From 69340b5ac58d95ab767f2f40bcd73c9b2d6bf2f7 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 3 May 2018 16:43:15 +1000 Subject: [PATCH] add support -T sigvalinsecs (cherry picked from commit 87a3dc8ab930ce4b3f338905903ffa08e4113159) --- bin/named/main.c | 5 ++++ bin/named/zoneconf.c | 41 ++++++++++++++++------------- lib/dns/zone.c | 54 +++++++++++++++++++++++++++++--------- lib/ns/include/ns/server.h | 1 + 4 files changed, 71 insertions(+), 30 deletions(-) diff --git a/bin/named/main.c b/bin/named/main.c index 57bddc2d4e..70322aef99 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -131,6 +131,7 @@ static unsigned int delay = 0; static isc_boolean_t nonearest = ISC_FALSE; static isc_boolean_t notcp = ISC_FALSE; static isc_boolean_t fixedlocal = ISC_FALSE; +static isc_boolean_t sigvalinsecs = ISC_FALSE; /* * -4 and -6 @@ -543,6 +544,8 @@ parse_T_opt(char *option) { if (dns_zone_mkey_month < dns_zone_mkey_day) { named_main_earlyfatal("bad mkeytimer"); } + } else if (!strcmp(option, "sigvalinsecs")) { + sigvalinsecs = ISC_TRUE; } else if (!strncmp(option, "tat=", 4)) { named_g_tat_interval = atoi(option + 4); } else { @@ -1215,6 +1218,8 @@ setup(void) { ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE); if (disable6) ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE); + if (sigvalinsecs) + ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE); named_g_server->sctx->delay = delay; diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 0002b933e3..ed225c82fc 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -1429,31 +1429,36 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, } if (ztype == dns_zone_master || raw != NULL) { + const cfg_obj_t *validity, *resign; isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE; + isc_boolean_t sigvalinsecs; obj = NULL; result = named_config_get(maps, "sig-validity-interval", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); - { - const cfg_obj_t *validity, *resign; - validity = cfg_tuple_get(obj, "validity"); - seconds = cfg_obj_asuint32(validity) * 86400; - dns_zone_setsigvalidityinterval(zone, seconds); - - resign = cfg_tuple_get(obj, "re-sign"); - if (cfg_obj_isvoid(resign)) { - seconds /= 4; - } else { - if (seconds > 7 * 86400) - seconds = cfg_obj_asuint32(resign) * - 86400; - else - seconds = cfg_obj_asuint32(resign) * - 3600; - } - dns_zone_setsigresigninginterval(zone, seconds); + sigvalinsecs = ns_server_getoption(named_g_server->sctx, + NS_SERVER_SIGVALINSECS); + validity = cfg_tuple_get(obj, "validity"); + seconds = cfg_obj_asuint32(validity); + if (!sigvalinsecs) { + seconds *= 86400; } + dns_zone_setsigvalidityinterval(zone, seconds); + + resign = cfg_tuple_get(obj, "re-sign"); + if (cfg_obj_isvoid(resign)) { + seconds /= 4; + } else if (!sigvalinsecs) { + if (seconds > 7 * 86400) { + seconds = cfg_obj_asuint32(resign) * 86400; + } else { + seconds = cfg_obj_asuint32(resign) * 3600; + } + } else { + seconds = cfg_obj_asuint32(resign); + } + dns_zone_setsigresigninginterval(zone, seconds); obj = NULL; result = named_config_get(maps, "key-directory", &obj); diff --git a/lib/dns/zone.c b/lib/dns/zone.c index c6172485d6..8bd2d2e0bf 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -6479,7 +6479,7 @@ zone_resigninc(dns_zone_t *zone) { isc_boolean_t check_ksk, keyset_kskonly = ISC_FALSE; isc_result_t result; isc_stdtime_t now, inception, soaexpire, expire, stop; - isc_uint32_t jitter; + isc_uint32_t jitter, sigvalidityinterval; unsigned int i; unsigned int nkeys = 0; unsigned int resign; @@ -6524,15 +6524,25 @@ zone_resigninc(dns_zone_t *zone) { goto failure; } + sigvalidityinterval = zone->sigvalidityinterval; inception = now - 3600; /* Allow for clock skew. */ - soaexpire = now + dns_zone_getsigvalidityinterval(zone); + soaexpire = now + sigvalidityinterval; /* * Spread out signatures over time if they happen to be * clumped. We don't do this for each add_sigs() call as * we still want some clustering to occur. */ - isc_random_get(&jitter); - expire = soaexpire - jitter % 3600 - 1; + if (sigvalidityinterval >= 3600U) { + isc_random_get(&jitter); + if (sigvalidityinterval > 7200U) { + jitter %= 3600; + } else { + jitter %= 1200; + } + expire = soaexpire - jitter - 1; + } else { + expire = soaexpire - 1; + } stop = now + 5; check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK); @@ -7436,7 +7446,7 @@ zone_nsec3chain(dns_zone_t *zone) { isc_boolean_t first; isc_result_t result; isc_stdtime_t now, inception, soaexpire, expire; - isc_uint32_t jitter; + isc_uint32_t jitter, sigvalidityinterval; unsigned int i; unsigned int nkeys = 0; isc_uint32_t nodes; @@ -7505,16 +7515,26 @@ zone_nsec3chain(dns_zone_t *zone) { goto failure; } + sigvalidityinterval = dns_zone_getsigvalidityinterval(zone); inception = now - 3600; /* Allow for clock skew. */ - soaexpire = now + dns_zone_getsigvalidityinterval(zone); + soaexpire = now + sigvalidityinterval; /* * Spread out signatures over time if they happen to be * clumped. We don't do this for each add_sigs() call as * we still want some clustering to occur. */ - isc_random_get(&jitter); - expire = soaexpire - jitter % 3600; + if (sigvalidityinterval >= 3600U) { + isc_random_get(&jitter); + if (sigvalidityinterval > 7200U) { + jitter %= 3600; + } else { + jitter %= 1200; + } + expire = soaexpire - jitter - 1; + } else { + expire = soaexpire - 1; + } check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK); keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY); @@ -8374,7 +8394,7 @@ zone_sign(dns_zone_t *zone) { isc_boolean_t first; isc_result_t result; isc_stdtime_t now, inception, soaexpire, expire; - isc_uint32_t jitter; + isc_uint32_t jitter, sigvalidityinterval; unsigned int i, j; unsigned int nkeys = 0; isc_uint32_t nodes; @@ -8425,16 +8445,26 @@ zone_sign(dns_zone_t *zone) { goto failure; } + sigvalidityinterval = dns_zone_getsigvalidityinterval(zone); inception = now - 3600; /* Allow for clock skew. */ - soaexpire = now + dns_zone_getsigvalidityinterval(zone); + soaexpire = now + sigvalidityinterval; /* * Spread out signatures over time if they happen to be * clumped. We don't do this for each add_sigs() call as * we still want some clustering to occur. */ - isc_random_get(&jitter); - expire = soaexpire - jitter % 3600; + if (sigvalidityinterval >= 3600U) { + isc_random_get(&jitter); + if (sigvalidityinterval > 7200U) { + jitter %= 3600; + } else { + jitter %= 1200; + } + expire = soaexpire - jitter - 1; + } else { + expire = soaexpire - 1; + } /* * We keep pulling nodes off each iterator in turn until diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h index 0b85570764..362f9ca0fc 100644 --- a/lib/ns/include/ns/server.h +++ b/lib/ns/include/ns/server.h @@ -40,6 +40,7 @@ #define NS_SERVER_DISABLE4 0x00000100U /*%< -6 */ #define NS_SERVER_DISABLE6 0x00000200U /*%< -4 */ #define NS_SERVER_FIXEDLOCAL 0x00000400U /*%< -T fixedlocal */ +#define NS_SERVER_SIGVALINSECS 0x00000800U /*%< -T sigvalinsecs */ /*% * Type for callback function to get hostname.