From: Peter van Dijk Date: Thu, 7 Mar 2013 10:35:32 +0000 (+0000) Subject: merge #476 by Aki Tuomi, providing default-ksk/zsk-algorithms/size configuration... X-Git-Tag: rec-3.5-rc3~23 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=36758d25ce712a7ef408c1362bf74519c36236cf;p=pdns merge #476 by Aki Tuomi, providing default-ksk/zsk-algorithms/size configuration parameters for pdnssec. Also cleans up some duplicate code git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@3112 d19b8d6e-7fed-0310-83ef-9ca221ded41b --- diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc index 6a47a607a..4f0959cbd 100644 --- a/pdns/common_startup.cc +++ b/pdns/common_startup.cc @@ -138,6 +138,10 @@ void declareArguments() ::arg().setSwitch("traceback-handler","Enable the traceback handler (Linux only)")="yes"; ::arg().setSwitch("experimental-direct-dnskey","EXPERIMENTAL: fetch DNSKEY RRs from backend during DNSKEY synthesis")="no"; + ::arg().set("default-ksk-algorithms","Default KSK algorithms")="rsasha256"; + ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0"; + ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256"; + ::arg().set("default-zsk-size","Default KSK size (0 means default)")="0"; } void declareStats(void) diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc index d07ddebc2..4020925c4 100644 --- a/pdns/dbdnsseckeeper.cc +++ b/pdns/dbdnsseckeeper.cc @@ -347,10 +347,10 @@ DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tri return retkeyset; } -bool DNSSECKeeper::secureZone(const std::string& name, int algorithm) +bool DNSSECKeeper::secureZone(const std::string& name, int algorithm, int size) { clearCaches(name); // just to be sure ;) - return addKey(name, true, algorithm); + return addKey(name, true, algorithm, size); } bool DNSSECKeeper::getPreRRSIGs(DNSBackend& db, const std::string& signer, const std::string& qname, diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh index 9eb16b310..2d81a71bc 100644 --- a/pdns/dnsseckeeper.hh +++ b/pdns/dnsseckeeper.hh @@ -75,7 +75,7 @@ public: bool activateKey(const std::string& zname, unsigned int id); bool deactivateKey(const std::string& zname, unsigned int id); - bool secureZone(const std::string& fname, int algorithm); + bool secureZone(const std::string& fname, int algorithm, int size); bool getNSEC3PARAM(const std::string& zname, NSEC3PARAMRecordContent* n3p=0, bool* narrow=0); bool setNSEC3PARAM(const std::string& zname, const NSEC3PARAMRecordContent& n3p, const bool& narrow=false); diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc index dd24aa592..95991b7fc 100644 --- a/pdns/pdnssec.cc +++ b/pdns/pdnssec.cc @@ -42,6 +42,22 @@ string humanTime(time_t t) return ret; } +static int shorthand2algorithm(const string &algorithm) +{ + if (!algorithm.compare("rsamd5")) return 1; + if (!algorithm.compare("dh")) return 2; + if (!algorithm.compare("dsa")) return 3; + if (!algorithm.compare("ecc")) return 4; + if (!algorithm.compare("rsasha1")) return 5; + if (!algorithm.compare("rsasha256")) return 8; + if (!algorithm.compare("rsasha512")) return 10; + if (!algorithm.compare("gost")) return 12; + if (!algorithm.compare("ecdsa256")) return 13; + if (!algorithm.compare("ecdsa384")) return 14; + if (!algorithm.compare("ed25519")) return 250; + return -1; +} + void loadMainConfig(const std::string& configdir) { ::arg().set("config-dir","Location of configuration directory (pdns.conf)")=configdir; @@ -64,6 +80,11 @@ void loadMainConfig(const std::string& configdir) string configname=::arg()["config-dir"]+"/"+s_programname+".conf"; cleanSlashes(configname); + + ::arg().set("default-ksk-algorithms","Default KSK algorithms")="rsasha256"; + ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0"; + ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256"; + ::arg().set("default-zsk-size","Default KSK size (0 means default)")="0"; ::arg().set("max-ent-entries", "Maximum number of empty non-terminals in a zone")="100000"; ::arg().set("module-dir","Default directory for modules")=LIBDIR; @@ -568,6 +589,33 @@ void showZone(DNSSECKeeper& dk, const std::string& zone) bool secureZone(DNSSECKeeper& dk, const std::string& zone) { + // parse attribute + vector k_algos; + vector z_algos; + int k_size; + int z_size; + + stringtok(k_algos, ::arg()["default-ksk-algorithms"], " ,"); + k_size = ::arg().asNum("default-ksk-size"); + stringtok(z_algos, ::arg()["default-zsk-algorithms"], " ,"); + z_size = ::arg().asNum("default-zsk-size"); + + if (k_size < 0) { + throw runtime_error("KSK key size must be equal to or greater than 0"); + } + + if (k_algos.size() < 1) { + throw runtime_error("No algorithm(s) given for KSK"); + } + + if (z_size < 0) { + throw runtime_error("ZSK key size must be equal to or greater than 0"); + } + + if (z_algos.size() < 1) { + throw runtime_error("No algorithm(s) given for ZSK"); + } + if(dk.isSecuredZone(zone)) { cerr << "Zone '"<::iterator i = k_algos.begin()+1; i != k_algos.end(); i++) + dk.addKey(zone, true, shorthand2algorithm(*i), k_size, true); + + BOOST_FOREACH(string z_algo, z_algos) + { + int algo = shorthand2algorithm(z_algo); + dk.addKey(zone, false, algo, z_size); + dk.addKey(zone, false, algo, z_size, false); // not active + } + // rectifyZone(dk, zone); // showZone(dk, zone); cout<<"Zone "<0) { + algorithm = tmp_algo; + } else if(atoi(cmds[n].c_str())) bits = atoi(cmds[n].c_str()); else { cerr<<"Unknown algorithm, key flag or size '"<