add note on why this cannot be built - ldns is too old

- Update to 1.4.14 as first steop to migrating to 2.x

.gitignore

@@ -0,0 +1,14 @@
+/opendnssec-1.4.0b1.tar.gz
+/opendnssec-1.4.0b2.tar.gz
+/opendnssec-1.4.0rc1.tar.gz
+/opendnssec-1.4.0rc2.tar.gz
+/opendnssec-1.4.0rc3.tar.gz
+/opendnssec-1.4.0.tar.gz
+/opendnssec-1.4.1.tar.gz
+/opendnssec-1.4.3.tar.gz
+/opendnssec-1.4.4.tar.gz
+/opendnssec-1.4.5.tar.gz
+/opendnssec-1.4.6.tar.gz
+/opendnssec-1.4.7.tar.gz
+/opendnssec-1.4.9.tar.gz
+/opendnssec-1.4.14.tar.gz

conf.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<Configuration>
+
+	<RepositoryList>
+
+		<Repository name="SoftHSM">
+			<Module>/usr/lib64/softhsm/libsofthsm.so</Module>
+			<TokenLabel>OpenDNSSEC</TokenLabel>
+			<PIN>1234</PIN>
+<!--
+			# Disabled so it stores the public key in the HSM too,
+			# so bind's dnssec-signzone can be used as well
+			<SkipPublicKey/>
+-->
+		</Repository>
+
+<!--
+		<Repository name="sca6000">
+			<Module>/usr/lib64/opencryptoki/PKCS11_API.so</Module>
+			<TokenLabel>Sun Metaslot</TokenLabel>
+			<PIN>test:1234</PIN>
+			<Capacity>255</Capacity>
+			<RequireBackup/>
+			<SkipPublicKey/>
+		</Repository>
+-->
+
+	</RepositoryList>
+
+	<Common>
+		<Logging>
+			<Syslog><Facility>local0</Facility></Syslog>
+		</Logging>
+		
+		<PolicyFile>/etc/opendnssec/kasp.xml</PolicyFile>
+		<ZoneListFile>/etc/opendnssec/zonelist.xml</ZoneListFile>
+
+	<!--
+		<ZoneFetchFile>/etc/opendnssec/zonefetch.xml</ZoneFetchFile>
+	-->
+	</Common>
+
+	<Enforcer>
+		<Privileges>
+			<User>ods</User>
+			<Group>ods</Group>
+		</Privileges>
+
+		<Datastore><SQLite>/var/opendnssec/kasp.db</SQLite></Datastore>
+		<Interval>PT3600S</Interval>
+		<!-- <ManualKeyGeneration/> -->
+		<!-- <RolloverNotification>P14D</RolloverNotification> -->
+		
+		<!-- the <DelegationSignerSubmitCommand> will get all current
+		     DNSKEYs (as a RRset) on standard input
+		-->
+		<!-- <DelegationSignerSubmitCommand>/usr/sbin/eppclient</DelegationSignerSubmitCommand> -->
+	</Enforcer>
+
+	<Signer>
+		<Privileges>
+			<User>ods</User>
+			<Group>ods</Group>
+		</Privileges>
+
+		<WorkingDirectory>/var/opendnssec/tmp</WorkingDirectory>
+		<WorkerThreads>4</WorkerThreads>
+		<!-- <SignerThreads>4</SignerThreads> -->
+
+<!--
+                <Listener>
+                        <Interface><Port>53</Port></Interface>
+                </Listener>
+-->
+
+		<!-- the <NotifyCommmand> will expand the following variables:
+
+		     %zone      the name of the zone that was signed
+		     %zonefile  the filename of the signed zone
+		<NotifyCommand>sudo systemctl reload nsd.service</NotifyCommand>
+		-->
+<!--
+		<NotifyCommand>/usr/sbin/rndc reload %zone</NotifyCommand>
+-->
+	</Signer>
+
+</Configuration>

