OpenDNSSEC-signer: /build/buildd-opendnssec_1.3.2-1~bpo60+1-mips-pXL6jA/opendnssec-1.3.2/signer/src/signer/signconf.c Source File

Go to the documentation of this file.
00001 /*
00002  * $Id: signconf.c 5248 2011-06-27 09:29:49Z matthijs $
00003  *
00004  * Copyright (c) 2009 NLNet Labs. All rights reserved.
00005  *
00006  * Redistribution and use in source and binary forms, with or without
00007  * modification, are permitted provided that the following conditions
00008  * are met:
00009  * 1. Redistributions of source code must retain the above copyright
00010  *    notice, this list of conditions and the following disclaimer.
00011  * 2. Redistributions in binary form must reproduce the above copyright
00012  *    notice, this list of conditions and the following disclaimer in the
00013  *    documentation and/or other materials provided with the distribution.
00014  *
00015  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
00016  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
00017  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
00018  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
00019  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
00020  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
00021  * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
00022  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
00023  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
00024  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
00025  * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
00026  *
00027  */
00028 
00034 #include "parser/confparser.h"
00035 #include "parser/signconfparser.h"
00036 #include "scheduler/task.h"
00037 #include "shared/duration.h"
00038 #include "shared/file.h"
00039 #include "shared/hsm.h"
00040 #include "shared/log.h"
00041 #include "signer/backup.h"
00042 #include "shared/status.h"
00043 #include "signer/keys.h"
00044 #include "signer/signconf.h"
00045 
00046 static const char* sc_str = "signconf";
00047 
00048 
00053 signconf_type*
00054 signconf_create(void)
00055 {
00056     signconf_type* sc;
00057     allocator_type* allocator = allocator_create(malloc, free);
00058     if (!allocator) {
00059         ods_log_error("[%s] unable to create: create allocator failed",
00060             sc_str);
00061         return NULL;
00062     }
00063     ods_log_assert(allocator);
00064 
00065     sc = (signconf_type*) allocator_alloc(allocator, sizeof(signconf_type));
00066     if (!sc) {
00067         ods_log_error("[%s] unable to create: allocator failed", sc_str);
00068         allocator_cleanup(allocator);
00069         return NULL;
00070     }
00071     ods_log_assert(sc);
00072     sc->allocator = allocator;
00073     sc->filename = NULL;
00074     /* Signatures */
00075     sc->sig_resign_interval = NULL;
00076     sc->sig_refresh_interval = NULL;
00077     sc->sig_validity_default = NULL;
00078     sc->sig_validity_denial = NULL;
00079     sc->sig_jitter = NULL;
00080     sc->sig_inception_offset = NULL;
00081     /* Denial of existence */
00082     sc->nsec_type = 0;
00083     sc->nsec3_optout = 0;
00084     sc->nsec3_algo = 0;
00085     sc->nsec3_iterations = 0;
00086     sc->nsec3_salt = NULL;
00087     /* Keys */
00088     sc->dnskey_ttl = NULL;
00089     sc->keys = NULL;
00090     /* Source of authority */
00091     sc->soa_ttl = NULL;
00092     sc->soa_min = NULL;
00093     sc->soa_serial = NULL;
00094     /* Other useful information */
00095     sc->last_modified = 0;
00096     sc->audit = 0;
00097     return sc;
00098 }
00099 
00100 
00105 static ods_status
00106 signconf_read(signconf_type* signconf, const char* scfile)
00107 {
00108     const char* rngfile = ODS_SE_RNGDIR "/signconf.rng";
00109     ods_status status = ODS_STATUS_OK;
00110     FILE* fd = NULL;
00111 
00112     ods_log_assert(scfile);
00113     ods_log_assert(signconf);
00114     ods_log_debug("[%s] read file %s", sc_str, scfile);
00115 
00116     status = parse_file_check(scfile, rngfile);
