int
handled_update_all_cmd(int sockfd, engine_type* engine, const char *cmd,
ssize_t n)
{
const char *scmd = "update all";
cmd = ods_check_command(cmd,n,scmd);
if (!cmd) return 0; // not handled
ods_log_debug("[%s] %s command", module_str, scmd);
// check that we are using a compatible protobuf version.
GOOGLE_PROTOBUF_VERIFY_VERSION;
time_t tstart = time(NULL);
autostart(engine);
/* Check all files for errors. The perform_update_*()
* functions check as well but this gives us all or nothing.
* Plus we get a complete check of the files mentioned in the
* conf which need not be the same as the files in use by the
* running enforcer!*/
char *kasp = NULL;
char *zonelist = NULL;
char **replist = NULL;
int repcount, i;
int error = 1;
if (check_conf(engine->config->cfg_filename, &kasp,
&zonelist, &replist, &repcount, 0))
ods_log_error_and_printf(sockfd, module_str,
"Unable to validate '%s' consistency.",
engine->config->cfg_filename);
else if (check_kasp(kasp, replist, repcount, 0))
ods_log_error_and_printf(sockfd, module_str,
"Unable to validate '%s' consistency.", kasp);
else if (check_zonelist(zonelist, 0))
ods_log_error_and_printf(sockfd, module_str,
"Unable to validate '%s' consistency.", zonelist);
else error = 0;
free(kasp);
free(zonelist);
if (replist) {
for (i = 0; i < repcount; i++) free(replist[i]);
}
if (!error)
error |= perform_update_repositorylist(sockfd, engine);
if (!error)
error |= perform_update_kasp(sockfd, engine->config);
if (!error)
error |= perform_update_keyzones(sockfd, engine->config);
if (!error) {
perform_update_hsmkeys(sockfd, engine->config, 0 /* automatic */);
perform_hsmkey_gen(sockfd, engine->config, 0 /* automatic */,
engine->config->automatic_keygen_duration);
flush_all_tasks(sockfd, engine);
}
ods_printf(sockfd, "%s completed in %ld seconds.\n",scmd,time(NULL)-tstart);
return 1;
}
bool get_arguments(int sockfd, const char *cmd,
std::string &out_zone,
int &need_write_xml)
{
char buf[ODS_SE_MAXLINE];
const char *argv[16];
const int NARGV = sizeof(argv)/sizeof(char*);
int argc;
// Use buf as an intermediate buffer for the command.
strncpy(buf,cmd,sizeof(buf));
buf[sizeof(buf)-1] = '\0';
// separate the arguments
argc = ods_str_explode(buf,NARGV,argv);
if (argc > NARGV) {
ods_log_error_and_printf(sockfd,module_str,"too many arguments");
return false;
}
const char *zone = NULL;
(void)ods_find_arg_and_param(&argc,argv,"zone","z",&zone);
int del_all = 0;
if (ods_find_arg(&argc, argv, "all", "a") != -1) del_all = 1;
if (ods_find_arg(&argc, argv, "xml", "u") >= 0) need_write_xml = 1;
if (argc) {
ods_log_error_and_printf(sockfd,module_str,"unknown arguments");
return false;
}
if (zone && del_all) {
ods_log_error_and_printf(sockfd,module_str,
"expected either --zone <zone> or --all, found both ");
return false;
}
if (!zone) {
if (!del_all) {
ods_log_error_and_printf(sockfd,module_str,
"expected option --zone <zone> or --all ");
return false;
}
}
else
out_zone = zone;
return true;
}
static bool
load_kasp_xml(int sockfd, const char * policiesfile,
std::auto_ptr< ::ods::kasp::KaspDocument >&doc)
{
// Create a kasp document and load it with policies from the kasp.xml file
doc.reset(new ::ods::kasp::KaspDocument);
if (doc.get() == NULL) {
ods_log_error_and_printf(sockfd,module_str,
"out of memory allocating KaspDocument");
return false;
}
if (!read_pb_message_from_xml_file(doc.get(), policiesfile)) {
ods_log_error_and_printf(sockfd, module_str,
"reading and processing kasp.xml file failed");
return false;
}
if (!doc->has_kasp()) {
ods_log_error_and_printf(sockfd, module_str,
"no policies found in kasp.xml file");
return false;
}
const ::ods::kasp::KASP &kasp = doc->kasp();
if (kasp.policies_size() <= 0) {
ods_log_error_and_printf(sockfd, module_str,
"no policies found in kasp.xml file");
return false;
}
if (!kasp.IsInitialized()) {
ods_log_error_and_printf(sockfd, module_str,
"a policy loaded from kasp.xml file is "
"lacking essential information");
return false;
}
return true;
}
bool get_arguments(int sockfd, const char *cmd,
std::string &out_zone)
{
char buf[ODS_SE_MAXLINE];
const char *argv[16];
const int NARGV = sizeof(argv)/sizeof(char*);
int argc;
// Use buf as an intermediate buffer for the command.
