OpenDNSSEC-enforcer  2.0.3
enforcer.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2011 NLNet Labs. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  * notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  * notice, this list of conditions and the following disclaimer in the
11  * documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
15  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
17  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
19  * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
21  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
22  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
23  * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  */
26 
27 /*
28  * @section DESCRIPTION
29  *
30  * This module controls the order and time for keys to be introduced,
31  * generated and discarded. It can be called for one zone at a time. It
32  * will then manipulate its keys and bring them closer to their goal,
33  * within bounds of the zone's policy. New keys may be fetched from the
34  * HSM and old keys discarded. When done, the update function returns
35  * a time at which it need to be called again for this zone. Unless
36  * there is an unscheduled change for this zone (some user input) it
37  * should not be called sooner. Calling sooner is not harmful in any
38  * way but also not effective. Calling later does not do any harm as
39  * well, however rollovers may be delayed.
40  */
41 
42 #include "config.h"
43 
44 #include <time.h>
45 
46 #include "libhsm.h"
47 #include "hsmkey/hsm_key_factory.h"
48 
49 #include <libhsmdns.h>
50 #include <ldns/ldns.h>
51 
52 #include "duration.h"
53 #include "log.h"
54 #include "daemon/engine.h"
55 
56 #include "db/zone.h"
57 #include "db/policy.h"
58 #include "db/policy_key.h"
59 #include "db/hsm_key.h"
60 #include "db/key_data.h"
61 #include "db/key_dependency.h"
62 #include "db/db_error.h"
63 
64 #include "enforcer/enforcer.h"
65 
66 #define HIDDEN KEY_STATE_STATE_HIDDEN
67 #define RUMOURED KEY_STATE_STATE_RUMOURED
68 #define OMNIPRESENT KEY_STATE_STATE_OMNIPRESENT
69 #define UNRETENTIVE KEY_STATE_STATE_UNRETENTIVE
70 #define NA KEY_STATE_STATE_NA
71 
72 static const char *module_str = "enforcer";
73 
75 #define NOKEY_TIMEOUT 60
76 
77 struct future_key {
82 };
83 
84 static int max(int a, int b) { return a>b?a:b; }
85 static int min(int a, int b) { return a<b?a:b; }
86 
96 static inline void
97 minTime(const time_t t, time_t* min)
98 {
99  assert(min); /* TODO: proper error */
100  if ( (t < *min || *min < 0) && t >= 0 ) *min = t;
101 }
102 
112 static time_t
113 addtime(const time_t t, const int seconds)
114 {
115  struct tm *tp = localtime(&t);
116  if (!tp) return -1; /* bad, but mktime also returns -1 on error */
117  tp->tm_sec += seconds;
118  return mktime(tp);
119 }
120 
127 static inline const key_state_t*
128 getRecord(key_data_t* key, key_state_type_t type)
129 {
130  if (!key) {
131  return NULL;
132  }
133 
134  switch (type) {
135  case KEY_STATE_TYPE_DS:
136  return key_data_cached_ds(key);
137 
139  return key_data_cached_dnskey(key);
140 
142  return key_data_cached_rrsig(key);
143 
145  return key_data_cached_rrsigdnskey(key);
146 
147  default:
148  break;
149  }
150 
151  return NULL;
152 }
153 
159 static inline key_state_state_t
160 getState(key_data_t* key, key_state_type_t type, struct future_key *future_key)
161 {
162  int cmp;
163 
164  if (!key) {
166  }
167 
168  if (future_key
169  && future_key->pretend_update
170  && future_key->type == type
171  && future_key->key)
172  {
173  if (db_value_cmp(key_data_id(key), key_data_id(future_key->key), &cmp)) {
175  }
176  if (!cmp) {
177  return future_key->next_state;
178  }
179  }
180 
181  return key_state_state(getRecord(key, type));
182 }
183 
195 static key_state_state_t
196 getDesiredState(int introducing, key_state_state_t state)
197 {
198  /*
199  * Given goal and state, what will be the next state?
200  */
201  if (!introducing) {
202  /*
203  * We are outroducing this key so we would like to move rumoured and
204  * omnipresent keys to unretentive and unretentive keys to hidden.
205  */
206  switch (state) {
207  case HIDDEN:
208  break;
209 
210  case RUMOURED:
211  state = UNRETENTIVE;
212  break;
213 
214  case OMNIPRESENT:
215  state = UNRETENTIVE;
216  break;
217 
218  case UNRETENTIVE:
219  state = HIDDEN;
220  break;
221 
222  case NA:
223  break;
224 
225  default:
226  state = KEY_STATE_STATE_INVALID;
227  break;
228  }
229  }
230  else {
231  /*
232  * We are introducing this key so we would like to move hidden and
233  * unretentive keys to rumoured and rumoured keys to omnipresent.
234  */
235  switch (state) {
236  case HIDDEN:
237  state = RUMOURED;
238  break;
239 
240  case RUMOURED:
241  state = OMNIPRESENT;
242  break;
243 
244  case OMNIPRESENT:
245  break;
246 
247  case UNRETENTIVE:
248  state = RUMOURED;
249  break;
250 
251  case NA:
252  break;
253 
254  default:
255  state = KEY_STATE_STATE_INVALID;
256  break;
257  }
258  }
259 
260  return state;
261 }
262 
269 static int
270 match(key_data_t* key, struct future_key *future_key, int same_algorithm,
271  const key_state_state_t mask[4])
272 {
273  if (!key) {
274  return -1;
275  }
276  if (!future_key) {
277  return -1;
278  }
279  if (!future_key->key) {
280  return -1;
281  }
282 
283  if (same_algorithm
284  && key_data_algorithm(key) != key_data_algorithm(future_key->key))
285  {
286  return 0;
287  }
288 
289  /*
290  * Check the states against the mask, for each mask that is not NA we
291  * need a match on that key state.
292  */
293  if ((mask[0] != NA
294  && getState(key, KEY_STATE_TYPE_DS, future_key) != mask[0])
295  || (mask[1] != NA
296  && getState(key, KEY_STATE_TYPE_DNSKEY, future_key) != mask[1])
297  || (mask[2] != NA
298  && getState(key, KEY_STATE_TYPE_RRSIGDNSKEY, future_key) != mask[2])
299  || (mask[3] != NA
300  && getState(key, KEY_STATE_TYPE_RRSIG, future_key) != mask[3]))
301  {
302  return 0;
303  }
304  return 1;
305 }
306 
313 static int
314 exists(key_data_t** keylist, size_t keylist_size, struct future_key *future_key,
315  int same_algorithm, const key_state_state_t mask[4])
316 {
317  size_t i;
318 
319  if (!keylist) {
320  return -1;
321  }
322  if (!future_key) {
323  return -1;
324  }
325  if (!future_key->key) {
326  return -1;
327  }
328 
329  for (i = 0; i < keylist_size; i++) {
330  /*
331  * Check the states against the mask. If we have a match we return a
332  * positive value.
333  */
334  if (match(keylist[i], future_key, same_algorithm, mask) > 0) {
335  return 1;
336  }
337  }
338 
339  /*
340  * We got no match, return zero.
341  */
342  return 0;
343 }
344 
351 static int
352 isPotentialSuccessor(key_data_t* successor_key, key_data_t* predecessor_key,
353  struct future_key *future_key, key_state_type_t type)
354 {
355  if (!successor_key) {
356  return -1;
357  }
358  if (!predecessor_key) {
359  return -1;
360  }
361  if (!future_key) {
362  return -1;
363  }
364 
365  /* You can't be a successor of yourself */
366  if (!key_data_cmp(successor_key, predecessor_key)) return 0;
367 
368  /*
369  * TODO
370  */
371  if (getState(successor_key, type, future_key) != RUMOURED
372  || key_data_algorithm(successor_key) != key_data_algorithm(predecessor_key))
373  {
374  return 0;
375  }
376 
377  /*
378  * TODO
379  */
380  switch (type) {
381  case KEY_STATE_TYPE_DS: /* Intentional fall-through */
383  /*
384  * TODO
385  */
386  if (getState(successor_key, KEY_STATE_TYPE_DNSKEY, future_key) == OMNIPRESENT) {
387  return 1;
388  }
389  break;
390 
392  /*
393  * Either both DS's should be omnipresent or both signatures, for the
394  * keys to be in a potential relationship for the DNSKEY.
395  */
396  if ((getState(predecessor_key, KEY_STATE_TYPE_DS, future_key) == OMNIPRESENT
397  && getState(successor_key, KEY_STATE_TYPE_DS, future_key) == OMNIPRESENT)
398  || (getState(predecessor_key, KEY_STATE_TYPE_RRSIG, future_key) == OMNIPRESENT
399  && getState(successor_key, KEY_STATE_TYPE_RRSIG, future_key) == OMNIPRESENT))
400  {
401  return 1;
402  }
403  break;
404 
406  /*
407  * TODO
408  */
409  break;
410 
411  default:
412  return -1;
413  }
414 
415  return 0;
416 }
417 
424 static int
425 successor_rec(key_data_t** keylist, size_t keylist_size,
426  key_data_t* successor_key, key_data_t* predecessor_key,
427  struct future_key *future_key,
429 {
430  size_t i;
431  int cmp;
432  const key_dependency_t* dep;
433  key_data_t *from_key;
434  key_dependency_list_t* deplist;
435 
436  if (!keylist) {
437  return -1;
438  }
439  if (!successor_key) {
440  return -1;
441  }
442  if (!predecessor_key) {
443  return -1;
444  }
445  if (!future_key) {
446  return -1;
447  }
448  if (!future_key->key) {
449  return -1;
450  }
451  if (!deplist_ext) {
452  return -1;
453  }
454 
455  /*
456  * Make a copy of the deplist in order to preserve where we are in the list
457  * if we are calling ourselves later on.
458  *
459  * TODO: This can be optimized with the implementation of *_list_ref_t or
460  * allocating an array as with keylist.
461  */
462  if (!(deplist = key_dependency_list_new_copy(deplist_ext))) {
463  return -1;
464  }
465 
466  /*
467  * Check the trivial case where the predecessor key is already a predecessor
468  * for the successor key.
469  */
470  for (dep = key_dependency_list_begin(deplist); dep; dep = key_dependency_list_next(deplist)) {
471  switch (key_dependency_type(dep)) {
473  if (type != KEY_STATE_TYPE_DS) {
474  continue;
475  }
476  break;
477 
479  if (type != KEY_STATE_TYPE_RRSIG) {
480  continue;
481  }
482  break;
483 
485  if (type != KEY_STATE_TYPE_DNSKEY) {
486  continue;
487  }
488  break;
489 
492  continue;
493  }
494  break;
495 
496  default:
497  continue;
498  }
499 
500  if (db_value_cmp(key_data_id(predecessor_key), key_dependency_from_key_data_id(dep), &cmp)) {
501  return -1;
502  }
503  if (cmp) {
504  continue;
505  }
506 
507  if (db_value_cmp(key_data_id(successor_key), key_dependency_to_key_data_id(dep), &cmp)) {
508  return -1;
509  }
510  if (cmp) {
511  continue;
512  }
513 
514  key_dependency_list_free(deplist);
515  return 1;
516  }
517 
518  /*
519  * Check the trivial case where there is a direct relationship in the future
520  */
521  if (future_key->pretend_update) {
522  if (db_value_cmp(key_data_id(future_key->key), key_data_id(predecessor_key), &cmp)) {
523  key_dependency_list_free(deplist);
524  return -1;
525  }
526  if (!cmp && isPotentialSuccessor(successor_key, predecessor_key, future_key, type) > 0) {
527  key_dependency_list_free(deplist);
528  return 1;
529  }
530  }
531 
532  /*
533  * Check for indirect relationship where X depends on S and X is in the same
534  * state as P and X is a successor of P.
535  */
536  for (dep = key_dependency_list_begin(deplist); dep; dep = key_dependency_list_next(deplist)) {
537  switch (key_dependency_type(dep)) {
539  if (type != KEY_STATE_TYPE_DS) {
540  continue;
541  }
542  break;
543 
545  if (type != KEY_STATE_TYPE_RRSIG) {
546  continue;
547  }
548  break;
549 
551  if (type != KEY_STATE_TYPE_DNSKEY) {
552  continue;
553  }
554  break;
555 
558  continue;
559  }
560  break;
561 
562  default:
563  continue;
564  }
565 
566  if (db_value_cmp(key_data_id(successor_key), key_dependency_to_key_data_id(dep), &cmp)) {
567  key_dependency_list_free(deplist);
568  return -1;
569  }
570  if (cmp) {
571  continue;
572  }
573 
574  /*
575  * TODO: This may be optimized by searching for the key in the keylist
576  * first, only retrieving it from the database if needed or giving an
577  * error if it does not exist in the keylist.
578  */
579  if (!(from_key = key_dependency_get_from_key_data(dep))) {
580  key_dependency_list_free(deplist);
581  return -1;
582  }
583 
584  /*
585  * The RRSIGDNSKEY is not compared because TODO .
