diff --git a/.gitignore b/.gitignore index e51367d..0cd90c9 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /opendnssec-1.4.0a2.tar.gz /opendnssec-1.4.0b1.tar.gz /opendnssec-1.4.0b2.tar.gz +/opendnssec-1.4.0rc1.tar.gz diff --git a/opendnssec-1.4.0-ksmutil.patch b/opendnssec-1.4.0-ksmutil.patch deleted file mode 100644 index 592aa3e..0000000 --- a/opendnssec-1.4.0-ksmutil.patch +++ /dev/null @@ -1,31 +0,0 @@ -diff -Naur opendnssec-1.4.0a2-orig/enforcer/utils/ksmutil.c opendnssec-1.4.0a2/enforcer/utils/ksmutil.c ---- opendnssec-1.4.0a2-orig/enforcer/utils/ksmutil.c 2012-05-24 12:38:04.000000000 -0400 -+++ opendnssec-1.4.0a2/enforcer/utils/ksmutil.c 2012-06-12 16:01:32.090442282 -0400 -@@ -4063,6 +4063,7 @@ - { - struct flock fl; - struct timeval tv; -+ int retry = 0; - - if (lock_fd == NULL) { - printf("%s could not be opened\n", lock_filename); -@@ -4075,6 +4076,10 @@ - fl.l_pid = getpid(); - - while (fcntl(fileno(lock_fd), F_SETLK, &fl) == -1) { -+ if (retry >= 3) { -+ printf("couldn't get lock on %s; %s\n", lock_filename, strerror(errno)); -+ return 1; -+ } - if (errno == EACCES || errno == EAGAIN) { - printf("%s already locked, sleep\n", lock_filename); - -@@ -4083,6 +4088,8 @@ - tv.tv_usec = 0; - select(0, NULL, NULL, NULL, &tv); - -+ retry++; -+ - } else { - printf("couldn't get lock on %s; %s\n", lock_filename, strerror(errno)); - return 1; diff --git a/opendnssec-1.4.0a1-deleterr.patch b/opendnssec-1.4.0a1-deleterr.patch deleted file mode 100644 index 1f39ec5..0000000 --- a/opendnssec-1.4.0a1-deleterr.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c opendnssec-1.4.0a1/signer/src/signer/namedb.c ---- opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c 2012-03-15 13:25:45.000000000 -0400 -+++ opendnssec-1.4.0a1/signer/src/signer/namedb.c 2012-05-16 11:32:52.123793809 -0400 -@@ -834,7 +834,7 @@ - if (!denial || !db || !db->denials) { - return NULL; - } -- if (denial->rrset->rr_count) { -+ if (denial->rrset && denial->rrset->rr_count) { - ods_log_error("[%s] unable to delete denial: denial in use [#%u]", - db_str, denial->rrset->rr_count); - log_dname(denial->dname, "ERR -DENIAL", LOG_ERR); diff --git a/opendnssec-1.4.0a3-aggressive-retry.patch b/opendnssec-1.4.0a3-aggressive-retry.patch deleted file mode 100644 index b45a2fc..0000000 --- a/opendnssec-1.4.0a3-aggressive-retry.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c ---- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c 2012-08-02 16:57:01.000000000 -0400 -+++ opendnssec-1.4.0a3/signer/src/daemon/worker.c 2012-08-20 15:41:34.665175565 -0400 -@@ -173,7 +173,11 @@ - * lets take a small break to not hog CPU. - */ - if (status == ODS_STATUS_UNCHANGED) { -+#if 0 - worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60); -+#else -+ worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5); -+#endif - } - lock_basic_unlock(&q->q_lock); - } diff --git a/opendnssec-1.4.0a3-cpu.patch b/opendnssec-1.4.0a3-cpu.patch deleted file mode 100644 index f9d89f7..0000000 --- a/opendnssec-1.4.0a3-cpu.patch +++ /dev/null @@ -1,68 +0,0 @@ -Modified: trunk/OpenDNSSEC/signer/src/signer/namedb.c -=================================================================== -- --- trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 09:36:35 -UTC (rev 6514) -+++ trunk/OpenDNSSEC/signer/src/signer/namedb.c 2012-08-09 14:19:56 -UTC (rev 6515) -@@ -215,9 +215,11 @@ - } else if (ods_strcmp(format, "datecounter") == 0) { - soa = (uint32_t) time_datestamp(0, "%Y%m%d", NULL) * 100; - if (!util_serial_gt(soa, prev)) { -- - ods_log_warning("[%s] unable to use datecounter as serial: %u " -- - "does not increase %u. Serial set to %u", db_str, soa, prev, -- - (prev+1)); -+ if (!db->is_initialized) { -+ ods_log_warning("[%s] unable to use datecounter as serial: %u " -+ "does not increase %u. Serial set to %u", db_str, soa, prev, -+ (prev+1)); -+ } - soa = prev + 1; - } - } else if (ods_strcmp(format, "counter") == 0) { - -Modified: trunk/OpenDNSSEC/signer/src/signer/tools.c -=================================================================== -- --- trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 09:36:35 UTC -(rev 6514) -+++ trunk/OpenDNSSEC/signer/src/signer/tools.c 2012-08-09 14:19:56 UTC -(rev 6515) -@@ -39,6 +39,7 @@ - #include "signer/tools.h" - #include "signer/zone.h" - -+#include - #include - #include - #include -@@ -213,7 +214,7 @@ - /* kick the nameserver */ - if (zone->notify_ns) { - int status; -- - pid_t pid; -+ pid_t pid, wpid; - ods_log_verbose("[%s] notify nameserver: %s", tools_str, - zone->notify_ns); - /** fork */ -@@ -236,9 +237,20 @@ - ods_log_debug("[%s] notify nameserver process forked", - tools_str); - /** wait for completion */ -- - while (wait(&status) != pid) { -- - ; -+ while((wpid = waitpid(pid, &status, 0)) <= 0) { -+ if (errno != EINTR) { -+ break; -+ } - } -+ if (wpid == -1) { -+ ods_log_error("[%s] notify nameserver failed: waitpid() ", -+ "failed (%s)", tools_str, strerror(errno)); -+ } else if (!WIFEXITED(status)) { -+ ods_log_error("[%s] notify nameserver failed: notify ", -+ "command did not terminate normally", tools_str); -+ } else { -+ ods_log_verbose("[%s] notify nameserver ok", tools_str); -+ } - break; - } - } diff --git a/opendnssec-1.4.0a3-nsec3param.patch b/opendnssec-1.4.0a3-nsec3param.patch deleted file mode 100644 index 7dd9130..0000000 --- a/opendnssec-1.4.0a3-nsec3param.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur opendnssec-1.4.0a3-orig/signer/src/signer/zone.c opendnssec-1.4.0a3/signer/src/signer/zone.c ---- opendnssec-1.4.0a3-orig/signer/src/signer/zone.c 2012-08-06 06:52:03.000000000 -0400 -+++ opendnssec-1.4.0a3/signer/src/signer/zone.c 2012-09-12 17:00:01.813426466 -0400 -@@ -355,7 +355,7 @@ - return ODS_STATUS_MALLOC_ERR; - } - ldns_rr_set_class(rr, zone->klass); -- ldns_rr_set_ttl(rr, zone->default_ttl); -+ ldns_rr_set_ttl(rr, 0); /* special case */ - ldns_rr_set_owner(rr, ldns_rdf_clone(zone->apex)); - ldns_nsec3_add_param_rdfs(rr, - zone->signconf->nsec3params->algorithm, 0, diff --git a/opendnssec-1.4.0b1-occluded.patch b/opendnssec-1.4.0b1-occluded.patch deleted file mode 100644 index b49a42f..0000000 --- a/opendnssec-1.4.0b1-occluded.