kasp.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  
+  NOTE:  The default policy below is a TEMPLATE ONLY and should be reviewed
+         before used in any production environment. The administrator should
+         consult the OpenDNSSEC documentation before changing any parameters.
+         
+         If you can read this message, it is likely that this file has not
+         been reviewed nor updated.
+
+  -->
+
+<KASP>
+
+	<Policy name="default">
+		<Description>A default policy that will amaze you and your friends</Description>
+		<Signatures>
+			<Resign>PT2H</Resign>
+			<Refresh>P3D</Refresh>
+			<Validity>
+				<Default>P7D</Default>
+				<Denial>P7D</Denial>
+			</Validity>
+			<Jitter>PT12H</Jitter>
+			<!-- two hours to avoid daylight saving disasters -->
+			<InceptionOffset>PT7200S</InceptionOffset>
+		</Signatures>
+
+		<Denial>
+			<NSEC3>
+				<!-- <OptOut/> -->
+				<Resalt>P100D</Resalt>
+				<Hash>
+					<Algorithm>1</Algorithm>
+					<Iterations>5</Iterations>
+					<Salt length="8"/>
+				</Hash>
+			</NSEC3>
+		</Denial>
+
+		<Keys>
+			<!-- Parameters for both KSK and ZSK -->
+			<TTL>PT3600S</TTL>
+			<RetireSafety>PT3600S</RetireSafety>
+			<PublishSafety>PT3600S</PublishSafety>
+			<!-- <ShareKeys/> -->
+			<Purge>P14D</Purge>
+
+			<!-- Parameters for KSK only -->
+			<KSK>
+				<Algorithm length="2048">8</Algorithm>
+				<Lifetime>P1Y</Lifetime>
+				<Repository>AEP</Repository>
+			</KSK>
+
+			<!-- Parameters for ZSK only -->
+			<ZSK>
+				<Algorithm length="1024">8</Algorithm>
+				<Lifetime>P30D</Lifetime>
+				<Repository>AEP</Repository>
+				<!-- <ManualRollover/> -->
+			</ZSK>
+		</Keys>
+
+		<Zone>
+			<PropagationDelay>PT43200S</PropagationDelay>
+			<SOA>
+				<TTL>PT3600S</TTL>
+				<Minimum>PT3600S</Minimum>
+				<Serial>unixtime</Serial>
+			</SOA>
+		</Zone>
+
+		<Parent>
+			<PropagationDelay>PT9999S</PropagationDelay>
+			<DS>
+				<TTL>PT3600S</TTL>
+			</DS>
+			<SOA>
+				<TTL>PT172800S</TTL>
+				<Minimum>PT10800S</Minimum>
+			</SOA>
+		</Parent>
+
+
+	</Policy>
+</KASP>

ods-enforcerd.init

@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+# ods-enforcerd:         Starts the OpenDNSSEC Enforcer Daemon
+#
+# chkconfig: - 13 87
+# description:  ods-enforcerd is the OpenDNSSEC DNSSEC policy enforcer daemon
+# processname: /usr/sbin/ods-enforcerd
+# config: /etc/opendnssec/conf.xml
+#
+### BEGIN INIT INFO
+# Provides: ods-enforcerd
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $network $syslog
+# Default-Stop: 0 11 89
+# Short-Description: start|stop|status|restart|try-restart| OpenDNSSEC Enforcer Daemon
+# Description: control OpenDNSSEC enforcer daemon
+### END INIT INFO
+
+# Init script default settings
+ODS_ENFORCERD_CONF="/etc/opendnssec/conf.xml"
+ODS_ENFORCERD_OPT=""
+ODS_ENFORCERD_PROG="/usr/sbin/ods-enforcerd"
+ODS_ENFORCERD_PIDFILE="/var/run/opendnssec/enforcerd.pid"
+PIDDIR="/var/run/opendnssec"
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods
+
+# Check that networking is configured.
+[ "${NETWORKING}" = "no" ] && exit 0
+
+start() {
+  # Source networking configuration.
+  [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network
+
+  # Check that networking is up
+  [ "${NETWORKING}" = "no" ] && exit 1
+
+  # Sanity checks.
+  [ -f $ODS_ENFORCERD_CONF ] || exit 5
+  [ -x $ODS_ENFORCERD_PROG ] || exit 5
+  # /var/run could (and should) be tmpfs
+  [ -d $PIDDIR ] || mkdir -p $PIDDIR
+
+  echo -n $"Starting ods-enforcerd:"
+  $ODS_ENFORCERD_PROG -c $ODS_ENFORCERD_CONF $ODS_ENFORCERD_OPT
+  RETVAL=$?
+        if [ $RETVAL -eq 0 ]; then
+           touch /var/lock/subsys/ods-enforcerd;
+           success
+           echo
+        else
+           failure
+           echo
+           exit 7;
+        fi
+  return 0;
+}
+
+stop() {
+  echo -n $"Stopping ods-enforcerd: "
+    killproc -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG
+    retval=$?
+    if [ $retval -eq 0 ] ; then
+       rm -f $ODS_ENFORCERD_PIDFILE
+       rm -f /var/lock/subsys/ods-enforcerd
+       success
+    else
+       failure
+    fi
+    echo
+    return $retval
+}
+
+restart() {
+	stop
+	start
+}
+
+RETVAL=0
+
+# See how we were called.
+case "$1" in
+  start)
+	start
+	;;
+  stop)
+	stop
+	;;
+  restart)
+	restart
+	;;
+  condrestart)
+        [ -f /var/lock/subsys/ods-enforcerd ] && restart || :
+	;;
+  status)
+	status -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG
+	;;
+  *)
+	echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+	exit 1
+esac
+
+exit $?