strncpy(buf,cmd,sizeof(buf));
buf[sizeof(buf)-1] = '\0';
// separate the arguments
argc = ods_str_explode(buf,NARGV,argv);
if (argc > NARGV) {
ods_log_error_and_printf(sockfd,module_str,"too many arguments");
return false;
}
const char *zone = NULL;
(void)ods_find_arg_and_param(&argc,argv,"zone","z",&zone);
bool bforce = ods_find_arg(&argc,argv,"force","f")!=-1;
if (argc) {
ods_log_error_and_printf(sockfd,module_str,"unknown arguments");
return false;
}
if (!zone) {
ods_log_error_and_printf(sockfd,module_str,
"expected option --zone <zone>");
return false;
}
out_zone = zone;
if (!bforce) {
ods_log_error_and_printf(sockfd,module_str,
"expected option --force");
return false;
}
return true;
}
static int
run(int sockfd, cmdhandler_ctx_type* context, const char *cmd)
{
engine_type* engine = getglobalcontext(context);
(void)cmd;
ods_log_debug("[%s] %s command", module_str,
update_repositorylist_funcblock.cmdname);
if (!perform_update_repositorylist(sockfd, engine)) {
ods_log_error_and_printf(sockfd, module_str,
"unable to update repositorylist.");
return 1;
}
return 0;
}
/**
* Update the repositorylist
* \param sockfd. Client to print to.
* \param engine. Main daemon state
* \return 1 on success, 0 on failure.
*/
static int
perform_update_repositorylist(int sockfd, engine_type* engine)
{
const char* cfgfile = ODS_SE_CFGFILE;
int status = 1;
hsm_repository_t* new_reps;
if (validate_configfile(cfgfile)) {
ods_log_error_and_printf(sockfd, module_str,
"Unable to validate '%s' consistency.", cfgfile);
return 0;
}
/* key gen tasks must be stopped, hsm connections must be closed
* easiest way is to stop all workers, */
pthread_mutex_lock(&engine->signal_lock);
/** we have got the lock, daemon thread is not going anywhere
* we can safely stop all workers */
engine_stop_workers(engine);
new_reps = parse_conf_repositories(cfgfile);
if (!new_reps) {
/* revert */
status = 0;
client_printf(sockfd, "Could not load new repositories. Will continue with old.\n");
} else {
/* succes */
hsm_repository_free(engine->config->repositories);
engine->config->repositories = new_reps;
engine->need_to_reload = 1;
client_printf(sockfd, "new repositories parsed successful.\n");
client_printf(sockfd, "Notifying enforcer of new respositories.\n");
/* kick daemon thread so it will reload the hsms */
pthread_cond_signal(&engine->signal_cond);
}
engine_start_workers(engine);
pthread_mutex_unlock(&engine->signal_lock);
return status;
}
static void
import_all_keys_from_all_hsms(int sockfd, OrmConn conn)
{
hsm_ctx_t * hsm_ctx = hsm_create_context();
if (!hsm_ctx) {
ods_log_error_and_printf(sockfd, module_str, "could not connect to HSM");
return;
}
size_t nkeys;
hsm_key_t **kl = hsm_list_keys(hsm_ctx, &nkeys);
if (!kl) {
ods_log_error_and_printf(sockfd, module_str, "could not list hsm keys");
return;
}
ods_printf(sockfd,
"HSM keys:\n"
" "
"Algorithm: "
"Bits: "
"Id: "
"\n"
);
OrmTransactionRW transaction(conn);
if (!transaction.started()) {
ods_log_error_and_printf(sockfd, module_str,
"could not start database transaction");
hsm_key_list_free(kl,nkeys);
hsm_destroy_context(hsm_ctx);
return;
}
for (int i=0; i<nkeys; ++i) {
hsm_key_t *k = kl[i];
hsm_key_info_t *kinf = hsm_get_key_info(hsm_ctx,k);
OrmResultRef result;
if (!OrmMessageEnumWhere(conn, ::ods::hsmkey::HsmKey::descriptor(),
result, "locator='%s'",kinf->id))
{
// free allocated resources
hsm_key_info_free(kinf);
ods_log_error_and_printf(sockfd, module_str,
"database query failed");
break;
}
if (OrmFirst(result)) {
// Key already exists
::ods::hsmkey::HsmKey key;
OrmContextRef context;
if (!OrmGetMessage(result,key,true,context)) {
// free allocated resources
hsm_key_info_free(kinf);
// release query result, we don't need it anymore.
