Changeset 1758

Timestamp:

12/27/10 16:57:14 (2 years ago)

Author:

ahu

Message:

this implies that there will be more dnsseckeepers - database backed for example

Files:

• trunk/pdns/pdns/fsdnsseckeeper.cc (copied) (copied from trunk/pdns/pdns/dnsseckeeper.cc) (14 diffs)

trunk/pdns/pdns/fsdnsseckeeper.cc

@@ -63 +63 @@
 }
 
-bool DNSSECKeeper::haveKSKFor(const std::string& zone, DNSSECPrivateKey* dpk)
-{
-  fs::path full_path = fs::system_complete( fs::path(d_dirname + "/" + zone + "/ksks/" ) );
+bool DNSSECKeeper::haveActiveKSKFor(const std::string& zone, DNSSECPrivateKey* dpk)
+{
+  keyset_t keys = getKeys(zone, true);
+  // need to get an *active* one!
+  if(dpk && !keys.empty()) {
+    *dpk = keys.begin()->first;
+  }
+  return !keys.empty();
+  
+  #if 0
+  fs::path full_path = fs::system_complete( fs::path(d_dirname + "/" + zone + "/keys/" ) );
 
   if ( !fs::exists( full_path ) )
@@ -95 +103 @@
 
   return false;
+  #endif
 }
 
@@ -117 +126 @@
 }
 
-void DNSSECKeeper::addZSKFor(const std::string& name, int algorithm, bool active)
+std::string DNSSECKeeper::getKeyFilenameById(const std::string& dirname, unsigned int id)
+{
+  fs::path full_path = fs::system_complete( fs::path(dirname));
+
+  if ( !fs::exists( full_path ) )
+    unixDie("Unable to get free key id from '"+dirname+"'");
+
+  fs::directory_iterator end_iter;
+  pair<string, string> parts;
+  for ( fs::directory_iterator dir_itr( full_path );
+    dir_itr != end_iter;
+    ++dir_itr )
+  {
+    parts = splitField(dir_itr->leaf(), '-');
+          if(atoi(parts.first.c_str()) == (signed int)id) 
+      return dirname+"/"+dir_itr->leaf();
+  }
+  throw runtime_error("Could not get filename for key id '"+lexical_cast<string>(id)+"'");
+}
+
+
+void DNSSECKeeper::addKey(const std::string& name, bool keyOrZone, int algorithm, bool active)
 {
   DNSSECPrivateKey dpk;
@@ -126 +156 @@
   drc.d_flags = 256; // KSK
   drc.d_algorithm = algorithm; 
-  string iscName=d_dirname+"/"+name+"/zsks/";
+  string iscName=d_dirname+"/"+name+"/keys/";
   unsigned int id = getNextKeyIDFromDir(iscName);
   time_t inception=time(0);
@@ -133 +163 @@
   gmtime_r(&inception, &ts);
 
-  iscName += (boost::format("%06d-%04d%02d%02d%02d%02d") % id
+  iscName += (boost::format("%06d-%04d%02d%02d%02d%02d.%u") % id
               % (1900+ts.tm_year) % (ts.tm_mon + 1)
-              % ts.tm_mday % ts.tm_hour % ts.tm_min).str();
-
+              % ts.tm_mday % ts.tm_hour % ts.tm_min % drc.getTag()).str();
+
+  iscName += keyOrZone ? ".ksk" : ".zsk";
   iscName += active ? ".active" : ".passive";
   
@@ -152 +183 @@
 
 
-static bool zskCompareByID(const DNSSECKeeper::zskset_t::value_type& a, const DNSSECKeeper::zskset_t::value_type& b)
+static bool zskCompareByID(const DNSSECKeeper::keyset_t::value_type& a, const DNSSECKeeper::keyset_t::value_type& b)
 {
   return a.second.id < b.second.id;
 }
 
-void DNSSECKeeper::deleteZSKFor(const std::string& zname, const std::string& fname)
-{
-  unlink((d_dirname +"/"+ zname +"/zsks/"+fname).c_str());
+void DNSSECKeeper::removeKey(const std::string& zname, unsigned int id)
+{
+  // unlink((d_dirname +"/"+ zname +"/zsks/"+fname).c_str());
+  abort();
+}
+
+void DNSSECKeeper::deactivateKey(const std::string& zname, unsigned int id)
+{
+  // unlink((d_dirname +"/"+ zname +"/zsks/"+fname).c_str());
+  string fname = getKeyFilenameById(d_dirname+"/keys/", id);
+  string newname = boost::replace_last_copy(fname, ".active", ".passive");
+  if(rename(fname.c_str(), newname.c_str()) < 0)
+    unixDie("renaming file to deactivate key, from: '"+fname+"' to '"+newname+"'");
+}
+
+void DNSSECKeeper::activateKey(const std::string& zname, unsigned int id)
+{
+  // unlink((d_dirname +"/"+ zname +"/zsks/"+fname).c_str());
+  abort();
 }
 