ods-signerd.init

@@ -0,0 +1,112 @@
+#!/bin/bash
+#
+# ods-signerd:         Starts the OpenDNSSEC Signer Daemon
+#
+# chkconfig: - 13 87
+# description:  ods-signerd is the OpenDNSSEC DNSSEC zone signer daemon
+# processname: /usr/sbin/ods-signerd
+# config: /etc/opendnssec/conf.xml
+#
+### BEGIN INIT INFO
+# Provides: ods-signerd
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $network $syslog
+# Default-Stop: 0 11 89
+# Short-Description: start|stop|status|restart|try-restart|reload|force-reload OpenDNSSEC Signer Daemon
+# Description: control OpenDNSSEC signer daemon
+### END INIT INFO
+
+# Init script default settings
+ODS_SIGNERD_CONF="/etc/opendnssec/conf.xml"
+ODS_SIGNERD_OPT=""
+ODS_SIGNERD_PROG="/usr/sbin/ods-signerd"
+ODS_SIGNER_PROG="/usr/sbin/ods-signer"
+ODS_SIGNERD_PIDFILE="/var/run/opendnssec/signerd.pid"
+PIDDIR="/var/run/opendnssec"
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods
+
+# Check that networking is configured.
+[ "${NETWORKING}" = "no" ] && exit 0
+
+start() {
+  # Source networking configuration.
+  [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network
+
+  # Check that networking is up
+  [ "${NETWORKING}" = "no" ] && exit 1
+
+  # Sanity checks.
+  [ -f $ODS_SIGNERD_CONF ] || exit 5
+  [ -x $ODS_SIGNERD_PROG ] || exit 5
+  # /var/run could (and should) be tmpfs
+  [ -d $PIDDIR ] || mkdir -p $PIDDIR
+
+  echo -n $"Starting ods-signerd:"
+# ods-signerd is lying about supporting -c conf.file option :(
+#  $ODS_SIGNERD_PROG -c $ODS_SIGNERD_CONF $ODS_SIGNERD_OPT
+  $ODS_SIGNERD_PROG $ODS_SIGNERD_OPT
+  RETVAL=$?
+        if [ $RETVAL -eq 0 ]; then
+           touch /var/lock/subsys/ods-signerd;
+           success
+           echo
+        else
+           failure
+           echo
+           exit 7;
+        fi
+  return 0;
+}
+
+stop() {
+  echo -n $"Stopping ods-signerd: "
+  #$ODS_SIGNER_PROG -c $ODS_SIGNERD_CONF stop
+  # seems that this loses our settings :(
+  /usr/sbin/ods-signer stop
+  RETVAL=$?
+  [ "$RETVAL" -eq 0 ] || killproc $ODS_SIGNERD_PROG -TERM >/dev/null 2>&1
+  if [ $RETVAL -eq 0 ] ; then
+     rm -f $ODS_SIGNERD_PIDFILE
+     rm -f /var/lock/subsys/ods-signerd
+     success
+  else
+     failure
+  fi
+  echo
+  return $RETVAL
+}
+
+restart() {
+	stop
+	start
+}
+
+RETVAL=0
+
+# See how we were called.
+case "$1" in
+  start)
+	start
+	;;
+  stop)
+	stop
+	;;
+  restart)
+	restart
+	;;
+  condrestart)
+        [ -f /var/lock/subsys/ods-signerd ] && restart || :
+	;;
+  status)
+	status -p $ODS_SIGNERD_PIDFILE $ODS_SIGNERD_PROG
+	;;
+  *)
+	echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+	exit 1
+esac
+
+exit $?

ods.sysconfig

@@ -0,0 +1,2 @@
+ODS_SIGNERD_OPT=""
+ODS_ENFORCERD_OPT=""

opendnssec-1.4.0b1-nonempty-terminals.patch

@@ -0,0 +1,54 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c	2012-11-23 11:17:00.752148535 -0500
++++ opendnssec-1.4.0b1/signer/src/signer/domain.c	2012-11-23 11:23:00.243158628 -0500
+@@ -399,6 +399,7 @@
+ {
+     ldns_rbnode_t* n = LDNS_RBTREE_NULL;
+     domain_type* d = NULL;
++    int unsigned_delegpt = 1;
+ 
+     ods_log_assert(domain);
+     if (domain->rrsets) {
+@@ -411,20 +412,15 @@
+             break;
+         }
+         if (d->rrsets) {
+-            if (domain_is_delegpt(d) == LDNS_RR_TYPE_NS) {
+-                /* domain has unsigned delegation */
+-                return 1;
+-            } else {
+-                /* domain has authoritative data or signed delegation */
++	if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS) {
++		/* domain has signed delegation/auth */
+                 return 0;
+             }
+         }
+         /* maybe there is data at the next domain */
+         n = ldns_rbtree_next(n);
+     }
+-    ods_log_warning("[%s] encountered empty terminal that is treated as "
+-        "non-terminal", dname_str);
+-    return 0;
++    return unsigned_delegpt;
+ }
+ 
+ 
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c opendnssec-1.4.0b1/signer/src/signer/namedb.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c	2012-08-28 09:43:15.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/namedb.c	2012-11-23 11:23:39.420172841 -0500
+@@ -788,13 +788,13 @@
+     if (!db || !db->domains) {
+         return;
+     }
+-    node = ldns_rbtree_first(db->domains);
++    node = ldns_rbtree_last(db->domains);
+     if (!node || node == LDNS_RBTREE_NULL) {
+         return;
+     }
+     while (node && node != LDNS_RBTREE_NULL) {
+         domain = (domain_type*) node->data;
+-        node = ldns_rbtree_next(node);
++        node = ldns_rbtree_previous(node);
+         domain_diff(domain, is_ixfr);
+         domain = namedb_del_denial_trigger(db, domain, 0);
+         if (domain) {

