr.patch diff --git a/opendnssec-1.4.0a1-deleterr.patch b/opendnssec-1.4.0a1-deleterr.patch new file mode 100644 index 0000000..1f39ec5 --- /dev/null +++ b/opendnssec-1.4.0a1-deleterr.patch @@ -0,0 +1,12 @@ +diff -Naur opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c opendnssec-1.4.0a1/signer/src/signer/namedb.c +--- opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c 2012-03-15 13:25:45.000000000 -0400 ++++ opendnssec-1.4.0a1/signer/src/signer/namedb.c 2012-05-16 11:32:52.123793809 -0400 +@@ -834,7 +834,7 @@ + if (!denial || !db || !db->denials) { + return NULL; + } +- if (denial->rrset->rr_count) { ++ if (denial->rrset && denial->rrset->rr_count) { + ods_log_error("[%s] unable to delete denial: denial in use [#%u]", + db_str, denial->rrset->rr_count); + log_dname(denial->dname, "ERR -DENIAL", LOG_ERR); From b2b6b57a4fedcf38ec7572986177c4923d7026f8 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Thu, 9 Aug 2012 15:27:43 -0400 Subject: [PATCH 05/37] * Tue Aug 07 2012 Paul Wouters - 1.4.0-0.a3.2 - Updated to 1.4.0a3 - Added ods-enforcerd.cron to sync key rollovers over multiple servers - Removed merged in patch. - Added patch for cpu lock from trunk - Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade) --- opendnssec-1.4.0a3-cpu.patch | 68 ++++++++++++++++++++++++++++++++++++ opendnssec.cron | 4 +++ opendnssec.spec | 26 +++++++++----- 3 files changed, 89 insertions(+), 9 deletions(-) create mode 100644 opendnssec-1.4.0a3-cpu.patch create mode 100644 opendnssec.cron diff --git a/opendnssec-1.4.0a3-cpu.patch b/opendnssec-1.4.0a3-cpu.patch new file mode 100644 index 0000000..f9d89f7 --- /dev/null +++ b/opendnssec-1.4.0a3-cpu.patch @@ -0,0 +1,68 @@ +Modified: trunk/OpenDNSSEC/signer/src/signer/namedb.c +=================================================================== +- --- trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 09:36:35 +UTC (rev 6514) ++++ trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 14:19:56 +UTC (rev 6515) +@@ -215,9 +215,11 @@ + } else if (ods_strcmp(format, "datecounter") == 0) { + soa = (uint32_t) time_datestamp(0, "%Y%m%d", NULL) * 100; + if (!util_serial_gt(soa, prev)) { +- - ods_log_warning("[%s] unable to use datecounter as serial: %u " +- - "does not increase %u. Serial set to %u", db_str, soa, prev, +- - (prev+1)); ++ if (!db->is_initialized) { ++ ods_log_warning("[%s] unable to use datecounter as serial: %u " ++ "does not increase %u. Serial set to %u", db_str, soa, prev, ++ (prev+1)); ++ } + soa = prev + 1; + } + } else if (ods_strcmp(format, "counter") == 0) { + +Modified: trunk/OpenDNSSEC/signer/src/signer/tools.c +=================================================================== +- --- trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 09:36:35 UTC +(rev 6514) ++++ trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 14:19:56 UTC +(rev 6515) +@@ -39,6 +39,7 @@ + #include "signer/tools.h" + #include "signer/zone.h" + ++#include + #include + #include + #include +@@ -213,7 +214,7 @@ + /* kick the nameserver */ + if (zone->notify_ns) { + int status; +- - pid_t pid; ++ pid_t pid, wpid; + ods_log_verbose("[%s] notify nameserver: %s", tools_str, + zone->notify_ns); + /** fork */ +@@ -236,9 +237,20 @@ + ods_log_debug("[%s] notify nameserver process forked", + tools_str); + /** wait for completion */ +- - while (wait(&status) != pid) { +- - ; ++ while((wpid = waitpid(pid, &status, 0)) <= 0) { ++ if (errno != EINTR) { ++ break; ++ } + } ++ if (wpid == -1) { ++ ods_log_error("[%s] notify nameserver failed: waitpid() ", ++ "failed (%s)", tools_str, strerror(errno)); ++ } else if (!WIFEXITED(status)) { ++ ods_log_error("[%s] notify nameserver failed: notify ", ++ "command did not terminate normally", tools_str); ++ } else { ++ ods_log_verbose("[%s] notify nameserver ok", tools_str); ++ } + break; + } + } diff --git a/opendnssec.cron b/opendnssec.cron new file mode 100644 index 0000000..bb47f59 --- /dev/null +++ b/opendnssec.cron @@ -0,0 +1,4 @@ +# Ensure multiple ods-enforcerd's on different system roll at the same time +# independant of when the daemon was started. Since TLDs often update their +# zone "on the hour" we do the key rollover checks just before the hour. +50,20 * * * * root kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null diff --git a/opendnssec.spec b/opendnssec.spec index 0f0c562..0c76b56 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,17 +1,18 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.a1%{?dist}.4 +Release: 0.a3%{?dist}.2 License: BSD Url: http://www.opendnssec.org/ #Source: http://www.opendnssec.org/files/source/% {name}-% {version}a1.tar.gz -Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}a1.tar.gz +Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}a3.tar.gz Source1: ods-enforcerd.init Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml +Source5: ods-enforcerd.cron Source6: opendnssec-LICENSE -Patch1: opendnssec-1.4.0a1-deleterr.patch +Patch1: opendnssec-1.4.0a3-cpu.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel @@ -25,7 +26,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}a1 -%patch1 -p1 -b .deleterr %build %configure --with-ldns=%{_libdir} @@ -40,9 +40,10 @@ cp %{SOURCE6} LICENSE rm -rf %{buildroot} make DESTDIR=%{buildroot} install mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} -install -d -m 0755 %{buildroot}%{_initrddir} install -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd install -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd +install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ +install -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/ods-enforcerd # cleanup sample files rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample @@ -51,10 +52,6 @@ install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec - -%clean -rm -rf %{buildroot} - %files %attr(0755,root,root) %{_initrddir}/ods-enforcerd %attr(0755,root,root) %{_initrddir}/ods-signerd @@ -66,6 +63,8 @@ rm -rf %{buildroot} %attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec +%attr(0644,root,root) %{_sysconfdir}/cron.d/ods-enforcerd + %doc NEWS README LICENSE %{_mandir}/*/* %{_sbindir}/* @@ -85,7 +84,9 @@ exit 0 /sbin/chkconfig --add ods-signerd # Initialise a slot on the softhsm on first install if [ "$1" -eq 1 ]; then + if [ ! -f /var/softhsm/slot0.db ]; then softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234 + fi fi %preun @@ -103,6 +104,13 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Tue Aug 07 2012 Paul Wouters - 1.4.0-0.a3.2 +- Updated to 1.4.0a3 +- Added ods-enforcerd.cron to sync key rollovers over multiple servers +- Removed merged in patch. +- Added patch for cpu lock from trunk +- Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade) + * Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.4 - Missed the actual patch line, so previous build did not have the patch From 4d395df3c9779cfa6abc7a68c1fb2f0567e351cc Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 21 Sep 2012 17:30:45 -0400 Subject: [PATCH 06/37] * Fri Sep 21 2012 Paul Wouters - 1.4.0-0.b1.1 - Updated to 1.4.0b1 - Patch to more aggressively try to take lock for resigning - Patch to give NSEC3PARAM record a TTL=0 --- .gitignore | 1 + opendnssec-aggressive-retry.patch | 15 ++++++++++++++ opendnssec.spec | 34 +++++++++++++++++++------------ sources | 1 + 4 files changed, 38 insertions(+), 13 deletions(-) create mode 100644 opendnssec-aggressive-retry.patch diff --git a/.gitignore b/.gitignore index e69de29..99539eb 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +/opendnssec-1.4.0b1.tar.gz diff --git a/opendnssec-aggressive-retry.patch b/opendnssec-aggressive-retry.patch new file mode 100644 index 0000000..b45a2fc --- /dev/null +++ b/opendnssec-aggressive-retry.patch @@ -0,0 +1,15 @@ +diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c +--- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c 2012-08-02 16:57:01.000000000 -0400 ++++ opendnssec-1.4.0a3/signer/src/daemon/worker.c 2012-08-20 15:41:34.665175565 -0400 +@@ -173,7 +173,11 @@ + * lets take a small break to not hog CPU. + */ + if (status == ODS_STATUS_UNCHANGED) { ++#if 0 + worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60); ++#else ++ worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5); ++#endif + } + lock_basic_unlock(&q->q_lock); + } diff --git a/opendnssec.spec b/opendnssec.spec index 0c76b56..2ae8606 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,21 +1,22 @@ -Summary: DNSSEC key and zone management software +Summary: DNSSEC key and zone management software for CIRA Name: opendnssec +Epoch: 10 Version: 1.4.0 -Release: 0.a3%{?dist}.2 +Release: 0.b1%{?dist}.1 License: BSD Url: http://www.opendnssec.org/ -#Source: http://www.opendnssec.org/files/source/% {name}-% {version}a1.tar.gz -Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}a3.tar.gz +#Source: http://www.opendnssec.org/files/source/% {name}-% {version}.tar.gz +Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}b1.tar.gz Source1: ods-enforcerd.init Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml -Source5: ods-enforcerd.cron -Source6: opendnssec-LICENSE -Patch1: opendnssec-1.4.0a3-cpu.patch +Source5: opendnssec.cron +Patch1: opendnssec-aggressive-retry.patch +Patch2: opendnssec-1.4.0a3-nsec3param.patch Group: Applications/System Requires: opencryptoki, softhsm -BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel +BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen Requires(pre): shadow-utils @@ -25,12 +26,13 @@ It secures zone data just before it is published in an authoritative name server. It requires a PKCS#11 crypto module library, such as softhsm %prep -%setup -q -n %{name}-%{version}a1 +%setup -q -n %{name}-%{version}b1 +%patch1 -p1 +%patch2 -p1 %build %configure --with-ldns=%{_libdir} make %{?_smp_mflags} -cp %{SOURCE6} LICENSE %check # Requires sample db not shipped with upstream @@ -40,10 +42,11 @@ cp %{SOURCE6} LICENSE rm -rf %{buildroot} make DESTDIR=%{buildroot} install mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} +mkdir -p %{buildroot}/%{_initrddir} install -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd install -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ -install -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/ods-enforcerd +install -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec # cleanup sample files rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample @@ -63,7 +66,7 @@ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec %attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec -%attr(0644,root,root) %{_sysconfdir}/cron.d/ods-enforcerd +%attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec %doc NEWS README LICENSE %{_mandir}/*/* @@ -104,9 +107,14 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Sep 21 2012 Paul Wouters - 1.4.0-0.b1.1 +- Updated to 1.4.0b1 +- Patch to more aggressively try to take lock for resigning +- Patch to give NSEC3PARAM record a TTL=0 + * Tue Aug 07 2012 Paul Wouters - 1.4.0-0.a3.2 - Updated to 1.4.0a3 -- Added ods-enforcerd.cron to sync key rollovers over multiple servers +- Added opendnssec.cron to sync key rollovers over multiple servers - Removed merged in patch. - Added patch for cpu lock from trunk - Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade) diff --git a/sources b/sources index e57d259..78313c5 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ c7e00424dbbf87ccf4667f3b397b0aa1 opendnssec-1.4.0a1.tar.gz +c5951e833a9414e3cbe575e7c66ee3ee opendnssec-1.4.0b1.tar.gz From 39a06929c954656394ddd3108a7ca7aa78da0713 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 22 Sep 2012 13:52:29 -0400 Subject: [PATCH 07/37] * added opendnssec-1.4.0a3-nsec3param.patch --- opendnssec-1.4.0a3-nsec3param.patch | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 opendnssec-1.4.0a3-nsec3param.patch diff --git a/opendnssec-1.4.0a3-nsec3param.patch b/opendnssec-1.4.0a3-nsec3param.patch new file mode 100644 index 0000000..7dd9130 --- /dev/null +++ b/opendnssec-1.4.0a3-nsec3param.patch @@ -0,0 +1,12 @@ +diff -Naur opendnssec-1.4.0a3-orig/signer/src/signer/zone.c opendnssec-1.4.0a3/signer/src/signer/zone.c +--- opendnssec-1.4.0a3-orig/signer/src/signer/zone.c 2012-08-06 06:52:03.000000000 -0400 ++++ opendnssec-1.4.0a3/signer/src/signer/zone.c 2012-09-12 17:00:01.813426466 -0400 +@@ -355,7 +355,7 @@ + return ODS_STATUS_MALLOC_ERR; + } + ldns_rr_set_class(rr, zone->klass); +- ldns_rr_set_ttl(rr, zone->default_ttl); ++ ldns_rr_set_ttl(rr, 0); /* special case */ + ldns_rr_set_owner(rr, ldns_rdf_clone(zone->apex)); + ldns_nsec3_add_param_rdfs(rr, + zone->signconf->nsec3params->algorithm, 0, From 2257f7fcf121e2925a6157390a9b7f26872ff488 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sun, 23 Sep 2012 12:15:50 -0400 Subject: [PATCH 08/37] * dont try to signal ods-enforcerd when not running --- opendnssec.cron | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opendnssec.cron b/opendnssec.cron index bb47f59..776de9b 100644 --- a/opendnssec.cron +++ b/opendnssec.cron @@ -1,4 +1,4 @@ # Ensure multiple ods-enforcerd's on different system roll at the same time # independant of when the daemon was started. Since TLDs often update their # zone "on the hour" we do the key rollover checks just before the hour. -50,20 * * * * root kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null +50,20 * * * * root test -f /var/lock/subsys/ods-enforcerd && kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null From 424a1e1c0277768916398c7df90a6cb07c58a95b Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Wed, 26 Sep 2012 14:00:48 -0400 Subject: [PATCH 09/37] * Bump to fix EVR Conflicts: opendnssec.spec --- opendnssec.spec | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 2ae8606..7678386 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,12 +1,11 @@ +%global prever b1 Summary: DNSSEC key and zone management software for CIRA Name: opendnssec -Epoch: 10 Version: 1.4.0 -Release: 0.b1%{?dist}.1 +Release: 0.2.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ -#Source: http://www.opendnssec.org/files/source/% {name}-% {version}.tar.gz -Source: http://www.opendnssec.org/files/source/testing/%{name}-%{version}b1.tar.gz +Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz Source1: ods-enforcerd.init Source2: ods-signerd.init Source3: ods.sysconfig @@ -19,6 +18,10 @@ Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen Requires(pre): shadow-utils +%if 0%{?prever:1} +# For building snapshots +Buildrequires: autoconf, automake, libtool, java +%endif %description OpenDNSSEC was created as an open-source turn-key solution for DNSSEC. @@ -26,9 +29,9 @@ It secures zone data just before it is published in an authoritative name server. It requires a PKCS#11 crypto module library, such as softhsm %prep -%setup -q -n %{name}-%{version}b1 -%patch1 -p1 -%patch2 -p1 +%setup -q -n %{name}-%{version}%{?prever} +%patch1 -p1 -b .aggressive-retry +%patch2 -p1 -b .nsec3param %build %configure --with-ldns=%{_libdir} @@ -67,13 +70,12 @@ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec %attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec - %doc NEWS README LICENSE %{_mandir}/*/* %{_sbindir}/* %{_bindir}/* -%attr(0755,root,root) %dir %{_prefix}/share/%{name} -%{_prefix}/share/%{name}/* +%attr(0755,root,root) %dir %{_datadir}/%{name} +%{_datadir}/%{name}/* %pre getent group ods >/dev/null || groupadd -r ods @@ -107,7 +109,12 @@ if [ "$1" -ge "1" ]; then fi %changelog -* Fri Sep 21 2012 Paul Wouters - 1.4.0-0.b1.1 +* Wed Sep 26 2012 Paul Wouters - 1.4.0-0.2.b1 +- Just an EVR fix to the proper standard +- Remove accidentally added (but not released) Epoch: +- Minor spec file cleanup + +* Wed Sep 12 2012 Paul Wouters - 1.4.0-0.b1.1 - Updated to 1.4.0b1 - Patch to more aggressively try to take lock for resigning - Patch to give NSEC3PARAM record a TTL=0 From 1b5392cae7392fa5cd244a37fba9199ea5898123 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 23 Oct 2012 10:44:21 -0400 Subject: [PATCH 10/37] * fix Summary --- opendnssec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 7678386..9597675 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,5 +1,5 @@ %global prever b1 -Summary: DNSSEC key and zone management software for CIRA +Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 Release: 0.2.