00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00034 #include "parser/confparser.h"
00035 #include "parser/signconfparser.h"
00036 #include "scheduler/task.h"
00037 #include "shared/duration.h"
00038 #include "shared/file.h"
00039 #include "shared/hsm.h"
00040 #include "shared/log.h"
00041 #include "signer/backup.h"
00042 #include "shared/status.h"
00043 #include "signer/keys.h"
00044 #include "signer/signconf.h"
00045
00046 static const char* sc_str = "signconf";
00047
00048
00053 signconf_type*
00054 signconf_create(void)
00055 {
00056 signconf_type* sc;
00057 allocator_type* allocator = allocator_create(malloc, free);
00058 if (!allocator) {
00059 ods_log_error("[%s] unable to create: create allocator failed",
00060 sc_str);
00061 return NULL;
00062 }
00063 ods_log_assert(allocator);
00064
00065 sc = (signconf_type*) allocator_alloc(allocator, sizeof(signconf_type));
00066 if (!sc) {
00067 ods_log_error("[%s] unable to create: allocator failed", sc_str);
00068 allocator_cleanup(allocator);
00069 return NULL;
00070 }
00071 ods_log_assert(sc);
00072 sc->allocator = allocator;
00073 sc->filename = NULL;
00074
00075 sc->sig_resign_interval = NULL;
00076 sc->sig_refresh_interval = NULL;
00077 sc->sig_validity_default = NULL;
00078 sc->sig_validity_denial = NULL;
00079 sc->sig_jitter = NULL;
00080 sc->sig_inception_offset = NULL;
00081
00082 sc->nsec_type = 0;
00083 sc->nsec3_optout = 0;
00084 sc->nsec3_algo = 0;
00085 sc->nsec3_iterations = 0;
00086 sc->nsec3_salt = NULL;
00087
00088 sc->dnskey_ttl = NULL;
00089 sc->keys = NULL;
00090
00091 sc->soa_ttl = NULL;
00092 sc->soa_min = NULL;
00093 sc->soa_serial = NULL;
00094
00095 sc->last_modified = 0;
00096 sc->audit = 0;
00097 return sc;
00098 }
00099
00100
00105 static ods_status
00106 signconf_read(signconf_type* signconf, const char* scfile)
00107 {
00108 const char* rngfile = ODS_SE_RNGDIR "/signconf.rng";
00109 ods_status status = ODS_STATUS_OK;
00110 FILE* fd = NULL;
00111
00112 ods_log_assert(scfile);
00113 ods_log_assert(signconf);
00114 ods_log_debug("[%s] read file %s", sc_str, scfile);
00115
00116 status = parse_file_check(scfile, rngfile);
00117 if (status != ODS_STATUS_OK) {
00118 ods_log_error("[%s] unable to parse file %s: %s", sc_str, scfile,
00119 ods_status2str(status));
00120 return status;
00121 }
00122
00123 fd = ods_fopen(scfile, NULL, "r");
00124 if (fd) {
00125 signconf->filename = allocator_strdup(signconf->allocator, scfile);
00126 signconf->sig_resign_interval = parse_sc_sig_resign_interval(scfile);
00127 signconf->sig_refresh_interval = parse_sc_sig_refresh_interval(scfile);
00128 signconf->sig_validity_default = parse_sc_sig_validity_default(scfile);
00129 signconf->sig_validity_denial = parse_sc_sig_validity_denial(scfile);
00130 signconf->sig_jitter = parse_sc_sig_jitter(scfile);
00131 signconf->sig_inception_offset = parse_sc_sig_inception_offset(scfile);
00132 signconf->nsec_type = parse_sc_nsec_type(scfile);
00133 if (signconf->nsec_type == LDNS_RR_TYPE_NSEC3) {
00134 signconf->nsec3_optout = parse_sc_nsec3_optout(scfile);
