Basic TSIG key management infrastructure

diff --git a/pdns/dnsbackend.hh b/pdns/dnsbackend.hh
index 2215bec5378ba2825911ddfccccae264e30c3158..bb50c7c856dce4d889f63d2023ef0530e1731716 100644 (file)
--- a/pdns/dnsbackend.hh
+++ b/pdns/dnsbackend.hh
@@ -65,6 +65,12 @@ struct DomainInfo
   }
 };
 
+struct TSIGKey {
+   std::string name;
+   std::string algorithm;
+   std::string key;
+};
+
 class DNSPacket;
 
 
@@ -132,6 +138,9 @@ public:
   virtual bool deactivateDomainKey(const string& name, unsigned int id) { return false; }
 
   virtual bool getTSIGKey(const string& name, string* algorithm, string* content) { return false; }
+  virtual bool setTSIGKey(const string& name, const string& algorithm, const string& content) { return false; }
+  virtual bool deleteTSIGKey(const string& name) { return false; }
+  virtual bool getTSIGKeys(std::vector< struct TSIGKey > &keys) { return false; }
 
   virtual bool getBeforeAndAfterNamesAbsolute(uint32_t id, const std::string& qname, std::string& unhashed, std::string& before, std::string& after)
   {

diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index 514b227d27fbfb8205b43d975448f193a226ab97..853e26645f67e6b1fa3b39678afe0b34f1d57a63 100644 (file)
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -86,7 +86,7 @@ public:
   bool isPresigned(const std::string& zname);
   bool setPresigned(const std::string& zname);
   bool unsetPresigned(const std::string& zname);
-  
+
   bool TSIGGrantsAccess(const string& zone, const string& keyname, const string& algorithm);
   bool getTSIGForAccess(const string& zone, const string& master, string* keyname);
   

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index ebf381f35946e462e41406833d525401768b2fd9..173eaba51223874510aad0dadbf420102bd79f0f 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -960,7 +960,8 @@ try
     cerr<<"show-zone ZONE                     Show DNSSEC (public) key details about a zone\n";
     cerr<<"unset-nsec3 ZONE                   Switch back to NSEC\n";
     cerr<<"unset-presigned ZONE               No longer use presigned RRSIGs\n";
-    cerr<<"test-schema ZONE                   Test DB schema - will create ZONE\n\n";
+    cerr<<"test-schema ZONE                   Test DB schema - will create ZONE\n";
+    cerr<<"import-tsig-key ZONE ALGORITHM KEY Import TSIG key for zone\n\n";
     cerr<<desc<<endl;
     return 0;
   }
@@ -1445,9 +1446,139 @@ try
     // print key to stdout 
     cout << "Flags: " << dspk.d_flags << endl << 
              dspk.getKey()->convertToISC() << endl; 
+  } else if (cmds[0]=="generate-tsig-key") {
+     if (cmds.size() < 3) {
+        cerr << "Syntax: " << cmds[0] << " name (hmac-md5|hmac-sha1|hmac-sha224|hmac-sha256|hmac-sha384|hmac-sha512)" << endl;
+        return 0;
+     }
+     string name = cmds[1];
+     string algo = cmds[2];
+     string key;
+     char tmpkey[64];
+
+     size_t klen;
+     if (algo == "hmac-md5") {
+       klen = 32;
+     } else if (algo == "hmac-sha1") {
+       klen = 32;
+     } else if (algo == "hmac-sha224") {
+       klen = 32;
+     } else if (algo == "hmac-sha256") {
+       klen = 64;
+     } else if (algo == "hmac-sha384") {
+       klen = 64;
+     } else if (algo == "hmac-sha512") {
+       klen = 64;
+     }
+
+     ifstream keyin("/dev/random", ifstream::in|ifstream::binary);
+     // read and hash data
+     keyin.read(tmpkey, klen);
+     key = Base64Encode(std::string(tmpkey, klen));
+
+     UeberBackend B("default");
+     if (B.setTSIGKey(name, algo, key)) {
+       cout << "Create new TSIG key " << name << " " << algo << " " << key << endl;
+     } else {
+       cout << "Failure storing new TSIG key " << name << " " << algo << " " << key << endl;
+       return 1;
+     }
+     return 0;
+  } else if (cmds[0]=="import-tsig-key") {
+     if (cmds.size() < 4) {
+        cerr << "Syntax: " << cmds[0] << " name algorithm key" << endl;
+        return 0;
+     }
+     string name = cmds[1];
+     string algo = cmds[2];
+     string key = cmds[3];
+
+     UeberBackend B("default");
+     if (B.setTSIGKey(name, algo, key)) {
+       cout << "Imported TSIG key " << name << " " << algo << endl;
+     } else {
+       cout << "Failure importing TSIG key " << name << " " << algo << endl;
+       return 1;
+     }
+     return 0;
+  } else if (cmds[0]=="delete-tsig-key") {
+     if (cmds.size() < 2) {
+        cerr << "Syntax: " << cmds[0] << " name" << endl;
+        return 0;
+     }
+     string name = cmds[1];
+     string algo = cmds[2];
+
+     UeberBackend B("default");
+     if (B.deleteTSIGKey(name)) {
+       cout << "Deleted TSIG key " << name << endl;
+     } else {
+       cout << "Failure deleting TSIG key " << name << endl;
+       return 1;
+     }
+     return 0;
+  } else if (cmds[0]=="list-tsig-keys") {
+     std::vector<struct TSIGKey> keys;
+     UeberBackend B("default");
+     if (B.getTSIGKeys(keys)) {
+        BOOST_FOREACH(const struct TSIGKey &key, keys) {
+           cout << key.name << " " << key.algorithm << " " << key.key << endl;
+        }
+     }
+     return 0;
+  } else if (cmds[0]=="enable-tsig-key") {
+     if (cmds.size() < 3) {
+        cerr << "Syntax: " << cmds[0] << " zone name" << endl;
+        return 0;
+     }
+     string zname = cmds[1];
+     string name = cmds[2];
+
+     UeberBackend B("default");
+     std::vector<std::string> meta; 
+     if (!B.getDomainMetadata(zname, "TSIG-ALLOW-AXFR", meta)) {
+       cout << "Failure enabling TSIG key " << name << " for " << zname << endl;
+       return 1;
+     }
+     bool found = false;
+     BOOST_FOREACH(std::string tmpname, meta) {
+          if (tmpname == name) { found = true; break; }
+     }
+     if (!found) meta.push_back(name);
+     if (B.setDomainMetadata(zname, "TSIG-ALLOW-AXFR", meta)) {
+       cout << "Enabled TSIG key " << name << " for " << zname << endl;
+     } else {
+       cout << "Failure enabling TSIG key " << name << " for " << zname << endl;
+       return 1;
+     }
+     return 0;
+  } else if (cmds[0]=="disable-tsig-key") {
+     if (cmds.size() < 3) {
+        cerr << "Syntax: " << cmds[0] << " zone name" << endl;
+        return 0;
+     }
+     string zname = cmds[1];
+     string name = cmds[2];
+
+     UeberBackend B("default");
+     std::vector<std::string> meta;
+     if (!B.getDomainMetadata(zname, "TSIG-ALLOW-AXFR", meta)) {
+       cout << "Failure disabling TSIG key " << name << " for " << zname << endl;
+       return 1;
+     }
+     std::vector<std::string>::iterator iter = meta.begin();
+     for(;iter != meta.end(); iter++) if (*iter == name) break;
+     if (iter != meta.end()) meta.erase(iter);
+     if (B.setDomainMetadata(zname, "TSIG-ALLOW-AXFR", meta)) {
+       cout << "Disabled TSIG key " << name << " for " << zname << endl;
+     } else {
+       cout << "Failure disabling TSIG key " << name << " for " << zname << endl;
+       return 1;
+     }
+     return 0;
   }
   else {
-    cerr<<"Unknown command '"<<cmds[0]<<"'\n";
+    cerr<<"Unknown command '"<<cmds[0] << endl;
     return 1;
   }
   return 0;