586  */
587  if (getState(predecessor_key, KEY_STATE_TYPE_DS, future_key) != getState(from_key, KEY_STATE_TYPE_DS, future_key)
588  || getState(predecessor_key, KEY_STATE_TYPE_DNSKEY, future_key) != getState(from_key, KEY_STATE_TYPE_DNSKEY, future_key)
589  || getState(predecessor_key, KEY_STATE_TYPE_RRSIG, future_key) != getState(from_key, KEY_STATE_TYPE_RRSIG, future_key))
590  {
591  key_data_free(from_key);
592  continue;
593  }
594  if (successor_rec(keylist, keylist_size, from_key, predecessor_key, future_key, type, deplist_ext) > 0) {
595  key_data_free(from_key);
596  key_dependency_list_free(deplist);
597  return 1;
598  }
599  key_data_free(from_key);
600  }
601  key_dependency_list_free(deplist);
602 
603  /*
604  * TODO
605  */
606  if (future_key->pretend_update) {
607  for (i = 0; i < keylist_size; i++) {
608  if (db_value_cmp(key_data_id(predecessor_key), key_data_id(keylist[i]), &cmp)) {
609  return -1;
610  }
611  if (!cmp) {
612  continue;
613  }
614 
615  if (isPotentialSuccessor(successor_key, keylist[i], future_key, type) > 0) {
616  /*
617  * The RRSIGDNSKEY is not compared because TODO .
618  */
619  if (getState(predecessor_key, KEY_STATE_TYPE_DS, future_key) != getState(keylist[i], KEY_STATE_TYPE_DS, future_key)
620  || getState(predecessor_key, KEY_STATE_TYPE_DNSKEY, future_key) != getState(keylist[i], KEY_STATE_TYPE_DNSKEY, future_key)
621  || getState(predecessor_key, KEY_STATE_TYPE_RRSIG, future_key) != getState(keylist[i], KEY_STATE_TYPE_RRSIG, future_key))
622  {
623  continue;
624  }
625  if (successor_rec(keylist, keylist_size, successor_key, keylist[i], future_key, type, deplist_ext) > 0) {
626  return 1;
627  }
628  }
629  }
630  }
631 
632  return 0;
633 }
634 
641 static int
642 successor(key_data_t** keylist, size_t keylist_size, key_data_t* successor_key,
643  key_data_t* predecessor_key, struct future_key *future_key,
645 {
646  int cmp;
647  const key_dependency_t* dep;
648 
649  if (!keylist) {
650  return -1;
651  }
652  if (!successor_key) {
653  return -1;
654  }
655  if (!predecessor_key) {
656  return -1;
657  }
658  if (!future_key) {
659  return -1;
660  }
661  if (!future_key->key) {
662  return -1;
663  }
664  if (!deplist) {
665  return -1;
666  }
667 
668  /*
669  * Nothing may depend on our predecessor.
670  */
671  for (dep = key_dependency_list_begin(deplist); dep; dep = key_dependency_list_next(deplist)) {
672  if (db_value_cmp(key_data_id(predecessor_key), key_dependency_to_key_data_id(dep), &cmp)) {
673  return -1;
674  }
675  if (!cmp) {
676  return 0;
677  }
678  }
679 
680  return successor_rec(keylist, keylist_size, successor_key, predecessor_key, future_key, type, deplist);
681 }
682 
689 static int
690 exists_with_successor(key_data_t** keylist, size_t keylist_size,
691  struct future_key *future_key, int same_algorithm,
692  const key_state_state_t predecessor_mask[4],
693  const key_state_state_t successor_mask[4], key_state_type_t type,
694  key_dependency_list_t* deplist)
695 {
696  size_t i, j;
697 
698  if (!keylist) {
699  return -1;
700  }
701  if (!future_key) {
702  return -1;
703  }
704 
705  /*
706  * Walk the list of keys, for each key that matches the successor mask we
707  * walk the list again and check that key against the keys that match the
708  * predecessor mask if has a valid successor/predecessor relationship.
709  */
710  for (i = 0; i < keylist_size; i++) {
711  if (match(keylist[i], future_key, same_algorithm, successor_mask) < 1) {
712  continue;
713  }
714 
715  for (j = 0; j < keylist_size; j++) {
716  if (j == i
717  || match(keylist[j], future_key, same_algorithm, predecessor_mask) < 1)
718  {
719  continue;
720  }
721 
722  if (successor(keylist, keylist_size, keylist[i], keylist[j], future_key, type, deplist) > 0) {
723  return 1;
724  }
725  }
726  }
727  return 0;
728 }
729 
736 static int
737 unsignedOk(key_data_t** keylist, size_t keylist_size,
738  struct future_key *future_key,
739  const key_state_state_t mask[4], key_state_type_t type)
740 {
741  size_t i;
742  key_state_state_t cmp_mask[4];
743 
744  if (!keylist) {
745  return -1;
746  }
747  if (!future_key) {
748  return -1;
749  }
750  if (!future_key->key) {
751  return -1;
752  }
753 
754  for (i = 0; i < keylist_size; i++) {
755  if (key_data_algorithm(keylist[i]) != key_data_algorithm(future_key->key)) {
756  continue;
757  }
758 
759  cmp_mask[0] = type == KEY_STATE_TYPE_DS
760  ? getState(keylist[i], type, future_key)
761  : mask[0];
762  cmp_mask[1] = type == KEY_STATE_TYPE_DNSKEY
763  ? getState(keylist[i], type, future_key)
764  : mask[1];
765  cmp_mask[2] = type == KEY_STATE_TYPE_RRSIGDNSKEY
766  ? getState(keylist[i], type, future_key)
767  : mask[2];
768  cmp_mask[3] = type == KEY_STATE_TYPE_RRSIG
769  ? getState(keylist[i], type, future_key)
770  : mask[3];
771 
772  /*
773  * If the state is hidden or NA for the given type this key is okay.
774  */
775  switch (type) {
776  case KEY_STATE_TYPE_DS:
777  if (cmp_mask[0] == HIDDEN || cmp_mask[0] == NA) {
778  continue;
779  }
780  break;
781 
783  if (cmp_mask[1] == HIDDEN || cmp_mask[1] == NA) {
784  continue;
785  }
786  break;
787 
789  if (cmp_mask[2] == HIDDEN || cmp_mask[2] == NA) {
790  continue;
791  }
792  break;
793 
795  if (cmp_mask[3] == HIDDEN || cmp_mask[3] == NA) {
796  continue;
797  }
798  break;
799 
800  default:
801  return -1;
802  }
803 
804  if (exists(keylist, keylist_size, future_key, 1, cmp_mask) < 1) {
805  return 0;
806  }
807  }
808 
809  return 1;
810 }
811 
818 static int
819 rule1(key_data_t** keylist, size_t keylist_size, struct future_key *future_key,
820  int pretend_update)
821 {
822  static const key_state_state_t mask[2][4] = {
823  /*
824  * This indicates a good key state.
825  */
826  { OMNIPRESENT, NA, NA, NA },
827  /*
828  * This indicates that the DS is introducing.
829  */
830  { RUMOURED, NA, NA, NA }
831  };
832 
833  if (!keylist) {
834  return -1;
835  }
836  if (!future_key) {
837  return -1;
838  }
839  if (!future_key->key) {
840  return -1;
841  }
842 
843  future_key->pretend_update = pretend_update;
844 
845  /*
846  * Return positive value if any of the masks are found.
847  */
848  if (exists(keylist, keylist_size, future_key, 0, mask[0]) > 0
849  || exists(keylist, keylist_size, future_key, 0, mask[1]) > 0)
850  {
851  return 1;
852  }
853  return 0;
854 }
855 
862 static int
863 rule2(key_data_t** keylist, size_t keylist_size, struct future_key *future_key,
865 {
866  static const key_state_state_t mask[8][4] = {
867  { OMNIPRESENT, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates a good key state.*/
868  { RUMOURED, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates an introducing DS state.*/
869  { UNRETENTIVE, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates an outroducing DS state.*/
870  { OMNIPRESENT, RUMOURED, RUMOURED, NA }, /*These indicates an introducing DNSKEY state.*/
871  { OMNIPRESENT, OMNIPRESENT, RUMOURED, NA },
872  { OMNIPRESENT, UNRETENTIVE, UNRETENTIVE, NA }, /*These indicates an outroducing DNSKEY state.*/
874  { HIDDEN, OMNIPRESENT, OMNIPRESENT, NA } /*This indicates an unsigned state.*/
875  };
876 
877  if (!keylist || !future_key || !future_key->key) {
878  return -1;
879  }
880 
881  future_key->pretend_update = pretend_update;
882 
883  /*
884  * Return positive value if any of the masks are found.
885  */
886  if (exists(keylist, keylist_size, future_key, 1, mask[0]) > 0
887  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[2], mask[1], KEY_STATE_TYPE_DS, deplist) > 0
888  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[5], mask[3], KEY_STATE_TYPE_DNSKEY, deplist) > 0
889  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[5], mask[4], KEY_STATE_TYPE_DNSKEY, deplist) > 0
890  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[6], mask[3], KEY_STATE_TYPE_DNSKEY, deplist) > 0
891  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[6], mask[4], KEY_STATE_TYPE_DNSKEY, deplist) > 0
892  || unsignedOk(keylist, keylist_size, future_key, mask[7], KEY_STATE_TYPE_DS) > 0)
893  {
894  return 1;
895  }
896  return 0;
897 }
898 
905 static int
906 rule3(key_data_t** keylist, size_t keylist_size, struct future_key *future_key,
908 {
909  static const key_state_state_t mask[6][4] = {
910  /*
911  * This indicates a good key state.
912  */
913  { NA, OMNIPRESENT, NA, OMNIPRESENT },
914  /*
915  * This indicates a introducing DNSKEY state.
916  */
917  { NA, RUMOURED, NA, OMNIPRESENT },
918  /*
919  * This indicates a outroducing DNSKEY state.
920  */
921  { NA, UNRETENTIVE, NA, OMNIPRESENT },
922  /*
923  * This indicates a introducing RRSIG state.
924  */
925  { NA, OMNIPRESENT, NA, RUMOURED },
926  /*
927  * This indicates a outroducing RRSIG state.
928  */
929  { NA, OMNIPRESENT, NA, UNRETENTIVE },
930  /*
931  * This indicates an unsigned state.
932  */
933  { NA, HIDDEN, NA, OMNIPRESENT }
934  };
935 
936  if (!keylist) {
937  return -1;
938  }
939  if (!future_key) {
940  return -1;
941  }
942  if (!future_key->key) {
943  return -1;
944  }
945 
946  future_key->pretend_update = pretend_update;
947 
948  /*
949  * Return positive value if any of the masks are found.
950  */
951  if (exists(keylist, keylist_size, future_key, 1, mask[0]) > 0
952  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[2], mask[1], KEY_STATE_TYPE_DNSKEY, deplist) > 0
953  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[4], mask[3], KEY_STATE_TYPE_RRSIG, deplist) > 0
954  || unsignedOk(keylist, keylist_size, future_key, mask[5], KEY_STATE_TYPE_DNSKEY) > 0)
955  {
956  return 1;
957  }
958  return 0;
959 }
960 
967 static int
968 dnssecApproval(key_data_t** keylist, size_t keylist_size,
969  struct future_key* future_key, int allow_unsigned,
970  key_dependency_list_t* deplist)
971 {
972  if (!keylist) {
973  return -1;
974  }
975  if (!future_key) {
976  return -1;
977  }
978  if (!deplist) {
979  return -1;
980  }
981 
982  /*
983  * Check if DNSSEC state will be invalid by the transition by checking that
984  * all 3 DNSSEC rules apply. Rule 1 only applies if we are not allowing an
985  * unsigned state.
986  *
987  * A rule is first checked against the current state of the key_state and if
988  * the current state is not valid an transition is allowed for that rule in
989  * order to try and move out of an invalid DNSSEC state.
990  *
991  * Next the rule is checked against the desired state and if that state is a
992  * valid DNSSEC state then the transition is allowed.
993  *
994  * rule1 - Handles DS states
995  * rule2 - Handles DNSKEY states.
996  * rule3 - Handles signatures.
997  */
998  if ((allow_unsigned
999  || !rule1(keylist, keylist_size, future_key, 0)
1000  || rule1(keylist, keylist_size, future_key, 1) > 0)
1001  && (!rule2(keylist, keylist_size, future_key, 0, deplist)
1002  || rule2(keylist, keylist_size, future_key, 1, deplist) > 0)
1003  && (!rule3(keylist, keylist_size, future_key, 0, deplist)
1004  || rule3(keylist, keylist_size, future_key, 1, deplist) > 0))
1005  {
1006  /*
1007  * All rules apply, we allow transition.
1008  */
1009  return 1;
1010  }
1011 
1012  return 0;
1013 }
1014 
1023 static time_t
1024 minTransitionTime(policy_t* policy, key_state_type_t type,
1025  key_state_state_t next_state, const time_t lastchange, const int ttl)
1026 {
1027  if (!policy) {
1028  return -1;
1029  }
1030 
1031  /*
1032  * We may freely move a record to a uncertain state.