result.release();
// This is an unexpected error !
ods_log_error_and_printf(sockfd, module_str,
"database record retrieval failed");
break;
} else {
// release query result, we don't need it anymore.
result.release();
// retrieved the key from the database
// Change key settings based on information from HSM key info
if (key.key_type() == std::string(kinf->algorithm_name)
|| key.repository() == std::string(k->module->name))
{
// key in the table does NOT need updating.
} else {
// key in the table needs updating.
key.set_key_type( kinf->algorithm_name );
key.set_repository( k->module->name );
if (!OrmMessageUpdate(context)) {
// This is an unexpected error !
ods_log_error_and_printf(sockfd, module_str,
"database record retrieval failed");
} else {
ods_printf(sockfd,
"%-7s %-10s %-7ld %-40s\n",
"update",
kinf->algorithm_name,
kinf->keysize,
kinf->id
);
}
}
// release the context, we don't need it anymore.
context.release();
}
} else {
// release query result, we don't need it anymore.
result.release();
// key does not exist
::ods::hsmkey::HsmKey key;
key.set_locator(kinf->id);
key.set_bits(kinf->keysize);
key.set_key_type( kinf->algorithm_name );
key.set_repository( k->module->name );
// verify that according to the proto file definition the key is
// fully initialized.
if(!key.IsInitialized()) {
// free allocated resources
hsm_key_info_free(kinf);
ods_log_error_and_printf(sockfd, module_str,
"new HsmKey missing required fields");
break;
}
pb::uint64 keyid;
if (!OrmMessageInsert(conn, key, keyid)) {
// free allocated resources
hsm_key_info_free(kinf);
// This is an unexpected error !
ods_log_error_and_printf(sockfd, module_str,
"database record insertion failed");
break;
} else {
// Key was inserted successfully
ods_printf(sockfd,
"%-7s %-10s %-7ld %-40s\n",
"import",
kinf->algorithm_name,
kinf->keysize,
kinf->id
);
}
}
hsm_key_info_free(kinf);
}
hsm_key_list_free(kl,nkeys);
hsm_destroy_context(hsm_ctx);
}
static bool
retract_dnskey_by_id(int sockfd,
const char *ds_retract_command,
const char *id,
::ods::keystate::keyrole role,
const char *zone,
int algorithm)
{
/* Code to output the DNSKEY record (stolen from hsmutil) */
hsm_ctx_t *hsm_ctx = hsm_create_context();
if (!hsm_ctx) {
ods_log_error_and_printf(sockfd,
module_str,
"could not connect to HSM");
return false;
}
hsm_key_t *key = hsm_find_key_by_id(hsm_ctx, id);
if (!key) {
ods_log_error_and_printf(sockfd,
module_str,
"key %s not found in any HSM",
id);
hsm_destroy_context(hsm_ctx);
return false;
}
bool bOK = false;
char *dnskey_rr_str;
hsm_sign_params_t *sign_params = hsm_sign_params_new();
sign_params->owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, zone);
sign_params->algorithm = (ldns_algorithm)algorithm;
sign_params->flags = LDNS_KEY_ZONE_KEY;
sign_params->flags += LDNS_KEY_SEP_KEY; /*KSK=>SEP*/
ldns_rr *dnskey_rr = hsm_get_dnskey(hsm_ctx, key, sign_params);
#if 0
ldns_rr_print(stdout, dnskey_rr);
#endif
dnskey_rr_str = ldns_rr2str(dnskey_rr);
hsm_sign_params_free(sign_params);
ldns_rr_free(dnskey_rr);
hsm_key_free(key);
/* Replace tab with white-space */
for (int i = 0; dnskey_rr_str[i]; ++i) {
if (dnskey_rr_str[i] == '\t') {
dnskey_rr_str[i] = ' ';
}
}
/* We need to strip off trailing comments before we send
to any clients that might be listening */
for (int i = 0; dnskey_rr_str[i]; ++i) {
if (dnskey_rr_str[i] == ';') {
dnskey_rr_str[i] = '\n';
dnskey_rr_str[i+1] = '\0';
break;
}
}
// pass the dnskey rr string to a configured
// delegation signer retract program.
