with this commit, ldns-signzone+nsd and 'drill -t axfr' on powerdns and nsd delivers...

git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@1761 d19b8d6e-7fed-0310-83ef-9ca221ded41b

diff --git a/pdns/dnssecinfra.cc b/pdns/dnssecinfra.cc
index f664cecd50e18698998e5bb18c03b9a0a12e1be1..a6661871d95152a43e344d69298c74eccfaacd4e 100644 (file)
--- a/pdns/dnssecinfra.cc
+++ b/pdns/dnssecinfra.cc
@@ -149,7 +149,7 @@ DSRecordContent makeDSFromDNSKey(const std::string& qname, const DNSKEYRecordCon
   return dsrc;
 }
 
-DNSKEYRecordContent makeDNSKEYFromRSAKey(rsa_context* rc, uint8_t algorithm)
+DNSKEYRecordContent makeDNSKEYFromRSAKey(const rsa_context* rc, uint8_t algorithm, uint16_t flags)
 {
   DNSKEYRecordContent drc;
   char tmp[256];
@@ -175,7 +175,7 @@ DNSKEYRecordContent makeDNSKEYFromRSAKey(rsa_context* rc, uint8_t algorithm)
   drc.d_protocol=3;
   drc.d_algorithm = algorithm;
 
-  drc.d_flags=256 + (modulus.length()>128);  // oops, I just made this up..
+  drc.d_flags=flags;
 
   return drc;
 }

diff --git a/pdns/dnssecinfra.hh b/pdns/dnssecinfra.hh
index 6f33ad39d680221c7cd1e028f38afc9947f87282..400c94e6d975656797cf7118b9c77b8a5488bf32 100644 (file)
--- a/pdns/dnssecinfra.hh
+++ b/pdns/dnssecinfra.hh
@@ -28,7 +28,7 @@ DNSKEYRecordContent getRSAKeyFromISC(rsa_context* rsa, const char* fname);
 void makeRSAPublicKeyFromDNS(rsa_context* rc, const DNSKEYRecordContent& dkrc);
 bool sharedDNSSECCompare(const boost::shared_ptr<DNSRecordContent>& a, const shared_ptr<DNSRecordContent>& b);
 string getSHA1HashForRRSET(const std::string& qname, const RRSIGRecordContent& rrc, std::vector<boost::shared_ptr<DNSRecordContent> >& signRecords);
-DNSKEYRecordContent makeDNSKEYFromRSAKey(rsa_context* rc, uint8_t algorithm);
+DNSKEYRecordContent makeDNSKEYFromRSAKey(const rsa_context* rc, uint8_t algorithm, uint16_t flags);
 DSRecordContent makeDSFromDNSKey(const std::string& qname, const DNSKEYRecordContent& drc, int digest=1);
 
 bool getSignerFor(const std::string& keyrepodir, const std::string& qname, std::string &signer);

diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index 09420fb88357dcbe502287ed9623eb6f0ace66ad..4cb2a7c0189ee4ab4d17599926f8f10f7fdf7f62 100644 (file)
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -55,11 +55,17 @@ public:
     return *this;
   }
 
-  rsa_context& getContext()
+  const rsa_context& getConstContext() const
   {
     return d_context;
   }
 
+  rsa_context& getContext() 
+  {
+    return d_context;
+  }
+
+
   void create(unsigned int bits);
   std::string convertToISC();
 
@@ -77,8 +83,9 @@ struct DNSSECPrivateKey
   uint16_t getTag();
   
