layer/validate: preliminary code enabling trust anchor configuration

diff --git a/lib/dnssec/ta.c b/lib/dnssec/ta.c
index 61e64205c83f5486a11d3fd2bd085fa9ea3c5c43..59e696890f9b037b89592793e89e0767c1b42936 100644 (file)
--- a/lib/dnssec/ta.c
+++ b/lib/dnssec/ta.c
@@ -17,9 +17,14 @@
 #include <arpa/inet.h>
 #include <assert.h>
 #include <ctype.h>
+#include <pthread.h>
 
+#include <contrib/ucw/mempool.h>
 #include <libknot/descriptor.h>
+#include <libknot/dname.h>
 #include <libknot/internal/base64.h>
+#include <libknot/rdataset.h>
+#include <libknot/rrset.h>
 #include <libknot/rrtype/rdname.h>
 
 #include "lib/defines.h"
@@ -423,3 +428,222 @@ fail:
 #undef RDATA_MAXSIZE
 #undef SEPARATORS
 }
+
+#define MAX_ANCHORS 16
+struct trust_anchors_nolock {
+       mm_ctx_t pool;
+       knot_rrset_t *anchors[MAX_ANCHORS];
+       int used;
+};
+
+struct trust_anchors {
+       struct trust_anchors_nolock locked;
+       pthread_rwlock_t rwlock;
+};
+
+struct trust_anchors global_trust_anchors = {
+       .locked.pool = {0, },
+       .locked.anchors = {0, },
+       .locked.used = 0,
+};
+
+static int ta_init(struct trust_anchors_nolock *tan)
+{
+       assert(tan);
+
+       memset(tan, 0, sizeof(*tan));
+       tan->pool.ctx = mp_new(4 * CPU_PAGE_SIZE);
+       tan->pool.alloc = (mm_alloc_t) mp_alloc;
+       tan->used = 0;
+
+       return kr_ok();
+}
+
+static void ta_deinit(struct trust_anchors_nolock *tan)
+{
+       assert(tan);
+
+       if (tan->pool.ctx) {
+               mp_delete(tan->pool.ctx);
+               tan->pool.ctx = NULL;
+       }
+}
+
+int kr_ta_init(struct trust_anchors *tas)
+{
+       if (!tas) {
+               return kr_error(EINVAL);
+       }
+
+       int ret = ta_init(&tas->locked);
+       if (ret != 0) {
+               return ret;
+       }
+
+       ret = pthread_rwlock_init(&tas->rwlock, NULL);
+       if (ret != 0) {
+               ta_deinit(&tas->locked);
+               return kr_error(ret);
+       }
+       return kr_ok();
+}
+
+void kr_ta_deinit(struct trust_anchors *tas)
+{
+       if (!tas) {
+               return;
+       }
+
+       while (pthread_rwlock_destroy(&tas->rwlock) == EBUSY);
+
+       ta_deinit(&tas->locked);
+}
+
+static int ta_reset(struct trust_anchors_nolock *tan, const char *ta_str)
+{
+       assert(tan);
+
+       ta_deinit(tan);
+       int ret = ta_init(tan);
+       if (ret != 0) {
+               return ret;
+       }
+
+       if (!ta_str || (ta_str[0] == '\0')) {
+               return kr_ok();
+       }
+
+       knot_rrset_t *ta = NULL;
+       ret = kr_ta_parse(&ta, ta_str, &tan->pool);
+       if (ret != 0) {
+               return ret;
+       }
+
+       assert(ta);
+
+       tan->anchors[tan->used++] = ta;
+
+       return kr_ok();
+}
+
+int kr_ta_reset(struct trust_anchors *tas, const char *ta_str)
+{
+       if (!tas) {
+               return kr_error(ENOENT);
