|
 |
f6021d |
INSERT INTO databaseVersion VALUES (NULL, 1, 1);
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** policy table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
INSERT INTO policy
|
|
|
f6021d |
SELECT id, 1, name, description,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0, 0,
|
|
|
f6021d |
86400, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0
|
|
|
f6021d |
FROM REMOTE.policies;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesResign = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'resign');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesRefresh = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'refresh') ;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesJitter = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'jitter');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesInceptionOffset = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'clockskew');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesValidityDefault = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'valdefault');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET signaturesValidityDenial = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 1
|
|
|
f6021d |
AND REMOTE.parameters.name = 'valdenial');
|
|
|
f6021d |
|
|
|
f6021d |
--MaxZoneTTL default 86400
|
|
|
f6021d |
|
|
|
f6021d |
-- We need the following mapping 1.4 -> 2.0 for denialType
|
|
|
f6021d |
-- 0 -> 1
|
|
|
f6021d |
-- 3 -> 0
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialType = (
|
|
|
f6021d |
SELECT (~value)&1
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'version');
|
|
|
f6021d |
|
|
|
f6021d |
-- I'm pretty sure this is not the correct way to do it. It is aweful but
|
|
|
f6021d |
-- I can't figure it out how it would work for sqlite.
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialOptout = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'optout')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'optout');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialTtl = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttl')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttl');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialResalt = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'resalt')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'resalt');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialAlgorithm = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'algorithm')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'algorithm');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialIterations = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'iterations')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'iterations');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialSaltLength = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'saltlength')
|
|
|
f6021d |
WHERE null != (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 2
|
|
|
f6021d |
AND REMOTE.parameters.name = 'saltlength');
|
|
|
f6021d |
|
|
|
f6021d |
-- clumsy salt update. salt is optional in 1.4 but required in 2.0
|
|
|
f6021d |
-- sqlite is limited in what it can do in an update. I hope there is a
|
|
|
f6021d |
-- better way for this?
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialSalt = (
|
|
|
f6021d |
SELECT salt
|
|
|
f6021d |
FROM REMOTE.policies
|
|
|
f6021d |
WHERE REMOTE.policies.id = policy.id)
|
|
|
f6021d |
WHERE (
|
|
|
f6021d |
SELECT salt
|
|
|
f6021d |
FROM REMOTE.policies
|
|
|
f6021d |
WHERE REMOTE.policies.id = policy.id) != null;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET denialSaltLastChange = (
|
|
|
f6021d |
SELECT salt_stamp
|
|
|
f6021d |
FROM REMOTE.policies
|
|
|
f6021d |
WHERE REMOTE.policies.id = policy.id)
|
|
|
f6021d |
WHERE (
|
|
|
f6021d |
SELECT salt_stamp
|
|
|
f6021d |
FROM REMOTE.policies
|
|
|
f6021d |
WHERE REMOTE.policies.id = policy.id) != null;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET keysTtl = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 5
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttl');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET keysRetireSafety = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 5
|
|
|
f6021d |
AND REMOTE.parameters.name = 'retiresafety');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET keysPublishSafety = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 5
|
|
|
f6021d |
AND REMOTE.parameters.name = 'publishsafety');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET keysShared = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 5
|
|
|
f6021d |
AND REMOTE.parameters.name = 'zones_share_keys');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET keysPurgeAfter = COALESCE((
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 5