00117     if (status != ODS_STATUS_OK) {
00118         ods_log_error("[%s] unable to parse file %s: %s", sc_str, scfile,
00119             ods_status2str(status));
00120         return status;
00121     }
00122 
00123     fd = ods_fopen(scfile, NULL, "r");
00124     if (fd) {
00125         signconf->filename = allocator_strdup(signconf->allocator, scfile);
00126         signconf->sig_resign_interval = parse_sc_sig_resign_interval(scfile);
00127         signconf->sig_refresh_interval = parse_sc_sig_refresh_interval(scfile);
00128         signconf->sig_validity_default = parse_sc_sig_validity_default(scfile);
00129         signconf->sig_validity_denial = parse_sc_sig_validity_denial(scfile);
00130         signconf->sig_jitter = parse_sc_sig_jitter(scfile);
00131         signconf->sig_inception_offset = parse_sc_sig_inception_offset(scfile);
00132         signconf->nsec_type = parse_sc_nsec_type(scfile);
00133         if (signconf->nsec_type == LDNS_RR_TYPE_NSEC3) {
00134             signconf->nsec3_optout = parse_sc_nsec3_optout(scfile);
00135             signconf->nsec3_algo = parse_sc_nsec3_algorithm(scfile);
00136             signconf->nsec3_iterations = parse_sc_nsec3_iterations(scfile);
00137             signconf->nsec3_salt = parse_sc_nsec3_salt(signconf->allocator,
00138                 scfile);
00139         }
00140         signconf->keys = parse_sc_keys(signconf->allocator, scfile);
00141         signconf->dnskey_ttl = parse_sc_dnskey_ttl(scfile);
00142         signconf->soa_ttl = parse_sc_soa_ttl(scfile);
00143         signconf->soa_min = parse_sc_soa_min(scfile);
00144         signconf->soa_serial = parse_sc_soa_serial(signconf->allocator,
00145             scfile);
00146         signconf->audit = parse_sc_audit(scfile);
00147         ods_fclose(fd);
00148         return ODS_STATUS_OK;
00149     }
00150     ods_log_error("[%s] unable to read signconf file %s", sc_str, scfile);
00151     return ODS_STATUS_ERR;
00152 }
00153 
00154 
00159 ods_status
00160 signconf_update(signconf_type** signconf, const char* scfile,
00161     time_t last_modified)
00162 {
00163     signconf_type* new_sc = NULL;
00164     time_t st_mtime = 0;
00165     ods_status status = ODS_STATUS_OK;
00166 
00167     if (!signconf) {
00168         ods_log_error("[%s] no signconf storage", sc_str);
00169         return ODS_STATUS_UNCHANGED;
00170     }
00171     ods_log_assert(signconf);
00172     if (!scfile) {
00173         ods_log_error("[%s] no signconf filename", sc_str);
00174         return ODS_STATUS_UNCHANGED;
00175     }
00176     ods_log_assert(scfile);
00177 
00178     /* is the file updated? */
00179     st_mtime = ods_file_lastmodified(scfile);
00180     if (st_mtime <= last_modified) {
00181         return ODS_STATUS_UNCHANGED;
00182     }
00183 
00184     new_sc = signconf_create();
00185     if (!new_sc) {
00186         ods_log_error("[%s] error creating new signconf", sc_str);
00187         return ODS_STATUS_ERR;
00188     }
00189 
00190     status = signconf_read(new_sc, scfile);
00191     if (status == ODS_STATUS_OK) {
00192         new_sc->last_modified = st_mtime;
00193         if (signconf_check(new_sc) != ODS_STATUS_OK) {
00194             ods_log_error("[%s] signconf %s has errors", sc_str, scfile);
00195             signconf_cleanup(new_sc);
00196             return ODS_STATUS_CFG_ERR;
00197         }
00198         *signconf = new_sc;
00199     } else {
00200         ods_log_error("[%s] unable to read file %s: %s", sc_str, scfile,
00201             ods_status2str(status));
00202         signconf_cleanup(new_sc);
00203     }
00204     return status;
00205 }
00206 
00207 
00212 signconf_type*
00213 signconf_recover_from_backup(const char* filename)
00214 {
00215     signconf_type* signconf = NULL;
00216     const char* zonename = NULL;
00217     FILE* scfd = NULL;
00218 
00219     scfd = ods_fopen(filename, NULL, "r");
00220     if (scfd) {
00221         signconf = signconf_create();
00222 
00223         if (!backup_read_check_str(scfd, ODS_SE_FILE_MAGIC) ||