00135 signconf->nsec3_algo = parse_sc_nsec3_algorithm(scfile);
00136 signconf->nsec3_iterations = parse_sc_nsec3_iterations(scfile);
00137 signconf->nsec3_salt = parse_sc_nsec3_salt(signconf->allocator,
00138 scfile);
00139 }
00140 signconf->keys = parse_sc_keys(signconf->allocator, scfile);
00141 signconf->dnskey_ttl = parse_sc_dnskey_ttl(scfile);
00142 signconf->soa_ttl = parse_sc_soa_ttl(scfile);
00143 signconf->soa_min = parse_sc_soa_min(scfile);
00144 signconf->soa_serial = parse_sc_soa_serial(signconf->allocator,
00145 scfile);
00146 signconf->audit = parse_sc_audit(scfile);
00147 ods_fclose(fd);
00148 return ODS_STATUS_OK;
00149 }
00150 ods_log_error("[%s] unable to read signconf file %s", sc_str, scfile);
00151 return ODS_STATUS_ERR;
00152 }
00153
00154
00159 ods_status
00160 signconf_update(signconf_type** signconf, const char* scfile,
00161 time_t last_modified)
00162 {
00163 signconf_type* new_sc = NULL;
00164 time_t st_mtime = 0;
00165 ods_status status = ODS_STATUS_OK;
00166
00167 if (!signconf) {
00168 ods_log_error("[%s] no signconf storage", sc_str);
00169 return ODS_STATUS_UNCHANGED;
00170 }
00171 ods_log_assert(signconf);
00172 if (!scfile) {
00173 ods_log_error("[%s] no signconf filename", sc_str);
00174 return ODS_STATUS_UNCHANGED;
00175 }
00176 ods_log_assert(scfile);
00177
00178
00179 st_mtime = ods_file_lastmodified(scfile);
00180 if (st_mtime <= last_modified) {
00181 return ODS_STATUS_UNCHANGED;
00182 }
00183
00184 new_sc = signconf_create();
00185 if (!new_sc) {
00186 ods_log_error("[%s] error creating new signconf", sc_str);
00187 return ODS_STATUS_ERR;
00188 }
00189
00190 status = signconf_read(new_sc, scfile);
00191 if (status == ODS_STATUS_OK) {
00192 new_sc->last_modified = st_mtime;
00193 if (signconf_check(new_sc) != ODS_STATUS_OK) {
00194 ods_log_error("[%s] signconf %s has errors", sc_str, scfile);
00195 signconf_cleanup(new_sc);
00196 return ODS_STATUS_CFG_ERR;
00197 }
00198 *signconf = new_sc;
00199 } else {
00200 ods_log_error("[%s] unable to read file %s: %s", sc_str, scfile,
00201 ods_status2str(status));
00202 signconf_cleanup(new_sc);
00203 }
00204 return status;
00205 }
00206
00207
00212 signconf_type*
00213 signconf_recover_from_backup(const char* filename)
00214 {
00215 signconf_type* signconf = NULL;
00216 const char* zonename = NULL;
00217 FILE* scfd = NULL;
00218
00219 scfd = ods_fopen(filename, NULL, "r");
00220 if (scfd) {
00221 signconf = signconf_create();
00222
00223 if (!backup_read_check_str(scfd, ODS_SE_FILE_MAGIC) ||
00224 !backup_read_check_str(scfd, ";name:") ||
00225 !backup_read_str(scfd, &zonename) ||
00226 !backup_read_check_str(scfd, ";filename:") ||
00227 !backup_read_str(scfd, &signconf->filename) ||
00228 !backup_read_check_str(scfd, ";last_modified:") ||
00229 !backup_read_time_t(scfd, &signconf->last_modified) ||
00230 !backup_read_check_str(scfd, ";sig_resign_interval:") ||
00231 !backup_read_duration(scfd, &signconf->sig_resign_interval) ||
00232 !backup_read_check_str(scfd, ";sig_refresh_interval:") ||
00233 !backup_read_duration(scfd, &signconf->sig_refresh_interval) ||