@@ -202 +249 @@
 
 
-DNSSECKeeper::zskset_t DNSSECKeeper::getZSKsFor(const std::string& zone, bool all)
-{
-  zskset_t zskset;
-
-  fs::path full_path = fs::system_complete( fs::path(d_dirname + "/" + zone + "/zsks/" ) );
+DNSSECKeeper::keyset_t DNSSECKeeper::getKeys(const std::string& zone, boost::tribool allOrKeyOrZone)
+{
+  keyset_t keyset;
+
+  fs::path full_path = fs::system_complete( fs::path(d_dirname + "/" + zone + "/keys/" ) );
 
   if ( !fs::exists( full_path ) )
-    return zskset;
+    return keyset;
 
   fs::directory_iterator end_iter;
@@ -216 +263 @@
         ++dir_itr )
   {
-    //    cerr<<"Entry: '"<< dir_itr->leaf() <<"'"<<endl;
+    //cerr<<"Entry: '"<< dir_itr->leaf() <<"'"<<endl;
     if(ends_with(dir_itr->leaf(),".isc")) {
-      //cerr<<"Hit!"<<endl;
       DNSSECPrivateKey dpk;
       getRSAKeyFromISC(&dpk.d_key.getContext(), dir_itr->path().file_string().c_str());
@@ -236 +282 @@
       unsigned int id;
       sscanf(dir_itr->leaf().c_str(), "%06u-%04d%02d%02d%02d%02d",
-                 &id,
-             &ts1.tm_year, 
-             &ts1.tm_mon, &ts1.tm_mday, &ts1.tm_hour, &ts1.tm_min);
+        &id,
+        &ts1.tm_year, 
+        &ts1.tm_mon, &ts1.tm_mday, &ts1.tm_hour, &ts1.tm_min);
              
 
@@ -247 +293 @@
       KeyMetaData kmd;
       
-          kmd.id = id;
+      kmd.id = id;
       kmd.fname = dir_itr->leaf();
       kmd.active = kmd.fname.find(".active") != string::npos;
-      zskset.push_back(make_pair(dpk, kmd));
+      kmd.keyOrZone = kmd.fname.find(".ksk") != string::npos;
+      if(boost::indeterminate(allOrKeyOrZone) || allOrKeyOrZone == kmd.keyOrZone)
+        keyset.push_back(make_pair(dpk, kmd));
     }
-    sort(zskset.begin(), zskset.end(), zskCompareByID);
-  }
-
-  return zskset;
+    sort(keyset.begin(), keyset.end(), zskCompareByID);
+  }
+
+  return keyset;
 }
 
@@ -267 +315 @@
 {
   mkdir((d_dirname+"/"+name).c_str(), 0700);
-  mkdir((d_dirname+"/"+name+"/ksks").c_str(), 0700);
-  if(mkdir((d_dirname+"/"+name+"/zsks").c_str(), 0700) < 0)
+  if(mkdir((d_dirname+"/"+name+"/keys").c_str(), 0700) < 0)
     unixDie("Making directory for keys in '"+d_dirname+"'");
 
+
   // now add the KSK
+
+  addKey(name, true, algorithm);
+#if 0
 
   DNSSECPrivateKey dpk;
@@ -280 +331 @@
   drc.d_flags = 257; // ZSK (?? for a KSK?)
   drc.d_algorithm = algorithm;  
-  string iscName=d_dirname+"/"+name+"/ksks/";
+  string iscName=d_dirname+"/"+name+"/keys/";
 
   time_t now=time(0);
@@ -286 +337 @@
   gmtime_r(&now, &ts);
   unsigned int id=1;
-  iscName += (boost::format("%06d-%04d%02d%02d%02d%02d.%u") % id
+  iscName += (boost::format("%06d-%04d%02d%02d%02d%02d.%u.%s.%s") % id
               % (1900+ts.tm_year) % (ts.tm_mon + 1)
-              % ts.tm_mday % ts.tm_hour % ts.tm_min % drc.getTag()).str();
+              % ts.tm_mday % ts.tm_hour % ts.tm_min % drc.getTag() % "ksk" % "active").str();
 
 
@@ -300 +351 @@
     dnskeyFile << toCanonic("", name) << " IN DNSKEY " << drc.getZoneRepresentation()<<endl;
   }
-
+#endif
 }