if (ds_retract_command && ds_retract_command[0] != '\0') {
/* send records to the configured command */
FILE *fp = popen(ds_retract_command, "w");
if (fp == NULL) {
ods_log_error_and_printf(sockfd,
module_str,
"failed to run command: %s: %s",
ds_retract_command,
strerror(errno));
} else {
int bytes_written = fprintf(fp, "%s", dnskey_rr_str);
if (bytes_written < 0) {
ods_log_error_and_printf(sockfd,
module_str,
"[%s] Failed to write to %s: %s",
ds_retract_command,
strerror(errno));
} else {
if (pclose(fp) == -1) {
ods_log_error_and_printf(sockfd,
module_str,
"failed to close %s: %s",
ds_retract_command,
strerror(errno));
} else {
bOK = true;
ods_printf(sockfd,
"key %s retracted by %s\n",
id,
ds_retract_command);
}
}
}
} else {
ods_log_error_and_printf(sockfd,
module_str,
"no \"DelegationSignerRetractCommand\" binary "
"configured in conf.xml.");
}
LDNS_FREE(dnskey_rr_str);
hsm_destroy_context(hsm_ctx);
return bOK;
}
static bool
retract_dnskey_by_id(int sockfd,
const char *ds_retract_command,
const char *id,
::ods::keystate::keyrole role,
const char *zone,
int algorithm,
bool force)
{
struct stat stat_ret;
/* Code to output the DNSKEY record (stolen from hsmutil) */
hsm_ctx_t *hsm_ctx = hsm_create_context();
if (!hsm_ctx) {
ods_log_error_and_printf(sockfd,
module_str,
"could not connect to HSM");
return false;
}
hsm_key_t *key = hsm_find_key_by_id(hsm_ctx, id);
if (!key) {
ods_log_error_and_printf(sockfd,
module_str,
"key %s not found in any HSM",
id);
hsm_destroy_context(hsm_ctx);
return false;
}
bool bOK = false;
char *dnskey_rr_str;
hsm_sign_params_t *sign_params = hsm_sign_params_new();
sign_params->owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, zone);
sign_params->algorithm = (ldns_algorithm)algorithm;
sign_params->flags = LDNS_KEY_ZONE_KEY;
sign_params->flags += LDNS_KEY_SEP_KEY; /*KSK=>SEP*/
ldns_rr *dnskey_rr = hsm_get_dnskey(hsm_ctx, key, sign_params);
#if 0
ldns_rr_print(stdout, dnskey_rr);
#endif
dnskey_rr_str = ldns_rr2str(dnskey_rr);
hsm_sign_params_free(sign_params);
ldns_rr_free(dnskey_rr);
hsm_key_free(key);
/* Replace tab with white-space */
for (int i = 0; dnskey_rr_str[i]; ++i) {
if (dnskey_rr_str[i] == '\t') {
dnskey_rr_str[i] = ' ';
}
}
/* We need to strip off trailing comments before we send
to any clients that might be listening */
for (int i = 0; dnskey_rr_str[i]; ++i) {
if (dnskey_rr_str[i] == ';') {
dnskey_rr_str[i] = '\n';
dnskey_rr_str[i+1] = '\0';
break;
}
}
// pass the dnskey rr string to a configured
// delegation signer retract program.
