rpms/opendnssec
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: rpms:rawhide
Branches Tags
rpms:rawhide
rpms:f43
rpms:main
rpms:f41
rpms:f42
rpms:f40
rpms:f39
rpms:f38
rpms:f37
rpms:f36
rpms:f35
rpms:f34
rpms:f33
rpms:f32
rpms:f31
rpms:f30
rpms:f29
rpms:f28
rpms:el6
rpms:f26
rpms:f27
rpms:f25
rpms:f23
rpms:f24
rpms:f22
rpms:f21
rpms:f20
rpms:f19
rpms:f18
rpms:f17
rpms:f16
rpms:el5
..
compare: rpms:f29
Branches Tags
rpms:f43
rpms:main
rpms:rawhide
rpms:f41
rpms:f42
rpms:f40
rpms:f39
rpms:f38
rpms:f37
rpms:f36
rpms:f35
rpms:f34
rpms:f33
rpms:f32
rpms:f31
rpms:f30
rpms:f29
rpms:f28
rpms:el6
rpms:f26
rpms:f27
rpms:f25
rpms:f23
rpms:f24
rpms:f22
rpms:f21
rpms:f20
rpms:f19
rpms:f18
rpms:f17
rpms:f16
rpms:el5

No commits in common. "rawhide" and "f29" have entirely different histories.
rawhide ... f29

15 changed files with 36 additions and 1262 deletions
Download patch file Download diff file Expand all files Collapse all files

11
.gitignore vendored
View file

@ -15,14 +15,3 @@
/opendnssec-1.4.7.tar.gz
/opendnssec-1.4.9.tar.gz
/opendnssec-1.4.14.tar.gz
/opendnssec-2.1.6.tar.gz
/opendnssec-2.1.7.tar.gz
/opendnssec-2.1.8.tar.gz
/opendnssec-2.1.9.tar.gz
/opendnssec-2.1.9.tar.gz.sig
/opendnssec-2.1.10.tar.gz.sig
/opendnssec-2.1.10.tar.gz
/opendnssec-2.1.14rc1.tar.gz
/opendnssec-2.1.14rc1.tar.gz.sig
/opendnssec-2.1.14.tar.gz
/opendnssec-2.1.14.tar.gz.sig

35
0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
View file

@ -1,35 +0,0 @@
From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Mon, 30 Jan 2023 11:44:49 +0200
Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle
string fortification
When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc
will cut few bytes off the string buffer for prevention of buffer
overruns. As a result, hsm_hex_unparse() will call into snprintf() with
a buffer length bigger than the size of the buffer as seen by the
GCC/glibc pair.
See also: https://pagure.io/freeipa/issue/9312
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
libhsm/src/lib/libhsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c
index 88dc79e31..8f1e0c3bc 100644
--- a/libhsm/src/lib/libhsm.c
+++ b/libhsm/src/lib/libhsm.c
@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len)
size_t i;
for (i = 0; i < len; i++) {
- snprintf(dst + (2*i), dst_len, "%02x", src[i]);
+ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]);
}
dst[len*2] = '\0';
}
--
2.39.0

1
conf.xml
View file

@ -48,6 +48,7 @@
</Privileges>
<Datastore><SQLite>/var/opendnssec/kasp.db</SQLite></Datastore>
<Interval>PT3600S</Interval>
<!-- <ManualKeyGeneration/> -->
<!-- <RolloverNotification>P14D</RolloverNotification> -->

6
ods-enforcerd.service
View file

@ -4,13 +4,9 @@ After=syslog.target network.target
[Service]
Type=forking
User=ods
Group=ods
PIDFile=/run/opendnssec/enforcerd.pid
PIDFile=/var/run/opendnssec/enforcerd.pid
EnvironmentFile=-/etc/sysconfig/ods
ExecStart=/usr/sbin/ods-enforcerd $ODS_ENFORCERD_OPT
ExecStartPost=/bin/bash -c 'while [ ! -S /run/opendnssec/enforcer.sock ]; do sleep 1; echo "Waiting for socket"; done'
TimeoutStartSec=20
[Install]
WantedBy=multi-user.target

6
ods-signerd.service
View file

@ -1,12 +1,10 @@
[Unit]
Description=OpenDNSSEC signer daemon
After=syslog.target network.target ods-enforcerd.service
After=syslog.target network.target ods-enforcerd
[Service]
Type=simple
User=ods
Group=ods
PIDFile=/run/opendnssec/signerd.pid
PIDFile=/var/run/opendnssec/signerd.pid
EnvironmentFile=-/etc/sysconfig/ods
ExecStart=/usr/sbin/ods-signerd -d $ODS_SIGNERD_OPT