%{?prever}%{?dist} From ce79f0a33273a96edf788e5fac2c395134d8b51d Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 23 Oct 2012 18:08:29 -0400 Subject: [PATCH 11/37] * add procps buildrequire --- opendnssec.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/opendnssec.spec b/opendnssec.spec index 9597675..d2c9050 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -17,6 +17,9 @@ Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen +# It tests for pkill/killall and would use /bin/false if not found +BuildRequires: procps + Requires(pre): shadow-utils %if 0%{?prever:1} # For building snapshots @@ -109,6 +112,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Wed Sep 26 2012 Paul Wouters - 1.4.0-0.4.b1 +- UNRELEASED - placeholder +- Added BuildRequires: procps for bug OPENDNSSEC-345 + * Wed Sep 26 2012 Paul Wouters - 1.4.0-0.2.b1 - Just an EVR fix to the proper standard - Remove accidentally added (but not released) Epoch: From b7e0073bd2d6c730d9052460621817e6319b58e0 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 30 Oct 2012 15:00:54 -0400 Subject: [PATCH 12/37] * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 - Added BuildRequires: procps-ng for bug OPENDNSSEC-345 - Change RRSIG inception offset to -2h to avoid possible daylight saving issues on resolvers - Patch to prevent removal of occluded data Conflicts: opendnssec.spec sources --- opendnssec-1.4.0b1-occluded.patch | 37 +++++++++++++++++++++++++++++++ opendnssec.spec | 12 ++++++---- sources | 3 +++ 3 files changed, 48 insertions(+), 4 deletions(-) create mode 100644 opendnssec-1.4.0b1-occluded.patch diff --git a/opendnssec-1.4.0b1-occluded.patch b/opendnssec-1.4.0b1-occluded.patch new file mode 100644 index 0000000..b49a42f --- /dev/null +++ b/opendnssec-1.4.0b1-occluded.patch @@ -0,0 +1,37 @@ +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-07-24 03:36:12.000000000 -0400 ++++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-10-30 12:03:00.972027099 -0400 +@@ -533,32 +533,13 @@ + while (rrset) { + /* skip SOA RRset */ + if (rrset->rrtype != LDNS_RR_TYPE_SOA) { +- dstatus = domain_is_occluded(domain); +- if (dstatus == LDNS_RR_TYPE_A) { +- /* Glue */ +- if (rrset->rrtype == LDNS_RR_TYPE_A || +- rrset->rrtype == LDNS_RR_TYPE_AAAA) { +- rrset_print(fd, rrset, 0, status); +- } +- } else if (dstatus == LDNS_RR_TYPE_SOA) { +- /* Authoritative or delegation */ +- dstatus = domain_is_delegpt(domain); +- if (dstatus == LDNS_RR_TYPE_SOA || +- rrset->rrtype == LDNS_RR_TYPE_A || +- rrset->rrtype == LDNS_RR_TYPE_AAAA || +- rrset->rrtype == LDNS_RR_TYPE_NS || +- rrset->rrtype == LDNS_RR_TYPE_DS) { +- rrset_print(fd, rrset, 0, status); +- } +- } +- /* Occluded */ ++ rrset_print(fd, rrset, 0, status); + } + if (status && *status != ODS_STATUS_OK) { + ods_log_crit("[%s] failed to print one or more RRsets: %s", + dname_str, ods_status2str(*status)); + return; + } +- + rrset = rrset->next; + } + } diff --git a/opendnssec.spec b/opendnssec.spec index d2c9050..3d5e9eb 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -2,7 +2,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.2.%{?prever}%{?dist} +Release: 0.4.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -13,6 +13,7 @@ Source4: conf.xml Source5: opendnssec.cron Patch1: opendnssec-aggressive-retry.patch Patch2: opendnssec-1.4.0a3-nsec3param.patch +Patch3: opendnssec-1.4.0b1-occluded.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -107,14 +108,17 @@ fi %postun if [ "$1" -ge "1" ]; then + ods-ksmutil update all ||: >/dev/null 2>/dev/null /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 || : /sbin/service ods-signerd condrestart >/dev/null 2>&1 || : fi %changelog -* Wed Sep 26 2012 Paul Wouters - 1.4.0-0.4.b1 -- UNRELEASED - placeholder -- Added BuildRequires: procps for bug OPENDNSSEC-345 +* Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 +- Added BuildRequires: procps-ng for bug OPENDNSSEC-345 +- Change RRSIG inception offset to -2h to avoid possible + daylight saving issues on resolvers +- Patch to prevent removal of occluded data * Wed Sep 26 2012 Paul Wouters - 1.4.0-0.2.b1 - Just an EVR fix to the proper standard diff --git a/sources b/sources index 78313c5..4a27788 100644 --- a/sources +++ b/sources @@ -1,2 +1,5 @@ +<<<<<<< HEAD c7e00424dbbf87ccf4667f3b397b0aa1 opendnssec-1.4.0a1.tar.gz +======= +>>>>>>> b55d6a7... * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 c5951e833a9414e3cbe575e7c66ee3ee opendnssec-1.4.0b1.tar.gz From 859e03cd1b5e17b1616e364c4f998f04ecd1cec8 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 30 Oct 2012 15:22:36 -0400 Subject: [PATCH 13/37] * add missing kaps.xml, fixup sources. --- kasp.xml | 88 +++++++++++++++++++++++++++++++++++++++++++++++++ opendnssec.spec | 11 ++++--- sources | 4 --- 3 files changed, 94 insertions(+), 9 deletions(-) create mode 100644 kasp.xml diff --git a/kasp.xml b/kasp.xml new file mode 100644 index 0000000..caacca6 --- /dev/null +++ b/kasp.xml @@ -0,0 +1,88 @@ + + + + + + + + A default policy that will amaze you and your friends + + PT2H + P3D + + P7D + P7D + + PT12H + + PT7200S + + + + + + P100D + + 1 + 5 + + + + + + + + PT3600S + PT3600S + PT3600S + + P14D + + + + 8 + P1Y + AEP + + + + + 8 + P30D + AEP + + + + + + PT43200S + + PT3600S + PT3600S + unixtime + + + + + PT9999S + + PT3600S + + + PT172800S + PT10800S + + + + + + diff --git a/opendnssec.spec b/opendnssec.spec index 3d5e9eb..a8af86f 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -11,6 +11,7 @@ Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron +Source6: kasp.xml Patch1: opendnssec-aggressive-retry.patch Patch2: opendnssec-1.4.0a3-nsec3param.patch Patch3: opendnssec-1.4.0b1-occluded.patch @@ -50,16 +51,16 @@ rm -rf %{buildroot} make DESTDIR=%{buildroot} install mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} mkdir -p %{buildroot}/%{_initrddir} -install -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd -install -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd +install -p -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd +install -p -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ -install -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec +install -p -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec # cleanup sample files rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig -install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods -install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ +install -p -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods +install -p -m 0644 %{SOURCE4} %{SOURCE6} %{buildroot}/%{_sysconfdir}/opendnssec/ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec %files diff --git a/sources b/sources index 4a27788..bcdf49c 100644 --- a/sources +++ b/sources @@ -1,5 +1 @@ -<<<<<<< HEAD -c7e00424dbbf87ccf4667f3b397b0aa1 opendnssec-1.4.0a1.tar.gz -======= ->>>>>>> b55d6a7... * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 c5951e833a9414e3cbe575e7c66ee3ee opendnssec-1.4.0b1.tar.gz From 9b702c24b8671095c031afe10030822b8eebb107 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 10 Nov 2012 17:37:06 -0500 Subject: [PATCH 14/37] * Sat Nov 10 2012 Paul Wouters - 1.4.0-0.5.b1 - Patch r6816 fixes enforcer/signer communication - Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset --- opendnssec-1.4.0b1-r6816.patch | 62 ++++++++++++++++++++++++++++++++++ opendnssec-1.4.0b1-r6817.patch | 48 ++++++++++++++++++++++++++ opendnssec.spec | 11 +++++- 3 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 opendnssec-1.4.0b1-r6816.patch create mode 100644 opendnssec-1.4.0b1-r6817.patch diff --git a/opendnssec-1.4.0b1-r6816.patch b/opendnssec-1.4.0b1-r6816.patch new file mode 100644 index 0000000..5375fe1 --- /dev/null +++ b/opendnssec-1.4.0b1-r6816.patch @@ -0,0 +1,62 @@ +Index: OpenDNSSEC/enforcer/enforcerd/enforcer.c +=================================================================== +--- OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6815) ++++ OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6816) +@@ -1293,7 +1293,7 @@ + { + int NewDS; + status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS); +- if (status2 != 0) { ++ if (status2 == 0) { + /* If the DS set changed