|
|
|
f6021d |
AND REMOTE.parameters.name = 'purge'), 0);
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET zonePropagationDelay = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 7
|
|
|
f6021d |
AND REMOTE.parameters.name = 'propagationdelay');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET zoneSoaTtl = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 7
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttl');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET zoneSoaMinimum = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 7
|
|
|
f6021d |
AND REMOTE.parameters.name = 'min');
|
|
|
f6021d |
|
|
|
f6021d |
-- Temporary mapping table between 1.4 and 2.0 SOA serial strategy
|
|
|
f6021d |
CREATE TABLE mapping (
|
|
|
f6021d |
soa14 INTEGER,
|
|
|
f6021d |
soa20 INTEGER
|
|
|
f6021d |
);
|
|
|
f6021d |
INSERT INTO mapping SELECT 1, 2;
|
|
|
f6021d |
INSERT INTO mapping SELECT 2, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 3, 1;
|
|
|
f6021d |
INSERT INTO mapping SELECT 4, 3;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET zoneSoaSerial = (
|
|
|
f6021d |
SELECT mapping.soa20
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
INNER JOIN mapping
|
|
|
f6021d |
ON REMOTE.parameters_policies.value = mapping.soa14
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 7
|
|
|
f6021d |
AND REMOTE.parameters.name = 'serial');
|
|
|
f6021d |
|
|
|
f6021d |
DROP TABLE mapping;
|
|
|
f6021d |
|
|
|
f6021d |
-- parentRegistrationDelay = 0 on 1.4
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET parentPropagationDelay = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 8
|
|
|
f6021d |
AND REMOTE.parameters.name = 'propagationdelay');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET parentDsTtl = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 8
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttlds');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET parentSoaTtl = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 8
|
|
|
f6021d |
AND REMOTE.parameters.name = 'ttl');
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policy
|
|
|
f6021d |
SET parentSoaMinimum = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policy.id
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 8
|
|
|
f6021d |
AND REMOTE.parameters.name = 'min');
|
|
|
f6021d |
|
|
|
f6021d |
-- passthrough = 0
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** policyKey table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ** For each policy in 1.4 add two keys: KSK and ZSK
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
-- Insert each KSK
|
|
|
f6021d |
INSERT INTO policyKey
|
|
|
f6021d |
SELECT null, 1, id,
|
|
|
f6021d |
1, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 4
|
|
|
f6021d |
FROM REMOTE.policies;
|
|
|
f6021d |
|
|
|
f6021d |
-- Insert each ZSK
|
|
|
f6021d |
INSERT INTO policyKey
|
|
|
f6021d |
SELECT null, 1, id,
|
|
|
f6021d |
2, 0, 0,
|
|
|
f6021d |
0, 0, 0,
|
|
|
f6021d |
0, 0, 1
|
|
|
f6021d |
FROM REMOTE.policies;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET algorithm = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'algorithm')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET algorithm = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'algorithm')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET bits = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'bits')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET bits = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'bits')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET lifetime = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'lifetime')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET lifetime = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'lifetime')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET repository = (
|
|
|
f6021d |
SELECT REMOTE.securitymodules.name
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
INNER JOIN REMOTE.securitymodules
|
|
|
f6021d |
ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'repository')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET repository = (
|
|
|
f6021d |
SELECT REMOTE.securitymodules.name
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
INNER JOIN REMOTE.securitymodules
|
|
|
f6021d |
ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'repository')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET standby = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'standby')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET standby = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'standby')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET manualRollover = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 3
|
|
|
f6021d |