34
opendnssec-2.1.14rc1-gcc14.patch
View file

@ -1,34 +0,0 @@
From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Thu, 8 Feb 2024 13:10:53 +0200
Subject: [PATCH] Fix missing include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
scheduler/task.c: In function ‘task_perform’:
scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration]
137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF);
| ^~~~~
make[2]: *** [Makefile:600: scheduler/task.o] Error 1
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
common/scheduler/task.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/common/scheduler/task.c b/common/scheduler/task.c
index 4dcf9e900..0dfa496a2 100644
--- a/common/scheduler/task.c
+++ b/common/scheduler/task.c
@@ -40,6 +40,7 @@
#include "duration.h"
#include "file.h"
#include "log.h"
+#include "utilities.h"
static const char* task_str = "task";
static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER;
--
2.43.0

842
opendnssec-2.1.sqlite_convert.sql
View file

@ -1,842 +0,0 @@
INSERT INTO databaseVersion VALUES (NULL, 1, 1);
-- ~ ************
-- ~ ** policy table
-- ~ **
-- ~ **
-- ~ **
-- ~ **
-- ~ ************
INSERT INTO policy
SELECT id, 1, name, description,
0, 0, 0,
0, 0, 0, 0,
86400, 0, 0,
0, 0, 0,
0, 0, 0,
0, 0, 0,
0, 0, 0,
0, 0, 0,
0, 0, 0,
0, 0, 0,
0
FROM REMOTE.policies;
UPDATE policy
SET signaturesResign = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'resign');
UPDATE policy
SET signaturesRefresh = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'refresh') ;
UPDATE policy
SET signaturesJitter = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'jitter');
UPDATE policy
SET signaturesInceptionOffset = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'clockskew');
UPDATE policy
SET signaturesValidityDefault = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'valdefault');
UPDATE policy
SET signaturesValidityDenial = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 1
AND REMOTE.parameters.name = 'valdenial');
--MaxZoneTTL default 86400
-- We need the following mapping 1.4 -> 2.0 for denialType
-- 0 -> 1
-- 3 -> 0
UPDATE policy
SET denialType = (
SELECT (~value)&1
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'version');
-- I'm pretty sure this is not the correct way to do it. It is aweful but
-- I can't figure it out how it would work for sqlite.
UPDATE policy
SET denialOptout = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'optout')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'optout');
UPDATE policy
SET denialTtl = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'ttl')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'ttl');
UPDATE policy
SET denialResalt = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'resalt')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'resalt');
UPDATE policy
SET denialAlgorithm = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'algorithm')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'algorithm');
UPDATE policy
SET denialIterations = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'iterations')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'iterations');
UPDATE policy
SET denialSaltLength = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'saltlength')
WHERE null != (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 2
AND REMOTE.parameters.name = 'saltlength');
-- clumsy salt update. salt is optional in 1.4 but required in 2.0
-- sqlite is limited in what it can do in an update. I hope there is a
-- better way for this?
UPDATE policy
SET denialSalt = (
SELECT salt
FROM REMOTE.policies
WHERE REMOTE.policies.id = policy.id)
WHERE (
SELECT salt
FROM REMOTE.policies
WHERE REMOTE.policies.id = policy.id) != null;
UPDATE policy
SET denialSaltLastChange = (
SELECT salt_stamp
FROM REMOTE.policies
WHERE REMOTE.policies.id = policy.id)
WHERE (
SELECT salt_stamp
FROM REMOTE.policies
WHERE REMOTE.policies.id = policy.id) != null;
UPDATE policy
SET keysTtl = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 5
AND REMOTE.parameters.name = 'ttl');
UPDATE policy