then log/do something about it */ + if (NewDS == 1) { + log_msg(config, LOG_INFO, "DSChanged"); +@@ -1655,8 +1655,11 @@ + if (system(signer_command)) + { + log_msg(NULL, LOG_ERR, "Could not call signer engine to update all zones"); +- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update --all' to manually update all zones"); ++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update all zones", signer_command); + } ++ else { ++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command); ++ } + + StrFree(signer_command); + } else { +@@ -1693,8 +1696,8 @@ + round potentially different behaviour of rename over existing + file.) */ + int gencnt; /* Number of keys in generate state */ ++ char *signer_command; /* how we will call the signer */ + #ifndef ENFORCER_USE_WORKERS +- char *signer_command; /* how we will call the signer */ + int NewDS = 0; /* Did we change the DS Set in any way? */ + #endif + char* datetime = DtParseDateTimeString("now"); +@@ -1954,7 +1957,6 @@ + return -1; + } + +-#ifndef ENFORCER_USE_WORKERS + if (*signer_flag == 1) { + /* call the signer engine to tell it that something changed */ + /* TODO for beta version connect straight to the socket +@@ -1970,13 +1972,15 @@ + if (status != 0) + { + log_msg(NULL, LOG_ERR, "Could not call signer engine"); +- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update' to manually update zones"); ++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update the zone", signer_command); + *signer_flag = 0; + } ++ else { ++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command); ++ } + + StrFree(signer_command); + } +-#endif + } + else { + log_msg(NULL, LOG_INFO, "No change to: %s", current_filename); diff --git a/opendnssec-1.4.0b1-r6817.patch b/opendnssec-1.4.0b1-r6817.patch new file mode 100644 index 0000000..6f74dea --- /dev/null +++ b/opendnssec-1.4.0b1-r6817.patch @@ -0,0 +1,48 @@ +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c opendnssec-1.4.0b1/signer/src/signer/rrset.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c 2012-08-28 10:00:54.000000000 -0400 ++++ opendnssec-1.4.0b1/signer/src/signer/rrset.c 2012-11-10 17:16:44.250226281 -0500 +@@ -32,6 +32,7 @@ + */ + + #include "config.h" ++#include "shared/file.h" + #include "shared/hsm.h" + #include "shared/log.h" + #include "shared/util.h" +@@ -557,6 +558,26 @@ + + + /** ++ * Is the RRset signed with this locator? ++ * ++ */ ++static int ++rrset_siglocator(rrset_type* rrset, const char* locator) ++{ ++ size_t i = 0; ++ if (!rrset) { ++ return 0; ++ } ++ for (i=0; i < rrset->rrsig_count; i++) { ++ if (!ods_strcmp(locator, rrset->rrsigs[i].key_locator)) { ++ return 1; ++ } ++ } ++ return 0; ++} ++ ++ ++/** + * Transmogrify the RRset to a RRlist. + * + */ +@@ -702,6 +723,9 @@ + continue; + } + /* Additional rules for signatures */ ++ if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) { ++ continue; ++ } + if (rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) { + continue; + } diff --git a/opendnssec.spec b/opendnssec.spec index a8af86f..e60d9d8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -2,7 +2,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.4.%{?prever}%{?dist} +Release: 0.5.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -15,6 +15,8 @@ Source6: kasp.xml Patch1: opendnssec-aggressive-retry.patch Patch2: opendnssec-1.4.0a3-nsec3param.patch Patch3: opendnssec-1.4.0b1-occluded.patch +Patch4: opendnssec-1.4.0b1-r6816.patch +Patch5: opendnssec-1.4.0b1-r6817.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -37,6 +39,9 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %setup -q -n %{name}-%{version}%{?prever} %patch1 -p1 -b .aggressive-retry %patch2 -p1 -b .nsec3param +%patch3 -p1 -b .occluded +%patch4 -p1 -b .r6816 +%patch5 -p1 -b .r6817 %build %configure --with-ldns=%{_libdir} @@ -115,6 +120,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Sat Nov 10 2012 Paul Wouters - 1.4.0-0.5.b1 +- Patch r6816 fixes enforcer/signer communication +- Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset + * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 - Added BuildRequires: procps-ng for bug OPENDNSSEC-345 - Change RRSIG inception offset to -2h to avoid possible From 35f76dc9a02d250830a5d20143176f2a1d4a29fa Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 23 Nov 2012 12:42:48 -0500 Subject: [PATCH 15/37] * Fri Nov 23 2012 Paul Wouters - 1.4.0-0.6.b1 - Patch for empty nonterminal NSEC3 records --- opendnssec-1.4.0b1-nonempty-terminals.patch | 54 +++++++++++++++++++++ opendnssec.spec | 7 ++- 2 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 opendnssec-1.4.0b1-nonempty-terminals.patch diff --git a/opendnssec-1.4.0b1-nonempty-terminals.patch b/opendnssec-1.4.0b1-nonempty-terminals.patch new file mode 100644 index 0000000..8ad2135 --- /dev/null +++ b/opendnssec-1.4.0b1-nonempty-terminals.patch @@ -0,0 +1,54 @@ +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-11-23 11:17:00.752148535 -0500 ++++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-11-23 11:23:00.243158628 -0500 +@@ -399,6 +399,7 @@ + { + ldns_rbnode_t* n = LDNS_RBTREE_NULL; + domain_type* d = NULL; ++ int unsigned_delegpt = 1; + + ods_log_assert(domain); + if (domain->rrsets) { +@@ -411,20 +412,15 @@ + break; + } + if (d->rrsets) { +- if (domain_is_delegpt(d) == LDNS_RR_TYPE_NS) { +- /* domain has unsigned delegation */ +- return 1; +- } else { +- /* domain has authoritative data or signed delegation */ ++ if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS) { ++ /* domain has signed delegation/auth */ + return 0; + } + } + /* maybe there is data at the next domain */ + n = ldns_rbtree_next(n); + } +- ods_log_warning("[%s] encountered empty terminal that is treated as " +- "non-terminal", dname_str); +- return 0; ++ return unsigned_delegpt; + } + + +diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c opendnssec-1.4.0b1/signer/src/signer/namedb.c +--- opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c 2012-08-28 09:43:15.000000000 -0400 ++++ opendnssec-1.4.0b1/signer/src/signer/namedb.c 2012-11-23 11:23:39.420172841 -0500 +@@ -788,13 +788,13 @@ + if (!db || !db->domains) { + return; + } +- node = ldns_rbtree_first(db->domains); ++ node = ldns_rbtree_last(db->domains); + if (!node || node == LDNS_RBTREE_NULL) { + return; + } + while (node && node != LDNS_RBTREE_NULL) { + domain = (domain_type*) node->data; +- node = ldns_rbtree_next(node); ++ node = ldns_rbtree_previous(node); + domain_diff(domain, is_ixfr); + domain = namedb_del_denial_trigger(db, domain, 0); + if (domain) { diff --git a/opendnssec.spec b/opendnssec.spec index e60d9d8..d01f5c8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -2,7 +2,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.5.%{?prever}%{?dist} +Release: 0.6.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -17,6 +17,7 @@ Patch2: opendnssec-1.4.0a3-nsec3param.patch Patch3: opendnssec-1.4.0b1-occluded.patch Patch4: opendnssec-1.4.0b1-r6816.patch Patch5: opendnssec-1.4.0b1-r6817.patch +Patch6: opendnssec-1.4.0b1-nonempty-terminals.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -42,6 +43,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %patch3 -p1 -b .occluded %patch4 -p1 -b .r6816 %patch5 -p1 -b .r6817 +%patch6 -p1 %build %configure --with-ldns=%{_libdir} @@ -120,6 +122,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Nov 23 2012 Paul Wouters - 1.4.0-0.6.b1 +- Patch for empty nonterminal NSEC3 records + * Sat Nov 10 2012 Paul Wouters - 1.4.0-0.5.b1 - Patch r6816 fixes enforcer/signer communication - Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset From f910073c8ac0463497bc1d747ad49afd6fa1e9d2 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 18 Dec 2012 23:25:34 -0500 Subject: [PATCH 16/37] * Tue Dec 18 2012 Paul Wouters - 1.4.0-0.6.b2 - Updated to 1.4.0b2 --- .gitignore | 1 + opendnssec.spec | 18 +++++------------- sources | 2 +- 3 files changed, 7 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 99539eb..dc88a48 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /opendnssec-1.4.0b1.tar.gz +/opendnssec-1.4.0b2.