   RSAContext d_key;
-  DNSKEYRecordContent getDNSKEY();
+  DNSKEYRecordContent getDNSKEY() const;
   uint8_t d_algorithm;
+  uint16_t d_flags;
 };
 
 class DNSSECKeeper

diff --git a/pdns/fsdnsseckeeper.cc b/pdns/fsdnsseckeeper.cc
index 90fdd584b40d2585f80c5bd98f1ad8150b4fbe40..1030b764dc71ab019f30d6cca2fc2929bbd791cd 100644 (file)
--- a/pdns/fsdnsseckeeper.cc
+++ b/pdns/fsdnsseckeeper.cc
@@ -68,39 +68,6 @@ bool DNSSECKeeper::haveActiveKSKFor(const std::string& zone, DNSSECPrivateKey* d
     *dpk = keys.begin()->first;
   }
   return !keys.empty();
-  
-  #if 0
-  fs::path full_path = fs::system_complete( fs::path(d_dirname + "/" + zone + "/keys/" ) );
-
-  if ( !fs::exists( full_path ) )
-    return false;
-
-  fs::directory_iterator end_iter;
-  for ( fs::directory_iterator dir_itr( full_path );
-       dir_itr != end_iter;
-       ++dir_itr )
-  {
-    //    cerr<<"Entry: '"<< dir_itr->leaf() <<"'"<<endl;
-    if(ends_with(dir_itr->leaf(),".private")) {
-      //      cerr<<"Hit!"<<endl;
-
-      if(dpk) {
-        getRSAKeyFromISC(&dpk->d_key.getContext(), dir_itr->path().file_string().c_str());
-       
-        if(getNSEC3PARAM(zone)) {
-          dpk->d_algorithm = 7;
-        }
-        else {
-          dpk->d_algorithm = 5;
-        }
-      
-      }
-      return true;
-    }
-  }
-
-  return false;
-  #endif
 }
 
 unsigned int DNSSECKeeper::getNextKeyIDFromDir(const std::string& dirname)
@@ -128,7 +95,7 @@ std::string DNSSECKeeper::getKeyFilenameById(const std::string& dirname, unsigne
   fs::path full_path = fs::system_complete( fs::path(dirname));
 
   if ( !fs::exists( full_path ) )
-    unixDie("Unable to get free key id from '"+dirname+"'");
+    unixDie("Unable to get filname key id from '"+dirname+"'");
 
   fs::directory_iterator end_iter;
   pair<string, string> parts;
@@ -136,6 +103,8 @@ std::string DNSSECKeeper::getKeyFilenameById(const std::string& dirname, unsigne
     dir_itr != end_iter;
     ++dir_itr )
   {
+    if(!ends_with(dir_itr->leaf(), ".private"))
+      continue;
     parts = splitField(dir_itr->leaf(), '-');
          if(atoi(parts.first.c_str()) == (signed int)id) 
       return dirname+"/"+dir_itr->leaf();
@@ -151,7 +120,7 @@ void DNSSECKeeper::addKey(const std::string& name, bool keyOrZone, int algorithm
 
   string isc = dpk.d_key.convertToISC();
   DNSKEYRecordContent drc = dpk.getDNSKEY();
-  drc.d_flags = 256; // KSK
+  drc.d_flags = 256 + keyOrZone; // KSK
   drc.d_algorithm = algorithm; 
   string iscName=d_dirname+"/"+name+"/keys/";
   unsigned int id = getNextKeyIDFromDir(iscName);
@@ -188,14 +157,14 @@ static bool keyCompareByKindAndID(const DNSSECKeeper::keyset_t::value_type& a, c
 
 void DNSSECKeeper::removeKey(const std::string& zname, unsigned int id)
 {
-  string fname = getKeyFilenameById(d_dirname+"/keys/", id);
+  string fname = getKeyFilenameById(d_dirname+"/"+zname+"/keys", id);
   if(unlink(fname.c_str()) < 0)
     unixDie("removing key file '"+fname+"'");
 }
 
