rpms/opendnssec
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Updated to 1.4.0rc1

Browse Source 
Applied opendnssec-ksk-premature-retirement.patch (svn r6952)
This commit is contained in:
Patrick Uiterwijk 2013-01-18 19:29:12 +01:00
parent 0dc36cc664
commit ebc1d51293
10 changed files with 30 additions and 178 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -2,3 +2,4 @@
/opendnssec-1.4.0a2.tar.gz
/opendnssec-1.4.0b1.tar.gz
/opendnssec-1.4.0b2.tar.gz
/opendnssec-1.4.0rc1.tar.gz

31
opendnssec-1.4.0-ksmutil.patch
View File

@ -1,31 +0,0 @@
diff -Naur opendnssec-1.4.0a2-orig/enforcer/utils/ksmutil.c opendnssec-1.4.0a2/enforcer/utils/ksmutil.c
--- opendnssec-1.4.0a2-orig/enforcer/utils/ksmutil.c 2012-05-24 12:38:04.000000000 -0400
+++ opendnssec-1.4.0a2/enforcer/utils/ksmutil.c 2012-06-12 16:01:32.090442282 -0400
@@ -4063,6 +4063,7 @@
{
struct flock fl;
struct timeval tv;
+ int retry = 0;
if (lock_fd == NULL) {
printf("%s could not be opened\n", lock_filename);
@@ -4075,6 +4076,10 @@
fl.l_pid = getpid();
while (fcntl(fileno(lock_fd), F_SETLK, &fl) == -1) {
+ if (retry >= 3) {
+ printf("couldn't get lock on %s; %s\n", lock_filename, strerror(errno));
+ return 1;
+ }
if (errno == EACCES || errno == EAGAIN) {
printf("%s already locked, sleep\n", lock_filename);
@@ -4083,6 +4088,8 @@
tv.tv_usec = 0;
select(0, NULL, NULL, NULL, &tv);
+ retry++;
+
} else {
printf("couldn't get lock on %s; %s\n", lock_filename, strerror(errno));
return 1;

12
opendnssec-1.4.0a1-deleterr.patch
View File

@ -1,12 +0,0 @@
diff -Naur opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c opendnssec-1.4.0a1/signer/src/signer/namedb.c
--- opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c 2012-03-15 13:25:45.000000000 -0400
+++ opendnssec-1.4.0a1/signer/src/signer/namedb.c 2012-05-16 11:32:52.123793809 -0400
@@ -834,7 +834,7 @@
if (!denial || !db || !db->denials) {
return NULL;
}
- if (denial->rrset->rr_count) {
+ if (denial->rrset && denial->rrset->rr_count) {
ods_log_error("[%s] unable to delete denial: denial in use [#%u]",
db_str, denial->rrset->rr_count);
log_dname(denial->dname, "ERR -DENIAL", LOG_ERR);

15
opendnssec-1.4.0a3-aggressive-retry.patch
View File

@ -1,15 +0,0 @@
diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c
--- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c 2012-08-02 16:57:01.000000000 -0400
+++ opendnssec-1.4.0a3/signer/src/daemon/worker.c 2012-08-20 15:41:34.665175565 -0400
@@ -173,7 +173,11 @@
* lets take a small break to not hog CPU.
*/
if (status == ODS_STATUS_UNCHANGED) {
+#if 0
worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60);
+#else
+ worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5);
+#endif
}
lock_basic_unlock(&q->q_lock);
}

68
opendnssec-1.4.0a3-cpu.patch
View File

@ -1,68 +0,0 @@
Modified: trunk/OpenDNSSEC/signer/src/signer/namedb.c
===================================================================
- --- trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 09:36:35
UTC (rev 6514)
+++ trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 14:19:56
UTC (rev 6515)
@@ -215,9 +215,11 @@
} else if (ods_strcmp(format, "datecounter") == 0) {
soa = (uint32_t) time_datestamp(0, "%Y%m%d", NULL) * 100;
if (!util_serial_gt(soa, prev)) {
- - ods_log_warning("[%s] unable to use datecounter as serial: %u "
- - "does not increase %u. Serial set to %u", db_str, soa, prev,
- - (prev+1));
+ if (!db->is_initialized) {
+ ods_log_warning("[%s] unable to use datecounter as serial: %u "
+ "does not increase %u. Serial set to %u", db_str, soa, prev,
+ (prev+1));
+ }
soa = prev + 1;
}
} else if (ods_strcmp(format, "counter") == 0) {
Modified: trunk/OpenDNSSEC/signer/src/signer/tools.c
===================================================================
- --- trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 09:36:35 UTC
(rev 6514)
+++ trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 14:19:56 UTC
(rev 6515)
@@ -39,6 +39,7 @@
#include "signer/tools.h"
#include "signer/zone.h"
+#include <errno.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
@@ -213,7 +214,7 @@
/* kick the nameserver */
if (zone->notify_ns) {
int status;
- - pid_t pid;
+ pid_t pid, wpid;
ods_log_verbose("[%s] notify nameserver: %s", tools_str,
zone->notify_ns);
/** fork */
@@ -236,9 +237,20 @@
ods_log_debug("[%s] notify nameserver process forked",
tools_str);
/** wait for completion */
- - while (wait(&status) != pid) {
- - ;
+ while((wpid = waitpid(pid, &status, 0)) <= 0) {
+ if (errno != EINTR) {
+ break;
+ }
}
+ if (wpid == -1) {
+ ods_log_error("[%s] notify nameserver failed: waitpid() ",
+ "failed (%s)", tools_str, strerror(errno));
+ } else if (!WIFEXITED(status)) {
+ ods_log_error("[%s] notify nameserver failed: notify ",
+ "command did not terminate normally", tools_str);
+ } else {
+ ods_log_verbose("[%s] notify nameserver ok", tools_str);
+ }
break;
}
}