00224             !backup_read_check_str(scfd, ";name:") ||
00225             !backup_read_str(scfd, &zonename) ||
00226             !backup_read_check_str(scfd, ";filename:") ||
00227             !backup_read_str(scfd, &signconf->filename) ||
00228             !backup_read_check_str(scfd, ";last_modified:") ||
00229             !backup_read_time_t(scfd, &signconf->last_modified) ||
00230             !backup_read_check_str(scfd, ";sig_resign_interval:") ||
00231             !backup_read_duration(scfd, &signconf->sig_resign_interval) ||
00232             !backup_read_check_str(scfd, ";sig_refresh_interval:") ||
00233             !backup_read_duration(scfd, &signconf->sig_refresh_interval) ||
00234             !backup_read_check_str(scfd, ";sig_validity_default:") ||
00235             !backup_read_duration(scfd, &signconf->sig_validity_default) ||
00236             !backup_read_check_str(scfd, ";sig_validity_denial:") ||
00237             !backup_read_duration(scfd, &signconf->sig_validity_denial) ||
00238             !backup_read_check_str(scfd, ";sig_jitter:") ||
00239             !backup_read_duration(scfd, &signconf->sig_jitter) ||
00240             !backup_read_check_str(scfd, ";sig_inception_offset:") ||
00241             !backup_read_duration(scfd, &signconf->sig_inception_offset) ||
00242             !backup_read_check_str(scfd, ";nsec_type:") ||
00243             !backup_read_rr_type(scfd, &signconf->nsec_type) ||
00244             !backup_read_check_str(scfd, ";dnskey_ttl:") ||
00245             !backup_read_duration(scfd, &signconf->dnskey_ttl) ||
00246             !backup_read_check_str(scfd, ";soa_ttl:") ||
00247             !backup_read_duration(scfd, &signconf->soa_ttl) ||
00248             !backup_read_check_str(scfd, ";soa_min:") ||
00249             !backup_read_duration(scfd, &signconf->soa_min) ||
00250             !backup_read_check_str(scfd, ";soa_serial:") ||
00251             !backup_read_str(scfd, &signconf->soa_serial) ||
00252             !backup_read_check_str(scfd, ";audit:") ||
00253             !backup_read_int(scfd, &signconf->audit) ||
00254             !backup_read_check_str(scfd, ODS_SE_FILE_MAGIC))
00255         {
00256             ods_log_error("[%s] unable to recover signconf backup file %s: corrupt "
00257                 "backup file ", sc_str, filename?filename:"(null)");
00258             signconf_cleanup(signconf);
00259             signconf = NULL;
00260         }
00261 
00262         if (zonename) {
00263             free((void*) zonename);
00264         }
00265         ods_fclose(scfd);
00266         return signconf;
00267     }
00268 
00269     ods_log_debug("[%s] unable to recover signconf backup file %s", sc_str,
00270         filename?filename:"(null)");
00271     return NULL;
00272 }
00273 
00274 
00279 static void
00280 signconf_backup_duration(FILE* fd, const char* opt, duration_type* duration)
00281 {
00282     char* str = duration2string(duration);
00283     fprintf(fd, "%s %s ", opt, str);
00284     free((void*) str);
00285     return;
00286 }
00287 
00288 
00289 
00294 void
00295 signconf_backup(FILE* fd, signconf_type* sc)
00296 {
00297     if (!fd || !sc) {
00298         return;
00299     }
00300     ods_log_assert(fd);
00301     ods_log_assert(sc);
00302 
00303     fprintf(fd, ";;Signconf: lastmod %u ", (unsigned) sc->last_modified);
00304     signconf_backup_duration(fd, "resign", sc->sig_resign_interval);
00305     signconf_backup_duration(fd, "refresh", sc->sig_refresh_interval);
00306     signconf_backup_duration(fd, "valid", sc->sig_validity_default);
00307     signconf_backup_duration(fd, "denial", sc->sig_validity_denial);
00308     signconf_backup_duration(fd, "jitter", sc->sig_jitter);
00309     signconf_backup_duration(fd, "offset", sc->sig_inception_offset);
00310     fprintf(fd, "nsec %u ", (unsigned) sc->nsec_type);
00311     signconf_backup_duration(fd, "dnskeyttl", sc->dnskey_ttl);
00312     signconf_backup_duration(fd, "soattl", sc->soa_ttl);
00313     signconf_backup_duration(fd, "soamin", sc->soa_min);