SET keysRetireSafety = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 5
AND REMOTE.parameters.name = 'retiresafety');
UPDATE policy
SET keysPublishSafety = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 5
AND REMOTE.parameters.name = 'publishsafety');
UPDATE policy
SET keysShared = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 5
AND REMOTE.parameters.name = 'zones_share_keys');
UPDATE policy
SET keysPurgeAfter = COALESCE((
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 5
AND REMOTE.parameters.name = 'purge'), 0);
UPDATE policy
SET zonePropagationDelay = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 7
AND REMOTE.parameters.name = 'propagationdelay');
UPDATE policy
SET zoneSoaTtl = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 7
AND REMOTE.parameters.name = 'ttl');
UPDATE policy
SET zoneSoaMinimum = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 7
AND REMOTE.parameters.name = 'min');
-- Temporary mapping table between 1.4 and 2.0 SOA serial strategy
CREATE TABLE mapping (
soa14 INTEGER,
soa20 INTEGER
);
INSERT INTO mapping SELECT 1, 2;
INSERT INTO mapping SELECT 2, 0;
INSERT INTO mapping SELECT 3, 1;
INSERT INTO mapping SELECT 4, 3;
UPDATE policy
SET zoneSoaSerial = (
SELECT mapping.soa20
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
INNER JOIN mapping
ON REMOTE.parameters_policies.value = mapping.soa14
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 7
AND REMOTE.parameters.name = 'serial');
DROP TABLE mapping;
-- parentRegistrationDelay = 0 on 1.4
UPDATE policy
SET parentPropagationDelay = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 8
AND REMOTE.parameters.name = 'propagationdelay');
UPDATE policy
SET parentDsTtl = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 8
AND REMOTE.parameters.name = 'ttlds');
UPDATE policy
SET parentSoaTtl = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 8
AND REMOTE.parameters.name = 'ttl');
UPDATE policy
SET parentSoaMinimum = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policy.id
AND REMOTE.parameters.category_id = 8
AND REMOTE.parameters.name = 'min');
-- passthrough = 0
-- ~ ************
-- ~ ** policyKey table
-- ~ **
-- ~ ** For each policy in 1.4 add two keys: KSK and ZSK
-- ~ **
-- ~ **
-- ~ ************
-- Insert each KSK
INSERT INTO policyKey
SELECT null, 1, id,
1, 0, 0,
0, 0, 0,
0, 0, 4
FROM REMOTE.policies;
-- Insert each ZSK
INSERT INTO policyKey
SELECT null, 1, id,
2, 0, 0,
0, 0, 0,
0, 0, 1
FROM REMOTE.policies;
UPDATE policyKey
SET algorithm = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'algorithm')
WHERE policyKey.role = 1;
UPDATE policyKey
SET algorithm = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'algorithm')
WHERE policyKey.role = 2;
UPDATE policyKey
SET bits = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'bits')
WHERE policyKey.role = 1;
UPDATE policyKey
SET bits = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'bits')
WHERE policyKey.role = 2;
UPDATE policyKey
SET lifetime = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'lifetime')
WHERE policyKey.role = 1;
UPDATE policyKey
SET lifetime = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'lifetime')
WHERE policyKey.role = 2;
UPDATE policyKey
SET repository = (
SELECT REMOTE.securitymodules.name
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
INNER JOIN REMOTE.securitymodules
ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'repository')
WHERE policyKey.role = 1;
UPDATE policyKey
SET repository = (
SELECT REMOTE.securitymodules.name
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
INNER JOIN REMOTE.securitymodules
ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'repository')
WHERE policyKey.role = 2;
UPDATE policyKey
SET standby = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'standby')
WHERE policyKey.role = 1;
UPDATE policyKey
SET standby = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'standby')
WHERE policyKey.role = 2;
UPDATE policyKey
SET manualRollover = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 3
AND REMOTE.parameters.name = 'manual_rollover')
WHERE policyKey.role = 1;
UPDATE policyKey