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index d01f5c8..48917c6 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,4 +1,4 @@ -%global prever b1 +%global prever b2 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 @@ -12,12 +12,6 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml -Patch1: opendnssec-aggressive-retry.patch -Patch2: opendnssec-1.4.0a3-nsec3param.patch -Patch3: opendnssec-1.4.0b1-occluded.patch -Patch4: opendnssec-1.4.0b1-r6816.patch -Patch5: opendnssec-1.4.0b1-r6817.patch -Patch6: opendnssec-1.4.0b1-nonempty-terminals.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -38,12 +32,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch1 -p1 -b .aggressive-retry -%patch2 -p1 -b .nsec3param -%patch3 -p1 -b .occluded -%patch4 -p1 -b .r6816 -%patch5 -p1 -b .r6817 -%patch6 -p1 %build %configure --with-ldns=%{_libdir} @@ -122,6 +110,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Tue Dec 18 2012 Paul Wouters - 1.4.0-0.6.b2 +- Updated to 1.4.0b2 +- All patches synced to/from with new release + * Fri Nov 23 2012 Paul Wouters - 1.4.0-0.6.b1 - Patch for empty nonterminal NSEC3 records diff --git a/sources b/sources index bcdf49c..b7e3f52 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -c5951e833a9414e3cbe575e7c66ee3ee opendnssec-1.4.0b1.tar.gz +17fd1b721fb568817be6866a82b19991 opendnssec-1.4.0b2.tar.gz From e86b6e93ff88a3e042db798b1ebed39b64a5a9d6 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Fri, 18 Jan 2013 19:29:12 +0100 Subject: [PATCH 17/37] Updated to 1.4.0rc1 Applied opendnssec-ksk-premature-retirement.patch (svn r6952) Conflicts: opendnssec-aggressive-retry.patch opendnssec.spec --- .gitignore | 1 + opendnssec-1.4.0a1-deleterr.patch | 12 ---- opendnssec-1.4.0a3-cpu.patch | 68 ----------------------- opendnssec-1.4.0a3-nsec3param.patch | 12 ---- opendnssec-1.4.0b1-occluded.patch | 37 ------------ opendnssec-ksk-premature-retirement.patch | 20 +++++++ opendnssec.spec | 8 ++- sources | 2 +- 8 files changed, 29 insertions(+), 131 deletions(-) delete mode 100644 opendnssec-1.4.0a1-deleterr.patch delete mode 100644 opendnssec-1.4.0a3-cpu.patch delete mode 100644 opendnssec-1.4.0a3-nsec3param.patch delete mode 100644 opendnssec-1.4.0b1-occluded.patch create mode 100644 opendnssec-ksk-premature-retirement.patch diff --git a/.gitignore b/.gitignore index dc88a48..379f1b1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /opendnssec-1.4.0b1.tar.gz /opendnssec-1.4.0b2.tar.gz +/opendnssec-1.4.0rc1.tar.gz diff --git a/opendnssec-1.4.0a1-deleterr.patch b/opendnssec-1.4.0a1-deleterr.patch deleted file mode 100644 index 1f39ec5..0000000 --- a/opendnssec-1.4.0a1-deleterr.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c opendnssec-1.4.0a1/signer/src/signer/namedb.c ---- opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c 2012-03-15 13:25:45.000000000 -0400 -+++ opendnssec-1.4.0a1/signer/src/signer/namedb.c 2012-05-16 11:32:52.123793809 -0400 -@@ -834,7 +834,7 @@ - if (!denial || !db || !db->denials) { - return NULL; - } -- if (denial->rrset->rr_count) { -+ if (denial->rrset && denial->rrset->rr_count) { - ods_log_error("[%s] unable to delete denial: denial in use [#%u]", - db_str, denial->rrset->rr_count); - log_dname(denial->dname, "ERR -DENIAL", LOG_ERR); diff --git a/opendnssec-1.4.0a3-cpu.patch b/opendnssec-1.4.0a3-cpu.patch deleted file mode 100644 index f9d89f7..0000000 --- a/opendnssec-1.4.0a3-cpu.patch +++ /dev/null @@ -1,68 +0,0 @@ -Modified: trunk/OpenDNSSEC/signer/src/signer/namedb.c -=================================================================== -- --- trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 09:36:35 -UTC (rev 6514) -+++ trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 14:19:56 -UTC (rev 6515) -@@ -215,9 +215,11 @@ - } else if (ods_strcmp(format, "datecounter") == 0) { - soa = (uint32_t) time_datestamp(0, "%Y%m%d", NULL) * 100; - if (!util_serial_gt(soa, prev)) { -- - ods_log_warning("[%s] unable to use datecounter as serial: %u " -- - "does not increase %u. Serial set to %u", db_str, soa, prev, -- - (prev+1)); -+ if (!db->is_initialized) { -+ ods_log_warning("[%s] unable to use datecounter as serial: %u " -+ "does not increase %u. Serial set to %u", db_str, soa, prev, -+ (prev+1)); -+ } - soa = prev + 1; - } - } else if (ods_strcmp(format, "counter") == 0) { - -Modified: trunk/OpenDNSSEC/signer/src/signer/tools.c -=================================================================== -- --- trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 09:36:35 UTC -(rev 6514) -+++ trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 14:19:56 UTC -(rev 6515) -@@ -39,6 +39,7 @@ - #include "signer/tools.h" - #include "signer/zone.h" - -+#include - #include - #include - #include -@@ -213,7 +214,7 @@ - /* kick the nameserver */ - if (zone->notify_ns) { - int status; -- - pid_t pid; -+ pid_t pid, wpid; - ods_log_verbose("[%s] notify nameserver: %s", tools_str, - zone->notify_ns); - /** fork */ -@@ -236,9 +237,20 @@ - ods_log_debug("[%s] notify nameserver process forked", - tools_str); - /** wait for completion */ -- - while (wait(&status) != pid) { -- - ; -+ while((wpid = waitpid(pid, &status, 0)) <= 0) { -+ if (errno != EINTR) { -+ break; -+ } - } -+ if (wpid == -1) { -+ ods_log_error("[%s] notify nameserver failed: waitpid() ", -+ "failed (%s)", tools_str, strerror(errno)); -+ } else if (!WIFEXITED(status)) { -+ ods_log_error("[%s] notify nameserver failed: notify ", -+ "command did not terminate normally", tools_str); -+ } else { -+ ods_log_verbose("[%s] notify nameserver ok", tools_str); -+ } - break; - } - } diff --git a/opendnssec-1.4.0a3-nsec3param.patch b/opendnssec-1.4.0a3-nsec3param.patch deleted file mode 100644 index 7dd9130..0000000 --- a/opendnssec-1.4.0a3-nsec3param.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur opendnssec-1.4.0a3-orig/signer/src/signer/zone.c opendnssec-1.4.0a3/signer/src/signer/zone.c ---- opendnssec-1.4.0a3-orig/signer/src/signer/zone.c 2012-08-06 06:52:03.000000000 -0400 -+++ opendnssec-1.4.0a3/signer/src/signer/zone.c 2012-09-12 17:00:01.813426466 -0400 -@@ -355,7 +355,7 @@ - return ODS_STATUS_MALLOC_ERR; - } - ldns_rr_set_class(rr, zone->klass); -- ldns_rr_set_ttl(rr, zone->default_ttl); -+ ldns_rr_set_ttl(rr, 0); /* special case */ - ldns_rr_set_owner(rr, ldns_rdf_clone(zone->apex)); - ldns_nsec3_add_param_rdfs(rr, - zone->signconf->nsec3params->algorithm, 0, diff --git a/opendnssec-1.4.0b1-occluded.patch b/opendnssec-1.4.0b1-occluded.patch deleted file mode 100644 index b49a42f..0000000 --- a/opendnssec-1.4.0b1-occluded.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c ---- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-07-24 03:36:12.000000000 -0400 -+++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-10-30 12:03:00.972027099 -0400 -@@ -533,32 +533,13 @@ - while (rrset) { - /* skip SOA RRset */ - if (rrset->rrtype != LDNS_RR_TYPE_SOA) { -- dstatus = domain_is_occluded(domain); -- if (dstatus == LDNS_RR_TYPE_A) { -- /* Glue */ -- if (rrset->rrtype == LDNS_RR_TYPE_A || -- rrset->rrtype == LDNS_RR_TYPE_AAAA) { -- rrset_print(fd, rrset, 0, status); -- } -- } else if (dstatus == LDNS_RR_TYPE_SOA) { -- /* Authoritative or delegation */ -- dstatus = domain_is_delegpt(domain); -- if (dstatus == LDNS_RR_TYPE_SOA || -- rrset->rrtype == LDNS_RR_TYPE_A || -- rrset->rrtype == LDNS_RR_TYPE_AAAA || -- rrset->rrtype == LDNS_RR_TYPE_NS || -- rrset->rrtype == LDNS_RR_TYPE_DS) { -- rrset_print(fd, rrset, 0, status); -- } -- } -- /* Occluded */ -+ rrset_print(fd, rrset, 0, status); - } - if (status && *status != ODS_STATUS_OK) { - ods_log_crit("[%s] failed to print one or more RRsets: %s", - dname_str, ods_status2str(*status)); - return; - } -- - rrset = rrset->next; - } - } diff --git a/opendnssec-ksk-premature-retirement.patch b/opendnssec-ksk-premature-retirement.patch new file mode 100644 index 0000000..0b59af8 --- /dev/null +++ b/opendnssec-ksk-premature-retirement.patch @@ -0,0 +1,20 @@ +--- enforcer/enforcerd/enforcer.c (revision 6951) ++++ enforcer/enforcerd/enforcer.c (revision 6952) +@@ -1291,7 +1291,7 @@ + /* turn this zone and policy into a file */ + #ifdef ENFORCER_USE_WORKERS + { +- int NewDS; ++ int NewDS = 0; + status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS); + if (status2 == 0) { + /* If the DS set changed then log/do something about it */ +--- NEWS (revision 6951) ++++ NEWS (revision 6952) +@@ -1,5 +1,7 @@ + $Id: NEWS 6934 2013-01-10 14:32:16Z jerry $ + ++* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired. ++ + + OpenDNSSEC 1.4.0rc1 - 2013-01-10 diff --git a/opendnssec.spec b/opendnssec.spec index 48917c6..a937ed8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,4 +1,4 @@ -%global prever b2 +%global prever rc1 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 @@ -12,6 +12,7 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml +Patch: opendnssec-ksk-premature-retirement.