00314     fprintf(fd, "serial %s ", sc->soa_serial?sc->soa_serial:"(null)");
00315     fprintf(fd, "audit %i\n", sc->audit);
00316     return;
00317 }
00318 
00319 
00324 static int
00325 signconf_soa_serial_check(const char* serial) {
00326     if (!serial) {
00327         return 1;
00328     }
00329 
00330     if (strlen(serial) == 4 && strncmp(serial, "keep", 4) == 0) {
00331         return 0;
00332     }
00333     if (strlen(serial) == 7 && strncmp(serial, "counter", 7) == 0) {
00334         return 0;
00335     }
00336     if (strlen(serial) == 8 && strncmp(serial, "unixtime", 8) == 0) {
00337         return 0;
00338     }
00339     if (strlen(serial) == 11 && strncmp(serial, "datecounter", 11) == 0) {
00340         return 0;
00341     }
00342     return 1;
00343 }
00344 
00349 ods_status
00350 signconf_check(signconf_type* sc)
00351 {
00352     ods_status status = ODS_STATUS_OK;
00353 
00354     if (!sc->sig_resign_interval) {
00355         ods_log_error("[%s] check failed: no signature resign interval found",
00356             sc_str);
00357         status = ODS_STATUS_CFG_ERR;
00358     }
00359     if (!sc->sig_refresh_interval) {
00360         ods_log_error("[%s] check failed: no signature resign interval found",
00361             sc_str);
00362         status = ODS_STATUS_CFG_ERR;
00363     }
00364     if (!sc->sig_validity_default) {
00365         ods_log_error("[%s] check failed: no signature default validity found",
00366             sc_str);
00367         status = ODS_STATUS_CFG_ERR;
00368     }
00369     if (!sc->sig_validity_denial) {
00370         ods_log_error("[%s] check failed: no signature denial validity found",
00371             sc_str);
00372         status = ODS_STATUS_CFG_ERR;
00373     }
00374     if (!sc->sig_jitter) {
00375         ods_log_error("[%s] check failed: no signature jitter found", sc_str);
00376         status = ODS_STATUS_CFG_ERR;
00377     }
00378     if (!sc->sig_inception_offset) {
00379         ods_log_error("[%s] check failed: no signature inception offset found",
00380             sc_str);
00381         status = ODS_STATUS_CFG_ERR;
00382     }
00383     if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00384         if (sc->nsec3_algo == 0) {
00385             ods_log_error("[%s] check failed: no nsec3 algorithm found",
00386                 sc_str);
00387             status = ODS_STATUS_CFG_ERR;
00388         }
00389         /* iterations */
00390         /* salt */
00391         /* optout */
00392     } else if (sc->nsec_type != LDNS_RR_TYPE_NSEC) {
00393         ods_log_error("[%s] check failed: wrong nsec type %i", sc_str,
00394             sc->nsec_type);
00395         status = ODS_STATUS_CFG_ERR;
00396     }
00397     if (!sc->keys || sc->keys->count == 0) {
00398         ods_log_error("[%s] check failed: no keys found", sc_str);
00399         status = ODS_STATUS_CFG_ERR;
00400     }
00401     if (!sc->dnskey_ttl) {
00402         ods_log_error("[%s] check failed: no dnskey ttl found", sc_str);
00403         status = ODS_STATUS_CFG_ERR;
00404     }
00405     if (!sc->soa_ttl) {
00406         ods_log_error("[%s] check failed: no soa ttl found", sc_str);
00407         status = ODS_STATUS_CFG_ERR;
00408     }
00409     if (!sc->soa_min) {
00410         ods_log_error("[%s] check failed: no soa minimum found", sc_str);
00411         status = ODS_STATUS_CFG_ERR;
00412     }
00413     if (!sc->soa_serial) {
00414         ods_log_error("[%s] check failed: no soa serial type found", sc_str);
00415         status = ODS_STATUS_CFG_ERR;
00416     } else if (signconf_soa_serial_check(sc->soa_serial) != 0) {
00417         ods_log_error("[%s] check failed: wrong soa serial type %s", sc_str,
00418             sc->soa_serial);
00419         status = ODS_STATUS_CFG_ERR;
00420     }
00421 
00422     return status;
00423 }
00424 
00425 
00430 task_id
00431 signconf_compare_denial(signconf_type* a, signconf_type* b)
00432 {
00433     task_id new_task = TASK_NONE;
00434     if (!a || !b) {
00435         return TASK_NONE;