if (!ds_retract_command || ds_retract_command[0] == '\0') {
if (!force) {
ods_log_error_and_printf(sockfd, module_str,
"No \"DelegationSignerRetractCommand\" "
"configured. No state changes made. "
"Use --force to override.");
bOK = false;
}
/* else: Do nothing, return keytag. */
} else if (stat(ds_retract_command, &stat_ret) != 0) {
/* First check that the command exists */
ods_log_error_and_printf(sockfd, module_str,
"Cannot stat file %s: %s", ds_retract_command,
strerror(errno));
} else if (S_ISREG(stat_ret.st_mode) &&
!(stat_ret.st_mode & S_IXUSR ||
stat_ret.st_mode & S_IXGRP ||
stat_ret.st_mode & S_IXOTH)) {
/* Then see if it is a regular file, then if usr, grp or
* all have execute set */
ods_log_error_and_printf(sockfd, module_str,
"File %s is not executable", ds_retract_command);
} else {
/* send records to the configured command */
FILE *fp = popen(ds_retract_command, "w");
if (fp == NULL) {
ods_log_error_and_printf(sockfd, module_str,
"failed to run command: %s: %s", ds_retract_command,
strerror(errno));
} else {
int bytes_written = fprintf(fp, "%s", dnskey_rr_str);
if (bytes_written < 0) {
ods_log_error_and_printf(sockfd, module_str,
"[%s] Failed to write to %s: %s", ds_retract_command,
strerror(errno));
} else if (pclose(fp) == -1) {
ods_log_error_and_printf(sockfd, module_str,
"failed to close %s: %s", ds_retract_command,
strerror(errno));
} else {
bOK = true;
ods_printf(sockfd, "key %s retracted by %s\n", id,
ds_retract_command);
}
}
}
LDNS_FREE(dnskey_rr_str);
hsm_destroy_context(hsm_ctx);
return bOK;
}
void
perform_zone_del(int sockfd, engineconfig_type *config, const char *zone, int need_write_xml, bool quiet)
{
GOOGLE_PROTOBUF_VERIFY_VERSION;
OrmConnRef conn;
if (!ods_orm_connect(sockfd, config, conn))
return; // error already reported.
std::string qzone;
bool is_del_succeed = false;
if (strlen(zone) > 0) {
if (!OrmQuoteStringValue(conn, std::string(zone), qzone)) {
const char *emsg = "quoting zone value failed";
ods_log_error_and_printf(sockfd,module_str,emsg);
return;
}
}
{ OrmTransactionRW transaction(conn);
if (!transaction.started()) {
const char *emsg = "could not start database transaction";
ods_log_error_and_printf(sockfd,module_str,emsg);
return;
}
if (qzone.empty()) {
OrmResultRef rows;
::ods::keystate::EnforcerZone enfzone;
std::vector<std::string> del_zones;
bool ok = OrmMessageEnum(conn, enfzone.descriptor(), rows);
if (!ok) {
transaction.rollback();
ods_log_error("[%s] enum enforcer zone failed", module_str);
return;
}
for (bool next=OrmFirst(rows); next; next = OrmNext(rows)) {
OrmContextRef context;
if (!OrmGetMessage(rows, enfzone, true, context)) {
rows.release();
transaction.rollback();
ods_log_error("[%s] retrieving zone from database failed");
return;
}
del_zones.push_back(enfzone.name());
}
rows.release();
for (std::vector<std::string>::iterator it = del_zones.begin();
it != del_zones.end(); ++it) {
std::string del_zone;
if (!OrmQuoteStringValue(conn, std::string(*it), del_zone)) {
transaction.rollback();
const char *emsg = "quoting zone value failed";
ods_log_error_and_printf(sockfd,module_str,emsg);
return;
}
if (!OrmMessageDeleteWhere(conn,
::ods::keystate::EnforcerZone::descriptor(),
"name = %s",
del_zone.c_str())) {
transaction.rollback();
const char *emsg = "unable to delete zone %s";
ods_log_error_and_printf(sockfd,module_str,emsg, it->c_str());
return;
}
is_del_succeed = true;
}
}
else {
//find the zone
OrmResultRef rows;
if (!OrmMessageEnumWhere(conn,
::ods::keystate::EnforcerZone::descriptor(),
rows,
"name = %s",
qzone.c_str())) {
transaction.rollback();
ods_log_error_and_printf(sockfd, module_str,
"unable to find zone %s", qzone.c_str());
return;
}
if (!OrmFirst(rows)) {
rows.release();
transaction.rollback();
ods_log_error_and_printf(sockfd, module_str,
"Couldn't find zone %s", qzone.c_str());
return;
}
rows.release();
if (!OrmMessageDeleteWhere(conn,
::ods::keystate::EnforcerZone::descriptor(),
"name = %s",
qzone.c_str()))
{
transaction.rollback();
const char *emsg = "unable to delete zone %s";
ods_log_error_and_printf(sockfd,module_str,emsg,qzone.c_str());
return;
}
is_del_succeed = true;
}
if (!transaction.commit()) {
const char *emsg = "committing delete of zone %s to database failed";
ods_log_error_and_printf(sockfd,module_str,emsg,qzone.c_str());
return;
}
}
// Now lets write out the required files - the internal list and optionally the zonelist.xml
// Note at the moment we re-export the whole file in zonelist.xml format here but this should be optimised....
