36#include "scheduler/schedule.h"
37#include "scheduler/task.h"
61static pthread_once_t __hsm_key_factory_once = PTHREAD_ONCE_INIT;
62static pthread_mutex_t* __hsm_key_factory_lock = NULL;
64static void hsm_key_factory_init(
void) {
65 pthread_mutexattr_t attr;
67 if (!__hsm_key_factory_lock) {
68 if (!(__hsm_key_factory_lock = calloc(1,
sizeof(pthread_mutex_t)))
69 || pthread_mutexattr_init(&attr)
70 || pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE)
71 || pthread_mutex_init(__hsm_key_factory_lock, &attr))
74 ods_log_error(
"[hsm_key_factory_init] mutex error");
75 if (__hsm_key_factory_lock) {
76 pthread_mutex_destroy(__hsm_key_factory_lock);
77 free(__hsm_key_factory_lock);
78 __hsm_key_factory_lock = NULL;
86 if (__hsm_key_factory_lock) {
87 (void)pthread_mutex_destroy(__hsm_key_factory_lock);
88 free(__hsm_key_factory_lock);
89 __hsm_key_factory_lock = NULL;
102 ssize_t generate_keys;
103 libhsm_key_t *key = NULL;
106 hsm_repository_t* hsm;
116 if (!__hsm_key_factory_lock) {
117 pthread_once(&__hsm_key_factory_once, hsm_key_factory_init);
118 if (!__hsm_key_factory_lock) {
119 ods_log_error(
"[hsm_key_factory_generate] mutex init error");
123 if (pthread_mutex_lock(__hsm_key_factory_lock)) {
124 ods_log_error(
"[hsm_key_factory_generate] mutex lock error");
146 ods_log_error(
"[hsm_key_factory_generate] unable to count unused keys, database or memory allocation error");
149 pthread_mutex_unlock(__hsm_key_factory_lock);
163 ods_log_error(
"[hsm_key_factory_generate] unable to count zones for policy, database or memory allocation error");
166 pthread_mutex_unlock(__hsm_key_factory_lock);
177 pthread_mutex_unlock(__hsm_key_factory_lock);
189 if (num_zones == 0 || (ssize_t)num_keys >= generate_keys) {
190 pthread_mutex_unlock(__hsm_key_factory_lock);
195 ods_log_info(
"%lu zone(s) found on policy \"%s\"", num_zones,
policy_name(
policy));
197 ods_log_info(
"%lu zone(s) found on policy <unknown>", num_zones);
199 ods_log_info(
"[hsm_key_factory_generate] %lu keys needed for %lu "
200 "zones covering %lld seconds, generating %lu keys for policy %s",
201 generate_keys, num_zones, (
long long)duration,
202 (
unsigned long)(generate_keys-num_keys),
204 generate_keys -= num_keys;
210 if (!(hsm_ctx = hsm_create_context())) {
211 pthread_mutex_unlock(__hsm_key_factory_lock);
215 if ((hsm_err = hsm_get_error(hsm_ctx))) {
222 hsm_destroy_context(hsm_ctx);
223 pthread_mutex_unlock(__hsm_key_factory_lock);
230 while (generate_keys--) {
243 hsm_destroy_context(hsm_ctx);
244 pthread_mutex_unlock(__hsm_key_factory_lock);
253 case LDNS_RSASHA1_NSEC3:
261 case LDNS_ECDSAP256SHA256:
264 case LDNS_ECDSAP384SHA384:
267#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
283 if (!(key_id = hsm_get_key_id(hsm_ctx, key))) {
284 if ((hsm_err = hsm_get_error(hsm_ctx))) {
285 ods_log_error(
"[hsm_key_factory_generate] unable to get the ID of the key generated, HSM error: %s", hsm_err);
289 ods_log_error(
"[hsm_key_factory_generate] unable to get the ID of the key generated");
291 libhsm_key_free(key);
292 hsm_destroy_context(hsm_ctx);
293 pthread_mutex_unlock(__hsm_key_factory_lock);
313 ods_log_error(
"[hsm_key_factory_generate] hsm key creation failed, database or memory error");
317 hsm_destroy_context(hsm_ctx);
318 pthread_mutex_unlock(__hsm_key_factory_lock);
322 ods_log_debug(
"[hsm_key_factory_generate] generated key %s successfully", key_id);
326 libhsm_key_free(key);
329 if ((hsm_err = hsm_get_error(hsm_ctx))) {
330 ods_log_error(
"[hsm_key_factory_generate] key generation failed, HSM error: %s", hsm_err);
334 ods_log_error(
"[hsm_key_factory_generate] key generation failed");
336 hsm_destroy_context(hsm_ctx);
337 pthread_mutex_unlock(__hsm_key_factory_lock);
341 hsm_destroy_context(hsm_ctx);
342 pthread_mutex_unlock(__hsm_key_factory_lock);
351 if (!engine || !