00234 !backup_read_check_str(scfd, ";sig_validity_default:") ||
00235 !backup_read_duration(scfd, &signconf->sig_validity_default) ||
00236 !backup_read_check_str(scfd, ";sig_validity_denial:") ||
00237 !backup_read_duration(scfd, &signconf->sig_validity_denial) ||
00238 !backup_read_check_str(scfd, ";sig_jitter:") ||
00239 !backup_read_duration(scfd, &signconf->sig_jitter) ||
00240 !backup_read_check_str(scfd, ";sig_inception_offset:") ||
00241 !backup_read_duration(scfd, &signconf->sig_inception_offset) ||
00242 !backup_read_check_str(scfd, ";nsec_type:") ||
00243 !backup_read_rr_type(scfd, &signconf->nsec_type) ||
00244 !backup_read_check_str(scfd, ";dnskey_ttl:") ||
00245 !backup_read_duration(scfd, &signconf->dnskey_ttl) ||
00246 !backup_read_check_str(scfd, ";soa_ttl:") ||
00247 !backup_read_duration(scfd, &signconf->soa_ttl) ||
00248 !backup_read_check_str(scfd, ";soa_min:") ||
00249 !backup_read_duration(scfd, &signconf->soa_min) ||
00250 !backup_read_check_str(scfd, ";soa_serial:") ||
00251 !backup_read_str(scfd, &signconf->soa_serial) ||
00252 !backup_read_check_str(scfd, ";audit:") ||
00253 !backup_read_int(scfd, &signconf->audit) ||
00254 !backup_read_check_str(scfd, ODS_SE_FILE_MAGIC))
00255 {
00256 ods_log_error("[%s] unable to recover signconf backup file %s: corrupt "
00257 "backup file ", sc_str, filename?filename:"(null)");
00258 signconf_cleanup(signconf);
00259 signconf = NULL;
00260 }
00261
00262 if (zonename) {
00263 free((void*) zonename);
00264 }
00265 ods_fclose(scfd);
00266 return signconf;
00267 }
00268
00269 ods_log_debug("[%s] unable to recover signconf backup file %s", sc_str,
00270 filename?filename:"(null)");
00271 return NULL;
00272 }
00273
00274
00279 static void
00280 signconf_backup_duration(FILE* fd, const char* opt, duration_type* duration)
00281 {
00282 char* str = duration2string(duration);
00283 fprintf(fd, "%s %s ", opt, str);
00284 free((void*) str);
00285 return;
00286 }
00287
00288
00289
00294 void
00295 signconf_backup(FILE* fd, signconf_type* sc)
00296 {
00297 if (!fd || !sc) {
00298 return;
00299 }
00300 ods_log_assert(fd);
00301 ods_log_assert(sc);
00302
00303 fprintf(fd, ";;Signconf: lastmod %u ", (unsigned) sc->last_modified);
00304 signconf_backup_duration(fd, "resign", sc->sig_resign_interval);
00305 signconf_backup_duration(fd, "refresh", sc->sig_refresh_interval);
00306 signconf_backup_duration(fd, "valid", sc->sig_validity_default);
00307 signconf_backup_duration(fd, "denial", sc->sig_validity_denial);
00308 signconf_backup_duration(fd, "jitter", sc->sig_jitter);
00309 signconf_backup_duration(fd, "offset", sc->sig_inception_offset);
00310 fprintf(fd, "nsec %u ", (unsigned) sc->nsec_type);
00311 signconf_backup_duration(fd, "dnskeyttl", sc->dnskey_ttl);
00312 signconf_backup_duration(fd, "soattl", sc->soa_ttl);
00313 signconf_backup_duration(fd, "soamin", sc->soa_min);
00314 fprintf(fd, "serial %s ", sc->soa_serial?sc->soa_serial:"(null)");
00315 fprintf(fd, "audit %i\n", sc->audit);
00316 return;
00317 }
00318
00319
00324 static int
00325 signconf_soa_serial_check(const char* serial) {