1033  */
1034  if (next_state == RUMOURED || next_state == UNRETENTIVE) {
1035  return lastchange;
1036  }
1037 
1038  switch (type) {
1039  case KEY_STATE_TYPE_DS:
1040  return addtime(lastchange, ttl
1043 
1044  /* TODO: 5011 will create special case here */
1045  case KEY_STATE_TYPE_DNSKEY: /* intentional fall-through */
1047  return addtime(lastchange, ttl
1049  + ( next_state == OMNIPRESENT
1050  ? policy_keys_publish_safety(policy)
1051  : policy_keys_retire_safety(policy) ));
1052 
1053  case KEY_STATE_TYPE_RRSIG:
1054  return addtime(lastchange, ttl
1055  + policy_zone_propagation_delay(policy));
1056 
1057  default:
1058  break;
1059  }
1060 
1061  return -1;
1062 }
1063 
1073 static int
1074 policyApproval(key_data_t** keylist, size_t keylist_size,
1075  struct future_key* future_key, key_dependency_list_t* deplist)
1076 {
1077  static const key_state_state_t dnskey_algorithm_rollover[4] = { OMNIPRESENT, OMNIPRESENT, OMNIPRESENT, NA };
1078  static const key_state_state_t mask[14][4] = {
1079  /*ZSK*/
1080  { NA, OMNIPRESENT, NA, OMNIPRESENT }, /*This indicates a good key state.*/
1081  { NA, RUMOURED, NA, OMNIPRESENT }, /*This indicates a introducing DNSKEY state.*/
1082  { NA, UNRETENTIVE, NA, OMNIPRESENT }, /*This indicates a outroducing DNSKEY state.*/
1083  { NA, OMNIPRESENT, NA, RUMOURED }, /*This indicates a introducing RRSIG state.*/
1084  { NA, OMNIPRESENT, NA, UNRETENTIVE }, /*This indicates a outroducing RRSIG state.*/
1085  { NA, HIDDEN, NA, OMNIPRESENT }, /*This indicates an unsigned state.*/
1086 
1087  /*KSK*/
1088  { OMNIPRESENT, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates a good key state.*/
1089  { RUMOURED, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates an introducing DS state.*/
1090  { UNRETENTIVE, OMNIPRESENT, OMNIPRESENT, NA }, /*This indicates an outroducing DS state.*/
1091  { OMNIPRESENT, RUMOURED, RUMOURED, NA }, /*These indicates an introducing DNSKEY state.*/
1092  { OMNIPRESENT, OMNIPRESENT, RUMOURED, NA },
1093  { OMNIPRESENT, UNRETENTIVE, UNRETENTIVE, NA }, /*These indicates an outroducing DNSKEY state.*/
1095  { HIDDEN, OMNIPRESENT, OMNIPRESENT, NA } /*This indicates an unsigned state.*/
1096  };
1097 
1098  if (!keylist || !future_key || !future_key->key) {
1099  return -1;
1100  }
1101 
1102  /*
1103  * Once the record is introduced the policy has no influence.
1104  */
1105  if (future_key->next_state != RUMOURED) {
1106  return 1;
1107  }
1108 
1109  /*
1110  * Check if policy prevents transition if the next state is rumoured.
1111  */
1112  switch (future_key->type) {
1113  case KEY_STATE_TYPE_DS:
1114  /*
1115  * If we want to minimize the DS transitions make sure the DNSKEY is
1116  * fully propagated.
1117  */
1118  if (key_state_minimize(key_data_cached_ds(future_key->key))
1120  {
1121  /*
1122  * DNSKEY is not fully propagated so we will not do any transitions.
1123  */
1124  return 0;
1125  }
1126  break;
1127 
1128  case KEY_STATE_TYPE_DNSKEY:
1129  if (!key_state_minimize(key_data_cached_dnskey(future_key->key))) {
1130  /*
1131  * There are no restrictions for the DNSKEY transition so we can
1132  * just continue.
1133  */
1134  break;
1135  }
1136 
1137  /*
1138  * Check that signatures has been propagated for CSK/ZSK.
1139  *
1140  * TODO: How is this related to CSK/ZSK, there is no check for key_data_role().
1141  */
1143  && key_state_state(key_data_cached_rrsig(future_key->key)) != NA)
1144  {
1145  /*
1146  * RRSIG not fully propagated so we will not do any transitions.
1147  */
1148  return 0;
1149  }
1150 
1151  /*
1152  * Check if the DS is introduced and continue if it is.
1153  */
1154  if (key_state_state(key_data_cached_ds(future_key->key)) == OMNIPRESENT
1155  || key_state_state(key_data_cached_ds(future_key->key)) == NA)
1156  {
1157  break;
1158  }
1159 
1160  /*
1161  * We might be doing an algorithm rollover so we check if there are
1162  * no other good KSK available and ignore the minimize flag if so.
1163  *
1164  * TODO: How is this related to KSK/CSK? There are no check for key_data_role().
1165  */
1166  if (exists(keylist, keylist_size, future_key, 1, mask[6]) > 0
1167  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[8], mask[7], KEY_STATE_TYPE_DS, deplist) > 0
1168  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[11], mask[9], KEY_STATE_TYPE_DNSKEY, deplist) > 0)
1169  {
1170  /*
1171  * We found a good key, so we will not do any transition.
1172  */
1173  return 0;
1174  }
1175  break;
1176 
1178  /*
1179  * The only time not to introduce RRSIG DNSKEY is when the DNSKEY is
1180  * still hidden.
1181  *
1182  * TODO: How do we know we are introducing the RRSIG DNSKEY? We might be
1183  * outroducing it.
1184  */
1185  if (key_state_state(key_data_cached_dnskey(future_key->key)) == HIDDEN) {
1186  return 0;
1187  }
1188  break;
1189 
1190  case KEY_STATE_TYPE_RRSIG:
1191  if (!key_state_minimize(key_data_cached_rrsig(future_key->key))) {
1192  /*
1193  * There are no restrictions for the RRSIG transition so we can
1194  * just continue.
1195  */
1196  break;
1197  }
1198 
1199  /*
1200  * Check if the DNSKEY is introduced and continue if it is.
1201  */
1202  if (key_state_state(key_data_cached_dnskey(future_key->key)) == OMNIPRESENT) {
1203  break;
1204  }
1205 
1206  /*
1207  * We might be doing an algorithm rollover so we check if there are
1208  * no other good ZSK available and ignore the minimize flag if so.
1209  *
1210  * TODO: How is this related to ZSK/CSK? There are no check for key_data_role().
1211  */
1212  if (exists(keylist, keylist_size, future_key, 1, mask[0]) > 0
1213  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[2], mask[1], KEY_STATE_TYPE_DNSKEY, deplist) > 0
1214  || exists_with_successor(keylist, keylist_size, future_key, 1, mask[4], mask[3], KEY_STATE_TYPE_RRSIG, deplist) > 0
1215  )
1216  {
1217  /*
1218  * We found a good key, so we will not do any transition.
1219  */
1220  return 0;
1221  }
1222  break;
1223 
1224  default:
1225  return 0;
1226  }
1227 
1228  return 1;
1229 }
1230 
1240 static int
1241 getZoneTTL(policy_t* policy, zone_t* zone, key_state_type_t type,
1242  const time_t now)
1243 {
1244  time_t end_date;
1245  int ttl;
1246 
1247  if (!policy) {
1248  return -1;
1249  }
1250  if (!zone) {
1251  return -1;
1252  }
1253 
1254  switch (type) {
1255  case KEY_STATE_TYPE_DS:
1256  end_date = zone_ttl_end_ds(zone);
1257  ttl = policy_parent_ds_ttl(policy);
1258  break;
1259 
1260  case KEY_STATE_TYPE_DNSKEY: /* Intentional fall-through */
1262  end_date = zone_ttl_end_dk(zone);
1263  ttl = policy_keys_ttl(policy);
1264  break;
1265 
1266  case KEY_STATE_TYPE_RRSIG:
1267  end_date = zone_ttl_end_rs(zone);
1268  ttl = max(min(policy_zone_soa_ttl(policy), policy_zone_soa_minimum(policy)),
1271  ? policy_denial_ttl(policy)
1272  : policy_signatures_max_zone_ttl(policy) )
1273  : policy_signatures_max_zone_ttl(policy) ));
1274  break;
1275 
1276  default:
1277  return -1;
1278  }
1279 
1280  return max((int)difftime(end_date, now), ttl);
1281 }
1282 
1289 static int
1290 isSuccessable(struct future_key* future_key)
1291 {
1292  if (!future_key) {
1293  return -1;
1294  }
1295 
1296  if (future_key->next_state != UNRETENTIVE) {
1297  return 0;
1298  }
1299 
1300  switch (future_key->type) {
1301  case KEY_STATE_TYPE_DS:
1302  case KEY_STATE_TYPE_RRSIG:
1303  if (key_state_state(key_data_cached_dnskey(future_key->key)) != OMNIPRESENT) {
1304  return 0;
1305  }
1306  break;
1307 
1309  return 0;
1310 
1311  case KEY_STATE_TYPE_DNSKEY:
1312  if (key_state_state(key_data_cached_ds(future_key->key)) != OMNIPRESENT
1314  {
1315  return 0;
1316  }
1317  break;
1318 
1319  default:
1320  return -1;
1321  }
1322 
1323  return 1;
1324 }
1325 
1332 static int
1333 markSuccessors(db_connection_t *dbconn, key_data_t** keylist,
1334  size_t keylist_size, struct future_key *future_key,
1335  key_dependency_list_t* deplist, const zone_t* zone)
1336 {
1337  static const char *scmd = "markSuccessors";
1338  size_t i;
1341 
1342  if (!dbconn) {
1343  return -1;
1344  }
1345  if (!keylist) {
1346  return -1;
1347  }
1348  if (!future_key) {
1349  return -1;
1350  }
1351  if (!deplist) {
1352  return -1;
1353  }
1354  if (!zone) {
1355  return -1;
1356  }
1357 
1358  if (isSuccessable(future_key) < 1) {
1359  return 0;
1360  }
1361 
1362  for (i = 0; i < keylist_size; i++) {
1363  if (isPotentialSuccessor(keylist[i], future_key->key, future_key, future_key->type) > 0) {
1364  switch (future_key->type) {
1365  case KEY_STATE_TYPE_DS:
1366  key_dependency_type = KEY_DEPENDENCY_TYPE_DS;
1367  break;
1368 
1369  case KEY_STATE_TYPE_DNSKEY:
1370  key_dependency_type = KEY_DEPENDENCY_TYPE_DNSKEY;
1371  break;
1372 
1374  key_dependency_type = KEY_DEPENDENCY_TYPE_RRSIGDNSKEY;
1375  break;
1376 
1377  case KEY_STATE_TYPE_RRSIG:
1378  key_dependency_type = KEY_DEPENDENCY_TYPE_RRSIG;
1379  break;
1380 
1381  default:
1382  return -1;
1383  }
1384 
1385  if (!(key_dependency = key_dependency_new(dbconn))
1386  || key_dependency_set_from_key_data_id(key_dependency, key_data_id(future_key->key))
1387  || key_dependency_set_to_key_data_id(key_dependency, key_data_id(keylist[i]))
1388  || key_dependency_set_type(key_dependency, key_dependency_type)
1389  || key_dependency_set_zone_id(key_dependency, zone_id(zone))
1390  || key_dependency_create(key_dependency))
1391  {
1392  ods_log_error("[%s] %s: unable to create key dependency between %s and %s",
1393  module_str, scmd,
1396  key_dependency_free(key_dependency);
1397  return -1;
1398  }
1399  key_dependency_free(key_dependency);
1400  }
1401  }
1402 
1403  return 1;
1404 }
1405 
1415 static time_t
1416 updateZone(db_connection_t *dbconn, policy_t* policy, zone_t* zone,
1417  const time_t now, int allow_unsigned, int *zone_updated,
1418  key_data_t** keylist, size_t keylist_size, key_dependency_list_t *deplist)
1419 {
1420  time_t returntime_zone = -1;
1421  unsigned int ttl;
1422  static const char *scmd = "updateZone";
1423  size_t i;
1424  unsigned int j, change;
1425  static const key_state_type_t type[] = {
1430  };
1431  struct future_key future_key;
1433  key_state_state_t state;
1434  time_t returntime_key;
1436  int key_data_updated, process, key_state_created;
1437  const db_enum_t* state_enum, *next_state_enum, *type_enum;
1438  key_dependency_list_t *deplisttmp = NULL;
1439 
1440  if (!dbconn) {
1441  /* TODO: better log error */
1442  ods_log_error("[%s] %s: no dbconn", module_str, scmd);
1443  return returntime_zone;
1444  }
1445  if (!policy) {
1446  /* TODO: better log error */
1447  ods_log_error("[%s] %s: no policy", module_str, scmd);
1448  return returntime_zone;
1449  }
1450  if (!zone) {
1451  /* TODO: better log error */
1452  ods_log_error("[%s] %s: no zone", module_str, scmd);
1453  return returntime_zone;
1454  }
1455  if (!zone_updated) {
1456  /* TODO: better log error */
1457  ods_log_error("[%s] %s: no zone_updated", module_str, scmd);
1458  return returntime_zone;
1459  }
1460  if (!keylist) {
1461  /* TODO: better log error */
1462  ods_log_error("[%s] %s: no keylist", module_str, scmd);
1463  return returntime_zone;
1464  }
1465  if (!deplist) {
1466  /* TODO: better log error */
1467  ods_log_error("[%s] %s: no deplist", module_str, scmd);
1468  return returntime_zone;
1469  }
1470 
1471  ods_log_verbose("[%s] %s: processing %s with policyName %s", module_str, scmd, zone_name(zone), policy_name(policy));
1472 
1473  deplisttmp = zone_get_key_dependencies(zone);
1474 
1475  /*
1476  * The process variable will indicate if we are processing, if something
1477  * fails and sets it to 0 then it will fall through to the end.
1478  */
1479  process = 1;
1480 
1481  /*
1482  * This code keeps track of TTL changes. If in the past a large TTL is used,
1483  * our keys *may* need to transition extra careful to make sure each
1484  * resolver picks up the RRset. When this date passes we may start using the
1485  * policies TTL.