 void DNSSECKeeper::deactivateKey(const std::string& zname, unsigned int id)
 {
-  string fname = getKeyFilenameById(d_dirname+"/keys/", id);
+  string fname = getKeyFilenameById(d_dirname+"/"+zname+"/keys/", id);
   string newname = boost::replace_last_copy(fname, ".active", ".passive");
   if(rename(fname.c_str(), newname.c_str()) < 0)
     unixDie("renaming file to deactivate key, from: '"+fname+"' to '"+newname+"'");
@@ -203,7 +172,7 @@ void DNSSECKeeper::deactivateKey(const std::string& zname, unsigned int id)
 
 void DNSSECKeeper::activateKey(const std::string& zname, unsigned int id)
 {
-  string fname = getKeyFilenameById(d_dirname+"/keys/", id);
+  string fname = getKeyFilenameById(d_dirname+"/"+zname+"/keys/", id);
   string newname = boost::replace_last_copy(fname, ".passive", ".active");
   if(rename(fname.c_str(), newname.c_str()) < 0)
     unixDie("renaming file to deactivate key, from: '"+fname+"' to '"+newname+"'");
@@ -274,7 +243,6 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tri
       else {
         dpk.d_algorithm = 5;
       }
-      
       struct tm ts1, ts2;
       
       memset(&ts1, 0, sizeof(ts1));
@@ -295,6 +263,9 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tri
       kmd.fname = dir_itr->leaf();
       kmd.active = kmd.fname.find(".active") != string::npos;
       kmd.keyOrZone = kmd.fname.find(".ksk") != string::npos;
+      
+      dpk.d_flags = 256 + kmd.keyOrZone;  // this is a clear sign we've got our abstractions wrong! FIXME XXX
+      
       if(boost::indeterminate(allOrKeyOrZone) || allOrKeyOrZone == kmd.keyOrZone)
         keyset.push_back(make_pair(dpk, kmd));
     }
@@ -304,9 +275,9 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tri
   return keyset;
 }
 
-DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY()
+DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
-  return makeDNSKEYFromRSAKey(&d_key.getContext(), d_algorithm);
+  return makeDNSKEYFromRSAKey(&d_key.getConstContext(), d_algorithm, d_flags);
 }
 
 

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index eec97e88ed25276c6c2fa3231803f8c8859c6ab0..83c40115b040d60d5ac5411672754d7b7c5f6b88 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -18,6 +18,7 @@
 #include "packetcache.hh"
 #include "utility.hh"
 #include "dnssecinfra.hh"
+#include "dnsseckeeper.hh"
 #include <cstdio>
 #include <cstring>
 #include <cstdlib>
@@ -456,6 +457,20 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
   outpacket=shared_ptr<DNSPacket>(q->replyPacket());
   outpacket->addRecord(soa); // AXFR format begins and ends with a SOA record, so we add one
   //  sendPacket(outpacket, outsock);
+  typedef map<string, set<uint16_t>, CanonicalCompare> nsecrepo_t;
+  nsecrepo_t nsecrepo;
+  // this is where the DNSKEYs go
+  
+  DNSSECKeeper dk(::arg()["key-repository"]);
+  DNSSECKeeper::keyset_t keys = dk.getKeys(target);
+  BOOST_FOREACH(const DNSSECKeeper::keyset_t::value_type& value, keys) {
+    rr.qname = target;
+    rr.qtype = QType(QType::DNSKEY);
+    rr.ttl = 3600;
+    rr.content = value.first.getDNSKEY().getZoneRepresentation();
+    nsecrepo[rr.qname].insert(rr.qtype.getCode());
+    outpacket->addRecord(rr);
+  }
 
   /* now write all other records */
 
@@ -468,8 +483,7 @@ int TCPNameserver::doAXFR(const string &target, shared_ptr<DNSPacket> q, int out
   outpacket->setCompress(false);
   outpacket->d_dnssecOk=true; // WRONG
 
-  typedef map<string, set<uint16_t>, CanonicalCompare> nsecrepo_t;
-  nsecrepo_t nsecrepo;
+
 
   while(B->get(rr)) {
     if(rr.auth || rr.qtype.getCode() == QType::NS)