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -32,6 +33,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} +%patch %build %configure --with-ldns=%{_libdir} @@ -110,6 +112,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Jan 18 2013 Patrick Uiterwijk - 1.4.0-0.6.rc1 +- Updated to 1.4.0rc1 +- Applied opendnssec-ksk-premature-retirement.patch (svn r6952) + * Tue Dec 18 2012 Paul Wouters - 1.4.0-0.6.b2 - Updated to 1.4.0b2 - All patches synced to/from with new release diff --git a/sources b/sources index b7e3f52..b2f5549 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -17fd1b721fb568817be6866a82b19991 opendnssec-1.4.0b2.tar.gz +bfd92b2830e1723acc90f20e575cf8cb opendnssec-1.4.0rc1.tar.gz From b8dacaf84d531dfec096d1f61863ec8617c0f78b Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Mon, 28 Jan 2013 16:32:12 -0500 Subject: [PATCH 18/37] * Mon Jan 28 2013 Paul Wouters - 1.4.0-0.7.rc2 - Updaed to 1.4.0rc2 - This merges in r6952 --- .gitignore | 1 + opendnssec.spec | 10 ++++++---- sources | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 379f1b1..93c3c18 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /opendnssec-1.4.0b1.tar.gz /opendnssec-1.4.0b2.tar.gz /opendnssec-1.4.0rc1.tar.gz +/opendnssec-1.4.0rc2.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index a937ed8..a87481a 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,8 +1,8 @@ -%global prever rc1 +%global prever rc2 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.6.%{?prever}%{?dist} +Release: 0.7.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -12,7 +12,6 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml -Patch: opendnssec-ksk-premature-retirement.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -33,7 +32,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch %build %configure --with-ldns=%{_libdir} @@ -112,6 +110,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Mon Jan 28 2013 Paul Wouters - 1.4.0-0.7.rc2 +- Updaed to 1.4.0rc2 +- This merges in r6952 + * Fri Jan 18 2013 Patrick Uiterwijk - 1.4.0-0.6.rc1 - Updated to 1.4.0rc1 - Applied opendnssec-ksk-premature-retirement.patch (svn r6952) diff --git a/sources b/sources index b2f5549..a502c90 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -bfd92b2830e1723acc90f20e575cf8cb opendnssec-1.4.0rc1.tar.gz +b9f39643c1f7cee1cd53ff3a5386ea63 opendnssec-1.4.0rc2.tar.gz From e440db7b2b1565f363d31d020a4611cafdf1e3ca Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 16 Apr 2013 00:05:14 -0400 Subject: [PATCH 19/37] * Mon Apr 15 2013 Paul Wouters - 1.4.0-0.3.rc3 - Updated to 1.4.0rc3 --- .gitignore | 1 + opendnssec.spec | 11 +++++------ sources | 3 +-- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 99539eb..e85a3b7 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /opendnssec-1.4.0b1.tar.gz +/opendnssec-1.4.0rc3.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 9597675..3dc3dc8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,8 +1,8 @@ -%global prever b1 +%global prever rc3 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.2.%{?prever}%{?dist} +Release: 0.3.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -11,8 +11,6 @@ Source2: ods-signerd.init Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron -Patch1: opendnssec-aggressive-retry.patch -Patch2: opendnssec-1.4.0a3-nsec3param.patch Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel @@ -30,8 +28,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch1 -p1 -b .aggressive-retry -%patch2 -p1 -b .nsec3param %build %configure --with-ldns=%{_libdir} @@ -109,6 +105,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Mon Apr 15 2013 Paul Wouters - 1.4.0-0.3.rc3 +- Updated to 1.4.0rc3 + * Wed Sep 26 2012 Paul Wouters - 1.4.0-0.2.b1 - Just an EVR fix to the proper standard - Remove accidentally added (but not released) Epoch: diff --git a/sources b/sources index 78313c5..dd596f0 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -c7e00424dbbf87ccf4667f3b397b0aa1 opendnssec-1.4.0a1.tar.gz -c5951e833a9414e3cbe575e7c66ee3ee opendnssec-1.4.0b1.tar.gz +f3a7e52f0a4c644e4200ec5a1c6b67cf opendnssec-1.4.0rc3.tar.gz From 512b3698559afb962112aef59842036cb4e7329b Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 11 May 2013 16:42:30 -0400 Subject: [PATCH 20/37] * Sat May 11 2013 Paul Wouters - 1.4.0-1 - Updated to 1.4.0 - Enabled full relro/pie protection --- opendnssec.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index e7d8ecd..dfc3823 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,8 +1,10 @@ -%global prever rc3 +#global prever rc3 +%global _hardened_build 1 + Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.8.%{?prever}%{?dist} +Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -34,6 +36,9 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %setup -q -n %{name}-%{version}%{?prever} %build +export LDFLAGS="-Wl,-z,relro,-z,now -pie" +export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security" + %configure --with-ldns=%{_libdir} make %{?_smp_mflags} @@ -110,6 +115,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Sat May 11 2013 Paul Wouters - 1.4.0-1 +- Updated to 1.4.0 +- Enabled full relro/pie protection + * Mon Apr 15 2013 Paul Wouters - 1.4.0-0.8.rc3 - Updated to 1.4.0rc3 From cba433cfc70afa940f2ed276b8ef80824bd673e3 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 11 May 2013 16:45:23 -0400 Subject: [PATCH 21/37] * updates sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 10779c3..b78d07b 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /opendnssec-1.4.0rc1.tar.gz /opendnssec-1.4.0rc2.tar.gz /opendnssec-1.4.0rc3.tar.gz +/opendnssec-1.4.0.tar.gz diff --git a/sources b/sources index dd596f0..4e0c3cc 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -f3a7e52f0a4c644e4200ec5a1c6b67cf opendnssec-1.4.0rc3.tar.gz +96399851f16cf68de53c974c0d07aa5b opendnssec-1.4.0.tar.gz From 3195307a4eb37ce2f2f97227dd164b6f9b3db897 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 28 Jun 2013 12:28:30 -0400 Subject: [PATCH 22/37] * Fri Jun 28 2013 Paul Wouters - 1.4.1-1 - Updated to 1.4.1, bugfixes for NSEC3 and serial handling --- .gitignore | 1 + opendnssec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b78d07b..ba03dc9 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /opendnssec-1.4.0rc2.tar.gz /opendnssec-1.4.0rc3.tar.gz /opendnssec-1.4.0.tar.gz +/opendnssec-1.4.1.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index dfc3823..393d1a6 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,7 +3,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.0 +Version: 1.4.1 Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ @@ -115,6 +115,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Jun 28 2013 Paul Wouters - 1.4.1-1 +- Updated to 1.4.1, bugfixes for NSEC3 and serial handling + * Sat May 11 2013 Paul Wouters - 1.4.0-1 - Updated to 1.4.0 - Enabled full relro/pie protection diff --git a/sources b/sources index 4e0c3cc..18f0126 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -96399851f16cf68de53c974c0d07aa5b opendnssec-1.4.0.tar.gz +c38eb91a32b77f9b37e8968ce2440469 opendnssec-1.4.1.tar.gz From 1b052000888c41dcdbb352b92dab740563977f2a Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Thu, 12 Sep 2013 12:56:34 -0400 Subject: [PATCH 23/37] * Wed Sep 11 2013 Paul Wouters - 1.4.2-1 - Updated to 1.4.2, bugfix release --- opendnssec.