1486  */
1487  if (process && zone_ttl_end_ds(zone) <= now) {
1488  if (zone_set_ttl_end_ds(zone, addtime(now, policy_parent_ds_ttl(policy)))) {
1489  ods_log_error("[%s] %s: zone_set_ttl_end_ds() failed", module_str, scmd);
1490  process = 0;
1491  }
1492  else {
1493  *zone_updated = 1;
1494  }
1495  }
1496  if (process && zone_ttl_end_dk(zone) <= now) {
1497  /*
1498  * If no DNSKEY is currently published we must take negative caching
1499  * into account.
1500  */
1501  for (i = 0; i < keylist_size; i++) {
1502  if (key_state_state(key_data_cached_dnskey(keylist[i])) == OMNIPRESENT) {
1503  break;
1504  }
1505  }
1506  if (keylist_size < i) {
1507  ttl = max(policy_keys_ttl(policy),
1508  min(policy_zone_soa_ttl(policy), policy_zone_soa_minimum(policy)));
1509  }
1510  else {
1511  ttl = policy_keys_ttl(policy);
1512  }
1513  if (zone_set_ttl_end_dk(zone, addtime(now, ttl))) {
1514  ods_log_error("[%s] %s: zone_set_ttl_end_dk() failed", module_str, scmd);
1515  process = 0;
1516  }
1517  else {
1518  *zone_updated = 1;
1519  }
1520  }
1521  if (process && zone_ttl_end_rs(zone) <= now) {
1523  ttl = max(policy_signatures_max_zone_ttl(policy), policy_denial_ttl(policy));
1524  }
1525  else {
1526  ttl = policy_signatures_max_zone_ttl(policy);
1527  }
1528  if (zone_set_ttl_end_rs(zone, addtime(now, max(
1529  min(policy_zone_soa_ttl(policy), policy_zone_soa_minimum(policy)),
1530  ttl))))
1531  {
1532  ods_log_error("[%s] %s: zone_set_ttl_end_rs() failed", module_str, scmd);
1533  process = 0;
1534  }
1535  else {
1536  *zone_updated = 1;
1537  }
1538  }
1539 
1540  /*
1541  * Create key states that do not exist.
1542  */
1543  for (i = 0; process && i < keylist_size; i++) {
1544  key_state_created = 0;
1545  if (!key_data_cached_ds(keylist[i])) {
1546  if (!(key_state = key_state_new(dbconn))
1547  || key_state_set_key_data_id(key_state, key_data_id(keylist[i]))
1548  || key_state_set_type(key_state, KEY_STATE_TYPE_DS)
1549  || key_state_set_minimize(key_state, (key_data_minimize(keylist[i]) >> 2) & 1)
1550  || key_state_set_state(key_state, key_data_role(keylist[i]) & KEY_DATA_ROLE_KSK ? HIDDEN : NA)
1551  || key_state_set_last_change(key_state, now)
1552  || key_state_set_ttl(key_state, getZoneTTL(policy, zone, KEY_STATE_TYPE_DS, now))
1553  || key_state_create(key_state))
1554  {
1555  ods_log_error("[%s] %s: key state DS creation failed", module_str, scmd);
1556  process = 0;
1557  key_state_free(key_state);
1558  key_state = NULL;
1559  break;
1560  }
1561  key_state_created = 1;
1562  key_state_free(key_state);
1563  key_state = NULL;
1564 
1565  if (!zone_signconf_needs_writing(zone)) {
1566  if (zone_set_signconf_needs_writing(zone, 1)) {
1567  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
1568  process = 0;
1569  break;
1570  }
1571  else {
1572  *zone_updated = 1;
1573  }
1574  }
1575  }
1576  if (!key_data_cached_dnskey(keylist[i])) {
1577  if (!(key_state = key_state_new(dbconn))
1578  || key_state_set_key_data_id(key_state, key_data_id(keylist[i]))
1580  || key_state_set_minimize(key_state, (key_data_minimize(keylist[i]) >> 1) & 1)
1581  || key_state_set_state(key_state, HIDDEN)
1582  || key_state_set_last_change(key_state, now)
1583  || key_state_set_ttl(key_state, getZoneTTL(policy, zone, KEY_STATE_TYPE_DNSKEY, now))
1584  || key_state_create(key_state))
1585  {
1586  ods_log_error("[%s] %s: key state DNSKEY creation failed", module_str, scmd);
1587  process = 0;
1588  key_state_free(key_state);
1589  key_state = NULL;
1590  break;
1591  }
1592  key_state_created = 1;
1593  key_state_free(key_state);
1594  key_state = NULL;
1595 
1596  if (!zone_signconf_needs_writing(zone)) {
1597  if (zone_set_signconf_needs_writing(zone, 1)) {
1598  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
1599  process = 0;
1600  break;
1601  }
1602  else {
1603  *zone_updated = 1;
1604  }
1605  }
1606  }
1607  if (!key_data_cached_rrsigdnskey(keylist[i])) {
1608  if (!(key_state = key_state_new(dbconn))
1609  || key_state_set_key_data_id(key_state, key_data_id(keylist[i]))
1611  || key_state_set_state(key_state, key_data_role(keylist[i]) & KEY_DATA_ROLE_KSK ? HIDDEN : NA)
1612  || key_state_set_last_change(key_state, now)
1613  || key_state_set_ttl(key_state, getZoneTTL(policy, zone, KEY_STATE_TYPE_RRSIGDNSKEY, now))
1614  || key_state_create(key_state))
1615  {
1616  ods_log_error("[%s] %s: key state RRSIGDNSKEY creation failed", module_str, scmd);
1617  process = 0;
1618  key_state_free(key_state);
1619  key_state = NULL;
1620  break;
1621  }
1622  key_state_created = 1;
1623  key_state_free(key_state);
1624  key_state = NULL;
1625 
1626  if (!zone_signconf_needs_writing(zone)) {
1627  if (zone_set_signconf_needs_writing(zone, 1)) {
1628  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
1629  process = 0;
1630  break;
1631  }
1632  else {
1633  *zone_updated = 1;
1634  }
1635  }
1636  }
1637  if (!key_data_cached_rrsig(keylist[i])) {
1638  if (!(key_state = key_state_new(dbconn))
1639  || key_state_set_key_data_id(key_state, key_data_id(keylist[i]))
1640  || key_state_set_type(key_state, KEY_STATE_TYPE_RRSIG)
1641  || key_state_set_minimize(key_state, key_data_minimize(keylist[i]) & 1)
1642  || key_state_set_state(key_state, key_data_role(keylist[i]) & KEY_DATA_ROLE_ZSK ? HIDDEN : NA)
1643  || key_state_set_last_change(key_state, now)
1644  || key_state_set_ttl(key_state, getZoneTTL(policy, zone, KEY_STATE_TYPE_RRSIG, now))
1645  || key_state_create(key_state))
1646  {
1647  ods_log_error("[%s] %s: key state RRSIG creation failed", module_str, scmd);
1648  process = 0;
1649  key_state_free(key_state);
1650  key_state = NULL;
1651  break;
1652  }
1653  key_state_created = 1;
1654  key_state_free(key_state);
1655  key_state = NULL;
1656 
1657  if (!zone_signconf_needs_writing(zone)) {
1658  if (zone_set_signconf_needs_writing(zone, 1)) {
1659  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
1660  process = 0;
1661  break;
1662  }
1663  else {
1664  *zone_updated = 1;
1665  }
1666  }
1667  }
1668  if (key_state_created) {
1669  if (key_data_cache_key_states(keylist[i])) {
1670  ods_log_error("[%s] %s: Unable to recache key states after creating some", module_str, scmd);
1671  process = 0;
1672  break;
1673  }
1674  }
1675  }
1676 
1677  /*
1678  * Keep looping till there are no state changes and find the earliest update
1679  * time to return.
1680  */
1681  do {
1682  change = 0;
1683  for (i = 0; process && i < keylist_size; i++) {
1684  ods_log_verbose("[%s] %s: processing key %s %u", module_str, scmd,
1685  hsm_key_locator(key_data_cached_hsm_key(keylist[i])), key_data_minimize(keylist[i]));
1686 
1687  for (j = 0; process && j < (sizeof(type) / sizeof(key_state_state_t)); j++) {
1688  /*
1689  * If the state or desired_state is invalid something went wrong
1690  * and we should return.
1691  */
1692  if ((state = getState(keylist[i], type[j], NULL)) == KEY_STATE_STATE_INVALID
1693  || (next_state = getDesiredState(key_data_introducing(keylist[i]), state)) == KEY_STATE_STATE_INVALID)
1694  {
1695  ods_log_error("[%s] %s: (state || next_state) == INVALID", module_str, scmd);
1696  process = 0;
1697  break;
1698  }
1699 
1700  /*
1701  * If there is no change in key state we continue.
1702  */
1703  if (state == next_state) {
1704  continue;
1705  }
1706 
1707  /*
1708  * If the key state is a DS then we need to check if we still
1709  * are waiting for user input before we can transition the key.
1710  */
1711  if (type[j] == KEY_STATE_TYPE_DS) {
1712  if ((next_state == OMNIPRESENT
1714  || (next_state == HIDDEN
1716  {
1717  continue;
1718  }
1719  }
1720 
1721  for (type_enum = key_state_enum_set_type; type_enum->text; type_enum++) {
1722  if (type_enum->value == (int)type[j]) {
1723  break;
1724  }
1725  }
1726  for (state_enum = key_state_enum_set_state; state_enum->text; state_enum++) {
1727  if (state_enum->value == (int)state) {
1728  break;
1729  }
1730  }
1731  for (next_state_enum = key_state_enum_set_state; next_state_enum->text; next_state_enum++) {
1732  if (next_state_enum->value == (int)next_state) {
1733  break;
1734  }
1735  }
1736  ods_log_verbose("[%s] %s: May %s %s %s in state %s transition to %s?", module_str, scmd,
1737  key_data_role_text(keylist[i]),
1739  type_enum->text,
1740  state_enum->text,
1741  next_state_enum->text);
1742 
1743  future_key.key = keylist[i];
1744  future_key.type = type[j];
1745  future_key.next_state = next_state;
1746 
1747  /*
1748  * Check if policy prevents transition.
1749  */
1750  if (policyApproval(keylist, keylist_size, &future_key, deplist) < 1) {
1751  continue;
1752  }
1753  ods_log_verbose("[%s] %s Policy says we can (1/3)", module_str, scmd);
1754 
1755  /*
1756  * Check if DNSSEC state prevents transition.
1757  */
1758  if (dnssecApproval(keylist, keylist_size, &future_key, allow_unsigned, deplisttmp) < 1) {
1759  continue;
1760  }
1761  ods_log_verbose("[%s] %s DNSSEC says we can (2/3)", module_str, scmd);
1762 
1763  returntime_key = minTransitionTime(policy, type[j], next_state,
1764  key_state_last_change(getRecord(keylist[i], type[j])),
1765  getZoneTTL(policy, zone, type[j], now));
1766 
1767  /*
1768  * If this is an RRSIG and the DNSKEY is omnipresent and next
1769  * state is a certain state, wait an additional signature
1770  * lifetime to allow for 'smooth rollover'.
1771  */
1772  if (type[j] == KEY_STATE_TYPE_RRSIG
1774  && (next_state == OMNIPRESENT || next_state == HIDDEN))
1775  {
1776  returntime_key = addtime(returntime_key,
1777  policy_signatures_jitter(policy)
1778  + max(policy_signatures_validity_default(policy),
1780  + policy_signatures_resign(policy)
1781  - policy_signatures_refresh(policy));
1782  }
1783 
1784  /*
1785  * It is to soon to make this change. Schedule it.
1786  */
1787  if (returntime_key > now) {
1788  minTime(returntime_key, &returntime_zone);
1789  continue;
1790  }
1791 
1792  ods_log_verbose("[%s] %s Timing says we can (3/3) now: %lu key: %lu",
1793  module_str, scmd, (unsigned long)now, (unsigned long)returntime_key);
1794 
1795  /*
1796  * A record can only reach Omnipresent if properly backed up.
1797  */
1798  if (next_state == OMNIPRESENT) {
1801  {
1802  ods_log_crit("[%s] %s Ready for transition but key material not backed up yet (%s)",
1803  module_str, scmd, hsm_key_locator(key_data_cached_hsm_key(keylist[i])));
1804 
1805  /*
1806  * Try again in 60 seconds
1807  */
1808  returntime_key = addtime(now, 60);
1809  minTime(returntime_key, &returntime_zone);
1810  continue;
1811  }
1812  }
1813 
1814  /*
1815  * If we are handling a DS we depend on the user or
1816  * some other external process. We must communicate
1817  * through the DSSeen and -submit flags.
1818  */
1819  if (type[j] == KEY_STATE_TYPE_DS) {
1820  key_data_updated = 0;
1821 
1822  /*
1823  * Ask the user to submit the DS to the parent.
1824  */
1825  if (next_state == RUMOURED) {
1826  switch (key_data_ds_at_parent(keylist[i])) {
1830  break;
1831 
1833  /*
1834  * Hypothetical case where we reintroduce keys.
1835  */
1837  key_data_updated = 1;
1838  break;
1839 
1840  default:
1842  key_data_updated = 1;
1843  }
1844  }
1845  /*
1846  * Ask the user to remove the DS from the parent.
1847  */
1848  else if (next_state == UNRETENTIVE) {
1849  switch(key_data_ds_at_parent(keylist[i])) {
1851  /*
1852  * Never submitted.
1853  * NOTE: not safe if we support reintroducing of keys.
1854  */
1856  key_data_updated = 1;
1857  break;
1858 
1862  break;
1863 
1864  default:
1866  key_data_updated = 1;
1867  }
1868  }
1869 
1870  /*
1871  * Save the changes made to the key data if any.