opendnssec-1.4.0b1-r6816.patch

@@ -0,0 +1,62 @@
+Index: OpenDNSSEC/enforcer/enforcerd/enforcer.c
+===================================================================
+--- OpenDNSSEC/enforcer/enforcerd/enforcer.c	(revision 6815)
++++ OpenDNSSEC/enforcer/enforcerd/enforcer.c	(revision 6816)
+@@ -1293,7 +1293,7 @@
+                 {
+                     int NewDS;
+                     status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
+-                    if (status2 != 0) {
++                    if (status2 == 0) {
+                         /* If the DS set changed then log/do something about it */
+                         if (NewDS == 1) {
+                             log_msg(config, LOG_INFO, "DSChanged");
+@@ -1655,8 +1655,11 @@
+         if (system(signer_command))
+         {
+             log_msg(NULL, LOG_ERR, "Could not call signer engine to update all zones");
+-            log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update --all' to manually update all zones");
++            log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update all zones", signer_command);
+         }
++        else {
++            log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++        }
+ 
+         StrFree(signer_command);
+     } else {
+@@ -1693,8 +1696,8 @@
+                                round potentially different behaviour of rename over existing
+                                file.) */
+     int     gencnt;         /* Number of keys in generate state */
++    char *signer_command;   /* how we will call the signer */
+ #ifndef ENFORCER_USE_WORKERS
+-    char *signer_command;   /* how we will call the signer */
+     int     NewDS = 0;      /* Did we change the DS Set in any way? */
+ #endif
+     char*   datetime = DtParseDateTimeString("now");
+@@ -1954,7 +1957,6 @@
+             return -1;
+         }
+ 
+-#ifndef ENFORCER_USE_WORKERS
+         if (*signer_flag == 1) {
+             /* call the signer engine to tell it that something changed */
+             /* TODO for beta version connect straight to the socket
+@@ -1970,13 +1972,15 @@
+             if (status != 0)
+             {
+                 log_msg(NULL, LOG_ERR, "Could not call signer engine");
+-                log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update' to manually update zones");
++                log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update the zone", signer_command);
+                 *signer_flag = 0;
+             }
++            else {
++                log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++            }
+ 
+             StrFree(signer_command);
+         }
+-#endif
+     }
+     else {
+         log_msg(NULL, LOG_INFO, "No change to: %s", current_filename);

opendnssec-1.4.0b1-r6817.patch

@@ -0,0 +1,48 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c opendnssec-1.4.0b1/signer/src/signer/rrset.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c	2012-08-28 10:00:54.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/rrset.c	2012-11-10 17:16:44.250226281 -0500
+@@ -32,6 +32,7 @@
+  */
+ 
+ #include "config.h"
++#include "shared/file.h"
+ #include "shared/hsm.h"
+ #include "shared/log.h"
+ #include "shared/util.h"
+@@ -557,6 +558,26 @@
+ 
+ 
+ /**
++ * Is the RRset signed with this locator?
++ *
++ */
++static int
++rrset_siglocator(rrset_type* rrset, const char* locator)
++{
++    size_t i = 0;
++    if (!rrset) {
++        return 0;
++    }
++    for (i=0; i < rrset->rrsig_count; i++) {
++        if (!ods_strcmp(locator, rrset->rrsigs[i].key_locator)) {
++            return 1;
++        }
++    }
++    return 0;
++}
++
++
++/**
+  * Transmogrify the RRset to a RRlist.
+  *
+  */
+@@ -702,6 +723,9 @@
+             continue;
+         }
+         /* Additional rules for signatures */
++        if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) {
++            continue;
++        }
+         if (rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) {
+             continue;
+         }

opendnssec-1.4.5-serial0.patch

@@ -0,0 +1,13 @@
+diff -Naur opendnssec-1.4.5-orig/signer/src/adapter/addns.c opendnssec-1.4.5/signer/src/adapter/addns.c
+--- opendnssec-1.4.5-orig/signer/src/adapter/addns.c	2014-03-25 06:45:44.000000000 +0000
++++ opendnssec-1.4.5/signer/src/adapter/addns.c	2014-04-18 16:26:39.079974120 +0000
+@@ -243,7 +243,8 @@
+             tmp_serial =
+                 ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
+             old_serial = adapi_get_serial(zone);
+-            if (!util_serial_gt(tmp_serial, old_serial)) {
++            if (!util_serial_gt(tmp_serial, old_serial)
++		&& zone->db->is_initialized) {
+                 ods_log_info("[%s] zone %s is already up to date, have "
+                     "serial %u, got serial %u", adapter_str, zone->name,
+                     old_serial, tmp_serial);