00326 if (!serial) {
00327 return 1;
00328 }
00329
00330 if (strlen(serial) == 4 && strncmp(serial, "keep", 4) == 0) {
00331 return 0;
00332 }
00333 if (strlen(serial) == 7 && strncmp(serial, "counter", 7) == 0) {
00334 return 0;
00335 }
00336 if (strlen(serial) == 8 && strncmp(serial, "unixtime", 8) == 0) {
00337 return 0;
00338 }
00339 if (strlen(serial) == 11 && strncmp(serial, "datecounter", 11) == 0) {
00340 return 0;
00341 }
00342 return 1;
00343 }
00344
00349 ods_status
00350 signconf_check(signconf_type* sc)
00351 {
00352 ods_status status = ODS_STATUS_OK;
00353
00354 if (!sc->sig_resign_interval) {
00355 ods_log_error("[%s] check failed: no signature resign interval found",
00356 sc_str);
00357 status = ODS_STATUS_CFG_ERR;
00358 }
00359 if (!sc->sig_refresh_interval) {
00360 ods_log_error("[%s] check failed: no signature resign interval found",
00361 sc_str);
00362 status = ODS_STATUS_CFG_ERR;
00363 }
00364 if (!sc->sig_validity_default) {
00365 ods_log_error("[%s] check failed: no signature default validity found",
00366 sc_str);
00367 status = ODS_STATUS_CFG_ERR;
00368 }
00369 if (!sc->sig_validity_denial) {
00370 ods_log_error("[%s] check failed: no signature denial validity found",
00371 sc_str);
00372 status = ODS_STATUS_CFG_ERR;
00373 }
00374 if (!sc->sig_jitter) {
00375 ods_log_error("[%s] check failed: no signature jitter found", sc_str);
00376 status = ODS_STATUS_CFG_ERR;
00377 }
00378 if (!sc->sig_inception_offset) {
00379 ods_log_error("[%s] check failed: no signature inception offset found",
00380 sc_str);
00381 status = ODS_STATUS_CFG_ERR;
00382 }
00383 if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00384 if (sc->nsec3_algo == 0) {
00385 ods_log_error("[%s] check failed: no nsec3 algorithm found",
00386 sc_str);
00387 status = ODS_STATUS_CFG_ERR;
00388 }
00389
00390
00391
00392 } else if (sc->nsec_type != LDNS_RR_TYPE_NSEC) {
00393 ods_log_error("[%s] check failed: wrong nsec type %i", sc_str,
00394 sc->nsec_type);
00395 status = ODS_STATUS_CFG_ERR;
00396 }
00397 if (!sc->keys || sc->keys->count == 0) {
00398 ods_log_error("[%s] check failed: no keys found", sc_str);
00399 status = ODS_STATUS_CFG_ERR;
00400 }
00401 if (!sc->dnskey_ttl) {
00402 ods_log_error("[%s] check failed: no dnskey ttl found", sc_str);
00403 status = ODS_STATUS_CFG_ERR;
00404 }
00405 if (!sc->soa_ttl) {
00406 ods_log_error("[%s] check failed: no soa ttl found", sc_str);
00407 status = ODS_STATUS_CFG_ERR;
00408 }
00409 if (!sc->soa_min) {
00410 ods_log_error("[%s] check failed: no soa minimum found", sc_str);
00411 status = ODS_STATUS_CFG_ERR;
00412 }
00413 if (!sc->soa_serial) {
00414 ods_log_error("[%s] check failed: no soa serial type found", sc_str);
00415 status = ODS_STATUS_CFG_ERR;
00416 } else if (signconf_soa_serial_check(sc->soa_serial) != 0) {
00417 ods_log_error("[%s] check failed: wrong soa serial type %s", sc_str,
00418 sc->soa_serial);
00419 status = ODS_STATUS_CFG_ERR;
00420 }
00421
00422 return status;
00423 }
00424
00425
00430 task_id
00431 signconf_compare_denial(signconf_type* a, signconf_type* b)
00432 {