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 393d1a6..90d3a53 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,7 +3,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.1 +Version: 1.4.2 Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ @@ -115,6 +115,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Wed Sep 11 2013 Paul Wouters - 1.4.2-1 +- Updated to 1.4.2, bugfix release + * Fri Jun 28 2013 Paul Wouters - 1.4.1-1 - Updated to 1.4.1, bugfixes for NSEC3 and serial handling diff --git a/sources b/sources index 18f0126..c2d51d0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -c38eb91a32b77f9b37e8968ce2440469 opendnssec-1.4.1.tar.gz +4ac59962721632e07cfb03405fdd152c opendnssec-1.4.2.tar.gz From eeb2023476fb139a9b0a395ed2748b53099ab135 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Thu, 9 Jan 2014 22:27:05 -0500 Subject: [PATCH 24/37] * Thu Jan 09 2014 Paul Wouters - 1.4.3-1 - Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements --- .gitignore | 1 + opendnssec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ba03dc9..5df32e8 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /opendnssec-1.4.0rc3.tar.gz /opendnssec-1.4.0.tar.gz /opendnssec-1.4.1.tar.gz +/opendnssec-1.4.3.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 90d3a53..865c55e 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,7 +3,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.2 +Version: 1.4.3 Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ @@ -115,6 +115,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Thu Jan 09 2014 Paul Wouters - 1.4.3-1 +- Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements + * Wed Sep 11 2013 Paul Wouters - 1.4.2-1 - Updated to 1.4.2, bugfix release diff --git a/sources b/sources index c2d51d0..a88abd5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -4ac59962721632e07cfb03405fdd152c opendnssec-1.4.2.tar.gz +009358a5dabca784128752bcf7b8d64f opendnssec-1.4.3.tar.gz From b441651118e39537fc5fdd527e12e36e0b4c3068 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 28 Mar 2014 13:00:16 -0400 Subject: [PATCH 25/37] * Thu Mar 27 2014 Paul Wouters - 1.4.4-1 - Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441) - Change the default ZSK policy from 1024 to 2048 bit RSA keys - Fix post to be quiet when upgrading opendnssec --- .gitignore | 1 + opendnssec.spec | 24 +++++++++++++++++------- sources | 2 +- 3 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 5df32e8..8c739d8 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /opendnssec-1.4.0.tar.gz /opendnssec-1.4.1.tar.gz /opendnssec-1.4.3.tar.gz +/opendnssec-1.4.4.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 865c55e..00e14f2 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,7 +3,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.3 +Version: 1.4.4 Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ @@ -34,6 +34,9 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} +# bump default policy ZSK keysize to 2048 +sed -i "s/1024/2048/" conf/kasp.xml.in + %build export LDFLAGS="-Wl,-z,relro,-z,now -pie" @@ -75,7 +78,7 @@ mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec %attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec -%doc NEWS README LICENSE +%doc NEWS README.md LICENSE %{_mandir}/*/* %{_sbindir}/* %{_bindir}/* @@ -98,23 +101,30 @@ if [ "$1" -eq 1 ]; then softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234 fi fi +# in case we update any xml conf file +ods-ksmutil update all >/dev/null 2>/dev/null ||: %preun if [ $1 -eq 0 ]; then - /sbin/service ods-signerd stop >/dev/null 2>&1 - /sbin/service ods-enforcerd stop >/dev/null 2>&1 + /sbin/service ods-signerd stop >/dev/null 2>&1 ||: + /sbin/service ods-enforcerd stop >/dev/null 2>&1 ||: /sbin/chkconfig --del ods-enforcerd /sbin/chkconfig --del ods-signerd fi %postun if [ "$1" -ge "1" ]; then - ods-ksmutil update all ||: >/dev/null 2>/dev/null - /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 || : - /sbin/service ods-signerd condrestart >/dev/null 2>&1 || : + ods-ksmutil update all >/dev/null 2>/dev/null ||: + /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 ||: + /sbin/service ods-signerd condrestart >/dev/null 2>&1 ||: fi %changelog +* Thu Mar 27 2014 Paul Wouters - 1.4.4-1 +- Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441) +- Change the default ZSK policy from 1024 to 2048 bit RSA keys +- Fix post to be quiet when upgrading opendnssec + * Thu Jan 09 2014 Paul Wouters - 1.4.3-1 - Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements diff --git a/sources b/sources index a88abd5..f80ab28 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -009358a5dabca784128752bcf7b8d64f opendnssec-1.4.3.tar.gz +2b8f2c6921953c7a1472b54fd6dfe495 opendnssec-1.4.4.tar.gz From dd1c45eee23b4162f4d7d326fcccedbbe9859d30 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 28 Mar 2014 19:40:59 -0400 Subject: [PATCH 26/37] * Fri Mar 28 2014 Paul Wouters - 1.4.4-2 - Add requires for ods-kasp2html (rhbz#1073313) --- opendnssec.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 00e14f2..c31355d 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.4 -Release: 1%{?prever}%{?dist} +Release: 2%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -16,6 +16,7 @@ Source5: opendnssec.cron Source6: kasp.xml Group: Applications/System Requires: opencryptoki, softhsm +Requires: libxml2, libxslt BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen # It tests for pkill/killall and would use /bin/false if not found @@ -120,8 +121,12 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Mar 28 2014 Paul Wouters - 1.4.4-2 +- Add requires for ods-kasp2html (rhbz#1073313) + * Thu Mar 27 2014 Paul Wouters - 1.4.4-1 -- Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441) +- Updated to 1.4.4 (rhbz#1080862) + (compatibility with non RFC 5155 errata 3441 implementations) - Change the default ZSK policy from 1024 to 2048 bit RSA keys - Fix post to be quiet when upgrading opendnssec From 1bf0742a24780610a9da9e4c92c0b177afc816b2 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 29 Mar 2014 17:32:08 -0400 Subject: [PATCH 27/37] merge changelog for previous build never released --- opendnssec.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index c31355d..86b6a8f 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -123,8 +123,6 @@ fi %changelog * Fri Mar 28 2014 Paul Wouters - 1.4.4-2 - Add requires for ods-kasp2html (rhbz#1073313) - -* Thu Mar 27 2014 Paul Wouters - 1.4.4-1 - Updated to 1.4.4 (rhbz#1080862) (compatibility with non RFC 5155 errata 3441 implementations) - Change the default ZSK policy from 1024 to 2048 bit RSA keys From 343561cb603f342827b637fdcef697f6086b218f Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 1 Apr 2014 11:37:16 -0400 Subject: [PATCH 28/37] * Tue Apr 01 2014 Paul Wouters - 1.4.4-3 - Add buildrequires for ods-kasp2html (rhbz#1073313) --- opendnssec.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 86b6a8f..4e19383 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.4 -Release: 2%{?prever}%{?dist} +Release: 3%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -16,6 +16,7 @@ Source5: opendnssec.cron Source6: kasp.xml Group: Applications/System Requires: opencryptoki, softhsm +BuildRequires: libxml2, libxslt Requires: libxml2, libxslt BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen @@ -121,6 +122,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Tue Apr 01 2014 Paul Wouters - 1.4.4-3 +- Add buildrequires for ods-kasp2html (rhbz#1073313) + * Fri Mar 28 2014 Paul Wouters - 1.4.4-2 - Add requires for ods-kasp2html (rhbz#1073313) - Updated to 1.4.4 (rhbz#1080862) From 48eb93c70d4f4238bb7702a17593db87a095bca3 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 18 Apr 2014 11:18:37 -0400 Subject: [PATCH 29/37] * Fri Apr 18 2014 Paul Wouters - 1.4.5-1 - Updated to 1.4.5 --- .gitignore | 1 + opendnssec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 8c739d8..48f0fb6 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /opendnssec-1.4.1.tar.gz /opendnssec-1.4.3.tar.gz /opendnssec-1.4.4.tar.gz +/opendnssec-1.4.5.