AND REMOTE.parameters.name = 'manual_rollover')
|
|
|
f6021d |
WHERE policyKey.role = 1;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE policyKey
|
|
|
f6021d |
SET manualRollover = (
|
|
|
f6021d |
SELECT value
|
|
|
f6021d |
FROM REMOTE.parameters_policies
|
|
|
f6021d |
INNER JOIN REMOTE.parameters
|
|
|
f6021d |
ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
|
|
|
f6021d |
WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
|
|
|
f6021d |
AND REMOTE.parameters.category_id = 4
|
|
|
f6021d |
AND REMOTE.parameters.name = 'manual_rollover')
|
|
|
f6021d |
WHERE policyKey.role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
-- rfc5011 = 0. 2.0 has no support
|
|
|
f6021d |
-- minimize already set
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** hsmKey table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ** get from keypairs and dnsseckeys
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
INSERT INTO hsmKey
|
|
|
f6021d |
SELECT DISTINCT REMOTE.keypairs.id, 1, REMOTE.keypairs.policy_id,
|
|
|
f6021d |
REMOTE.keypairs.HSMkey_id, 2, REMOTE.keypairs.size,
|
|
|
f6021d |
REMOTE.keypairs.algorithm, (~(REMOTE.dnsseckeys.keytype)&1)+1,
|
|
|
f6021d |
CASE WHEN REMOTE.keypairs.generate IS NOT NULL THEN
|
|
|
f6021d |
strftime('%s', REMOTE.keypairs.generate)
|
|
|
f6021d |
ELSE strftime("%s", "now") END,
|
|
|
f6021d |
0,
|
|
|
f6021d |
1, --only RSA supported
|
|
|
f6021d |
REMOTE.securitymodules.name,
|
|
|
f6021d |
0 --assume no backup
|
|
|
f6021d |
FROM REMOTE.keypairs
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.keypairs.id = REMOTE.dnsseckeys.keypair_id
|
|
|
f6021d |
JOIN REMOTE.securitymodules
|
|
|
f6021d |
ON REMOTE.securitymodules.id = REMOTE.keypairs.securitymodule_id;
|
|
|
f6021d |
|
|
|
f6021d |
-- For some policies put the keys in a shared state
|
|
|
f6021d |
UPDATE hsmKey
|
|
|
f6021d |
SET state = 3
|
|
|
f6021d |
WHERE EXISTS
|
|
|
f6021d |
(SELECT * FROM hsmKey AS h
|
|
|
f6021d |
JOIN policy ON policy.id = h.policyId
|
|
|
f6021d |
WHERE policy.keysShared AND hsmKey.id = h.id);
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** zone table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
INSERT INTO zone
|
|
|
f6021d |
SELECT zones.id, 1, zones.policy_id,
|
|
|
f6021d |
zones.name, 1, zones.signconf, 0,
|
|
|
f6021d |
0,0,0,
|
|
|
f6021d |
0,0,0,
|
|
|
f6021d |
zones.in_type, zones.input,
|
|
|
f6021d |
zones.out_type, zones.output,
|
|
|
f6021d |
0,0,0
|
|
|
f6021d |
FROM REMOTE.zones;
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** keyData table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
-- Temporary mapping table between 1.4 states and 2.0 ds_at_parent states
|
|
|
f6021d |
-- We are ignoring the fact this may set a DS state for a ZSK; We don't care
|
|
|
f6021d |
CREATE TABLE mapping (
|
|
|
f6021d |
state INTEGER,
|
|
|
f6021d |
ds_state INTEGER
|
|
|
f6021d |
);
|
|
|
f6021d |
INSERT INTO mapping SELECT 1, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 2, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 3, 1;
|
|
|
f6021d |
INSERT INTO mapping SELECT 4, 3;
|
|
|
f6021d |
INSERT INTO mapping SELECT 5, 5;
|
|
|
f6021d |
INSERT INTO mapping SELECT 6, 5;
|
|
|
f6021d |
INSERT INTO mapping SELECT 7, 5;
|
|
|
f6021d |
INSERT INTO mapping SELECT 8, 5;
|
|
|
f6021d |
INSERT INTO mapping SELECT 9, 5;
|
|
|
f6021d |
INSERT INTO mapping SELECT 10, 5;
|
|
|
f6021d |
|
|
|
f6021d |
INSERT INTO keyData
|
|
|
f6021d |
SELECT
|
|
|
f6021d |
NULL, 1, REMOTE.dnsseckeys.zone_id,
|
|
|
f6021d |
REMOTE.dnsseckeys.keypair_id, REMOTE.keypairs.algorithm,
|
|
|
f6021d |
CASE WHEN REMOTE.dnsseckeys.publish IS NOT NULL THEN
|
|
|
f6021d |
strftime('%s', REMOTE.dnsseckeys.publish)
|
|
|
f6021d |
ELSE strftime("%s", "now") END,
|
|
|
f6021d |
(~REMOTE.dnsseckeys.keytype&1)+1,
|
|
|
f6021d |
REMOTE.dnsseckeys.state <= 4, -- introducing
|
|
|
f6021d |
0, -- should revoke, not used
|
|
|
f6021d |
0, -- standby
|
|
|
f6021d |
REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 256, --activeZSK:
|
|
|
f6021d |
REMOTE.dnsseckeys.state >= 2 AND REMOTE.dnsseckeys.state <= 5, --publish
|
|
|
f6021d |
REMOTE.dnsseckeys.state = 4 AND REMOTE.dnsseckeys.keytype = 257, --activeKSK:
|
|
|
f6021d |
mapping.ds_state, --dsatparent
|
|
|
f6021d |
1<<16, --keytag (crap, will 2.0 regenerate this?)
|
|
|
f6021d |
(REMOTE.dnsseckeys.keytype&1)*3+1 --minimize
|
|
|
f6021d |
FROM REMOTE.dnsseckeys
|
|
|
f6021d |
JOIN REMOTE.keypairs
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = REMOTE.keypairs.id
|
|
|
f6021d |
JOIN mapping
|
|
|
f6021d |
ON REMOTE.dnsseckeys.state = mapping.state
|
|
|
f6021d |
WHERE EXISTS(select REMOTE.zones.id FROM REMOTE.zones WHERE REMOTE.zones.id = REMOTE.dnsseckeys.zone_id);
|
|
|
f6021d |
|
|
|
f6021d |
-- Everything that is just a ZSK must not have dsatparent set.