1872  */
1873  if (key_data_updated) {
1874  if (key_data_update(keylist[i])) {
1875  ods_log_error("[%s] %s: key data update failed", module_str, scmd);
1876  process = 0;
1877  break;
1878  }
1879  /*
1880  * We now need to reread the key data object.
1881  *
1882  * TODO: This needs investigation how to do better.
1883  */
1884  if (key_data_get_by_id(keylist[i], key_data_id(keylist[i]))
1885  || key_data_cache_key_states(keylist[i])
1886  || key_data_cache_hsm_key(keylist[i]))
1887  {
1888  ods_log_error("[%s] %s: key data reread failed", module_str, scmd);
1889  process = 0;
1890  break;
1891  }
1892  }
1893  }
1894 
1895  /*
1896  * We've passed all tests! Make the transition.
1897  */
1898  key_state = NULL;
1899 
1900  switch (future_key.type) {
1901  case KEY_STATE_TYPE_DS:
1902  key_state = key_data_get_cached_ds(future_key.key);
1903  break;
1904 
1905  case KEY_STATE_TYPE_DNSKEY:
1906  key_state = key_data_get_cached_dnskey(future_key.key);
1907  break;
1908 
1909  case KEY_STATE_TYPE_RRSIG:
1910  key_state = key_data_get_cached_rrsig(future_key.key);
1911  break;
1912 
1914  key_state = key_data_get_cached_rrsigdnskey(future_key.key);
1915  break;
1916 
1917  default:
1918  ods_log_error("[%s] %s: future key type error", module_str, scmd);
1919  process = 0;
1920  break;
1921  }
1922 
1923  for (next_state_enum = key_state_enum_set_state; next_state_enum->text; next_state_enum++) {
1924  if (next_state_enum->value == (int)next_state) {
1925  break;
1926  }
1927  }
1928  ods_log_verbose("[%s] %s: Transitioning %s %s %s from %s to %s", module_str, scmd,
1929  key_data_role_text(keylist[i]),
1931  key_state_type_text(key_state),
1932  key_state_state_text(key_state),
1933  next_state_enum->text);
1934 
1935  if (key_state_set_state(key_state, future_key.next_state)
1936  || key_state_set_last_change(key_state, now)
1937  || key_state_set_ttl(key_state, getZoneTTL(policy, zone, future_key.type, now))
1938  || key_state_update(key_state))
1939  {
1940  ods_log_error("[%s] %s: key state transition failed", module_str, scmd);
1941  process = 0;
1942  key_state_free(key_state);
1943  break;
1944  }
1945  key_state_free(key_state);
1946 
1947  if (!zone_signconf_needs_writing(zone)) {
1948  if (zone_set_signconf_needs_writing(zone, 1)) {
1949  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
1950  process = 0;
1951  break;
1952  }
1953  else {
1954  *zone_updated = 1;
1955  }
1956  }
1957 
1958  if (markSuccessors(dbconn, keylist, keylist_size, &future_key, deplisttmp, zone) < 0) {
1959  ods_log_error("[%s] %s: markSuccessors() error", module_str, scmd);
1960  process = 0;
1961  break;
1962  }
1963  /*deps have changed reload*/
1964  key_dependency_list_free(deplisttmp);
1965  deplisttmp = zone_get_key_dependencies(zone);
1966 
1967 
1968  if (key_data_cache_key_states(keylist[i])) {
1969  ods_log_error("[%s] %s: Unable to recache key states after transition", module_str, scmd);
1970  process = 0;
1971  break;
1972  }
1973 
1974  change = true;
1975  }
1976  }
1977  } while (process && change);
1978  key_dependency_list_free(deplisttmp);
1979  return returntime_zone;
1980 }
1981 
1985 static const hsm_key_t*
1986 getLastReusableKey(key_data_list_t *key_list, const policy_key_t *pkey)
1987 {
1988  const key_data_t *key;
1989  const hsm_key_t *hkey, *hkey_young = NULL;
1990  hsm_key_list_t* hsmkeylist;
1991  int match;
1992  int cmp;
1993 
1994  if (!key_list || !pkey)
1995  return NULL;
1996 
1997  hsmkeylist = hsm_key_list_new_get_by_policy_key(pkey);
1998  for (hkey = hsm_key_list_get_begin(hsmkeylist); hkey;
1999  hkey = hsm_key_list_get_next(hsmkeylist))
2000  {
2002  if ((~hsm_key_role(hkey) & policy_key_role(pkey)) != 0)
2003  continue;
2004 
2007  if (hkey->state == HSM_KEY_STATE_UNUSED)
2008  continue;
2009 
2011  for (match = 0, key = key_data_list_begin(key_list); key; key = key_data_list_next(key_list)) {
2012  if (!db_value_cmp(key_data_hsm_key_id(key), hsm_key_id(hkey), &cmp)
2013  && cmp == 0)
2014  {
2016  match = 1;
2017  break;
2018  }
2019  }
2020  if (match) continue;
2021 
2023  if (!hkey_young || hsm_key_inception(hkey_young) < hsm_key_inception(hkey))
2024  hkey_young = hkey;
2025  }
2026 
2027  hsm_key_list_free(hsmkeylist);
2028  return hkey_young;
2029 }
2030 
2039 static int
2040 existsPolicyForKey(policy_key_list_t *policykeylist, const key_data_t *key)
2041 {
2042  static const char *scmd = "existsPolicyForKey";
2043  const policy_key_t *pkey;
2044  hsm_key_t *hkey;
2045 
2046  if (!policykeylist) {
2047  return -1;
2048  }
2049  if (!key) {
2050  return -1;
2051  }
2052 
2053  if (!(hkey = key_data_get_hsm_key(key))) {
2054  /*
2055  * This key is not associated with actual key material!
2056  * This is a bug or database corruption.
2057  * Crashing here is an option but we just return false so the
2058  * key will be thrown away in a graceful manner.
2059  */
2060  ods_log_verbose("[%s] %s no hsmkey!", module_str, scmd);
2061  return 0;
2062  }
2063  pkey = policy_key_list_begin(policykeylist);
2064  while (pkey) {
2065  if ((int)policy_key_role(pkey) == (int)key_data_role(key) &&
2066  hsm_key_repository(hkey) && policy_key_repository(pkey) &&
2067  strcmp(hsm_key_repository(hkey), policy_key_repository(pkey)) == 0 &&
2068  hsm_key_algorithm(hkey) == policy_key_algorithm(pkey) &&
2069  hsm_key_bits(hkey) == policy_key_bits(pkey))
2070  {
2071  hsm_key_free(hkey);
2072  return 1;
2073  }
2074  pkey = policy_key_list_next(policykeylist);
2075  }
2076  ods_log_verbose("[%s] %s not found such config", module_str, scmd);
2077  hsm_key_free(hkey);
2078  return 0;
2079 }
2080 
2081 static int
2082 last_inception_policy(key_data_list_t *key_list, const policy_key_t *pkey)
2083 {
2084  const key_data_t *key = NULL;
2085  hsm_key_t *hsmkey = NULL;
2086  int max_inception = -1;
2087 
2088  if (!key_list || !pkey) return -1;
2089 
2090  /*
2091  * Must match: role, bits, algorithm and repository.
2092  */
2093  for (key = key_data_list_begin(key_list); key;
2094  key = key_data_list_next(key_list))
2095  {
2096  if ((int)policy_key_role(pkey) != (int)key_data_role(key) ||
2097  policy_key_algorithm(pkey) != key_data_algorithm(key) ||
2098  (hsmkey = key_data_get_hsm_key(key)) == NULL ||
2099  policy_key_bits(pkey) != hsm_key_bits(hsmkey) ||
2100  policy_key_algorithm(pkey) != hsm_key_algorithm(hsmkey) ||
2101  strcmp(policy_key_repository(pkey), hsm_key_repository(hsmkey)))
2102  {
2103  hsm_key_free(hsmkey);
2104  hsmkey = NULL;
2105  continue;
2106  }
2107  hsm_key_free(hsmkey);
2108  hsmkey = NULL;
2110  if (max_inception == -1 || max_inception < (signed int)key_data_inception(key))
2111  {
2112  max_inception = key_data_inception(key);
2113  }
2114  }
2115  return max_inception;
2116 }
2117 
2126 static int
2127 key_for_conf(key_data_list_t *key_list, const policy_key_t *pkey)
2128 {
2129  const key_data_t *key;
2130 
2131  if (!key_list) {
2132  return 0;
2133  }
2134  if (!pkey) {
2135  return 0;
2136  }
2137 
2138  for (key = key_data_list_begin(key_list); key;
2139  key = key_data_list_next(key_list))
2140  {
2141  if (policy_key_algorithm(pkey) == key_data_algorithm(key) &&
2142  (int)policy_key_role(pkey) == (int)key_data_role(key))
2143  {
2144  return 1;
2145  }
2146  }
2147  return 0;
2148 }
2149 
2156 static void
2157 setnextroll(zone_t *zone, const policy_key_t *pkey, time_t t)
2158 {
2159  assert(zone);
2160  assert(pkey);
2161 
2162  switch(policy_key_role(pkey)) {
2163  case POLICY_KEY_ROLE_KSK:
2164  zone->next_ksk_roll = (unsigned int)t;
2165  break;
2166  case POLICY_KEY_ROLE_ZSK:
2167  zone->next_zsk_roll = (unsigned int)t;
2168  break;
2169  case POLICY_KEY_ROLE_CSK:
2170  zone->next_csk_roll = (unsigned int)t;
2171  break;
2172  default:
2173  assert(0);
2174  }
2175 }
2176 
2177 static int
2178 enforce_roll(const zone_t *zone, const policy_key_t *pkey)
2179 {
2180  if (!zone) {
2181  return 0;
2182  }
2183  if (!pkey) {
2184  return 0;
2185  }
2186 
2187  switch(policy_key_role(pkey)) {
2188  case POLICY_KEY_ROLE_KSK:
2189  return zone_roll_ksk_now(zone);
2190  case POLICY_KEY_ROLE_ZSK:
2191  return zone_roll_zsk_now(zone);
2192  case POLICY_KEY_ROLE_CSK:
2193  return zone_roll_csk_now(zone);
2194  default:
2195  return 0;
2196  }
2197 }
2198 
2199 static int
2200 set_roll(zone_t *zone, const policy_key_t *pkey, unsigned int roll)
2201 {
2202  if (!zone) {
2203  return 0;
2204  }
2205  if (!pkey) {
2206  return 0;
2207  }
2208 
2209  switch(policy_key_role(pkey)) {
2210  case POLICY_KEY_ROLE_KSK:
2211  return zone_set_roll_ksk_now(zone, roll);
2212  case POLICY_KEY_ROLE_ZSK:
2213  return zone_set_roll_zsk_now(zone, roll);
2214  case POLICY_KEY_ROLE_CSK:
2215  return zone_set_roll_csk_now(zone, roll);
2216  default:
2217  return 1;
2218  }
2219 }
2220 
2230 static time_t
2231 updatePolicy(engine_type *engine, db_connection_t *dbconn, policy_t *policy,
2232  zone_t *zone, const time_t now, int *allow_unsigned, int *zone_updated)
2233 {
2234  time_t return_at = -1;
2235  key_data_list_t *keylist;
2236  policy_key_list_t *policykeylist;
2237  const key_data_t *key;
2238  key_data_t *mutkey = NULL;
2239  key_data_t *mutkey2 = NULL;
2240  const policy_key_t *pkey;
2241  const hsm_key_t *hsmkey;
2242  hsm_key_t *hsmkey2 = NULL;
2243  hsm_key_t *newhsmkey = NULL;
2244  static const char *scmd = "updatePolicy";
2245  int force_roll;
2246  time_t t_ret;
2247  key_data_role_t key_role;
2248  int err;
2249  uint16_t tag;
2250  int ret;
2251 
2252  if (!dbconn) {
2253  /* TODO: better log error */
2254  ods_log_error("[%s] %s: no dbconn", module_str, scmd);
2255  return now + 60;
2256  }
2257  if (!policy) {
2258  /* TODO: better log error */
2259  ods_log_error("[%s] %s: no policy", module_str, scmd);
2260  return now + 60;
2261  }
2262  if (!zone) {
2263  /* TODO: better log error */
2264  ods_log_error("[%s] %s: no zone", module_str, scmd);
2265  return now + 60;
2266  }
2267  if (!allow_unsigned) {
2268  /* TODO: better log error */
2269  ods_log_error("[%s] %s: no allow_unsigned", module_str, scmd);
2270  return now + 60;
2271  }
2272  if (!zone_updated) {
2273  /* TODO: better log error */
2274  ods_log_error("[%s] %s: no zone_updated", module_str, scmd);
2275  return now + 60;
2276  }
2277 
2278  ods_log_verbose("[%s] %s: policyName: %s", module_str, scmd, policy_name(policy));
2279 
2280  /*
2281  * Get all policy keys (configurations) for the given policy and fetch all
2282  * the policy key database objects so we can iterate over it more then once.
2283  */
2284  if (!(policykeylist = policy_get_policy_keys(policy))) {
2285  /* TODO: better log error */
2286  ods_log_error("[%s] %s: error policy_get_policy_keys()", module_str, scmd);
2287  policy_key_list_free(policykeylist);
2288  return now + 60;
2289  }
2290 
2291  /*
2292  * Get all key data objects for the given zone and fetch all the objects
2293  * from the database so we can use the list again later.