SET manualRollover = (
SELECT value
FROM REMOTE.parameters_policies
INNER JOIN REMOTE.parameters
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
AND REMOTE.parameters.category_id = 4
AND REMOTE.parameters.name = 'manual_rollover')
WHERE policyKey.role = 2;
-- rfc5011 = 0. 2.0 has no support
-- minimize already set
-- ~ ************
-- ~ ** hsmKey table
-- ~ **
-- ~ ** get from keypairs and dnsseckeys
-- ~ **
-- ~ **
-- ~ ************
INSERT INTO hsmKey
SELECT DISTINCT REMOTE.keypairs.id, 1, REMOTE.keypairs.policy_id,
REMOTE.keypairs.HSMkey_id, 2, REMOTE.keypairs.size,
REMOTE.keypairs.algorithm, (~(REMOTE.dnsseckeys.keytype)&1)+1,
CASE WHEN REMOTE.keypairs.generate IS NOT NULL THEN
strftime('%s', REMOTE.keypairs.generate)
ELSE strftime("%s", "now") END,
0,
1, --only RSA supported
REMOTE.securitymodules.name,
0 --assume no backup
FROM REMOTE.keypairs
JOIN REMOTE.dnsseckeys
ON REMOTE.keypairs.id = REMOTE.dnsseckeys.keypair_id
JOIN REMOTE.securitymodules
ON REMOTE.securitymodules.id = REMOTE.keypairs.securitymodule_id;
-- For some policies put the keys in a shared state
UPDATE hsmKey
SET state = 3
WHERE EXISTS
(SELECT * FROM hsmKey AS h
JOIN policy ON policy.id = h.policyId
WHERE policy.keysShared AND hsmKey.id = h.id);
-- ~ ************
-- ~ ** zone table
-- ~ **
-- ~ **
-- ~ **
-- ~ **
-- ~ ************
INSERT INTO zone
SELECT zones.id, 1, zones.policy_id,
zones.name, 1, zones.signconf, 0,
0,0,0,
0,0,0,
zones.in_type, zones.input,
zones.out_type, zones.output,
0,0,0
FROM REMOTE.zones;
-- ~ ************
-- ~ ** keyData table
-- ~ **
-- ~ **
-- ~ **
-- ~ **
-- ~ ************
-- Temporary mapping table between 1.4 states and 2.0 ds_at_parent states
-- We are ignoring the fact this may set a DS state for a ZSK; We don't care
CREATE TABLE mapping (
state INTEGER,
ds_state INTEGER
);
INSERT INTO mapping SELECT 1, 0;
INSERT INTO mapping SELECT 2, 0;
INSERT INTO mapping SELECT 3, 1;
INSERT INTO mapping SELECT 4, 3;
INSERT INTO mapping SELECT 5, 5;
INSERT INTO mapping SELECT 6, 5;
INSERT INTO mapping SELECT 7, 5;
INSERT INTO mapping SELECT 8, 5;
INSERT INTO mapping SELECT 9, 5;
INSERT INTO mapping SELECT 10, 5;
INSERT INTO keyData
SELECT
NULL, 1, REMOTE.dnsseckeys.zone_id,
REMOTE.dnsseckeys.keypair_id, REMOTE.keypairs.algorithm,
CASE WHEN REMOTE.dnsseckeys.publish IS NOT NULL THEN
strftime('%s', REMOTE.dnsseckeys.publish)
ELSE strftime("%s", "now") END,
(~REMOTE.dnsseckeys.keytype&1)+1,
REMOTE.dnsseckeys.state <= 4, -- introducing
0, -- should revoke, not used
0, -- standby
REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 256, --activeZSK:
REMOTE.dnsseckeys.state >= 2 AND REMOTE.dnsseckeys.state <= 5, --publish
REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 257, --activeKSK:
mapping.ds_state, --dsatparent
1<<16, --keytag (crap, will 2.0 regenerate this?)
(REMOTE.dnsseckeys.keytype&1)*3+1 --minimize
FROM REMOTE.dnsseckeys
JOIN REMOTE.keypairs
ON REMOTE.dnsseckeys.keypair_id = REMOTE.keypairs.id
JOIN mapping
ON REMOTE.dnsseckeys.state = mapping.state
WHERE EXISTS(select REMOTE.zones.id FROM REMOTE.zones WHERE REMOTE.zones.id = REMOTE.dnsseckeys.zone_id);
-- Everything that is just a ZSK must not have dsatparent set.
UPDATE keyData
SET dsatparent = 0
WHERE role = 2;
DROP TABLE mapping;
-- If a active time is set for a ready KSK dsAtParent is submitted
-- instead of submit
UPDATE keyData
SET dsatparent = 2
WHERE keyData.dsAtParent = 1 AND keyData.id IN (
SELECT keyData.id
FROM keyData
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
WHERE REMOTE.dnsseckeys.active IS NOT NULL);
-- ~ ************
-- ~ ** Keystate table
-- ~ **
-- ~ **
-- ~ **
-- ~ **
-- ~ ************
CREATE TABLE mapping (
state INTEGER,
ds INTEGER,
dk INTEGER,
ks INTEGER,
rs INTEGER
);
INSERT INTO mapping SELECT 1, 0, 0, 0, 0;
INSERT INTO mapping SELECT 2, 0, 1, 1, 1;
INSERT INTO mapping SELECT 3, 0, 2, 2, 1;
INSERT INTO mapping SELECT 4, 2, 2, 2, 1;
INSERT INTO mapping SELECT 5, 3, 2, 2, 3;
INSERT INTO mapping SELECT 6, 0, 3, 3, 0;
INSERT INTO mapping SELECT 7, 3, 0, 0, 0;
INSERT INTO mapping SELECT 8, 3, 0, 0, 0;
INSERT INTO mapping SELECT 9, 3, 0, 0, 0;