|
|
|
f6021d |
UPDATE keyData
|
|
|
f6021d |
SET dsatparent = 0
|
|
|
f6021d |
WHERE role = 2;
|
|
|
f6021d |
|
|
|
f6021d |
DROP TABLE mapping;
|
|
|
f6021d |
|
|
|
f6021d |
-- If a active time is set for a ready KSK dsAtParent is submitted
|
|
|
f6021d |
-- instead of submit
|
|
|
f6021d |
UPDATE keyData
|
|
|
f6021d |
SET dsatparent = 2
|
|
|
f6021d |
WHERE keyData.dsAtParent = 1 AND keyData.id IN (
|
|
|
f6021d |
SELECT keyData.id
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
WHERE REMOTE.dnsseckeys.active IS NOT NULL);
|
|
|
f6021d |
|
|
|
f6021d |
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
-- ~ ** Keystate table
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ **
|
|
|
f6021d |
-- ~ ************
|
|
|
f6021d |
|
|
|
f6021d |
CREATE TABLE mapping (
|
|
|
f6021d |
state INTEGER,
|
|
|
f6021d |
ds INTEGER,
|
|
|
f6021d |
dk INTEGER,
|
|
|
f6021d |
ks INTEGER,
|
|
|
f6021d |
rs INTEGER
|
|
|
f6021d |
);
|
|
|
f6021d |
INSERT INTO mapping SELECT 1, 0, 0, 0, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 2, 0, 1, 1, 1;
|
|
|
f6021d |
INSERT INTO mapping SELECT 3, 0, 2, 2, 1;
|
|
|
f6021d |
INSERT INTO mapping SELECT 4, 2, 2, 2, 1;
|
|
|
f6021d |
INSERT INTO mapping SELECT 5, 3, 2, 2, 3;
|
|
|
f6021d |
INSERT INTO mapping SELECT 6, 0, 3, 3, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 7, 3, 0, 0, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 8, 3, 0, 0, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 9, 3, 0, 0, 0;
|
|
|
f6021d |
INSERT INTO mapping SELECT 10, 3, 0, 0, 0;
|
|
|
f6021d |
|
|
|
f6021d |
-- DS RECORDS
|
|
|
f6021d |
INSERT INTO keyState
|
|
|
f6021d |
SELECT NULL, 1, keyData.id, 0, mapping.ds, strftime("%s", "now"), (keyData.minimize>>2)&1, policy.parentDsTtl
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN zone
|
|
|
f6021d |
ON zone.id = keyData.zoneId
|
|
|
f6021d |
JOIN policy
|
|
|
f6021d |
ON policy.id = zone.policyId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
JOIN mapping
|
|
|
f6021d |
ON mapping.state = REMOTE.dnsseckeys.state;
|
|
|
f6021d |
|
|
|
f6021d |
UPDATE keyState
|
|
|
f6021d |
SET state = 1
|
|
|
f6021d |
WHERE keyState.state = 0 AND keyState.type = 0 AND keyState.id IN (
|
|
|
f6021d |
SELECT keyState.id
|
|
|
f6021d |
FROM keyState
|
|
|
f6021d |
JOIN keyData
|
|
|
f6021d |
ON keyData.id = keyState.keydataId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
WHERE REMOTE.dnsseckeys.active IS NOT NULL);
|
|
|
f6021d |
|
|
|
f6021d |
-- DNSKEY RECORDS
|
|
|
f6021d |
INSERT INTO keyState
|
|
|
f6021d |
SELECT NULL, 1, keyData.id, 2, mapping.dk, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN zone
|
|
|
f6021d |
ON zone.id = keyData.zoneId
|
|
|
f6021d |
JOIN policy
|
|
|
f6021d |
ON policy.id = zone.policyId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
JOIN mapping
|
|
|
f6021d |
ON mapping.state = REMOTE.dnsseckeys.state;
|
|
|
f6021d |
|
|
|
f6021d |
-- RRSIG DNSKEY RECORDS
|
|
|
f6021d |
INSERT INTO keyState
|
|
|
f6021d |
SELECT NULL, 1, keyData.id, 3, mapping.ks, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN zone
|
|
|
f6021d |
ON zone.id = keyData.zoneId
|
|
|
f6021d |
JOIN policy
|
|
|
f6021d |
ON policy.id = zone.policyId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
JOIN mapping
|
|
|
f6021d |
ON mapping.state = REMOTE.dnsseckeys.state;
|
|
|
f6021d |
|
|
|
f6021d |
-- RRSIG RECORDS
|
|
|
f6021d |
INSERT INTO keyState
|
|
|
f6021d |