opendnssec-1.4.7-extract.patch

@@ -0,0 +1,156 @@
+diff -Naur opendnssec-1.4.7-orig/conf/conf.rnc opendnssec-1.4.7/conf/conf.rnc
+--- opendnssec-1.4.7-orig/conf/conf.rnc	2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.rnc	2014-12-08 22:49:16.100212010 -0500
+@@ -50,7 +50,10 @@
+ 			element RequireBackup { empty }?,
+ 
+ 			# Do not maintain public keys in the repository (optional)
+-			element SkipPublicKey { empty }?
++			element SkipPublicKey { empty }?,
++
++			# Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional)
++			element AllowExtraction { empty }?
+ 		}*
+ 	},
+ 
+diff -Naur opendnssec-1.4.7-orig/conf/conf.rng opendnssec-1.4.7/conf/conf.rng
+--- opendnssec-1.4.7-orig/conf/conf.rng	2014-12-04 10:18:39.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.rng	2014-12-08 22:49:16.105212137 -0500
+@@ -71,6 +71,12 @@
+                 <empty/>
+               </element>
+             </optional>
++            <optional>
++              <!-- Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional) -->
++              <element name="AllowExtraction">
++                <empty/>
++              </element>
++            </optional>
+           </element>
+         </zeroOrMore>
+       </element>
+diff -Naur opendnssec-1.4.7-orig/conf/conf.xml.in opendnssec-1.4.7/conf/conf.xml.in
+--- opendnssec-1.4.7-orig/conf/conf.xml.in	2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.xml.in	2014-12-08 22:49:16.101212036 -0500
+@@ -9,6 +9,9 @@
+ 			<TokenLabel>OpenDNSSEC</TokenLabel>
+ 			<PIN>1234</PIN>
+ 			<SkipPublicKey/>
++			<!--
++			<AllowExtraction/>
++			-->
+ 		</Repository>
+ 
+ <!--
+diff -Naur opendnssec-1.4.7-orig/libhsm/src/lib/libhsm.c opendnssec-1.4.7/libhsm/src/lib/libhsm.c
+--- opendnssec-1.4.7-orig/libhsm/src/lib/libhsm.c	2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/libhsm/src/lib/libhsm.c	2014-12-08 22:49:16.102212061 -0500
+@@ -504,6 +504,7 @@
+ hsm_config_default(hsm_config_t *config)
+ {
+     config->use_pubkey = 1;
++    config->allow_extract = 0;
+ }
+ 
+ /* creates a session_t structure, and automatically adds and initializes
+@@ -2054,6 +2055,8 @@
+                     module_pin = (char *) xmlNodeGetContent(curNode);
+                 if (xmlStrEqual(curNode->name, (const xmlChar *)"SkipPublicKey"))
+                     module_config.use_pubkey = 0;
++                if (xmlStrEqual(curNode->name, (const xmlChar *)"AllowExtraction"))
++                    module_config.allow_extract = 1;
+                 curNode = curNode->next;
+             }
+ 
+@@ -2341,10 +2344,12 @@
+     CK_BBOOL ctrue = CK_TRUE;
+     CK_BBOOL cfalse = CK_FALSE;
+     CK_BBOOL ctoken = CK_TRUE;
++    CK_BBOOL cextractable = CK_FALSE;
+ 
+     if (!ctx) ctx = _hsm_ctx;
+     session = hsm_find_repository_session(ctx, repository);
+     if (!session) return NULL;
++    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
+ 
+     /* check whether this key doesn't happen to exist already */
+     do {
+@@ -2380,7 +2385,7 @@
+         { CKA_SENSITIVE,   &ctrue,   sizeof (ctrue) },
+         { CKA_TOKEN,       &ctrue,   sizeof (ctrue)  },
+         { CKA_PRIVATE,     &ctrue,   sizeof (ctrue)  },
+-        { CKA_EXTRACTABLE, &cfalse,  sizeof (cfalse) }
++        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }
+     };
+ 
+     rv = ((CK_FUNCTION_LIST_PTR)session->module->sym)->C_GenerateKeyPair(session->session,
+@@ -2420,6 +2425,7 @@
+     CK_OBJECT_HANDLE domainPar, publicKey, privateKey;
+     CK_BBOOL ctrue = CK_TRUE;
+     CK_BBOOL cfalse = CK_FALSE;
++    CK_BBOOL cextractable = CK_FALSE;
+ 
+     /* ids we create are 16 bytes of data */
+     unsigned char id[16];
+@@ -2466,12 +2472,13 @@
+         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },
+         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },
+         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },
+-        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }
++        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }
+     };
+ 
+     if (!ctx) ctx = _hsm_ctx;
+     session = hsm_find_repository_session(ctx, repository);
+     if (!session) return NULL;
++    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
+ 
+     /* check whether this key doesn't happen to exist already */
+ 
+@@ -2533,6 +2540,7 @@
+     CK_OBJECT_HANDLE publicKey, privateKey;
+     CK_BBOOL ctrue = CK_TRUE;
+     CK_BBOOL cfalse = CK_FALSE;
++    CK_BBOOL cextractable = CK_FALSE;
+ 
+     /* ids we create are 16 bytes of data */
+     unsigned char id[16];
+@@ -2569,12 +2577,13 @@
+         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },
+         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },
+         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },
+-        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }
++        { CKA_EXTRACTABLE,         &cextractable,  sizeof (cextractable) }
+     };
+ 
+     if (!ctx) ctx = _hsm_ctx;
+     session = hsm_find_repository_session(ctx, repository);
+     if (!session) return NULL;
++    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
+ 
+     /* check whether this key doesn't happen to exist already */
+ 
+diff -Naur opendnssec-1.4.7-orig/libhsm/src/lib/libhsm.h opendnssec-1.4.7/libhsm/src/lib/libhsm.h
+--- opendnssec-1.4.7-orig/libhsm/src/lib/libhsm.h	2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/libhsm/src/lib/libhsm.h	2014-12-08 22:49:16.102212061 -0500
+@@ -75,6 +75,7 @@
+ /*! HSM configuration */
+ typedef struct {
+     unsigned int use_pubkey;     /*!< Maintain public keys in HSM */
++    unsigned int allow_extract;  /*!< Generate CKA_EXTRACTABLE private keys */
+ } hsm_config_t;
+ 
+ /*! Data type to describe an HSM */
+diff -Naur opendnssec-1.4.7-orig/NEWS opendnssec-1.4.7/NEWS
+--- opendnssec-1.4.7-orig/NEWS	2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/NEWS	2014-12-08 22:50:00.560342544 -0500
+@@ -1,3 +1,9 @@
++
++Fedora patch:
++* Enforcer: New repository option <AllowExtraction/> allows to generate keys
++  with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped
++  and extracted from HSM.
++
+ OpenDNSSEC 1.4.7 - 2014-12-04
+ 
+ Bugfixes:

