Changeset 1984

Timestamp:

02/07/11 10:33:20 (2 years ago)

Author:

ahu

Message:

improve secure-zone output when no dnssec capable backend was loaded
fix verify-crypto so it actually does that again
add dead code to implement a remote signing-server

Files:

• trunk/pdns/pdns/pdnssec.cc (modified) (7 diffs)

trunk/pdns/pdns/pdnssec.cc

@@ -12 +12 @@
 #include "zoneparser-tng.hh"
 #include "signingpipe.hh"
+
 StatBag S;
 PacketCache PC;
@@ -20 +21 @@
 
 string s_programname="pdns";
+
+#if 0
+void launchSigningService(int fd)
+{
+  UeberBackend db("key-only");
+  DNSSECKeeper dk;
+  string str;
+  vector<DNSResourceRecord> chunk;
+  uint64_t signatures=0;
+  while(readLStringFromSocket(fd, str))
+  {
+    if(str.empty())
+      break;
+    chunk=convertDNSRRVectorFromPBString(str);
+  
+    addRRSigs(dk, db, "big.aa", chunk); // sucks
+  
+    ++signatures;
+    str=convertDNSRRVectorToPBString(chunk);
+    writeLStringToSocket(fd, str);    
+  }
+  cerr<<"Exiting after "<<signatures<<" signatures"<<endl;
+  char c;
+  //read(fd, &c, 1); // wait for EOF, signifies that the other side received everything
+  _exit(1);
+}
+
+void signingServer()
+{
+  ComboAddress local("::", 2000);
+  int sock = socket(AF_INET6, SOCK_STREAM, 0);
+  
+  setSocketReusable(sock);
+  if(::bind(sock, (struct sockaddr*)&local, local.getSocklen()) < 0)
+    unixDie("Binding signing server to socket");
+  listen(sock, 5);
+  for(;;) {
+    ComboAddress remote("::");
+    socklen_t remotelen = remote.getSocklen();
+    int client = accept(sock, (struct sockaddr*)&remote, &remotelen);
+    
+    if(client < 0) 
+      break;
+    cerr<<"Got connection from "<<remote.toString()<<endl;  
+    if(fork()) 
+      continue;
+    launchSigningService(client);
+  }
+}
+#endif 
 
 ArgvMap &arg()
@@ -183 +234 @@
 }
 
-void testSpeed(DNSSECKeeper& dk, const string& zone, int cores)
+void testSpeed(DNSSECKeeper& dk, const string& zone, const string& remote, int cores)
 {
   DNSResourceRecord rr;
@@ -194 +245 @@
   rr.priority=0;
   
-  UeberBackend db;
-  
-  ChunkedSigningPipe csp(dk, db, zone, 1, cores);
+  UeberBackend db("key-only");
+  
+  ChunkedSigningPipe csp(zone, 1, remote, cores);
   
   vector<DNSResourceRecord> signatures;
@@ -258 +309 @@
   
   string msg = getMessageForRRSET(qname, rrc, toSign);        
-  DNSCryptoKeyEngine* dpk = DNSCryptoKeyEngine::make(rrc.d_algorithm);
-  string hash = dpk->sign(msg);
-  cerr<<"Verify: "<<DNSCryptoKeyEngine::makeFromPublicKeyString(drc.d_algorithm, drc.d_key)->verify(hash, rrc.d_signature)<<endl;
+  cerr<<"Verify: "<<DNSCryptoKeyEngine::makeFromPublicKeyString(drc.d_algorithm, drc.d_key)->verify(msg, rrc.d_signature)<<endl;
   if(dsrc.d_digesttype) {
     cerr<<"Calculated DS: "<<apex<<" IN DS "<<makeDSFromDNSKey(apex, drc, dsrc.d_digesttype).getZoneRepresentation()<<endl;
@@ -393 +442 @@
     checkZone(dk, cmds[1]);
   }
+#if 0
+  else if(cmds[0] == "signing-server" )
+  {
+    signingServer();
+  }
+  else if(cmds[0] == "signing-slave")
+  {
+    launchSigningService(0);
+  }
+#endif
   else if(cmds[0] == "test-speed") {
-    if(cmds.size() != 3) {
-      cerr << "Error: "<<cmds[0]<<" takes exactly 2 parameters, zone numcores"<<endl;
-      return 0;
-    }
-    testSpeed(dk, cmds[1], atoi(cmds[2].c_str()));
+    if(cmds.size() < 3) {
+      cerr << "Error: "<<cmds[0]<<" takes  2 or 3 parameters, zone numcores [signing-server]"<<endl;
+      return 0;
+    }
+    testSpeed(dk, cmds[1],  (cmds.size() > 3) ? cmds[3] : "", atoi(cmds[2].c_str()));
   }
   else if(cmds[0] == "verify-crypto") {
@@ -484 +543 @@
     }
       
-    dk.secureZone(zone, 8);
+    if(!dk.secureZone(zone, 8)) {
+      cerr<<"No backend was able to secure '"<<zone<<"', most likely because no DNSSEC\n";
+      cerr<<"capable backends are loaded, or because the backends have DNSSEC disabled.\n";
+      cerr<<"For the Generic SQL backends, set 'gsqlite3-dnssec' or 'gmysql-dnssec' or\n";
+      cerr<<"'gpgsql-dnssec' etc. Also make sure the schema has been updated for DNSSEC!\n";
+      return 0;
+    }
 
     if(!dk.isSecuredZone(zone)) {