00433 task_id new_task = TASK_NONE;
00434 if (!a || !b) {
00435 return TASK_NONE;
00436 }
00437 ods_log_assert(a);
00438 ods_log_assert(b);
00439
00440 if (a->nsec_type != b->nsec_type) {
00441 new_task = TASK_NSECIFY;
00442 } else if (a->nsec_type == LDNS_RR_TYPE_NSEC3) {
00443 if ((ods_strcmp(a->nsec3_salt, b->nsec3_salt) != 0) ||
00444 (a->nsec3_algo != b->nsec3_algo) ||
00445 (a->nsec3_iterations != b->nsec3_iterations) ||
00446 (a->nsec3_optout != b->nsec3_optout)) {
00447
00448 new_task = TASK_NSECIFY;
00449 }
00450 }
00451 return new_task;
00452 }
00453
00454
00459 task_id
00460 signconf_compare_keys(signconf_type* a, signconf_type* b, ldns_rr_list* del)
00461 {
00462 task_id new_task = TASK_NONE;
00463 ods_status status = ODS_STATUS_OK;
00464 key_type* walk = NULL;
00465 key_type* ka = NULL;
00466 key_type* kb = NULL;
00467 int remove = 0;
00468 int copy = 0;
00469
00470 if (!a || !b) {
00471 return TASK_NONE;
00472 }
00473 ods_log_assert(a);
00474 ods_log_assert(b);
00475
00476
00477 if (a->keys) {
00478 walk = a->keys->first_key;
00479 }
00480 while (walk && walk->locator) {
00481 remove = 0;
00482 copy = 0;
00483
00484 kb = keylist_lookup(b->keys, walk->locator);
00485 if (!kb) {
00486 remove = 1;
00487 } else {
00488 if (duration_compare(a->dnskey_ttl, b->dnskey_ttl) != 0) {
00489 remove = 1;
00490 } else if (walk->flags != kb->flags) {
00491 remove = 1;
00492 } else if (walk->algorithm != kb->algorithm) {
00493 remove = 1;
00494 } else if (walk->publish != kb->publish) {
00495 if (walk->publish) {
00496 remove = 1;
00497 } else {
00498 new_task = TASK_READ;
00499 }
00500 } else if (walk->ksk != kb->ksk) {
00501 copy = 1;
00502 } else if (walk->zsk != kb->zsk) {
00503 copy = 1;
00504 } else {
00505
00506 copy = 1;
00507 }
00508 }
00509
00510 if (remove) {
00511 new_task = TASK_READ;
00512 if (del && walk->dnskey) {
00513 if (!ldns_rr_list_push_rr(del, walk->dnskey)) {
00514 ods_log_error("[%s] del key failed", sc_str);
00515 new_task = TASK_SIGNCONF;
00516 break;
00517 }
00518 }
00519 } else if (copy) {
00520 if (walk->dnskey && !kb->dnskey) {
00521 kb->dnskey = walk->dnskey;
00522 kb->hsmkey = walk->hsmkey;
00523 status = lhsm_get_key(NULL, ldns_rr_owner(walk->dnskey), kb);
00524 walk->hsmkey = NULL;
00525 walk->dnskey = NULL;
00526 }
00527 if (status != ODS_STATUS_OK) {
00528 ods_log_error("[%s] copy key failed", sc_str);
00529 new_task = TASK_SIGNCONF;
00530 break;
00531 }
00532 }
00533 walk = walk->next;
00534 }
00535
00536 if (new_task == TASK_NONE) {
00537
00538 walk = NULL;
00539 if (b->keys) {
00540 walk = b->keys->first_key;
00541 }
00542 while (walk) {
00543 ka = keylist_lookup(a->keys, walk->locator);
00544 if (!ka) {
00545 new_task = TASK_READ;
00546 break;
00547 }
00552 walk = walk->next;
00553 }
00554 }
00555 return new_task;
00556 }
00557
00558
00563 task_id
00564 signconf_compare(signconf_type* a, signconf_type* b)
00565 {
00566 task_id new_task = TASK_NONE;
00567 task_id tmp_task = TASK_NONE;
00568
00569 new_task = signconf_compare_denial(a, b);
00570 tmp_task = signconf_compare_keys(a, b, NULL);