+       }
+
+       int ret = pthread_rwlock_wrlock(&tas->rwlock);
+       if (ret != 0) {
+               return kr_error(ret);
+       }
+
+       ret = ta_reset(&tas->locked, ta_str);
+
+       pthread_rwlock_unlock(&tas->rwlock);
+       return ret;
+}
+
+static knot_rrset_t *ta_find(struct trust_anchors_nolock *tan, const knot_dname_t *name)
+{
+       assert(tan && name);
+
+       knot_rrset_t *found = NULL;
+
+       int i;
+       for (i = 0; i < tan->used; ++i) {
+               if (knot_dname_is_equal(tan->anchors[i]->owner, name)) {
+                       found = tan->anchors[i];
+                       break;
+               }
+       }
+
+       return found;
+}
+
+static int ta_add(struct trust_anchors_nolock *tan, const char *ta_str)
+{
+       assert(tan && ta_str);
+
+       if (tan->used >= MAX_ANCHORS) {
+               return kr_error(ENOMEM);
+       }
+
+       knot_rrset_t *ta = NULL;
+       int ret = kr_ta_parse(&ta, ta_str, &tan->pool);
+       if (ret != 0) {
+               return ret;
+       }
+       assert(ta);
+
+       knot_rrset_t *found = ta_find(tan, ta->owner);
+       if (!found) {
+               tan->anchors[tan->used++] = ta;
+               return kr_ok();
+       }
+
+       if (found->type != ta->type) {
+               knot_rrset_free(&ta, &tan->pool);
+               return kr_error(EINVAL);
+       }
+
+       ret = knot_rdataset_merge(&found->rrs, &ta->rrs, &tan->pool);
+       knot_rrset_free(&ta, &tan->pool);
+       if (ret != 0) {
+               return ret;
+       }
+
+       return kr_ok();
+}
+
+int kr_ta_add(struct trust_anchors *tas, const char *ta_str)
+{
+       if (!tas || !ta_str) {
+               return kr_error(EINVAL);
+       }
+
+       int ret = pthread_rwlock_wrlock(&tas->rwlock);
+       if (ret != 0) {
+               return kr_error(ret);
+       }
+
+       ret = ta_add(&tas->locked, ta_str);
+
+       pthread_rwlock_unlock(&tas->rwlock);
+       return ret;
+}
+
+static int ta_get(knot_rrset_t **ta, struct trust_anchors_nolock *tan, const knot_dname_t *name, mm_ctx_t *pool)
+{
+       assert(ta && tan && name);
+
+       knot_rrset_t *copy = ta_find(tan, name);
+       if (!copy) {
+               kr_error(ENOENT);
+       }
+
+       copy = knot_rrset_copy(copy, pool);
+       if (!copy) {
+               kr_error(ENOMEM);
+       }
+
+       *ta = copy;
+
+       return kr_ok();
+}
+
+int kr_ta_get(knot_rrset_t **ta, struct trust_anchors *tas, const knot_dname_t *name, mm_ctx_t *pool)
+{
+       if (!ta || !tas || !name) {
+               return kr_error(EINVAL);
+       }
+
+       int ret = pthread_rwlock_rdlock(&tas->rwlock);
+       if (ret != 0) {
+               return kr_error(ret);
+       }
+
+       ret = ta_get(ta, &tas->locked, name, pool);
+
+       pthread_rwlock_unlock(&tas->rwlock);
+       return ret;
+}