2294  */
2295  if (!(keylist = zone_get_keys(zone))) {
2296  /* TODO: better log error */
2297  ods_log_error("[%s] %s: error zone_get_keys()", module_str, scmd);
2298  key_data_list_free(keylist);
2299  policy_key_list_free(policykeylist);
2300  return now + 60;
2301  }
2302 
2303  /*
2304  * Decommission all key data objects without any matching policy key config.
2305  */
2306  while ((key = key_data_list_next(keylist))) {
2307  ret = existsPolicyForKey(policykeylist, key);
2308  if (ret < 0) {
2309  /* TODO: better log error */
2310  ods_log_error("[%s] %s: error existsPolicyForKey() < 0", module_str, scmd);
2311  key_data_list_free(keylist);
2312  policy_key_list_free(policykeylist);
2313  return now + 60;
2314  }
2315  if (!ret) {
2316  if (!(mutkey = key_data_new_copy(key))
2317  || key_data_set_introducing(mutkey, 0)
2318  || key_data_update(mutkey))
2319  {
2320  /* TODO: better log error */
2321  ods_log_error("[%s] %s: error update mutkey", module_str, scmd);
2322  key_data_free(mutkey);
2323  key_data_list_free(keylist);
2324  policy_key_list_free(policykeylist);
2325  return now + 60;
2326  }
2327  key_data_free(mutkey);
2328  mutkey = NULL;
2329  }
2330  }
2331 
2332  pkey = policy_key_list_begin(policykeylist);
2333 
2334  /*
2335  * If no keys are configured an unsigned zone is okay.
2336  */
2337  *allow_unsigned = pkey ? 0 : 1;
2338 
2339  /* If there are no keys configured set 'signconf_needs_writing'
2340  * every time this function is called */
2341  if (!policy_key_list_size(policykeylist)) {
2342  if (zone_set_signconf_needs_writing(zone, 1)) {
2343  ods_log_error("[%s] %s: zone_set_signconf_needs_writing() failed", module_str, scmd);
2344  } else {
2345  *zone_updated = 1;
2346  }
2347  }
2348 
2349  for (; pkey; pkey = policy_key_list_next(policykeylist)) {
2350  newhsmkey = NULL;
2351  /*
2352  * Check if we should roll, first get the roll state from the zone then
2353  * check if the policy key is set to manual rollover and last check the
2354  * key timings.
2355  */
2356  force_roll = enforce_roll(zone, pkey);
2357  if (policy_key_manual_rollover(pkey)) {
2358  /*
2359  * If this policy key is set to manual rollover and we do not have
2360  * a key yet (for ex first run) then we should roll anyway.
2361  */
2362  if (!key_for_conf(keylist, pkey)) {
2363  force_roll = 1;
2364  }
2365  else if (!force_roll) {
2366  /*
2367  * Since this is set to manual rollover we do not want it to
2368  * roll unless we have zone state saying that we should roll.
2369  */
2370  continue;
2371  }
2372  }
2373  if (!force_roll) {
2374  int inception = -1;
2375  /*
2376  * We do not need to roll but we should check if the youngest key
2377  * needs to be replaced. If not we reschedule for later based on the
2378  * youngest key.
2379  * TODO: Describe better why the youngest?!?
2380  */
2381  inception = last_inception_policy(keylist, pkey);
2382  if (inception != -1 &&
2383  inception + policy_key_lifetime(pkey) > now)
2384  {
2385  t_ret = addtime(inception, policy_key_lifetime(pkey));
2386  minTime(t_ret, &return_at);
2387  setnextroll(zone, pkey, t_ret);
2388  *zone_updated = 1;
2389  continue;
2390  }
2391  }
2392 
2393  /*
2394  * Time for a new key
2395  */
2396  ods_log_verbose("[%s] %s: New key needed for role %s",
2397  module_str, scmd, policy_key_role_text(pkey));
2398 
2399  /*
2400  * Sanity check for unreasonable short key lifetime.
2401  * This would produce silly output and give the signer lots of useless
2402  * work to do otherwise.
2403  */
2404  if ((policy_key_role(pkey) == POLICY_KEY_ROLE_KSK ||
2406  policy_parent_ds_ttl(policy) + policy_keys_ttl(policy) >=
2407  policy_key_lifetime(pkey))
2408  {
2409  ods_log_crit("[%s] %s: For policy %s %s key lifetime of %d "
2410  "is unreasonably short with respect to sum of parent "
2411  "TTL (%d) and key TTL (%d). Will not insert key!",
2412  module_str, scmd, policy_name(policy), policy_key_role_text(pkey),
2414  policy_keys_ttl(policy));
2415  setnextroll(zone, pkey, now);
2416  *zone_updated = 1;
2417  continue;
2418  }
2419  if ((policy_key_role(pkey) == POLICY_KEY_ROLE_ZSK ||
2421  policy_signatures_max_zone_ttl(policy) + policy_keys_ttl(policy) >=
2422  policy_key_lifetime(pkey))
2423  {
2424  ods_log_crit("[%s] %s: For policy %s %s key lifetime of %d "
2425  "is unreasonably short with respect to sum of "
2426  "MaxZoneTTL (%d) and key TTL (%d). Will not insert key!",
2427  module_str, scmd, policy_name(policy), policy_key_role_text(pkey),
2429  policy_keys_ttl(policy));
2430  setnextroll(zone, pkey, now);
2431  *zone_updated = 1;
2432  continue;
2433  }
2434 
2435  /*
2436  * Get a new key, either a existing/shared key if the policy is set to
2437  * share keys or create a new key.
2438  */
2439  if (policy_keys_shared(policy)) {
2440  hsmkey = getLastReusableKey(keylist, pkey);
2441 
2442  if (!hsmkey) {
2443  newhsmkey = hsm_key_factory_get_key(engine, dbconn, pkey, HSM_KEY_STATE_SHARED);
2444  hsmkey = newhsmkey;
2445  }
2446  } else {
2447  newhsmkey = hsm_key_factory_get_key(engine, dbconn, pkey, HSM_KEY_STATE_PRIVATE);
2448  hsmkey = newhsmkey;
2449  }
2450 
2451  if (!hsmkey) {
2452  /*
2453  * Unable to get/create a HSM key at this time, retry later.
2454  */
2455  ods_log_warning("[%s] %s: No keys available in HSM for policy %s, retry in %d seconds",
2456  module_str, scmd, policy_name(policy), NOKEY_TIMEOUT);
2457  minTime(now + NOKEY_TIMEOUT, &return_at);
2458  setnextroll(zone, pkey, now);
2459  *zone_updated = 1;
2460  continue;
2461  }
2462  ods_log_verbose("[%s] %s: got new key from HSM", module_str, scmd);
2463 
2464  /*
2465  * TODO: This will be replaced once roles are global
2466  */
2467  key_role = KEY_DATA_ROLE_INVALID;
2468  switch (policy_key_role(pkey)) {
2469  case POLICY_KEY_ROLE_KSK:
2470  key_role = KEY_DATA_ROLE_KSK;
2471  break;
2472 
2473  case POLICY_KEY_ROLE_ZSK:
2474  key_role = KEY_DATA_ROLE_ZSK;
2475  break;
2476 
2477  case POLICY_KEY_ROLE_CSK:
2478  key_role = KEY_DATA_ROLE_CSK;
2479  break;
2480 
2481  default:
2482  break;
2483  }
2484 
2485  /*
2486  * Create a new key data object.
2487  */
2488  if (!(mutkey = key_data_new(dbconn))
2489  || key_data_set_zone_id(mutkey, zone_id(zone))
2490  || key_data_set_hsm_key_id(mutkey, hsm_key_id(hsmkey))
2492  || key_data_set_inception(mutkey, now)
2493  || key_data_set_role(mutkey, key_role)
2494  || key_data_set_minimize(mutkey, policy_key_minimize(pkey))
2495  || key_data_set_introducing(mutkey, 1)
2497  {
2498  /* TODO: better log error */
2499  ods_log_error("[%s] %s: error new key", module_str, scmd);
2500  key_data_free(mutkey);
2501  if (newhsmkey) {
2502  hsm_key_factory_release_key(newhsmkey, dbconn);
2503  }
2504  hsm_key_free(newhsmkey);
2505  key_data_list_free(keylist);
2506  policy_key_list_free(policykeylist);
2507  return now + 60;
2508  }
2509 
2510  /*
2511  * Generate keytag for the new key and set it.
2512  */
2513  err = hsm_keytag(hsm_key_locator(hsmkey), hsm_key_algorithm(hsmkey),
2514  ((hsm_key_role(hsmkey) == HSM_KEY_ROLE_KSK
2515  || hsm_key_role(hsmkey) == HSM_KEY_ROLE_CSK)
2516  ? 1 : 0),
2517  &tag);
2518  if (err || key_data_set_keytag(mutkey, tag))
2519  {
2520  /* TODO: better log error */
2521  ods_log_error("[%s] %s: error keytag", module_str, scmd);
2522  key_data_free(mutkey);
2523  if (newhsmkey) {
2524  hsm_key_factory_release_key(newhsmkey, dbconn);
2525  }
2526  hsm_key_free(newhsmkey);
2527  key_data_list_free(keylist);
2528  policy_key_list_free(policykeylist);
2529  return now + 60;
2530  }
2531 
2532  /*
2533  * Create the new key in the database, if successful we set the next
2534  * roll after the lifetime of the key.
2535  */
2536  if (key_data_create(mutkey)) {
2537  /* TODO: better log error */
2538  ods_log_error("[%s] %s: error key_data_create()", module_str, scmd);
2539  key_data_free(mutkey);
2540  if (newhsmkey) {
2541  hsm_key_factory_release_key(newhsmkey, dbconn);
2542  }
2543  hsm_key_free(newhsmkey);
2544  key_data_list_free(keylist);
2545  policy_key_list_free(policykeylist);
2546  return now + 60;
2547  }
2548  t_ret = addtime(now, policy_key_lifetime(pkey));
2549  minTime(t_ret, &return_at);
2550  setnextroll(zone, pkey, t_ret);
2551  *zone_updated = 1;
2552 
2553  /*
2554  * Tell similar keys to out-troduce.
2555  * Similar keys are those that match role, algorithm, bits and repository
2556  * and are introduced.
2557  *
2558  * NOTE:
2559  * Will not work if a policy has 2 or more keys of the same role, algorithm,
2560  * bits and repository. Unclear how to fix this since keys are not directly
2561  * related to a policy key.
2562  * We currently do not allow two policy keys with the same attributes.
2563  */
2564  for (key = key_data_list_begin(keylist); key; key = key_data_list_next(keylist)) {
2565  if (key_data_introducing(key)
2566  && key_data_role(key) == key_data_role(mutkey)
2567  && key_data_algorithm(key) == key_data_algorithm(mutkey)
2568  && (hsmkey2 = key_data_get_hsm_key(key))
2569  && hsm_key_bits(hsmkey2) == hsm_key_bits(hsmkey)
2570  && !strcmp(hsm_key_repository(hsmkey2), hsm_key_repository(hsmkey)))
2571  {
2572  if (!(mutkey2 = key_data_new_copy(key))
2573  || key_data_set_introducing(mutkey2, 0)
2574  || key_data_update(mutkey2))
2575  {
2576  /* TODO: better log error */
2577  ods_log_error("[%s] %s: error update mutkey2", module_str, scmd);
2578  key_data_free(mutkey2);
2579  hsm_key_free(hsmkey2);
2580  key_data_free(mutkey);
2581  hsm_key_free(newhsmkey);
2582  key_data_list_free(keylist);
2583  policy_key_list_free(policykeylist);
2584  return now + 60;
2585  }
2586 
2587  ods_log_verbose("[%s] %s: decommissioning old key: %s", module_str, scmd, hsm_key_locator(hsmkey2));
2588 
2589  key_data_free(mutkey2);
2590  mutkey2 = NULL;
2591  }
2592  hsm_key_free(hsmkey2);
2593  hsmkey2 = NULL;
2594  }
2595 
2596  key_data_free(mutkey);
2597  mutkey = NULL;
2598  hsm_key_free(newhsmkey);
2599  newhsmkey = NULL;
2600 
2601  /*
2602  * Clear roll now (if set) in the zone for this policy key.