00571 if (tmp_task != TASK_NONE) {
00572 new_task = tmp_task;
00573 }
00574
00575
00576 return new_task;
00577 }
00578
00579
00584 void
00585 signconf_cleanup(signconf_type* sc)
00586 {
00587 allocator_type* allocator;
00588 if (!sc) {
00589 return;
00590 }
00591 duration_cleanup(sc->sig_resign_interval);
00592 duration_cleanup(sc->sig_refresh_interval);
00593 duration_cleanup(sc->sig_validity_default);
00594 duration_cleanup(sc->sig_validity_denial);
00595 duration_cleanup(sc->sig_jitter);
00596 duration_cleanup(sc->sig_inception_offset);
00597 duration_cleanup(sc->dnskey_ttl);
00598 duration_cleanup(sc->soa_ttl);
00599 duration_cleanup(sc->soa_min);
00600 keylist_cleanup(sc->keys);
00601
00602 allocator = sc->allocator;
00603 allocator_deallocate(allocator, (void*) sc->filename);
00604 allocator_deallocate(allocator, (void*) sc->nsec3_salt);
00605 allocator_deallocate(allocator, (void*) sc->soa_serial);
00606 allocator_deallocate(allocator, (void*) sc);
00607 allocator_cleanup(allocator);
00608 return;
00609 }
00610
00611
00616 void
00617 signconf_print(FILE* out, signconf_type* sc, const char* name)
00618 {
00619 char* s = NULL;
00620
00621 fprintf(out, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
00622
00623 if (sc) {
00624 fprintf(out, "<SignerConfiguration>\n");
00625 fprintf(out, "\t<Zone name=\"%s\">\n", name?name:"(null)");
00626
00627
00628 fprintf(out, "\t\t<Signatures>\n");
00629 s = duration2string(sc->sig_resign_interval);
00630 fprintf(out, "\t\t\t<Resign>%s</Resign>\n", s?s:"(null)");
00631 free((void*)s);
00632
00633 s = duration2string(sc->sig_refresh_interval);
00634 fprintf(out, "\t\t\t<Refresh>%s</Refresh>\n", s?s:"(null)");
00635 free((void*)s);
00636
00637 fprintf(out, "\t\t\t<Validity>\n");
00638
00639 s = duration2string(sc->sig_validity_default);
00640 fprintf(out, "\t\t\t\t<Default>%s</Default>\n", s?s:"(null)");
00641 free((void*)s);
00642
00643 s = duration2string(sc->sig_validity_denial);
00644 fprintf(out, "\t\t\t\t<Denial>%s</Denial>\n", s?s:"(null)");
00645 free((void*)s);
00646
00647 fprintf(out, "\t\t\t</Validity>\n");
00648
00649 s = duration2string(sc->sig_jitter);
00650 fprintf(out, "\t\t\t<Jitter>%s</Jitter>\n", s?s:"(null)");
00651 free((void*)s);
00652
00653 s = duration2string(sc->sig_inception_offset);
00654 fprintf(out, "\t\t\t<InceptionOffset>%s</InceptionOffset>\n",
00655 s?s:"(null)");
00656 free((void*)s);
00657
00658 fprintf(out, "\t\t</Signatures>\n");
00659 fprintf(out, "\n");
00660
00661
00662 fprintf(out, "\t\t<Denial>\n");
00663 if (sc->nsec_type == LDNS_RR_TYPE_NSEC) {
00664 fprintf(out, "\t\t\t<NSEC />\n");
00665 } else if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00666 fprintf(out, "\t\t\t<NSEC3>\n");
00667 if (sc->nsec3_optout) {
00668 fprintf(out, "\t\t\t\t<OptOut />\n");
00669 }
00670 fprintf(out, "\t\t\t\t<Hash>\n");
00671 fprintf(out, "\t\t\t\t\t<Algorithm>%i</Algorithm>\n",
00672 sc->nsec3_algo);
00673 fprintf(out, "\t\t\t\t\t<Iterations>%i</Iterations>\n",
00674 sc->nsec3_iterations);
00675 fprintf(out, "\t\t\t\t\t<Salt>%s</Salt>\n",