INSERT INTO mapping SELECT 10, 3, 0, 0, 0;
-- DS RECORDS
INSERT INTO keyState
SELECT NULL, 1, keyData.id, 0, mapping.ds, strftime("%s", "now"), (keyData.minimize>>2)&1, policy.parentDsTtl
FROM keyData
JOIN zone
ON zone.id = keyData.zoneId
JOIN policy
ON policy.id = zone.policyId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
JOIN mapping
ON mapping.state = REMOTE.dnsseckeys.state;
UPDATE keyState
SET state = 1
WHERE keyState.state = 0 AND keyState.type = 0 AND keyState.id IN (
SELECT keyState.id
FROM keyState
JOIN keyData
ON keyData.id = keyState.keydataId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
WHERE REMOTE.dnsseckeys.active IS NOT NULL);
-- DNSKEY RECORDS
INSERT INTO keyState
SELECT NULL, 1, keyData.id, 2, mapping.dk, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
FROM keyData
JOIN zone
ON zone.id = keyData.zoneId
JOIN policy
ON policy.id = zone.policyId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
JOIN mapping
ON mapping.state = REMOTE.dnsseckeys.state;
-- RRSIG DNSKEY RECORDS
INSERT INTO keyState
SELECT NULL, 1, keyData.id, 3, mapping.ks, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
FROM keyData
JOIN zone
ON zone.id = keyData.zoneId
JOIN policy
ON policy.id = zone.policyId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
JOIN mapping
ON mapping.state = REMOTE.dnsseckeys.state;
-- RRSIG RECORDS
INSERT INTO keyState
SELECT NULL, 1, keyData.id, 1, mapping.rs, strftime("%s", "now"), (keyData.minimize>>0)&1, policy.signaturesMaxZoneTtl
FROM keyData
JOIN zone
ON zone.id = keyData.zoneId
JOIN policy
ON policy.id = zone.policyId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
JOIN mapping
ON mapping.state = REMOTE.dnsseckeys.state;
--Set to OMN if Tactive + Dttl < Tnow
UPDATE keyState
SET state = 2
WHERE keyState.state = 1 AND keyState.type = 1 AND keyState.id IN (
SELECT keyState.id
FROM keyState
JOIN keyData
ON keyData.id = keyState.keydataId
JOIN REMOTE.dnsseckeys
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
JOIN zone
ON keyData.zoneId = zone.id
JOIN policy
ON policy.id = zone.policyId
WHERE CAST(strftime("%s", REMOTE.dnsseckeys.active) + policy.signaturesValidityDefault as INTEGER) < strftime("%s", "now"));
--Force the RRSIG state in omnipresent if rumoured and there is no old ZSK
-- unretentive
UPDATE keyState
SET state = 2
WHERE keyState.id IN (
SELECT rs.id FROM keyState AS rs
JOIN keystate AS dk ON dk.keyDataId == rs.keyDataId
WHERE rs.type == 1 AND dk.type == 2 AND rs.state == 1 AND dk.state == 2
AND NOT EXISTS(
SELECT* FROM keystate AS rs2
JOIN keystate AS dk2 ON dk2.keyDataId == rs2.keyDataId
WHERE rs2.type == 1 AND dk2.type == 2 AND rs2.state == 3 AND dk2.state == 2
));
DROP TABLE mapping;
-- We need to create records in the keydependency table in case we are in a
-- rollover. Only done for ZSK. For every introducing ZSK with RRSIG rumoured
-- that has an outroducing ZSK with RRSIG unretentive, we add a record.
INSERT INTO keyDependency
SELECT NULL, 0, keyData.zoneID, SUB.IDout, keyData.id, 1
FROM keyData
JOIN keyState AS KS1
ON KS1.keyDataId == keyData.id
JOIN keyState AS KS2
ON KS2.keyDataId == keyData.id
JOIN (
SELECT keyData.id AS IDout, keyData.zoneID
FROM keyData
JOIN keyState AS KS1
ON KS1.keyDataId == keyData.id
JOIN keyState AS KS2
ON KS2.keyDataId == keyData.id
WHERE KS1.type == 2
AND ks1.state = 2
AND KS2.type == 1
AND KS2.state == 3
AND keyData.introducing == 0
AND keyData.role == 2
) AS SUB
ON SUB.zoneId == keyData.zoneId
WHERE
KS1.type == 2
AND ks1.state = 2
AND KS2.type == 1
AND KS2.state == 1
AND keyData.introducing == 1
AND keyData.role == 2;
-- ZSK
UPDATE keyState
SET state = 4
WHERE (keyState.type = 0 OR keyState.type = 3) AND keyDataId IN (
SELECT keyData.id
FROM keyData
WHERE keyData.role = 2);
--KSK
UPDATE keyState
SET state = 4
WHERE keyState.type = 1 AND keyDataId IN (
SELECT keyData.id
FROM keyData
WHERE keyData.role = 1);
-- For rpm based systems to see if db was migrated already. store opendnssec major minor version
CREATE TABLE rpm_migration (
major INTEGER,
minor INTEGER
);
INSERT INTO rpm_migration VALUES(2, 1);