opendnssec-LICENSE

@@ -0,0 +1,25 @@
+$Id: LICENSE 6226 2012-03-26 17:25:52Z jakob $
+
+Copyright (c) 2012 OpenDNSSEC AB (svb). All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

opendnssec-aggressive-retry.patch

@@ -0,0 +1,15 @@
+diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c
+--- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c	2012-08-02 16:57:01.000000000 -0400
++++ opendnssec-1.4.0a3/signer/src/daemon/worker.c	2012-08-20 15:41:34.665175565 -0400
+@@ -173,7 +173,11 @@
+          * lets take a small break to not hog CPU.
+          */
+         if (status == ODS_STATUS_UNCHANGED) {
++#if 0
+             worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60);
++#else
++            worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5);
++#endif
+         }
+         lock_basic_unlock(&q->q_lock);
+     }

opendnssec-ksk-premature-retirement.patch

@@ -0,0 +1,20 @@
+--- enforcer/enforcerd/enforcer.c   (revision 6951)
++++ enforcer/enforcerd/enforcer.c   (revision 6952)
+@@ -1291,7 +1291,7 @@
+                 /* turn this zone and policy into a file */
+ #ifdef ENFORCER_USE_WORKERS
+                 {
+-                    int NewDS;
++                    int NewDS = 0;
+                     status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
+                     if (status2 == 0) {
+                         /* If the DS set changed then log/do something about it */
+--- NEWS    (revision 6951)
++++ NEWS    (revision 6952)
+@@ -1,5 +1,7 @@
+ $Id: NEWS 6934 2013-01-10 14:32:16Z jerry $
+ 
++* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired.
++
+ 
+ OpenDNSSEC 1.4.0rc1 - 2013-01-10

opendnssec.cron

@@ -0,0 +1,4 @@
+# Ensure multiple ods-enforcerd's on different system roll at the same time
+# independant of when the daemon was started. Since TLDs often update their
+# zone "on the hour" we do the key rollover checks just before the hour.
+50,20 * * * * root test -f /var/lock/subsys/ods-enforcerd && kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null