00436     }
00437     ods_log_assert(a);
00438     ods_log_assert(b);
00439 
00440    if (a->nsec_type != b->nsec_type) {
00441        new_task = TASK_NSECIFY;
00442    } else if (a->nsec_type == LDNS_RR_TYPE_NSEC3) {
00443        if ((ods_strcmp(a->nsec3_salt, b->nsec3_salt) != 0) ||
00444            (a->nsec3_algo != b->nsec3_algo) ||
00445            (a->nsec3_iterations != b->nsec3_iterations) ||
00446            (a->nsec3_optout != b->nsec3_optout)) {
00447 
00448            new_task = TASK_NSECIFY;
00449        }
00450    }
00451    return new_task;
00452 }
00453 
00454 
00459 task_id
00460 signconf_compare_keys(signconf_type* a, signconf_type* b, ldns_rr_list* del)
00461 {
00462    task_id new_task = TASK_NONE;
00463     ods_status status = ODS_STATUS_OK;
00464     key_type* walk = NULL;
00465     key_type* ka = NULL;
00466     key_type* kb = NULL;
00467     int remove = 0;
00468     int copy = 0;
00469 
00470     if (!a || !b) {
00471        return TASK_NONE;
00472     }
00473     ods_log_assert(a);
00474     ods_log_assert(b);
00475 
00476     /* keys deleted? */
00477     if (a->keys) {
00478         walk = a->keys->first_key;
00479     }
00480     while (walk && walk->locator) {
00481         remove = 0;
00482         copy = 0;
00483 
00484         kb = keylist_lookup(b->keys, walk->locator);
00485         if (!kb) {
00486             remove = 1; /* [DEL] key removed from signconf */
00487         } else {
00488             if (duration_compare(a->dnskey_ttl, b->dnskey_ttl) != 0) {
00489                 remove = 1; /* [DEL] consider to be different key */
00490             } else if (walk->flags != kb->flags) {
00491                 remove = 1; /* [DEL] consider to be different key */
00492             } else if (walk->algorithm != kb->algorithm) {
00493                 remove = 1; /* [DEL] consider to be different key */
00494             } else if (walk->publish != kb->publish) {
00495                 if (walk->publish) {
00496                     remove = 1; /* [DEL] withdraw dnskey from zone */
00497                 } else {
00498                     new_task = TASK_READ; /* [ADD] introduce key to zone */
00499                 }
00500             } else if (walk->ksk != kb->ksk) {
00501                 copy = 1; /* [UNCHANGED] same key, different role */
00502             } else if (walk->zsk != kb->zsk) {
00503                 copy = 1; /* [UNCHANGED] same key, different role */
00504             } else {
00505                 /* [UNCHANGED] identical key credentials */
00506                 copy = 1;
00507             }
00508         }
00509 
00510         if (remove) {
00511             new_task = TASK_READ;
00512             if (del && walk->dnskey) {
00513                 if (!ldns_rr_list_push_rr(del, walk->dnskey)) {
00514                     ods_log_error("[%s] del key failed", sc_str);
00515                     new_task = TASK_SIGNCONF;
00516                     break;
00517                 }
00518             }
00519         } else if (copy) {
00520             if (walk->dnskey && !kb->dnskey) {
00521                 kb->dnskey = walk->dnskey;
00522                 kb->hsmkey = walk->hsmkey;
00523                 status = lhsm_get_key(NULL, ldns_rr_owner(walk->dnskey), kb);
00524                 walk->hsmkey = NULL;
00525                 walk->dnskey = NULL;
00526             }
00527             if (status != ODS_STATUS_OK) {
00528                 ods_log_error("[%s] copy key failed", sc_str);
00529                 new_task = TASK_SIGNCONF;
00530                 break;
00531             }
00532         }
00533         walk = walk->next;
00534     }
00535 
00536     if (new_task == TASK_NONE) {
00537         /* no error and no keys were deleted, perhaps keys were added */
00538         walk = NULL;
00539         if (b->keys) {
00540             walk = b->keys->first_key;
00541         }
00542         while (walk) {
00543             ka = keylist_lookup(a->keys, walk->locator);
00544             if (!ka) {