7
opendnssec-2.1.sqlite_rpmversion.sql
View file

@ -1,7 +0,0 @@
-- For rpm based systems to see if db was migrated already. store opendnssec major minor version
CREATE TABLE rpm_migration (
major INTEGER,
minor INTEGER
);
INSERT INTO rpm_migration VALUES(2, 1);

20
opendnssec-c99-2.patch
View file

@ -1,20 +0,0 @@
commit 5422819c17c02e6069328b2f5e4bef6fe5c179df
Author: Mathieu Mirmont <mat@parad0x.org>
Date: Sun Dec 1 17:57:36 2019 +0100
enforcer: remove remove strptime build warning
diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c
index f1ee21b87529c136..5baef1b6ff7c4cc2 100644
--- a/enforcer/src/daemon/time_leap_cmd.c
+++ b/enforcer/src/daemon/time_leap_cmd.c
@@ -26,8 +26,8 @@
*
*/
-#include <getopt.h>
#include "config.h"
+#include <getopt.h>
#include "file.h"
#include "duration.h"

45
opendnssec-configure-c99.patch
View file

@ -1,45 +0,0 @@
Include <unistd.h> for the setresuid and setresgid functions,
to avoid an implicit function declaration.
Submitted upstream: <https://github.com/opendnssec/opendnssec/pull/843>
diff --git a/configure b/configure
index bf515cde3d4fab71..52d2885d6a6ef546 100755
--- a/configure
+++ b/configure
@@ -21101,6 +21101,7 @@ else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
+#include <unistd.h>
#include <stdlib.h>
#include <errno.h>
int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
@@ -21143,6 +21144,7 @@ else
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
+#include <unistd.h>
#include <stdlib.h>
#include <errno.h>
int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4
index 374cee0b0b8ef196..467db9170a319170 100644
--- a/m4/acx_broken_setres.m4
+++ b/m4/acx_broken_setres.m4
@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[
AC_MSG_CHECKING(if setresuid seems to work)
AC_RUN_IFELSE(
[AC_LANG_SOURCE([[
+#include <unistd.h>
#include <stdlib.h>
#include <errno.h>
int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
AC_MSG_CHECKING(if setresgid seems to work)
AC_RUN_IFELSE(
[AC_LANG_SOURCE([[
+#include <unistd.h>
#include <stdlib.h>
#include <errno.h>
int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}

48
opendnssec-implicit-declarations.patch
View file

@ -1,48 +0,0 @@
From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Tue, 26 Dec 2023 14:09:12 -0500
Subject: [PATCH] Fix implicit function declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’
utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’
utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’
utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’
utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’
utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’
utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’
utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’
---
enforcer/src/utils/kaspcheck.c | 1 +
enforcer/src/utils/kc_helper.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c
index 9bac3b796..b3b808598 100644
--- a/enforcer/src/utils/kaspcheck.c
+++ b/enforcer/src/utils/kaspcheck.c
@@ -26,6 +26,7 @@
#define _GNU_SOURCE
#include <stdio.h>
#include <getopt.h>
+#include <stdlib.h>
#include <string.h>
#include <syslog.h>
diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c
index 89e56c61e..e1704f6f9 100644
--- a/enforcer/src/utils/kc_helper.c
+++ b/enforcer/src/utils/kc_helper.c
@@ -27,6 +27,7 @@
#include <syslog.h>
#include <stdarg.h>
#include <stdio.h>
+#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <errno.h>
--
2.43.0

1
opendnssec-sysusers.conf
View file

@ -1 +0,0 @@
u ods - "opendnssec daemon account"