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 4e19383..826d6b8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,8 +3,8 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.4 -Release: 3%{?prever}%{?dist} +Version: 1.4.5 +Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -122,6 +122,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Apr 18 2014 Paul Wouters - 1.4.5-1 +- Updated to 1.4.5 + * Tue Apr 01 2014 Paul Wouters - 1.4.4-3 - Add buildrequires for ods-kasp2html (rhbz#1073313) diff --git a/sources b/sources index f80ab28..575aeda 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -2b8f2c6921953c7a1472b54fd6dfe495 opendnssec-1.4.4.tar.gz +76eb0e2165de2081f5018ab04ec532aa opendnssec-1.4.5.tar.gz From d32888b9c23cd9eea5fe36f8f23f3e47d9ff1ceb Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 18 Apr 2014 13:07:59 -0400 Subject: [PATCH 30/37] * Fri Apr 18 2014 Paul Wouters - 1.4.5-2 - Added patch for serial 0 bug in XFR adapter - Add redhat-rpm-config buildrequire to ensure debug package --- opendnssec-2.4.5-serial0.patch | 13 +++++++++++++ opendnssec.spec | 12 ++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 opendnssec-2.4.5-serial0.patch diff --git a/opendnssec-2.4.5-serial0.patch b/opendnssec-2.4.5-serial0.patch new file mode 100644 index 0000000..b587e04 --- /dev/null +++ b/opendnssec-2.4.5-serial0.patch @@ -0,0 +1,13 @@ +diff -Naur opendnssec-1.4.5-orig/signer/src/adapter/addns.c opendnssec-1.4.5/signer/src/adapter/addns.c +--- opendnssec-1.4.5-orig/signer/src/adapter/addns.c 2014-03-25 06:45:44.000000000 +0000 ++++ opendnssec-1.4.5/signer/src/adapter/addns.c 2014-04-18 16:26:39.079974120 +0000 +@@ -243,7 +243,8 @@ + tmp_serial = + ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL)); + old_serial = adapi_get_serial(zone); +- if (!util_serial_gt(tmp_serial, old_serial)) { ++ if (!util_serial_gt(tmp_serial, old_serial) ++ && zone->db->is_initialized) { + ods_log_info("[%s] zone %s is already up to date, have " + "serial %u, got serial %u", adapter_str, zone->name, + old_serial, tmp_serial); diff --git a/opendnssec.spec b/opendnssec.spec index 826d6b8..f8bbaa9 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.5 -Release: 1%{?prever}%{?dist} +Release: 2%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -14,6 +14,8 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml +Patch1: opendnssec-2.4.5-serial0.patch + Group: Applications/System Requires: opencryptoki, softhsm BuildRequires: libxml2, libxslt @@ -22,6 +24,8 @@ BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen # It tests for pkill/killall and would use /bin/false if not found BuildRequires: procps +# or else no debug package on epel6 +BuildRequires: redhat-rpm-config Requires(pre): shadow-utils %if 0%{?prever:1} @@ -38,7 +42,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %setup -q -n %{name}-%{version}%{?prever} # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in - +%patch1 -p1 %build export LDFLAGS="-Wl,-z,relro,-z,now -pie" @@ -122,6 +126,10 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Fri Apr 18 2014 Paul Wouters - 1.4.5-2 +- Added patch for serial 0 bug in XFR adapter +- Add redhat-rpm-config buildrequire to ensure debug package + * Fri Apr 18 2014 Paul Wouters - 1.4.5-1 - Updated to 1.4.5 From 9b9c5dadc99367adfdd2bfb5e4d6fa9d499541fb Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Fri, 18 Apr 2014 14:10:00 -0400 Subject: [PATCH 31/37] rename patch file for next build --- ...dnssec-2.4.5-serial0.patch => opendnssec-1.4.5-serial0.patch | 0 opendnssec.spec | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename opendnssec-2.4.5-serial0.patch => opendnssec-1.4.5-serial0.patch (100%) diff --git a/opendnssec-2.4.5-serial0.patch b/opendnssec-1.4.5-serial0.patch similarity index 100% rename from opendnssec-2.4.5-serial0.patch rename to opendnssec-1.4.5-serial0.patch diff --git a/opendnssec.spec b/opendnssec.spec index f8bbaa9..767baeb 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -14,7 +14,7 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml -Patch1: opendnssec-2.4.5-serial0.patch +Patch1: opendnssec-1.4.5-serial0.patch Group: Applications/System Requires: opencryptoki, softhsm From f39f31d1e0ba9d635f6989d39605d56656f9d168 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Wed, 20 Aug 2014 12:06:07 -0400 Subject: [PATCH 32/37] - Updated to 1.4.6 --- .gitignore | 1 + opendnssec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 48f0fb6..cf0a372 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /opendnssec-1.4.3.tar.gz /opendnssec-1.4.4.tar.gz /opendnssec-1.4.5.tar.gz +/opendnssec-1.4.6.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 767baeb..201d21f 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,8 +3,8 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 1.4.5 -Release: 2%{?prever}%{?dist} +Version: 1.4.6 +Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -126,6 +126,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Wed Aug 20 2014 Paul Wouters - 1.4.6-1 +- Updated to 1.4.6 + * Fri Apr 18 2014 Paul Wouters - 1.4.5-2 - Added patch for serial 0 bug in XFR adapter - Add redhat-rpm-config buildrequire to ensure debug package diff --git a/sources b/sources index 575aeda..fa56547 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -76eb0e2165de2081f5018ab04ec532aa opendnssec-1.4.5.tar.gz +d241a6e4660aad92044f61568d32d4dd opendnssec-1.4.6.tar.gz From de37ee60cf6ac0d20a70ead4aa3d571a1d2b79e6 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Wed, 20 Aug 2014 12:34:56 -0400 Subject: [PATCH 33/37] remove obsoleted patch --- opendnssec.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/opendnssec.spec b/opendnssec.spec index 201d21f..ae54f3a 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -14,7 +14,6 @@ Source3: ods.sysconfig Source4: conf.xml Source5: opendnssec.cron Source6: kasp.xml -Patch1: opendnssec-1.4.5-serial0.patch Group: Applications/System Requires: opencryptoki, softhsm @@ -42,7 +41,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %setup -q -n %{name}-%{version}%{?prever} # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in -%patch1 -p1 %build export LDFLAGS="-Wl,-z,relro,-z,now -pie" @@ -128,6 +126,7 @@ fi %changelog * Wed Aug 20 2014 Paul Wouters - 1.4.6-1 - Updated to 1.4.6 +- Removed merged in patch * Fri Apr 18 2014 Paul Wouters - 1.4.5-2 - Added patch for serial 0 bug in XFR adapter From 8739ab95cc308f1353b17da04a17656a9a8c2b10 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 9 Jun 2015 11:50:31 -0400 Subject: [PATCH 34/37] * Tue Jun 09 2015 Paul Wouters - 1.4.7-1 - Updated to 1.4.7 - Create slot as ods user, not root. - Added the extract patches from the fedora branch --- .gitignore | 1 + opendnssec-1.4.7-extract.patch | 156 +++++++++++++++++++++++++++++++++ opendnssec.spec | 13 ++- sources | 2 +- 4 files changed, 169 insertions(+), 3 deletions(-) create mode 100644 opendnssec-1.4.7-extract.patch diff --git a/.gitignore b/.gitignore index cf0a372..f48fdde 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /opendnssec-1.4.4.tar.gz /opendnssec-1.4.5.tar.gz /opendnssec-1.4.6.tar.gz +/opendnssec-1.4.7.tar.gz diff --git a/opendnssec-1.4.7-extract.patch b/opendnssec-1.4.7-extract.patch new file mode 100644 index 0000000..2b96715 --- /dev/null +++ b/opendnssec-1.4.7-extract.patch @@ -0,0 +1,156 @@ +diff -Naur opendnssec-1.4.7-orig/conf/conf.rnc opendnssec-1.4.7/conf/conf.rnc +--- opendnssec-1.4.7-orig/conf/conf.rnc 2014-12-04 10:17:40.000000000 -0500 ++++ opendnssec-1.4.7/conf/conf.rnc 2014-12-08 22:49:16.100212010 -0500 +@@ -50,7 +50,10 @@ + element RequireBackup { empty }?, + + # Do not maintain public keys in the repository (optional) +- element SkipPublicKey { empty }? ++ element SkipPublicKey { empty }?, ++ ++ # Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional) ++ element AllowExtraction { empty }? + }* + }, + +diff -Naur opendnssec-1.4.7-orig/conf/conf.rng opendnssec-1.4.7/conf/conf.rng +--- opendnssec-1.4.7-orig/conf/conf.rng 2014-12-04 10:18:39.000000000 -0500 ++++ opendnssec-1.4.7/conf/conf.rng 2014-12-08 22:49:16.105212137 -0500 +@@ -71,6 +71,12 @@ + + + ++ ++ ++ ++ ++ ++ + + + +diff -Naur opendnssec-1.4.7-orig/conf/conf.xml.in opendnssec-1.4.7/conf/conf.xml.in +--- opendnssec-1.4.7-orig/conf/conf.xml.in 2014-12-04 10:17:40.000000000 -0500 ++++ opendnssec-1.4.7/conf/conf.xml.in 2014-12-08 22:49:16.101212036 -0500 +@@ -9,6 +9,9 @@ + OpenDNSSEC + 1234 + ++ + + + +