policy || !connection) {
355 if (!__hsm_key_factory_lock) {
356 pthread_once(&__hsm_key_factory_once, hsm_key_factory_init);
357 if (!__hsm_key_factory_lock) {
358 ods_log_error(
"[hsm_key_factory_generate_policy] mutex init error");
362 if (pthread_mutex_lock(__hsm_key_factory_lock)) {
363 ods_log_error(
"[hsm_key_factory_generate_policy] mutex lock error");
367 ods_log_debug(
"[hsm_key_factory_generate_policy] policy %s",
policy_name(
policy));
374 pthread_mutex_unlock(__hsm_key_factory_lock);
382 pthread_mutex_unlock(__hsm_key_factory_lock);
393 if (!engine || !connection) {
397 if (!__hsm_key_factory_lock) {
398 pthread_once(&__hsm_key_factory_once, hsm_key_factory_init);
399 if (!__hsm_key_factory_lock) {
400 ods_log_error(
"[hsm_key_factory_generate_all] mutex init error");
404 if (pthread_mutex_lock(__hsm_key_factory_lock)) {
405 ods_log_error(
"[hsm_key_factory_generate_all] mutex lock error");
409 ods_log_debug(
"[hsm_key_factory_generate_all] generating keys");
416 pthread_mutex_unlock(__hsm_key_factory_lock);
431 pthread_mutex_unlock(__hsm_key_factory_lock);
436hsm_key_factory_generate_cb(task_type* task,
char const *owner,
void* userdata,
void* context)
445 return schedule_SUCCESS;
456 ods_log_debug(
"[hsm_key_factory_generate_cb] generate for policy key [duration: %lu]", (
unsigned long)task2->
duration);
458 ods_log_debug(
"[hsm_key_factory_generate_cb] generate for policy key done");
464 return schedule_SUCCESS;
468hsm_key_factory_generate_policy_cb(task_type* task,
char const *owner,
void *userdata,
477 return schedule_SUCCESS;
481 ods_log_debug(
"[hsm_key_factory_generate_policy_cb] generate for policy [duration: %lu]", (
unsigned long) task2->
duration);
483 ods_log_debug(
"[hsm_key_factory_generate_policy_cb] generate for policy done");
486 return schedule_SUCCESS;
490hsm_key_factory_generate_all_cb(task_type* task,
char const *owner,
void *userdata,
499 return schedule_SUCCESS;
503 ods_log_debug(
"[hsm_key_factory_generate_all_cb] generate for all policies [duration: %lu]", (
unsigned long)task2->
duration);
505 ods_log_debug(
"[hsm_key_factory_generate_all_cb] generate for all policies done");
508 return schedule_SUCCESS;
543 task = task_create(strdup(
"hsm_key_factory_schedule_generation"),
544 TASK_CLASS_ENFORCER, TASK_TYPE_HSMKEYGEN,
545 hsm_key_factory_generate_cb, task2,
548 if (schedule_task(
engine->
taskq, task, 1, 0) != ODS_STATUS_OK) {
581 task = task_create(strdup(
"hsm_key_factory_schedule_generation_policy"),
582 TASK_CLASS_ENFORCER, TASK_TYPE_HSMKEYGEN,
583 hsm_key_factory_generate_policy_cb, task2,
586 if (schedule_task(
engine->
taskq, task, 1, 0) != ODS_STATUS_OK) {
613 task = task_create(strdup(
"hsm_key_factory_schedule_generation"),
614 TASK_CLASS_ENFORCER, TASK_TYPE_HSMKEYGEN,
615 hsm_key_factory_generate_all_cb, task2,
618 if (schedule_task(
engine->
taskq, task, 1, 0) != ODS_STATUS_OK) {
665 ods_log_error(
"[hsm_key_factory_get_key] unable to list keys, database or memory allocation error");
676 ods_log_warning(
"[hsm_key_factory_get_key] no keys available");
690 ods_log_debug(
"[hsm_key_factory_get_key] unable to update fetched key");
698 ods_log_debug(
"[hsm_key_factory_get_key] key allocated");
723 ods_log_debug(
"[hsm_key_factory_release_key_id] unable to check usage of hsm_key, database or memory allocation error");
733 ods_log_debug(
"[hsm_key_factory_release_key_id] unable to release hsm_key, in use");
739 ods_log_debug(
"[hsm_key_factory_release_key_id] unable to fetch hsm_key");