237
opendnssec.spec
View file

@ -1,38 +1,29 @@
#global prever rcX
%global _hardened_build 1
Summary: DNSSEC key and zone management software
Name: opendnssec
Version: 2.1.14
Release: 2%{?dist}
License: BSD-2-Clause
Version: 1.4.14
Release: 3%{?prever}%{?dist}
License: BSD
Url: http://www.opendnssec.org/
Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig
Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
Source1: ods-enforcerd.service
Source2: ods-signerd.service
Source3: ods.sysconfig
Source4: conf.xml
Source5: tmpfiles-opendnssec.conf
Source6: opendnssec.cron
Source7: opendnssec-2.1.sqlite_convert.sql
Source8: opendnssec-2.1.sqlite_rpmversion.sql
Source9: %{name}-sysusers.conf
Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
Patch2: opendnssec-configure-c99.patch
Patch3: opendnssec-2.1.14rc1-gcc14.patch
Patch4: opendnssec-c99-2.patch
Patch5: opendnssec-implicit-declarations.patch
Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units
Group: Applications/System
Requires: opencryptoki, softhsm, systemd-units
Requires: libxml2, libxslt sqlite
BuildRequires: make
BuildRequires: gcc
BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel
BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel
BuildRequires: libxml2-devel CUnit-devel, doxygen
# It tests for pkill/killall and would use /bin/false if not found
BuildRequires: procps-ng
BuildRequires: perl-interpreter
BuildRequires: libmicrohttpd-devel jansson-devel libyaml-devel
BuildRequires: systemd-units
Requires(pre): shadow-utils
@ -40,11 +31,8 @@ Requires(post): systemd-units
Requires(preun): systemd-units
Requires(postun): systemd-units
%if 0%{?prever:1}
# For building development snapshots
Buildrequires: autoconf, automake, libtool
%ifarch %{java_arches}
Buildrequires: java
%endif
#For building snapshots
Buildrequires: autoconf, automake, libtool, java
%endif
%description
@ -54,15 +42,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
%prep
%setup -q -n %{name}-%{version}%{?prever}
%patch -P1 -p1
%patch -P2 -p1
%patch -P3 -p1
%patch -P4 -p1
%patch -P5 -p1
# Prevent re-running autoconf.
touch -r aclocal.m4 configure* m4/*
# bump default policy ZSK keysize to 2048
sed -i "s/1024/2048/" conf/kasp.xml.in
@ -70,12 +49,8 @@ sed -i "s/1024/2048/" conf/kasp.xml.in
export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"
export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security"
export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security"
%if 0%{?prever:1}
# for development snapshots
autoreconf
%endif
%configure --with-ldns=%{_libdir}
%make_build
make %{?_smp_mflags}
%check
# Requires sample db not shipped with upstream
@ -83,8 +58,8 @@ autoreconf
%install
rm -rf %{buildroot}
%make_install
mkdir -p %{buildroot}%{_localstatedir}/opendnssec/{tmp,signed,signconf,enforcer}
make DESTDIR=%{buildroot} install
mkdir -p %{buildroot}%{_localstatedir}/opendnssec/{tmp,signed,signconf}
install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/
install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample
@ -94,22 +69,10 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/
install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf
mkdir -p %{buildroot}%{_tmpfilesdir}/
install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf
mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
mkdir -p %{buildroot}%{_datadir}/opendnssec/
cp -a enforcer/utils %{buildroot}%{_datadir}/opendnssec/migration
cp -a enforcer/src/db/schema.* %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/
# fixup path for mysql/sqlite. Use our replacement sqlite_convert.sql to detect previous migration
cp -a %{SOURCE7} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql
cp -a %{SOURCE8} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql
sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql
sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql
sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
cp enforcer/utils/migrate_1_4_8.sqlite3 %{buildroot}%{_datadir}/%{name}/
%files
%{_unitdir}/ods-enforcerd.service
@ -120,7 +83,6 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp
%attr(0775,root,ods) %dir %{_localstatedir}/opendnssec/signed
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/enforcer
%attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods
%attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec
@ -130,59 +92,33 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert
%{_mandir}/*/*
%{_sbindir}/*
%{_bindir}/*
%attr(0755,root,root) %dir %{_datadir}/opendnssec
%{_datadir}/opendnssec/*
%{_sysusersdir}/%{name}.conf
%attr(0755,root,root) %dir %{_datadir}/%{name}
%{_datadir}/%{name}/*
%pre
%sysusers_create_package %{name} %{SOURCE9}
getent group ods >/dev/null || groupadd -r ods
getent passwd ods >/dev/null || \
useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
-c "opendnssec daemon account" ods
exit 0
%post
# Initialise a slot on the softhsm on first install
if [ "$1" -eq 1 ]; then
%{_sbindir}/runuser -u ods -- %{_bindir}/softhsm2-util --init-token \
--free --label "OpenDNSSEC" --pin 1234 --so-pin 1234
if [ ! -s %{_localstatedir}/opendnssec/kasp.db ]; then
echo y | %{_sbindir}/ods-enforcer-db-setup
%{_bindir}/sqlite3 -batch %{_localstatedir}/opendnssec/kasp.db < %{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql
fi
elif [ -z "$(%{_bindir}/sqlite3 %{_localstatedir}/opendnssec/kasp.db 'select * from rpm_migration;')" ]; then
# Migrate version 1.4 db to version 2.1 db
if [ -e %{_localstatedir}/opendnssec/rpm-migration-in-progress ]; then
echo "previous (partial?) migration found - human intervention is needed"