00545                 new_task = TASK_READ; /* [ADD] key added to signconf */
00546                 break;
00547             }
00552             walk = walk->next;
00553         }
00554     }
00555    return new_task;
00556 }
00557 
00558 
00563 task_id
00564 signconf_compare(signconf_type* a, signconf_type* b)
00565 {
00566     task_id new_task = TASK_NONE;
00567     task_id tmp_task = TASK_NONE;
00568 
00569     new_task = signconf_compare_denial(a, b);
00570     tmp_task = signconf_compare_keys(a, b, NULL);
00571     if (tmp_task != TASK_NONE) {
00572         new_task = tmp_task;
00573     }
00574     /* not like python: reschedule if resign/refresh differs */
00575     /* this needs review, tasks correct on signconf changes? */
00576     return new_task;
00577 }
00578 
00579 
00584 void
00585 signconf_cleanup(signconf_type* sc)
00586 {
00587     allocator_type* allocator;
00588     if (!sc) {
00589         return;
00590     }
00591     duration_cleanup(sc->sig_resign_interval);
00592     duration_cleanup(sc->sig_refresh_interval);
00593     duration_cleanup(sc->sig_validity_default);
00594     duration_cleanup(sc->sig_validity_denial);
00595     duration_cleanup(sc->sig_jitter);
00596     duration_cleanup(sc->sig_inception_offset);
00597     duration_cleanup(sc->dnskey_ttl);
00598     duration_cleanup(sc->soa_ttl);
00599     duration_cleanup(sc->soa_min);
00600     keylist_cleanup(sc->keys);
00601 
00602     allocator = sc->allocator;
00603     allocator_deallocate(allocator, (void*) sc->filename);
00604     allocator_deallocate(allocator, (void*) sc->nsec3_salt);
00605     allocator_deallocate(allocator, (void*) sc->soa_serial);
00606     allocator_deallocate(allocator, (void*) sc);
00607     allocator_cleanup(allocator);
00608     return;
00609 }
00610 
00611 
00616 void
00617 signconf_print(FILE* out, signconf_type* sc, const char* name)
00618 {
00619     char* s = NULL;
00620 
00621     fprintf(out, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
00622 
00623     if (sc) {
00624         fprintf(out, "<SignerConfiguration>\n");
00625         fprintf(out, "\t<Zone name=\"%s\">\n", name?name:"(null)");
00626 
00627         /* Signatures */
00628         fprintf(out, "\t\t<Signatures>\n");
00629         s = duration2string(sc->sig_resign_interval);
00630         fprintf(out, "\t\t\t<Resign>%s</Resign>\n", s?s:"(null)");
00631         free((void*)s);
00632 
00633         s = duration2string(sc->sig_refresh_interval);
00634         fprintf(out, "\t\t\t<Refresh>%s</Refresh>\n", s?s:"(null)");
00635         free((void*)s);
00636 
00637         fprintf(out, "\t\t\t<Validity>\n");
00638 
00639         s = duration2string(sc->sig_validity_default);
00640         fprintf(out, "\t\t\t\t<Default>%s</Default>\n", s?s:"(null)");
00641         free((void*)s);
00642 
00643         s = duration2string(sc->sig_validity_denial);
00644         fprintf(out, "\t\t\t\t<Denial>%s</Denial>\n", s?s:"(null)");
00645         free((void*)s);
00646 
00647         fprintf(out, "\t\t\t</Validity>\n");
00648 
00649         s = duration2string(sc->sig_jitter);
00650         fprintf(out, "\t\t\t<Jitter>%s</Jitter>\n", s?s:"(null)");
00651         free((void*)s);
00652 
00653         s = duration2string(sc->sig_inception_offset);
00654         fprintf(out, "\t\t\t<InceptionOffset>%s</InceptionOffset>\n",
00655             s?s:"(null)");
00656         free((void*)s);
00657 
00658         fprintf(out, "\t\t</Signatures>\n");
00659         fprintf(out, "\n");
00660 
00661         /* Denial */
00662         fprintf(out, "\t\t<Denial>\n");
00663         if (sc->nsec_type == LDNS_RR_TYPE_NSEC) {
00664             fprintf(out, "\t\t\t<NSEC />\n");
00665         } else if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00666             fprintf(out, "\t\t\t<NSEC3>\n");
00667             if (sc->nsec3_optout) {
00668                 fprintf(out, "\t\t\t\t<OptOut />\n");
00669             }
00670             fprintf(out, "\t\t\t\t<Hash>\n");
00671             fprintf(out, "\t\t\t\t\t<Algorithm>%i</Algorithm>\n",