diff --git a/lib/dnssec/ta.h b/lib/dnssec/ta.h
index cf525059419723a18d55ed7a53816e81c2640d65..83d89d1f7751afdd90be67dc7397bd1935949f24 100644 (file)
--- a/lib/dnssec/ta.h
+++ b/lib/dnssec/ta.h
@@ -20,6 +20,7 @@
 #include <libknot/rrset.h>
 
 //#define ROOT_TA ". IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
+#define ROOT_NAME ""
 #define ROOT_TA ". IN DS 19036 RSASHA256 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
 //#define ROOT_TA ". IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0="
 
@@ -32,3 +33,19 @@
  * @return       0 or an error code
  */
 int kr_ta_parse(knot_rrset_t **rr, const char *ds_str, mm_ctx_t *pool);
+
+/** Trust anchor container structure. */
+struct trust_anchors;
+
+/** Global trust anchor container. */
+extern struct trust_anchors global_trust_anchors;
+
+int kr_ta_init(struct trust_anchors *tas);
+
+void kr_ta_deinit(struct trust_anchors *tas);
+
+int kr_ta_reset(struct trust_anchors *tas, const char *ta_str);
+
+int kr_ta_add(struct trust_anchors *tas, const char *ta_str);
+
+int kr_ta_get(knot_rrset_t **ta, struct trust_anchors *tas, const knot_dname_t *name, mm_ctx_t *pool);

diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index d746390a057665bfc5e2b0c63b599ee25e24e750..80b32eaab5934eece8d83515f7103cef102b7ccd 100644 (file)
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -440,7 +440,43 @@ const knot_layer_api_t *validate_layer(struct kr_module *module)
                .begin = &begin,
                .consume = &validate,
        };
+       /* Store module reference */
        return &_layer;
 }
 
+int validate_init(struct kr_module *module)
+{
+       int ret = kr_ta_init(&global_trust_anchors);
+       if (ret != 0) {
+               return ret;
+       }
+       /* Add root trust anchor. */
+       ret = kr_ta_add(&global_trust_anchors, ROOT_TA);
+       if (ret != 0) {
+               return ret;
+       }
+       return kr_ok();
+}
+
+#warning TODO: set root trust anchor from config
+int validate_config(struct kr_module *module, const char *conf)
+{
+       return kr_ok();
+}
+
+int validate_deinit(struct kr_module *module)
+{
+       kr_ta_deinit(&global_trust_anchors);
+       return kr_ok();
+}
+
+const struct kr_prop validate_prop_list[] = {
+    { NULL, NULL, NULL }
+};
+
+struct kr_prop *validate_props(void)
+{
+       return (struct kr_prop *) validate_prop_list;
+}
+
 KR_MODULE_EXPORT(validate)

diff --git a/lib/module.c b/lib/module.c
index 071394940611722b5cb47b4441e181ed2a8e0097..53cfbe15c892e26e9f912369016c314f6ad3c8a0 100644 (file)
--- a/lib/module.c
+++ b/lib/module.c
@@ -25,12 +25,16 @@
 
 /* List of embedded modules */
 const knot_layer_api_t *iterate_layer(struct kr_module *module);
+int validate_init(struct kr_module *module);
+int validate_deinit(struct kr_module *module);
+int validate_config(struct kr_module *module, const char *conf);
 const knot_layer_api_t *validate_layer(struct kr_module *module);
+extern struct kr_prop validate_prop_list[];
 const knot_layer_api_t *rrcache_layer(struct kr_module *module);
 const knot_layer_api_t *pktcache_layer(struct kr_module *module);
 static const struct kr_module embedded_modules[] = {
        { "iterate",  NULL, NULL, NULL, iterate_layer, NULL, NULL, NULL },
-       { "validate", NULL, NULL, NULL, validate_layer, NULL, NULL, NULL },
+       { "validate", validate_init, validate_deinit, validate_config, validate_layer, validate_prop_list, NULL, NULL },
        { "rrcache",  NULL, NULL, NULL, rrcache_layer, NULL, NULL, NULL },
        { "pktcache", NULL, NULL, NULL, pktcache_layer, NULL, NULL, NULL },
 };

diff --git a/lib/zonecut.c b/lib/zonecut.c
index 5265936c1be2e2f0998c4eb93b4f01431d3c4ee6..c0bb394a99169954fa113e42d725af370749a4f1 100644 (file)
--- a/lib/zonecut.c
+++ b/lib/zonecut.c
@@ -289,10 +289,12 @@ int kr_zonecut_set_sbelt(struct kr_context *ctx, struct kr_zonecut *cut)
                }
        }
 
-#warning TODO: set root trust anchor from config
        /* Set trust anchor. */
        knot_rrset_free(&cut->trust_anchor, cut->pool);
-       int ret = kr_ta_parse(&cut->trust_anchor, ROOT_TA, cut->pool);
+       /* The root trust anchor can be changed via the validator layer
+        * (interactive) interface.
+        */
+       int ret = kr_ta_get(&cut->trust_anchor, &global_trust_anchors, ROOT_NAME, cut->pool);
        if (ret != 0) {
                return ret;
        }