diff --git a/pdns/ueberbackend.cc b/pdns/ueberbackend.cc
index 84122ca005040300dc68588d424a5fce7c1e5ddf..30e945dfa655cf2f7da9803b3edca669a162a253 100644 (file)
--- a/pdns/ueberbackend.cc
+++ b/pdns/ueberbackend.cc
@@ -177,6 +177,33 @@ bool UeberBackend::getTSIGKey(const string& name, string* algorithm, string* con
 }
 
 
+bool UeberBackend::setTSIGKey(const string& name, const string& algorithm, const string& content)
+{
+  BOOST_FOREACH(DNSBackend* db, backends) {
+    if(db->setTSIGKey(name, algorithm, content))
+      return true;
+  }
+  return false;
+}
+
+bool UeberBackend::deleteTSIGKey(const string& name)
+{
+  BOOST_FOREACH(DNSBackend* db, backends) {
+    if(db->deleteTSIGKey(name))
+      return true;
+  }
+  return false;
+}
+
+bool UeberBackend::getTSIGKeys(std::vector< struct TSIGKey > &keys)
+{
+  BOOST_FOREACH(DNSBackend* db, backends) {
+    db->getTSIGKeys(keys);
+  }
+  return true;
+}
+
+
 void UeberBackend::reload()
 {
   for ( vector< DNSBackend * >::iterator i = backends.begin(); i != backends.end(); ++i )

diff --git a/pdns/ueberbackend.hh b/pdns/ueberbackend.hh
index ff2d582556431e2d97e80926b3213ebb43f08565..d0ef671cbc108f824754433d69dc1ba35d6c089b 100644 (file)
--- a/pdns/ueberbackend.hh
+++ b/pdns/ueberbackend.hh
@@ -134,7 +134,10 @@ public:
   bool deactivateDomainKey(const string& name, unsigned int id);
 
   bool getTSIGKey(const string& name, string* algorithm, string* content);
-  
+  bool setTSIGKey(const string& name, const string& algorithm, const string& content);
+  bool deleteTSIGKey(const string& name);
+  bool getTSIGKeys(std::vector< struct TSIGKey > &keys);
+
   void alsoNotifies(const string &domain, set<string> *ips); 
   void rediscover(string* status=0);
   void reload();