else
echo "opendnssec 1.4 database found, migrating to 2.x"
touch %{_localstatedir}/opendnssec/rpm-migration-in-progress
mv -n %{_localstatedir}/opendnssec/kasp.db %{_localstatedir}/opendnssec/kasp.db-1.4
echo "migrating conf.xml from 1.4 to 2.1 schema"
cp -n %{_sysconfdir}/opendnssec/conf.xml %{_sysconfdir}/opendnssec/conf.xml-1.4
# fixup incompatibilities inflicted upon us by upstream :(
sed -i "/<Interval>.*Interval>/d" %{_sysconfdir}/opendnssec/conf.xml
echo "Converting kasp.db"
ERR=""
%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite -i %{_localstatedir}/opendnssec/kasp.db-1.4 -o %{_localstatedir}/opendnssec/kasp.db || ERR="convert_sqlite error"
chown ods.ods %{_localstatedir}/opendnssec/kasp.db
cp -n %{_sysconfdir}/opendnssec/zonelist.xml %{_localstatedir}/opendnssec/enforcer/zones.xml
if [ -z "$ERR" ]; then
echo "calling ods-migrate"
ods-migrate || ERR="ods-migrate failed"
if [ -z "$ERR" ]; then
echo "opendnssec 1.4 to 2.x migration completed"
rm %{_localstatedir}/opendnssec/rpm-migration-in-progress
else
echo "ods-migrate process failed - human intervention is needed"
fi
else
echo "%{_localstatedir}/opendnssec/kasp.db conversion failed - not calling ods-migrate to complete migration. human intervention is needed"
fi
--slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
if [ ! -s %{_localstatedir}opendnssec/kasp.db ]; then
echo y | %{_bindir}/ods-ksmutil setup
fi
fi
# in case we update any xml conf file
ods-enforcer update all >/dev/null 2>/dev/null ||:
# Migrate version 3 db to version 4 db
if [ "`%{_bindir}/sqlite3 %{_localstatedir}/%{name}/kasp.db 'select version from dbadmin;'`" != "4" ]; then
%{_bindir}/sqlite3 %{_localstatedir}/%{name}/kasp.db < %{_datadir}/%{name}/migrate_1_4_8.sqlite3
fi
# in case we update any xml conf file
ods-ksmutil update all >/dev/null 2>/dev/null ||:
%systemd_post ods-enforcerd.service
%systemd_post ods-signerd.service
@ -195,119 +131,6 @@ ods-enforcer update all >/dev/null 2>/dev/null ||:
%systemd_postun_with_restart ods-signerd.service
%changelog
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jan 21 2025 Rafel Jeffman <rjeffman@redhat.com> - 2.1.14-1
- Upstream release 2.1.14
- Use systemd-sysusers
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.4rc1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Tue Oct 22 2024 Richard W.M. Jones <rjones@redhat.com> - 2.1.14-0.3rc1
- Rebuild for Jansson 2.14
(https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/)
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.2rc1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Thu Feb 08 2024 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.14-0.1rc1
- Upstream release 2.1.14RC1
- Fix build with gcc 14
- Resolves: rhbz#2261421
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Fri Feb 24 2023 Florian Weimer <fweimer@redhat.com> - 2.1.10-6
- Port to C99
* Mon Jan 30 2023 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.10-5
- Fix fortification issues leading to crash in FreeIPA setup
Upstream PR: https://github.com/opendnssec/opendnssec/pull/842
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Mon Oct 18 2021 François Cami <fcami@redhat.com> - 2.1.10-1
- Update to 2.1.10 (rhbz#2003250).
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.1.9-3
- Rebuilt with OpenSSL 3.0.0
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Tue Jul 06 2021 François Cami <fcami@redhat.com> - 2.1.9-1
- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956.
- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured.
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.8-2
- Rebuilt for updated systemd-rpm-macros
See https://pagure.io/fesco/issue/2583.
* Sat Feb 20 2021 Fedora Release Monitoring <release-monitoring@fedoraproject.org> - 2.1.8-1
- Update to 2.1.8 (#1931143)
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.7-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3
- Rebuild for libldns soname bump
* Tue Dec 8 21:09:23 EST 2020 Paul Wouters <pwouters@redhat.com> - 2.1.7-2
- Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready
* Fri Dec 04 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.7-1
- Upstream release 2.1.7
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.6-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 2.1.6-7
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Thu May 28 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-6
- Resolves: rhbz#1833718 ods-signerd.service missing .service
* Mon Apr 20 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-5
- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd
* Wed Mar 11 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-4
- Fix migration check to not attempt to check on first install with no db
* Tue Mar 03 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.6-3
- Create and manage /var/opendnssec/enforcer directory
- Resolves rhbz#1809492
* Wed Feb 19 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-2
- Update to 2.1.6 (major upgrade, supports migration from 1.4.x)
- gcc10 compile fixups
- Fix trying to use unversioned libsqlite3.so file
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

3
sources
View file

@ -1,2 +1 @@
SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620
SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f
SHA512 (opendnssec-1.4.14.tar.gz) = b814d13ef95dcf238f3e9d6bb3dc489328d7a4a5db9e32214ac29716043f9e635e62fb3795b9d5d75e8215373f9330ea5a17840830f5e467067f305a610bee6b

2
tmpfiles-opendnssec.conf
View file

@ -1 +1 @@
D /run/opendnssec 0755 ods ods -
D /var/run/opendnssec 0755 ods ods -