if (is_del_succeed) {
if (!perform_write_signzone_file(sockfd, config)) {
ods_log_error_and_printf(sockfd, module_str,
"failed to write internal zonelist");
}
if (need_write_xml) {
if (!perform_zonelist_export_to_file(config->zonelist_filename,config)) {
ods_log_error_and_printf(sockfd, module_str,
"failed to write zonelist.xml");
}
if (!quiet) {
if (qzone.empty()) {
ods_printf(sockfd, "Deleted all zones in database and zonelist.xml updated.\n");
} else {
ods_printf(sockfd, "Deleted zone: %s in database and zonelist.xml updated.\n", zone);
}
}
} else if (!quiet) {
if (qzone.empty()) {
ods_printf(sockfd, "Deleted all zones in database only. Use the --xml flag or run \"ods-enforcer zonelist export\" if an update of zonelist.xml is required.\n", zone);
} else {
ods_printf(sockfd, "Deleted zone: %s in database only. Use the --xml flag or run \"ods-enforcer zonelist export\" if an update of zonelist.xml is required.\n", zone);
}
}
}
}
void
perform_update_kasp(int sockfd, engineconfig_type *config)
{
GOOGLE_PROTOBUF_VERIFY_VERSION;
std::auto_ptr< ::ods::kasp::KaspDocument > kaspDoc;
if (!load_kasp_xml(sockfd, config->policy_filename, kaspDoc))
return; // errors have already been reported.
OrmConnRef conn;
if (!ods_orm_connect(sockfd, config, conn))
return; // errors have already been reported.
//TODO: SPEED: We should create an index on the Policy.name column
// Go through the list of policies from the kasp.xml file to determine
// if we need to insert new policies to the policies table.
for (int i=0; i<kaspDoc->kasp().policies_size(); ++i) {
const ::ods::kasp::Policy &policy = kaspDoc->kasp().policies(i);
{ OrmTransactionRW transaction(conn);
if (!transaction.started()) {
ods_log_error_and_printf(sockfd, module_str,
"starting a database transaction for "
"updating a policy failed");
return;
}
std::string qpolicy;
if (!OrmQuoteStringValue(conn, policy.name(), qpolicy)) {
ods_log_error_and_printf(sockfd, module_str,
"quoting a string failed");
return;
}
// delete the existing policy from the database
if (!OrmMessageDeleteWhere(conn, policy.descriptor(),
"name=%s",qpolicy.c_str())) {
ods_log_error_and_printf(sockfd, module_str,
"failed to delete policy with "
"name %s",policy.name().c_str());
return;
}
// insert the policy we read from the kasp.xml file.
pb::uint64 policyid;
if (!OrmMessageInsert(conn, policy, policyid)) {
ods_log_error_and_printf(sockfd, module_str,
"inserting policy into the database failed");
return;
}
// commit the update policy to the database.
if (!transaction.commit()) {
ods_log_error_and_printf(sockfd, module_str,
"committing policy to the database failed");
return;
}
}
}
}