opendnssec.spec

@@ -0,0 +1,264 @@
+#global prever rc3
+%global _hardened_build 1
+
+Summary: DNSSEC key and zone management software
+Name: opendnssec
+Version: 1.4.14
+Release: 1%{?prever}%{?dist}
+License: BSD
+Url: http://www.opendnssec.org/
+Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
+Source1: ods-enforcerd.init
+Source2: ods-signerd.init
+Source3: ods.sysconfig
+Source4: conf.xml
+Source5: opendnssec.cron
+Source6: kasp.xml
+
+Group: Applications/System
+Requires: opencryptoki, softhsm
+BuildRequires: libxml2, libxslt
+Requires: libxml2, libxslt
+BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel
+BuildRequires: libxml2-devel CUnit-devel, doxygen
+# It tests for pkill/killall and would use /bin/false if not found
+BuildRequires: procps
+# or else no debug package on epel6
+BuildRequires: redhat-rpm-config
+
+Requires(pre): shadow-utils
+%if 0%{?prever:1}
+# For building snapshots
+Buildrequires: autoconf, automake, libtool, java
+%endif
+
+%description
+OpenDNSSEC was created as an open-source turn-key solution for DNSSEC.
+It secures zone data just before it is published in an authoritative
+name server. It requires a PKCS#11 crypto module library, such as softhsm
+
+%prep
+%setup -q -n %{name}-%{version}%{?prever}
+# bump default policy ZSK keysize to 2048
+sed -i "s/1024/2048/" conf/kasp.xml.in
+
+%build
+export LDFLAGS="-Wl,-z,relro,-z,now -pie"
+export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security"
+
+%configure --with-ldns=%{_libdir}
+make %{?_smp_mflags}
+
+%check
+# Requires sample db not shipped with upstream
+# make check
+
+%install
+rm -rf %{buildroot}
+make DESTDIR=%{buildroot} install
+mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf}
+mkdir -p %{buildroot}/%{_initrddir}
+install -p -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd
+install -p -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd
+install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/
+install -p -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
+
+# cleanup sample files
+rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample
+install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig
+install -p -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
+install -p -m 0644 %{SOURCE4} %{SOURCE6} %{buildroot}/%{_sysconfdir}/opendnssec/
+mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
+
+%files
+%attr(0755,root,root) %{_initrddir}/ods-enforcerd
+%attr(0755,root,root) %{_initrddir}/ods-signerd
+%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec
+%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec
+%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp
+%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signed
+%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf
+%attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods
+%attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec
+%attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec
+%doc NEWS README.md LICENSE
+%{_mandir}/*/*
+%{_sbindir}/*
+%{_bindir}/*
+%attr(0755,root,root) %dir %{_datadir}/%{name}
+%{_datadir}/%{name}/*
+
+%pre
+getent group ods >/dev/null || groupadd -r ods
+getent passwd ods >/dev/null || \
+useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
+-c "opendnssec daemon account" ods
+exit 0
+
+%post
+/sbin/chkconfig --add ods-enforcerd
+/sbin/chkconfig --add ods-signerd
+# Initialise a slot on the softhsm on first install
+if [ "$1" -eq 1 ]; then
+    if [ ! -f /var/softhsm/slot0.db ]; then
+        %{_sbindir}/runuser -u ods -- softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
+    fi
+fi
+# in case we update any xml conf file
+ods-ksmutil update all >/dev/null 2>/dev/null ||:
+
+%preun
+if [ $1 -eq 0 ]; then
+  /sbin/service ods-signerd stop >/dev/null 2>&1 ||:
+  /sbin/service ods-enforcerd stop >/dev/null 2>&1 ||:
+  /sbin/chkconfig --del ods-enforcerd
+  /sbin/chkconfig --del ods-signerd
+fi
+
+%postun
+if [ "$1" -ge "1" ]; then
+  ods-ksmutil update all >/dev/null 2>/dev/null ||:
+  /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 ||:
+  /sbin/service ods-signerd condrestart >/dev/null 2>&1 ||:
+fi
+
+%changelog
+* Tue Dec 12 2017 Paul Wouters <pwouters@redhat.com> - 1.4.14-1
+- Update to 1.4.14 as first steop to migrating to 2.x
+  [this version cannot be build until ldns-1.6.17 appears in el6]
+
+* Mon Feb 01 2016 Paul Wouters <pwouters@redhat.com> - 1.4.9-1
+- Updated to 1.4.9
+- Removed merged in patch
+
+* Tue Jun 09 2015 Paul Wouters <pwouters@redhat.com> - 1.4.7-1
+- Updated to 1.4.7 (fix zone update can get stuck, crash on retransfer cmd)
+- Create slot as ods user, not root.
+- Added the extract patches from the fedora branch
+
+* Wed Aug 20 2014 Paul Wouters <pwouters@redhat.com> - 1.4.6-1
+- Updated to 1.4.6
+- Removed merged in patch
+
+* Fri Apr 18 2014 Paul Wouters <pwouters@redhat.com> - 1.4.5-2
+- Added patch for serial 0 bug in XFR adapter
+- Add redhat-rpm-config buildrequire to ensure debug package