745 ods_log_debug(
"[hsm_key_factory_release_key_id] hsm_key already DELETE (?)");
753 ods_log_debug(
"[hsm_key_factory_release_key_id] unable to change hsm_key state to DELETE");
780 ods_log_debug(
"[hsm_key_factory_release_key] unable to check usage of hsm_key, database or memory allocation error");
789 ods_log_debug(
"[hsm_key_factory_release_key] unable to release hsm_key, in use");
794 ods_log_debug(
"[hsm_key_factory_release_key] hsm_key already DELETE (?)");
801 ods_log_debug(
"[hsm_key_factory_release_key] unable to change hsm_key state to DELETE");
814 libhsm_key_t* hsmkey;
819 if (!(hsm_ctx = hsm_create_context())) {
824 ods_log_error(
"[hsm_key_factory_delete_key] looking for keys to purge from HSM");
830 ods_log_error(
"[hsm_key_factory_delete_key] unable to list keys, database or memory allocation error");
838 if(hsm_remove_key(hsm_ctx, hsmkey)) {
863 hsm_destroy_context(hsm_ctx);
db_clause_list_t * db_clause_list_new(void)
db_clause_t * db_clause_new(void)
db_value_t * db_clause_get_value(db_clause_t *clause)
int db_clause_list_add(db_clause_list_t *clause_list, db_clause_t *clause)
void db_clause_list_free(db_clause_list_t *clause_list)
int db_clause_set_operator(db_clause_t *clause, db_clause_operator_t clause_operator)
int db_clause_set_field(db_clause_t *clause, const char *field)
int db_clause_set_type(db_clause_t *clause, db_clause_type_t type)
int db_object_delete(const db_object_t *object, const db_clause_list_t *clause_list)
int db_value_from_text(db_value_t *value, const char *from_text)
int db_value_copy(db_value_t *value, const db_value_t *from_value)
void enforce_task_flush_all(engine_type *engine, db_connection_t *dbconn)
void enforce_task_flush_policy(engine_type *engine, db_connection_t *dbconn, policy_t const *policy)
void hsm_key_free(hsm_key_t *hsm_key)
int hsm_key_set_role(hsm_key_t *hsm_key, hsm_key_role_t role)
int hsm_key_count(hsm_key_t *hsm_key, db_clause_list_t *clause_list, size_t *count)
int hsm_key_set_state(hsm_key_t *hsm_key, hsm_key_state_t state)
const char * hsm_key_locator(const hsm_key_t *hsm_key)
int hsm_key_set_inception(hsm_key_t *hsm_key, unsigned int inception)
hsm_key_t * hsm_key_new(const db_connection_t *connection)
int hsm_key_set_bits(hsm_key_t *hsm_key, unsigned int bits)
int hsm_key_update(hsm_key_t *hsm_key)
int hsm_key_create(hsm_key_t *hsm_key)
int hsm_key_set_key_type(hsm_key_t *hsm_key, hsm_key_key_type_t key_type)
void hsm_key_list_free(hsm_key_list_t *hsm_key_list)
db_clause_t * hsm_key_policy_id_clause(db_clause_list_t *clause_list, const db_value_t *policy_id)
db_clause_t * hsm_key_is_revoked_clause(db_clause_list_t *clause_list, unsigned int is_revoked)
int hsm_key_set_repository(hsm_key_t *hsm_key, const char *repository_text)
int hsm_key_set_backup(hsm_key_t *hsm_key, hsm_key_backup_t backup)
db_clause_t * hsm_key_algorithm_clause(db_clause_list_t *clause_list, unsigned int algorithm)
db_clause_t * hsm_key_repository_clause(db_clause_list_t *clause_list, const char *repository_text)
db_clause_t * hsm_key_state_clause(db_clause_list_t *clause_list, hsm_key_state_t state)
int hsm_key_set_policy_id(hsm_key_t *hsm_key, const db_value_t *policy_id)
const db_value_t * hsm_key_id(const hsm_key_t *hsm_key)
db_clause_t * hsm_key_key_type_clause(db_clause_list_t *clause_list, hsm_key_key_type_t key_type)
hsm_key_t * hsm_key_list_get_next(hsm_key_list_t *hsm_key_list)
db_clause_t * hsm_key_bits_clause(db_clause_list_t *clause_list, unsigned int bits)