00672                 sc->nsec3_algo);
00673             fprintf(out, "\t\t\t\t\t<Iterations>%i</Iterations>\n",
00674                 sc->nsec3_iterations);
00675             fprintf(out, "\t\t\t\t\t<Salt>%s</Salt>\n",
00676                 sc->nsec3_salt?sc->nsec3_salt:"(null)");
00677             fprintf(out, "\t\t\t\t</Hash>\n");
00678             fprintf(out, "\t\t\t</NSEC3>\n");
00679         }
00680         fprintf(out, "\t\t</Denial>\n");
00681         fprintf(out, "\n");
00682 
00683         /* Keys */
00684         fprintf(out, "\t\t<Keys>\n");
00685         s = duration2string(sc->dnskey_ttl);
00686         fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)");
00687         free((void*)s);
00688         fprintf(out, "\n");
00689         keylist_print(out, sc->keys);
00690         fprintf(out, "\t\t</Keys>\n");
00691         fprintf(out, "\n");
00692 
00693         /* SOA */
00694         fprintf(out, "\t\t<SOA>\n");
00695         s = duration2string(sc->soa_ttl);
00696         fprintf(out, "\t\t\t<TTL>%s</TTL>\n", s?s:"(null)");
00697         free((void*)s);
00698 
00699         s = duration2string(sc->soa_min);
00700         fprintf(out, "\t\t\t<Minimum>%s</Minimum>\n", s?s:"(null)");
00701         free((void*)s);
00702 
00703         fprintf(out, "\t\t\t<Serial>%s</Serial>\n",
00704             sc->soa_serial?sc->soa_serial:"(null)");
00705         fprintf(out, "\t\t</SOA>\n");
00706         fprintf(out, "\n");
00707 
00708         /* Audit */
00709         if (sc->audit) {
00710             fprintf(out, "\t\t<Audit />\n");
00711             fprintf(out, "\n");
00712         }
00713 
00714         fprintf(out, "\t</Zone>\n");
00715         fprintf(out, "</SignerConfiguration>\n");
00716     }
00717     return;
00718 }
00719 
00720 
00725 void
00726 signconf_log(signconf_type* sc, const char* name)
00727 {
00728     char* resign = NULL;
00729     char* refresh = NULL;
00730     char* validity = NULL;
00731     char* denial = NULL;
00732     char* jitter = NULL;
00733     char* offset = NULL;
00734     char* dnskeyttl = NULL;
00735     char* soattl = NULL;
00736     char* soamin = NULL;
00737 
00738     if (sc) {
00739         resign = duration2string(sc->sig_resign_interval);
00740         refresh = duration2string(sc->sig_refresh_interval);
00741         validity = duration2string(sc->sig_validity_default);
00742         denial = duration2string(sc->sig_validity_denial);
00743         jitter = duration2string(sc->sig_jitter);
00744         offset = duration2string(sc->sig_inception_offset);
00745         dnskeyttl = duration2string(sc->dnskey_ttl);
00746         soattl = duration2string(sc->soa_ttl);
00747         soamin = duration2string(sc->soa_min);
00748 
00749         ods_log_info("[%s] zone %s signconf: RESIGN[%s] REFRESH[%s] "
00750             "VALIDITY[%s] DENIAL[%s] JITTER[%s] OFFSET[%s] NSEC[%i] "
00751             "DNSKEYTTL[%s] SOATTL[%s] MINIMUM[%s] SERIAL[%s] AUDIT[%i]",
00752             sc_str, name?name:"(null)", resign, refresh, validity, denial,
00753             jitter, offset, (int) sc->nsec_type, dnskeyttl, soattl,
00754             soamin, sc->soa_serial?sc->soa_serial:"(null)",
00755             (int) sc->audit);
00756 
00757         if (sc->nsec_type == LDNS_RR_TYPE_NSEC3) {
00758             ods_log_debug("[%s] zone %s nsec3: OPTOUT[%i] ALGORITHM[%u] "
00759                 "ITERATIONS[%u] SALT[%s]", sc_str, name, sc->nsec3_optout,
00760                 sc->nsec3_algo, sc->nsec3_iterations,
00761                 sc->nsec3_salt?sc->nsec3_salt:"(null)");
00762         }
00763 
00764         /* Keys */
00765         keylist_log(sc->keys, name);
00766 
00767         free((void*)resign);
00768         free((void*)refresh);
00769         free((void*)validity);
00770         free((void*)denial);
00771         free((void*)jitter);
00772         free((void*)offset);
00773         free((void*)dnskeyttl);
00774         free((void*)soattl);
00775         free((void*)soamin);
00776     }
00777     return;
00778 }