+
+* Fri Apr 18 2014 Paul Wouters <pwouters@redhat.com> - 1.4.5-1
+- Updated to 1.4.5
+
+* Tue Apr 01 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-3
+- Add buildrequires for ods-kasp2html (rhbz#1073313)
+
+* Fri Mar 28 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-2
+- Add requires for ods-kasp2html (rhbz#1073313)
+- Updated to 1.4.4 (rhbz#1080862)
+  (compatibility with non RFC 5155 errata 3441 implementations)
+- Change the default ZSK policy from 1024 to 2048 bit RSA keys
+- Fix post to be quiet when upgrading opendnssec
+
+* Thu Jan 09 2014 Paul Wouters <pwouters@redhat.com> - 1.4.3-1
+- Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements
+
+* Wed Sep 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.2-1
+- Updated to 1.4.2, bugfix release
+
+* Fri Jun 28 2013 Paul Wouters <pwouters@redhat.com> - 1.4.1-1
+- Updated to 1.4.1, bugfixes for NSEC3 and serial handling
+
+* Sat May 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-1
+- Updated to 1.4.0
+- Enabled full relro/pie protection
+
+* Mon Apr 15 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.8.rc3
+- Updated to 1.4.0rc3
+
+* Mon Jan 28 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.7.rc2
+- Updaed to 1.4.0rc2
+- This merges in r6952
+
+* Fri Jan 18 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.6.rc1
+- Updated to 1.4.0rc1
+- Applied opendnssec-ksk-premature-retirement.patch (svn r6952)
+
+* Tue Dec 18 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.6.b2
+- Updated to 1.4.0b2
+- All patches synced to/from with new release
+
+* Fri Nov 23 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.6.b1
+- Patch for empty nonterminal NSEC3 records
+
+* Sat Nov 10 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.5.b1
+- Patch r6816 fixes enforcer/signer communication
+- Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset
+
+* Tue Oct 30 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.4.b1
+- Added BuildRequires: procps-ng for bug OPENDNSSEC-345
+- Change RRSIG inception offset to -2h to avoid possible
+  daylight saving issues on resolvers
+- Patch to prevent removal of occluded data
+
+* Wed Sep 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.2.b1
+- Just an EVR fix to the proper standard
+- Remove accidentally added (but not released) Epoch:
+- Minor spec file cleanup
+
+* Wed Sep 12 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.b1.1
+- Updated to 1.4.0b1
+- Patch to more aggressively try to take lock for resigning
+- Patch to give NSEC3PARAM record a TTL=0
+
+* Tue Aug 07 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a3.2
+- Updated to 1.4.0a3
+- Added opendnssec.cron to sync key rollovers over multiple servers
+- Removed merged in patch.
+- Added patch for cpu lock from trunk
+- Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade)
+
+* Wed May 16 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.4
+- Missed the actual patch line, so previous build did not have the patch
+
+* Tue Apr 17 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.3
+- Remove bad artifact dependancy on systemd-units from Fedora branch
+
+* Thu Mar 29 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.2
+- Added opendnssec LICENSE file from trunk (Thanks Jakob!)
+- Convert back to sysv for EL5/EL6 repos
+
+* Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.1
+- Fix macros in comment
+- Added missing -m to install target
+
+* Sun Mar 25 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1
+- The 1.4.x branch no longer needs ruby, as the auditor has been removed
+- Added missing openssl-devel BuildRequire
+- Comment out <SkipPublicKey/> so keys generated by ods can be used by bind
+
+* Fri Feb 24 2012 Paul Wouters <pwouters@redhat.com> - 1.3.6-3
+- Requires rubygem-soap4r when using ruby-1.9
+- Don't ghost /var/run/opendnssec
+- Converted initd to systemd
+
+* Thu Nov 24 2011 root - 1.3.2-6
+- Added rubygem-dnsruby requires as rpm does not pick it up automatically
+
+* Tue Nov 22 2011 root - 1.3.2-5
+- Added /var/opendnssec/signconf/ /as this temp dir is needed
+
+* Mon Nov 21 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-4
+- Added /var/opendnssec/signed/ as this is the default output dir
+
+* Sun Nov 20 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-3
+- Add ods user for opendnssec tasks
+- Added initscripts and services for ods-signerd and ods-enforcerd
+- Initialise OpenDNSSEC softhsm token on first install
+
+* Wed Oct 05 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-1
+- Updated to 1.3.2
+- Added dependancies on opencryptoki and softhsm
+- Don't install duplicate unreadable .sample files
+- Fix upstream conf.xml to point to actually used library paths
+
+* Thu Mar  3 2011 Paul Wouters <paul@xelerance.com> - 1.2.0-1
+- Initial package for Fedora

sources

@@ -0,0 +1 @@
+SHA512 (opendnssec-1.4.14.tar.gz) = b814d13ef95dcf238f3e9d6bb3dc489328d7a4a5db9e32214ac29716043f9e635e62fb3795b9d5d75e8215373f9330ea5a17840830f5e467067f305a610bee6b