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c ---- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-07-24 03:36:12.000000000 -0400 -+++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-10-30 12:03:00.972027099 -0400 -@@ -533,32 +533,13 @@ - while (rrset) { - /* skip SOA RRset */ - if (rrset->rrtype != LDNS_RR_TYPE_SOA) { -- dstatus = domain_is_occluded(domain); -- if (dstatus == LDNS_RR_TYPE_A) { -- /* Glue */ -- if (rrset->rrtype == LDNS_RR_TYPE_A || -- rrset->rrtype == LDNS_RR_TYPE_AAAA) { -- rrset_print(fd, rrset, 0, status); -- } -- } else if (dstatus == LDNS_RR_TYPE_SOA) { -- /* Authoritative or delegation */ -- dstatus = domain_is_delegpt(domain); -- if (dstatus == LDNS_RR_TYPE_SOA || -- rrset->rrtype == LDNS_RR_TYPE_A || -- rrset->rrtype == LDNS_RR_TYPE_AAAA || -- rrset->rrtype == LDNS_RR_TYPE_NS || -- rrset->rrtype == LDNS_RR_TYPE_DS) { -- rrset_print(fd, rrset, 0, status); -- } -- } -- /* Occluded */ -+ rrset_print(fd, rrset, 0, status); - } - if (status && *status != ODS_STATUS_OK) { - ods_log_crit("[%s] failed to print one or more RRsets: %s", - dname_str, ods_status2str(*status)); - return; - } -- - rrset = rrset->next; - } - } diff --git a/opendnssec-ksk-premature-retirement.patch b/opendnssec-ksk-premature-retirement.patch new file mode 100644 index 0000000..0b59af8 --- /dev/null +++ b/opendnssec-ksk-premature-retirement.patch @@ -0,0 +1,20 @@ +--- enforcer/enforcerd/enforcer.c (revision 6951) ++++ enforcer/enforcerd/enforcer.c (revision 6952) +@@ -1291,7 +1291,7 @@ + /* turn this zone and policy into a file */ + #ifdef ENFORCER_USE_WORKERS + { +- int NewDS; ++ int NewDS = 0; + status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS); + if (status2 == 0) { + /* If the DS set changed then log/do something about it */ +--- NEWS (revision 6951) ++++ NEWS (revision 6952) +@@ -1,5 +1,7 @@ + $Id: NEWS 6934 2013-01-10 14:32:16Z jerry $ + ++* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired. ++ + + OpenDNSSEC 1.4.0rc1 - 2013-01-10 diff --git a/opendnssec.spec b/opendnssec.spec index bd92ca2..b503425 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,8 +1,8 @@ -%global prever b2 +%global prever rc1 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 -Release: 0.5.%{?prever}%{?dist} +Release: 0.6.%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -12,6 +12,7 @@ Source3: ods.sysconfig Source4: conf.xml Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron +Patch: opendnssec-ksk-premature-retirement.patch Group: Applications/System Requires: opencryptoki, softhsm, systemd-units BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel @@ -35,6 +36,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} +%patch %build %configure --with-ldns=%{_libdir} @@ -111,6 +113,10 @@ fi %systemd_postun_with_restart ods-signerd.service %changelog +* Fri Jan 18 2013 Patrick Uiterwijk - 1.4.0-0.6.rc1 +- Updated to 1.4.0rc1 +- Applied opendnssec-ksk-premature-retirement.patch (svn r6952) + * Tue Dec 18 2012 Paul Wouters - 1.4.0-0.5.b2 - Updated to 1.4.0b2 - All patches have been merged upstream diff --git a/sources b/sources index b7e3f52..b2f5549 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -17fd1b721fb568817be6866a82b19991 opendnssec-1.4.0b2.tar.gz +bfd92b2830e1723acc90f20e575cf8cb opendnssec-1.4.0rc1.tar.gz