00676 sc->nsec3_salt?sc->nsec3_salt:"(null)");
00677 fprintf(out, "\t\t\t\t</Hash>\n");
00678 fprintf(out, "\t\t\t</NSEC3>\n");
00679 }
00680 fprintf(out, "\t\t</Denial>\n");
00681 fprintf(out, "\n");
00682
00683
00684 fprintf(out, "\t\t<Keys>\n");
00685 s = duration2string(sc->dnskey_ttl);
00686 fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)");
00687 free((void*)s);
00688 fprintf(out, "\n");
00689 keylist_print(out, sc->keys);
00690 fprintf(out, "\t\t</Keys>\n");
00691 fprintf(out, "\n");
00692
00693
00694 fprintf(out, "\t\t<SOA>\n");
00695 s = duration2string(sc->soa_ttl);
00696 fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)");
00697 free((void*)s);
00698
00699 s = duration2string(sc->soa_min);
00700 fprintf(out, "\t\t\t<Minimum>%s</Minimum>\n", s?s:"(null)");
00701 free((void*)s);
00702
00703 fprintf(out, "\t\t\t<Serial>%s</Serial>\n",
00704 sc->soa_serial?sc->soa_serial:"(null)");
00705 fprintf(out, "\t\t</SOA>\n");
00706 fprintf(out, "\n");
00707
00708
00709 if (sc->audit) {
00710 fprintf(out, "\t\t<Audit />\n");
00711 fprintf(out, "\n");
00712 }
00713
00714 fprintf(out, "\t</Zone>\n");
00715 fprintf(out, "</SignerConfiguration>\n");
00716 }
00717 return;
00718 }
00719
00720
00725 void
00726 signconf_log(signconf_type* sc, const char* name)
00727 {
00728 char* resign = NULL;
00729 char* refresh = NULL;
00730 char* validity = NULL;
00731 char* denial = NULL;
00732 char* jitter = NULL;
00733 char* offset = NULL;
00734 char* dnskeyttl = NULL;
00735 char* soattl = NULL;
00736 char* soamin = NULL;
00737
00738 if (sc) {
00739 resign = duration2string(sc->sig_resign_interval);
00740 refresh = duration2string(sc->sig_refresh_interval);
00741 validity = duration2string(sc->sig_validity_default);
00742 denial = duration2string(sc->sig_validity_denial);
00743 jitter = duration2string(sc->sig_jitter);
00744 offset = duration2string(sc->sig_inception_offset);
00745 dnskeyttl = duration2string(sc->dnskey_ttl);
00746 soattl = duration2string(sc->soa_ttl);
00747 soamin = duration2string(sc->soa_min);
00748
00749 ods_log_info("[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] "
00750 "VALIDITY[%s] DENIAL[%s] JITTER[%s] OFFSET[%s] NSEC[%i] "
00751 "DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s] AUDIT[%i]",
00752 sc_str, name?name:"(null)", resign, refresh, validity, denial,
00753 jitter, offset, (int) sc->nsec_type, dnskeyttl, soattl,
00754 soamin, sc->soa_serial?sc->soa_serial:"(null)",
00755 (int) sc->audit);
00756
00757 if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00758 ods_log_debug("[%s] zone %s nsec3: OPTOUT[%i] ALGORITHM[%u] "
00759 "ITERATIONS[%u] SALT[%s]", sc_str, name, sc->nsec3_optout,
00760 sc->nsec3_algo, sc->nsec3_iterations,
00761 sc->nsec3_salt?sc->nsec3_salt:"(null)");
00762 }
00763
00764
00765 keylist_log(sc->keys, name);
00766
00767 free((void*)resign);
00768 free((void*)refresh);
00769 free((void*)validity);
00770 free((void*)denial);
00771 free((void*)jitter);
00772 free((void*)offset);
00773 free((void*)dnskeyttl);
00774 free((void*)soattl);
00775 free((void*)soamin);
00776 }
00777 return;
00778 }