2603  */
2604  if (enforce_roll(zone, pkey)) {
2605  if (set_roll(zone, pkey, 0)) {
2606  /* TODO: better log error */
2607  ods_log_error("[%s] %s: error set_roll()", module_str, scmd);
2608  key_data_list_free(keylist);
2609  policy_key_list_free(policykeylist);
2610  return now + 60;
2611  }
2612  *zone_updated = 1;
2613  }
2614  }
2615 
2616  key_data_list_free(keylist);
2617  policy_key_list_free(policykeylist);
2618 
2619  return return_at;
2620 }
2621 
2622 static time_t
2623 removeDeadKeys(db_connection_t *dbconn, key_data_t** keylist,
2624  size_t keylist_size, key_dependency_list_t *deplist, const time_t now,
2625  const int purgetime)
2626 {
2627  static const char *scmd = "removeDeadKeys";
2628  time_t first_purge = -1, key_time;
2629  size_t i, deplist2_size = 0;
2630  int key_purgable, cmp;
2631  unsigned int j;
2632  const key_state_t* state = NULL;
2633  key_dependency_t **deplist2 = NULL;
2634 
2635  assert(keylist);
2636  assert(deplist);
2637 
2638  deplist2_size = key_dependency_list_size(deplist);
2639  deplist2 = (key_dependency_t**)calloc(deplist2_size, sizeof(key_dependency_t*));
2640  /* deplist might be NULL but is always freeable */
2641  if (deplist2_size > 0)
2642  deplist2[0] = key_dependency_list_get_begin(deplist);
2643  for (i = 1; i < deplist2_size; i++)
2644  deplist2[i] = key_dependency_list_get_next(deplist);
2645 
2646  for (i = 0; i < keylist_size; i++) {
2647  if (key_data_introducing(keylist[i])) continue;
2648  key_time = -1;
2649  key_purgable = 1;
2650  for (j = 0; j<4; j++) {
2651  switch(j){
2652  case 0: state = key_data_cached_ds(keylist[i]); break;
2653  case 1: state = key_data_cached_dnskey(keylist[i]); break;
2654  case 2: state = key_data_cached_rrsigdnskey(keylist[i]); break;
2655  case 3: state = key_data_cached_rrsig(keylist[i]);
2656  }
2657  if (key_state_state(state) == NA) continue;
2658  if (key_state_state(state) != HIDDEN) {
2659  key_purgable = 0;
2660  break;
2661  }
2662  if (key_state_last_change(state) > key_time) {
2663  key_time = key_state_last_change(state);
2664  }
2665  }
2666  if (key_time != -1) key_time = addtime(key_time, purgetime);
2667  if (key_purgable) {
2668  /* key is purgable, is it time yet? */
2669  if (now >= key_time) {
2670  key_state_t* ks_ds = key_data_get_cached_ds(keylist[i]);
2671  key_state_t* ks_dk = key_data_get_cached_dnskey(keylist[i]);
2672  key_state_t* ks_rd = key_data_get_cached_rrsigdnskey(keylist[i]);
2673  key_state_t* ks_rs = key_data_get_cached_rrsig(keylist[i]);
2674 
2675  ods_log_info("[%s] %s deleting key: %s", module_str, scmd,
2677 
2678  if ( key_state_delete(ks_ds) || key_state_delete(ks_dk)
2679  || key_state_delete(ks_rd) || key_state_delete(ks_rs)
2680  || key_data_delete(keylist[i])
2682  {
2683  /* TODO: better log error */
2684  ods_log_error("[%s] %s: key_state_delete() || key_data_delete() || hsm_key_factory_release_key() failed", module_str, scmd);
2685  }
2686  key_state_free(ks_ds);
2687  key_state_free(ks_dk);
2688  key_state_free(ks_rd);
2689  key_state_free(ks_rs);
2690  } else {
2691  minTime(key_time, &first_purge);
2692  }
2693  /* we can clean up dependency because key is purgable */
2694 
2695  for (j = 0; j < deplist2_size; j++) {
2696  if (!deplist2[j]) continue;
2697  if (db_value_cmp(key_data_id(keylist[i]), key_dependency_from_key_data_id(deplist2[j]), &cmp)) {
2698  /* TODO: better log error */
2699  ods_log_error("[%s] %s: cmp deplist from failed", module_str, scmd);
2700  break;
2701  }
2702  if(cmp) continue;
2703 
2704  if (key_dependency_delete(deplist2[j])) {
2705  /* TODO: better log error */
2706  ods_log_error("[%s] %s: key_dependency_delete() failed", module_str, scmd);
2707  break;
2708  }
2709  }
2710  }
2711  }
2712  for (i = 0; i < deplist2_size; i++){
2713  key_dependency_free(deplist2[i]);
2714  }
2715  free(deplist2);
2716  return first_purge;
2717 }
2718 
2719 time_t
2720 update(engine_type *engine, db_connection_t *dbconn, zone_t *zone, policy_t *policy, time_t now, int *zone_updated)
2721 {
2722  int allow_unsigned = 0;
2723  time_t policy_return_time, zone_return_time, purge_return_time = -1, return_time;
2724  key_data_list_t *key_list;
2725  const key_data_t* key;
2726  key_data_t** keylist = NULL;
2727  size_t keylist_size, i;
2728  key_dependency_list_t *deplist;
2729  static const char *scmd = "update";
2730  int key_data_updated;
2731 
2732  if (!engine) {
2733  ods_log_error("[%s] no engine", module_str);
2734  return now + 60;
2735  }
2736  if (!dbconn) {
2737  ods_log_error("[%s] no dbconn", module_str);
2738  return now + 60;
2739  }
2740  if (!zone) {
2741  ods_log_error("[%s] no zone", module_str);
2742  return now + 60;
2743  }
2744  if (!policy) {
2745  ods_log_error("[%s] no policy", module_str);
2746  return now + 60;
2747  }
2748  if (!zone_updated) {
2749  ods_log_error("[%s] no zone_updated", module_str);
2750  return now + 60;
2751  }
2752 
2753  ods_log_info("[%s] update zone: %s", module_str, zone_name(zone));
2754 
2755  /*
2756  * Update policy.
2757  */
2758  policy_return_time = updatePolicy(engine, dbconn, policy, zone, now, &allow_unsigned, zone_updated);
2759 
2760  if (allow_unsigned) {
2761  ods_log_info("[%s] No keys configured for %s, zone will become unsigned eventually",
2762  module_str, zone_name(zone));
2763  }
2764 
2765  /*
2766  * Get all key data/state/hsm objects for later processing.
2767  */
2768  if (!(deplist = zone_get_key_dependencies(zone))) {
2769  /* TODO: better log error */
2770  ods_log_error("[%s] %s: error zone_get_key_dependencies()", module_str, scmd);
2771  key_dependency_list_free(deplist);
2772  return now + 60;
2773  }
2774  if (!(key_list = zone_get_keys(zone))) {
2775  /* TODO: better log error */
2776  ods_log_error("[%s] %s: error zone_get_keys()", module_str, scmd);
2777  key_data_list_free(key_list);
2778  key_dependency_list_free(deplist);
2779  return now + 60;
2780  }
2781  /*WTF DOES THIS CODE DO?*/
2782  if (!(keylist_size = key_data_list_size(key_list))) {
2783  if ((key = key_data_list_begin(key_list))) {
2784  while (key) {
2785  keylist_size++;
2786  key = key_data_list_next(key_list);
2787  }
2788  }
2789  }
2790  if (keylist_size) {
2791  if (!(keylist = (key_data_t**)calloc(keylist_size, sizeof(key_data_t*)))) {
2792  /* TODO: better log error */
2793  ods_log_error("[%s] %s: error calloc(keylist_size)", module_str, scmd);
2794  key_data_list_free(key_list);
2795  key_dependency_list_free(deplist);
2796  return now + 60;
2797  }
2798  for (i = 0; i < keylist_size; i++) {
2799  if (!i) {
2800  keylist[i] = key_data_list_get_begin(key_list);
2801  }
2802  else {
2803  keylist[i] = key_data_list_get_next(key_list);
2804  }
2805  if (!keylist[i]
2806  || key_data_cache_hsm_key(keylist[i])
2807  || key_data_cache_key_states(keylist[i]))
2808  {
2809  ods_log_error("[%s] %s: error key_data_list cache", module_str, scmd);
2810  for (i = 0; i < keylist_size; i++) {
2811  if (keylist[i]) {
2812  key_data_free(keylist[i]);
2813  }
2814  }
2815  free(keylist);
2816  key_data_list_free(key_list);
2817  key_dependency_list_free(deplist);
2818  return now + 60;
2819  }
2820  }
2821  }
2822  key_data_list_free(key_list);
2823 
2824  /*
2825  * Update zone.
2826  */
2827  zone_return_time = updateZone(dbconn, policy, zone, now, allow_unsigned, zone_updated,
2828  keylist, keylist_size, deplist);
2829 
2830  /*
2831  * Only purge old keys if the policy says so.
2832  */
2833  if (policy_keys_purge_after(policy) && keylist) {
2834  purge_return_time = removeDeadKeys(dbconn, keylist, keylist_size, deplist, now,
2835  policy_keys_purge_after(policy));
2836  }
2837 
2838  /*
2839  * Always set these flags. Normally this needs to be done _only_ when the
2840  * Signer config needs writing. However a previous Signer config might not
2841  * be available, we have no way of telling. :(
2842  */
2843  for (i = 0; i < keylist_size; i++) {
2844  key_data_updated = 0;
2845 
2846  /* hack */
2847  key_data_set_publish(keylist[i], 0);
2848  key_data_set_active_ksk(keylist[i], 0);
2849  key_data_set_active_zsk(keylist[i], 0);
2850  key_data_updated = 1;
2851  /*
2852  * TODO: description
2853  */
2855  || key_state_state(key_data_cached_dnskey(keylist[i])) == RUMOURED)
2856  {
2857  if (!key_data_publish(keylist[i])) {
2858  if (key_data_set_publish(keylist[i], 1)) {
2859  ods_log_error("[%s] %s: key_data_set_publish() failed",
2860  module_str, scmd);
2861  break;
2862  }
2863 
2864  key_data_updated = 1;
2865  }
2866  }
2867 
2868  /*
2869  * TODO: description
2870  */
2873  {
2874  if (!key_data_active_ksk(keylist[i])) {
2875  if (key_data_set_active_ksk(keylist[i], 1)) {
2876  ods_log_error("[%s] %s: key_data_set_active_ksk() failed",
2877  module_str, scmd);
2878  break;
2879  }
2880 
2881  key_data_updated = 1;
2882  }
2883  }
2884 
2885  /*
2886  * TODO: description
2887  */
2889  || key_state_state(key_data_cached_rrsig(keylist[i])) == RUMOURED)
2890  {
2891  if (!key_data_active_zsk(keylist[i])) {
2892  if (key_data_set_active_zsk(keylist[i], 1)) {
2893  ods_log_error("[%s] %s: key_data_set_active_zsk() failed",
2894  module_str, scmd);
2895  break;
2896  }
2897 
2898  key_data_updated = 1;
2899  }
2900  }
2901 
2902  if (key_data_updated) {
2903  if (key_data_update(keylist[i])) {
2904  ods_log_error("[%s] %s: key_data_update() failed",
2905  module_str, scmd);
2906  break;
2907  }
2908  }
2909  }
2910 
2911  /*
2912  * Release cached objects.
2913  */
2914  for (i = 0; i < keylist_size; i++) {
2915  if (keylist[i]) {
2916  key_data_free(keylist[i]);
2917  }
2918  }
2919  free(keylist);
2920  key_dependency_list_free(deplist);
2921 
2922  return_time = zone_return_time;
2923  minTime(policy_return_time, &return_time);
2924  minTime(purge_return_time, &return_time);
2925  return return_time;
2926 }
const char * key_data_role_text(const key_data_t *key_data)
Definition: key_data.c:711
const char * key_state_state_text(const key_state_t *key_state)
Definition: key_state.c:377
const policy_key_t * policy_key_list_next(policy_key_list_t *policy_key_list)
Definition: policy_key.c:1378
key_data_role
Definition: key_data.h:40
int key_data_set_inception(key_data_t *key_data, unsigned int inception)
Definition: key_data.c:880
int key_data_get_by_id(key_data_t *key_data, const db_value_t *id)
Definition: key_data.c:1296
int key_state_set_ttl(key_state_t *key_state, unsigned int ttl)
Definition: key_state.c:482
int key_dependency_delete(key_dependency_t *key_dependency)
int key_state_delete(key_state_t *key_state)
Definition: key_state.c:831
hsm_key_t * key_data_get_hsm_key(const key_data_t *key_data)
Definition: key_data.c:649
int zone_set_roll_csk_now(zone_t *zone, unsigned int roll_csk_now)
Definition: zone.c:1051
unsigned int next_zsk_roll
Definition: zone.h:68
int zone_set_ttl_end_dk(zone_t *zone, unsigned int ttl_end_dk)
Definition: zone.c:1011
unsigned int zone_roll_zsk_now(const zone_t *zone)
Definition: zone.c:846
hsm_key_t * hsm_key_factory_get_key(engine_type *engine, const db_connection_t *connection, const policy_key_t *policy_key, hsm_key_state_t hsm_key_state)
unsigned int policy_parent_registration_delay(const policy_t *policy)
Definition: policy.c:1045
unsigned int key_data_publish(const key_data_t *key_data)
Definition: key_data.c:743
#define RUMOURED
Definition: enforcer.c:67
const char * key_state_type_text(const key_state_t *key_state)
Definition: key_state.c:353
key_state_t * key_data_get_cached_rrsig(key_data_t *key_data)
Definition: key_data_ext.c:84
const char * policy_name(const policy_t *policy)
Definition: policy.c:813
unsigned int key_data_active_zsk(const key_data_t *key_data)
Definition: key_data.c:735
#define NA
Definition: enforcer.c:70
int zone_set_roll_zsk_now(zone_t *zone, unsigned int roll_zsk_now)
Definition: zone.c:1041
key_state_type_t type
Definition: enforcer.c:79
unsigned int policy_signatures_max_zone_ttl(const policy_t *policy)
Definition: policy.c:885
int zone_set_ttl_end_ds(zone_t *zone, unsigned int ttl_end_ds)
Definition: zone.c:1001
int key_data_cmp(const key_data_t *key_data_a, const key_data_t *key_data_b)
Definition: key_data.c:402
enum key_state_state key_state_state_t
enum key_data_role key_data_role_t
void ods_log_info(const char *format,...)