hsm_key_list_t * hsm_key_list_new_get_by_clauses(const db_connection_t *connection, const db_clause_list_t *clause_list)
int hsm_key_get_by_id(hsm_key_t *hsm_key, const db_value_t *id)
db_clause_t * hsm_key_role_clause(db_clause_list_t *clause_list, hsm_key_role_t role)
int hsm_key_set_locator(hsm_key_t *hsm_key, const char *locator_text)
int hsm_key_set_algorithm(hsm_key_t *hsm_key, unsigned int algorithm)
enum hsm_key_state hsm_key_state_t
enum hsm_key_role hsm_key_role_t
@ HSM_KEY_BACKUP_NO_BACKUP
@ HSM_KEY_BACKUP_BACKUP_REQUIRED
int hsm_key_factory_schedule_generate_policy(engine_type *engine, const policy_t *policy_orig, time_t duration)
int hsm_key_factory_generate(engine_type *engine, const db_connection_t *connection, const policy_t *policy, const policy_key_t *policy_key, time_t duration)
int hsm_key_factory_delete_key(const db_connection_t *connection)
int hsm_key_factory_release_key_id(const db_value_t *hsm_key_id, const db_connection_t *connection)
int hsm_key_factory_generate_all(engine_type *engine, const db_connection_t *connection, time_t duration)
int hsm_key_factory_generate_policy(engine_type *engine, const db_connection_t *connection, const policy_t *policy, time_t duration)
void hsm_key_factory_deinit(void)
int hsm_key_factory_release_key(hsm_key_t *hsm_key, const db_connection_t *connection)
int hsm_key_factory_schedule_generate_all(engine_type *engine, time_t duration)
hsm_key_t * hsm_key_factory_get_key(engine_type *engine, const db_connection_t *connection, const policy_key_t *policy_key, hsm_key_state_t hsm_key_state)
void key_data_free(key_data_t *key_data)
db_clause_t * key_data_hsm_key_id_clause(db_clause_list_t *clause_list, const db_value_t *hsm_key_id)
key_data_t * key_data_new(const db_connection_t *connection)
int key_data_count(key_data_t *key_data, db_clause_list_t *clause_list, size_t *count)
policy_t * policy_new(const db_connection_t *connection)
void policy_list_free(policy_list_t *policy_list)
const policy_t * policy_list_next(policy_list_t *policy_list)
policy_list_t * policy_list_new_get(const db_connection_t *connection)
policy_t * policy_new_copy(const policy_t *policy)
const char * policy_name(const policy_t *policy)
const db_value_t * policy_id(const policy_t *policy)
int policy_get_by_id(policy_t *policy, const db_value_t *id)
void policy_free(policy_t *policy)
unsigned int policy_key_lifetime(const policy_key_t *policy_key)
policy_key_list_t * policy_key_list_new_get_by_policy_id(const db_connection_t *connection, const db_value_t *policy_id)
const db_value_t * policy_key_policy_id(const policy_key_t *policy_key)
const policy_key_t * policy_key_list_next(policy_key_list_t *policy_key_list)
policy_key_t * policy_key_new_copy(const policy_key_t *policy_key)
const char * policy_key_repository(const policy_key_t *policy_key)
void policy_key_list_free(policy_key_list_t *policy_key_list)
const char * policy_key_role_text(const policy_key_t *policy_key)
void policy_key_free(policy_key_t *policy_key)
unsigned int policy_key_algorithm(const policy_key_t *policy_key)
unsigned int policy_key_bits(const policy_key_t *policy_key)
int reschedule_enforce_task
policy_key_t * policy_key
engineconfig_type * config
hsm_repository_t * repositories
time_t automatic_keygen_duration
void zone_db_free(zone_db_t *zone)
int zone_db_count(zone_db_t *zone, db_clause_list_t *clause_list, size_t *count)
zone_db_t * zone_db_new(const db_connection_t *connection)
db_clause_t * zone_db_policy_id_clause(db_clause_list_t *clause_list, const db_value_t *policy_id)