12
opendnssec-1.4.0a3-nsec3param.patch
View File

@ -1,12 +0,0 @@
diff -Naur opendnssec-1.4.0a3-orig/signer/src/signer/zone.c opendnssec-1.4.0a3/signer/src/signer/zone.c
--- opendnssec-1.4.0a3-orig/signer/src/signer/zone.c 2012-08-06 06:52:03.000000000 -0400
+++ opendnssec-1.4.0a3/signer/src/signer/zone.c 2012-09-12 17:00:01.813426466 -0400
@@ -355,7 +355,7 @@
return ODS_STATUS_MALLOC_ERR;
}
ldns_rr_set_class(rr, zone->klass);
- ldns_rr_set_ttl(rr, zone->default_ttl);
+ ldns_rr_set_ttl(rr, 0); /* special case */
ldns_rr_set_owner(rr, ldns_rdf_clone(zone->apex));
ldns_nsec3_add_param_rdfs(rr,
zone->signconf->nsec3params->algorithm, 0,

37
opendnssec-1.4.0b1-occluded.patch
View File

@ -1,37 +0,0 @@
diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c
--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-07-24 03:36:12.000000000 -0400
+++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-10-30 12:03:00.972027099 -0400
@@ -533,32 +533,13 @@
while (rrset) {
/* skip SOA RRset */
if (rrset->rrtype != LDNS_RR_TYPE_SOA) {
- dstatus = domain_is_occluded(domain);
- if (dstatus == LDNS_RR_TYPE_A) {
- /* Glue */
- if (rrset->rrtype == LDNS_RR_TYPE_A ||
- rrset->rrtype == LDNS_RR_TYPE_AAAA) {
- rrset_print(fd, rrset, 0, status);
- }
- } else if (dstatus == LDNS_RR_TYPE_SOA) {
- /* Authoritative or delegation */
- dstatus = domain_is_delegpt(domain);
- if (dstatus == LDNS_RR_TYPE_SOA ||
- rrset->rrtype == LDNS_RR_TYPE_A ||
- rrset->rrtype == LDNS_RR_TYPE_AAAA ||
- rrset->rrtype == LDNS_RR_TYPE_NS ||
- rrset->rrtype == LDNS_RR_TYPE_DS) {
- rrset_print(fd, rrset, 0, status);
- }
- }
- /* Occluded */
+ rrset_print(fd, rrset, 0, status);
}
if (status && *status != ODS_STATUS_OK) {
ods_log_crit("[%s] failed to print one or more RRsets: %s",
dname_str, ods_status2str(*status));
return;
}
-
rrset = rrset->next;
}
}

20
opendnssec-ksk-premature-retirement.patch Normal file
View File

@ -0,0 +1,20 @@
--- enforcer/enforcerd/enforcer.c (revision 6951)
+++ enforcer/enforcerd/enforcer.c (revision 6952)
@@ -1291,7 +1291,7 @@
/* turn this zone and policy into a file */
#ifdef ENFORCER_USE_WORKERS
{
- int NewDS;
+ int NewDS = 0;
status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
if (status2 == 0) {
/* If the DS set changed then log/do something about it */
--- NEWS (revision 6951)
+++ NEWS (revision 6952)
@@ -1,5 +1,7 @@
$Id: NEWS 6934 2013-01-10 14:32:16Z jerry $
+* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired.
+
OpenDNSSEC 1.4.0rc1 - 2013-01-10

10
opendnssec.spec
View File

@ -1,8 +1,8 @@
%global prever b2
%global prever rc1
Summary: DNSSEC key and zone management software
Name: opendnssec
Version: 1.4.0
Release: 0.5.%{?prever}%{?dist}
Release: 0.6.%{?prever}%{?dist}
License: BSD
Url: http://www.opendnssec.org/
Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
@ -12,6 +12,7 @@ Source3: ods.sysconfig
Source4: conf.xml
Source5: tmpfiles-opendnssec.conf
Source6: opendnssec.cron
Patch: opendnssec-ksk-premature-retirement.patch
Group: Applications/System
Requires: opencryptoki, softhsm, systemd-units
BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel
@ -35,6 +36,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
%prep
%setup -q -n %{name}-%{version}%{?prever}
%patch
%build
%configure --with-ldns=%{_libdir}
@ -111,6 +113,10 @@ fi
%systemd_postun_with_restart ods-signerd.service
%changelog
* Fri Jan 18 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.6.rc1
- Updated to 1.4.0rc1
- Applied opendnssec-ksk-premature-retirement.patch (svn r6952)
* Tue Dec 18 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.5.b2
- Updated to 1.4.0b2
- All patches have been merged upstream

2
sources
View File

@ -1 +1 @@
17fd1b721fb568817be6866a82b19991 opendnssec-1.4.0b2.tar.gz
bfd92b2830e1723acc90f20e575cf8cb opendnssec-1.4.0rc1.tar.gz