Definition: log.c:55
unsigned int policy_signatures_refresh(const policy_t *policy)
Definition: policy.c:837
const db_value_t * key_data_id(const key_data_t *key_data)
Definition: key_data.c:553
unsigned int zone_ttl_end_rs(const zone_t *zone)
Definition: zone.c:830
key_data_list_t * zone_get_keys(const zone_t *zone)
Definition: zone_ext.c:38
const hsm_key_t * key_data_cached_hsm_key(const key_data_t *key_data)
Definition: key_data_ext.c:108
unsigned int policy_signatures_validity_default(const policy_t *policy)
Definition: policy.c:861
size_t key_data_list_size(key_data_list_t *key_data_list)
Definition: key_data.c:2461
unsigned int policy_parent_propagation_delay(const policy_t *policy)
Definition: policy.c:1053
int zone_set_signconf_needs_writing(zone_t *zone, unsigned int signconf_needs_writing)
Definition: zone.c:959
void ods_log_error(const char *format,...)
Definition: log.c:69
int key_state_set_key_data_id(key_state_t *key_state, const db_value_t *key_data_id)
Definition: key_state.c:417
unsigned int zone_roll_csk_now(const zone_t *zone)
Definition: zone.c:854
int pretend_update
Definition: enforcer.c:81
int key_dependency_set_zone_id(key_dependency_t *key_dependency, const db_value_t *zone_id)
int key_state_set_minimize(key_state_t *key_state, unsigned int minimize)
Definition: key_state.c:472
key_dependency_list_t * zone_get_key_dependencies(const zone_t *zone)
Definition: zone_ext.c:58
const db_enum_t key_state_enum_set_type[]
Definition: key_state.c:36
int key_data_set_role(key_data_t *key_data, key_data_role_t role)
Definition: key_data.c:890
unsigned int policy_signatures_validity_denial(const policy_t *policy)
Definition: policy.c:869
key_data_t * key_data_list_get_next(key_data_list_t *key_data_list)
Definition: key_data.c:2425
unsigned int policy_signatures_jitter(const policy_t *policy)
Definition: policy.c:845
const char * hsm_key_repository(const hsm_key_t *hsm_key)
Definition: hsm_key.c:568
time_t update(engine_type *engine, db_connection_t *dbconn, zone_t *zone, policy_t *policy, time_t now, int *zone_updated)
Definition: enforcer.c:2720
unsigned int next_csk_roll
Definition: zone.h:69
policy_denial_type
Definition: policy.h:40
int key_data_create(key_data_t *key_data)
Definition: key_data.c:1093
int key_data_set_hsm_key_id(key_data_t *key_data, const db_value_t *hsm_key_id)
Definition: key_data.c:851
unsigned int key_data_introducing(const key_data_t *key_data)
Definition: key_data.c:727
const db_value_t * key_dependency_to_key_data_id(const key_dependency_t *key_dependency)
int hsm_key_factory_release_key(hsm_key_t *hsm_key, const db_connection_t *connection)
unsigned int policy_zone_propagation_delay(const policy_t *policy)
Definition: policy.c:1005
int key_state_set_type(key_state_t *key_state, key_state_type_t type)
Definition: key_state.c:436
int key_state_update(key_state_t *key_state)
Definition: key_state.c:684
size_t policy_key_list_size(policy_key_list_t *policy_key_list)
Definition: policy_key.c:1480
int key_dependency_set_type(key_dependency_t *key_dependency, key_dependency_type_t type)
void ods_log_crit(const char *format,...)
Definition: log.c:80
unsigned int key_state_minimize(const key_state_t *key_state)
Definition: key_state.c:401
const key_state_t * key_data_cached_rrsigdnskey(key_data_t *key_data)
Definition: key_data_ext.c:72
key_dependency_t * key_dependency_new(const db_connection_t *connection)
int db_value_cmp(const db_value_t *value_a, const db_value_t *value_b, int *result)
Definition: db_value.c:102
void key_dependency_list_free(key_dependency_list_t *key_dependency_list)
unsigned int zone_ttl_end_dk(const zone_t *zone)
Definition: zone.c:822
unsigned int key_data_inception(const key_data_t *key_data)
Definition: key_data.c:695
int key_state_set_state(key_state_t *key_state, key_state_state_t state)
Definition: key_state.c:449
const char * policy_key_repository(const policy_key_t *policy_key)
Definition: policy_key.c:534
const key_dependency_t * key_dependency_list_next(key_dependency_list_t *key_dependency_list)
unsigned int policy_zone_soa_ttl(const policy_t *policy)
Definition: policy.c:1013
unsigned int zone_roll_ksk_now(const zone_t *zone)
Definition: zone.c:838
void key_state_free(key_state_t *key_state)
Definition: key_state.c:214
int zone_set_ttl_end_rs(zone_t *zone, unsigned int ttl_end_rs)
Definition: zone.c:1021
unsigned int hsm_key_inception(const hsm_key_t *hsm_key)
Definition: hsm_key.c:560
unsigned int policy_key_lifetime(const policy_key_t *policy_key)
Definition: policy_key.c:526
key_data_t * key_data_new(const db_connection_t *connection)
Definition: key_data.c:264
const key_data_t * key_data_list_begin(key_data_list_t *key_data_list)
Definition: key_data.c:2267
void key_dependency_free(key_dependency_t *key_dependency)
unsigned int policy_keys_publish_safety(const policy_t *policy)
Definition: policy.c:981
int zone_set_roll_ksk_now(zone_t *zone, unsigned int roll_ksk_now)
Definition: zone.c:1031
policy_key_list_t * policy_get_policy_keys(const policy_t *policy)
Definition: policy_ext.c:1248
const db_value_t * key_dependency_from_key_data_id(const key_dependency_t *key_dependency)
key_data_ds_at_parent
Definition: key_data.h:48
unsigned int zone_signconf_needs_writing(const zone_t *zone)
Definition: zone.c:790
key_dependency_type
const key_data_t * key_data_list_next(key_data_list_t *key_data_list)
Definition: key_data.c:2359
int key_data_set_publish(key_data_t *key_data, unsigned int publish)
Definition: key_data.c:923
int key_data_cache_key_states(key_data_t *key_data)
Definition: key_data_ext.c:33
hsm_key_t * hsm_key_list_get_begin(hsm_key_list_t *hsm_key_list)
Definition: hsm_key.c:1888
const db_enum_t key_state_enum_set_state[]
Definition: key_state.c:44
unsigned int key_state_last_change(const key_state_t *key_state)
Definition: key_state.c:393
const char * hsm_key_locator(const hsm_key_t *hsm_key)
Definition: hsm_key.c:520
int value
Definition: db_enum.h:40
int key_dependency_set_from_key_data_id(key_dependency_t *key_dependency, const db_value_t *from_key_data_id)
key_state_state
Definition: key_state.h:49
unsigned int policy_parent_ds_ttl(const policy_t *policy)
Definition: policy.c:1061
unsigned int policy_key_minimize(const policy_key_t *policy_key)
Definition: policy_key.c:566
const char * zone_name(const zone_t *zone)
Definition: zone.c:782
unsigned int policy_denial_ttl(const policy_t *policy)
Definition: policy.c:909
size_t key_dependency_list_size(key_dependency_list_t *key_dependency_list)
key_data_t * key
Definition: enforcer.c:78
const key_state_t * key_data_cached_rrsig(key_data_t *key_data)
Definition: key_data_ext.c:64
key_state_t * key_state_new(const db_connection_t *connection)
Definition: key_state.c:176
key_dependency_t * key_dependency_list_get_next(key_dependency_list_t *key_dependency_list)
key_state_t * key_data_get_cached_rrsigdnskey(key_data_t *key_data)
Definition: key_data_ext.c:100
const char * policy_key_role_text(const policy_key_t *policy_key)
Definition: policy_key.c:494
unsigned int policy_keys_retire_safety(const policy_t *policy)
Definition: policy.c:973
hsm_key_t * hsm_key_list_get_next(hsm_key_list_t *hsm_key_list)
Definition: hsm_key.c:1990
int key_data_set_zone_id(key_data_t *key_data, const db_value_t *zone_id)
Definition: key_data.c:832
int key_dependency_create(key_dependency_t *key_dependency)
key_state_t * key_data_get_cached_ds(key_data_t *key_data)
Definition: key_data_ext.c:76
void ods_log_verbose(const char *format,...)
Definition: log.c:48
unsigned int policy_key_manual_rollover(const policy_key_t *policy_key)
Definition: policy_key.c:550
int key_state_set_last_change(key_state_t *key_state, unsigned int last_change)
Definition: key_state.c:462
const key_state_t * key_data_cached_ds(key_data_t *key_data)
Definition: key_data_ext.c:60
int key_data_cache_hsm_key(key_data_t *key_data)
Definition: key_data.c:615
void key_data_list_free(key_data_list_t *key_data_list)
Definition: key_data.c:1694
int key_state_create(key_state_t *key_state)
Definition: key_state.c:519
key_dependency_t * key_dependency_list_get_begin(key_dependency_list_t *key_dependency_list)
const db_value_t * key_data_hsm_key_id(const key_data_t *key_data)
Definition: key_data.c:607
const key_state_t * key_data_cached_dnskey(key_data_t *key_data)
Definition: key_data_ext.c:68
unsigned int key_data_minimize(const key_data_t *key_data)
Definition: key_data.c:775
#define UNRETENTIVE
Definition: enforcer.c:69
hsm_key_role
Definition: hsm_key.h:49
int key_data_set_active_ksk(key_data_t *key_data, unsigned int active_ksk)
Definition: key_data.c:933
void key_data_free(key_data_t *key_data)
Definition: key_data.c:304
const key_dependency_t * key_dependency_list_begin(key_dependency_list_t *key_dependency_list)
const db_value_t * zone_id(const zone_t *zone)
Definition: zone.c:728
#define HIDDEN
Definition: enforcer.c:66
unsigned int hsm_key_algorithm(const hsm_key_t *hsm_key)
Definition: hsm_key.c:544
int key_data_set_ds_at_parent(key_data_t *key_data, key_data_ds_at_parent_t ds_at_parent)
Definition: key_data.c:943
hsm_key_backup
Definition: hsm_key.h:62
hsm_key_list_t * hsm_key_list_new_get_by_policy_key(const policy_key_t *pkey)
Definition: hsm_key_ext.c:33
void hsm_key_free(hsm_key_t *hsm_key)
Definition: hsm_key.c:286
key_data_t * key_data_new_copy(const key_data_t *key_data)
Definition: key_data.c:285
const char * text
Definition: db_enum.h:39
unsigned int key_data_active_ksk(const key_data_t *key_data)
Definition: key_data.c:751
Definition: policy.h:60
key_state_state_t next_state
Definition: enforcer.c:80
Definition: zone.h:46
unsigned int policy_key_algorithm(const policy_key_t *policy_key)
Definition: policy_key.c:510
int key_data_set_introducing(key_data_t *key_data, unsigned int introducing)
Definition: key_data.c:903
unsigned int key_data_algorithm(const key_data_t *key_data)
Definition: key_data.c:687
int key_data_update(key_data_t *key_data)
Definition: key_data.c:1349
#define OMNIPRESENT
Definition: enforcer.c:68
enum key_state_type key_state_type_t
unsigned int next_ksk_roll
Definition: zone.h:67
int key_data_set_keytag(key_data_t *key_data, unsigned int keytag)
Definition: key_data.c:956
int key_data_set_active_zsk(key_data_t *key_data, unsigned int active_zsk)
Definition: key_data.c:913
key_dependency_list_t * key_dependency_list_new_copy(const key_dependency_list_t *from_key_dependency_list)
int key_dependency_set_to_key_data_id(key_dependency_t *key_dependency, const db_value_t *to_key_data_id)
unsigned int policy_keys_shared(const policy_t *policy)
Definition: policy.c:989
void hsm_key_list_free(hsm_key_list_t *hsm_key_list)
Definition: hsm_key.c:1496
policy_key_role
Definition: policy_key.h:40
unsigned int policy_key_bits(const policy_key_t *policy_key)
Definition: policy_key.c:518
void policy_key_list_free(policy_key_list_t *policy_key_list)
Definition: policy_key.c:1006
const db_value_t * hsm_key_id(const hsm_key_t *hsm_key)
Definition: hsm_key.c:504
unsigned int hsm_key_bits(const hsm_key_t *hsm_key)
Definition: hsm_key.c:536
enum key_dependency_type key_dependency_type_t
int key_data_delete(key_data_t *key_data)
Definition: key_data.c:1587
const policy_key_t * policy_key_list_begin(policy_key_list_t *policy_key_list)
Definition: policy_key.c:1322
key_data_t * key_dependency_get_from_key_data(const key_dependency_t *key_dependency)
void ods_log_warning(const char *format,...)
Definition: log.c:62
unsigned int policy_zone_soa_minimum(const policy_t *policy)
Definition: policy.c:1021
int key_data_set_algorithm(key_data_t *key_data, unsigned int algorithm)
Definition: key_data.c:870
hsm_key_state_t state
Definition: hsm_key.h:85
int hsm_key_factory_release_key_id(const db_value_t *hsm_key_id, const db_connection_t *connection)
unsigned int policy_keys_purge_after(const policy_t *policy)
Definition: policy.c:997
unsigned int zone_ttl_end_ds(const zone_t *zone)
Definition: zone.c:814
unsigned int policy_keys_ttl(const policy_t *policy)
Definition: policy.c:965
key_state_t * key_data_get_cached_dnskey(key_data_t *key_data)
Definition: key_data_ext.c:92
int key_data_set_minimize(key_data_t *key_data, unsigned int minimize)
Definition: key_data.c:966
unsigned int policy_signatures_resign(const policy_t *policy)
Definition: policy.c:829
key_data_t * key_data_list_get_begin(key_data_list_t *key_data_list)
Definition: key_data.c:2323
#define NOKEY_TIMEOUT
Definition: enforcer.c:75