SELECT NULL, 1, keyData.id, 1, mapping.rs, strftime("%s", "now"), (keyData.minimize>>0)&1, policy.signaturesMaxZoneTtl
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN zone
|
|
|
f6021d |
ON zone.id = keyData.zoneId
|
|
|
f6021d |
JOIN policy
|
|
|
f6021d |
ON policy.id = zone.policyId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
JOIN mapping
|
|
|
f6021d |
ON mapping.state = REMOTE.dnsseckeys.state;
|
|
|
f6021d |
|
|
|
f6021d |
--Set to OMN if Tactive + Dttl < Tnow
|
|
|
f6021d |
UPDATE keyState
|
|
|
f6021d |
SET state = 2
|
|
|
f6021d |
WHERE keyState.state = 1 AND keyState.type = 1 AND keyState.id IN (
|
|
|
f6021d |
SELECT keyState.id
|
|
|
f6021d |
FROM keyState
|
|
|
f6021d |
JOIN keyData
|
|
|
f6021d |
ON keyData.id = keyState.keydataId
|
|
|
f6021d |
JOIN REMOTE.dnsseckeys
|
|
|
f6021d |
ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
|
|
|
f6021d |
JOIN zone
|
|
|
f6021d |
ON keyData.zoneId = zone.id
|
|
|
f6021d |
JOIN policy
|
|
|
f6021d |
ON policy.id = zone.policyId
|
|
|
f6021d |
WHERE CAST(strftime("%s", REMOTE.dnsseckeys.active) + policy.signaturesValidityDefault as INTEGER) < strftime("%s", "now"));
|
|
|
f6021d |
|
|
|
f6021d |
--Force the RRSIG state in omnipresent if rumoured and there is no old ZSK
|
|
|
f6021d |
-- unretentive
|
|
|
f6021d |
UPDATE keyState
|
|
|
f6021d |
SET state = 2
|
|
|
f6021d |
WHERE keyState.id IN (
|
|
|
f6021d |
SELECT rs.id FROM keyState AS rs
|
|
|
f6021d |
JOIN keystate AS dk ON dk.keyDataId == rs.keyDataId
|
|
|
f6021d |
WHERE rs.type == 1 AND dk.type == 2 AND rs.state == 1 AND dk.state == 2
|
|
|
f6021d |
AND NOT EXISTS(
|
|
|
f6021d |
SELECT* FROM keystate AS rs2
|
|
|
f6021d |
JOIN keystate AS dk2 ON dk2.keyDataId == rs2.keyDataId
|
|
|
f6021d |
WHERE rs2.type == 1 AND dk2.type == 2 AND rs2.state == 3 AND dk2.state == 2
|
|
|
f6021d |
));
|
|
|
f6021d |
|
|
|
f6021d |
DROP TABLE mapping;
|
|
|
f6021d |
|
|
|
f6021d |
-- We need to create records in the keydependency table in case we are in a
|
|
|
f6021d |
-- rollover. Only done for ZSK. For every introducing ZSK with RRSIG rumoured
|
|
|
f6021d |
-- that has an outroducing ZSK with RRSIG unretentive, we add a record.
|
|
|
f6021d |
INSERT INTO keyDependency
|
|
|
f6021d |
SELECT NULL, 0, keyData.zoneID, SUB.IDout, keyData.id, 1
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN keyState AS KS1
|
|
|
f6021d |
ON KS1.keyDataId == keyData.id
|
|
|
f6021d |
JOIN keyState AS KS2
|
|
|
f6021d |
ON KS2.keyDataId == keyData.id
|
|
|
f6021d |
JOIN (
|
|
|
f6021d |
SELECT keyData.id AS IDout, keyData.zoneID
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
JOIN keyState AS KS1
|
|
|
f6021d |
ON KS1.keyDataId == keyData.id
|
|
|
f6021d |
JOIN keyState AS KS2
|
|
|
f6021d |
ON KS2.keyDataId == keyData.id
|
|
|
f6021d |
WHERE KS1.type == 2
|
|
|
f6021d |
AND ks1.state = 2
|
|
|
f6021d |
AND KS2.type == 1
|
|
|
f6021d |
AND KS2.state == 3
|
|
|
f6021d |
AND keyData.introducing == 0
|
|
|
f6021d |
AND keyData.role == 2
|
|
|
f6021d |
) AS SUB
|
|
|
f6021d |
ON SUB.zoneId == keyData.zoneId
|
|
|
f6021d |
WHERE
|
|
|
f6021d |
KS1.type == 2
|
|
|
f6021d |
AND ks1.state = 2
|
|
|
f6021d |
AND KS2.type == 1
|
|
|
f6021d |
AND KS2.state == 1
|
|
|
f6021d |
AND keyData.introducing == 1
|
|
|
f6021d |
AND keyData.role == 2;
|
|
|
f6021d |
|
|
|
f6021d |
-- ZSK
|
|
|
f6021d |
UPDATE keyState
|
|
|
f6021d |
SET state = 4
|
|
|
f6021d |
WHERE (keyState.type = 0 OR keyState.type = 3) AND keyDataId IN (
|
|
|
f6021d |
SELECT keyData.id
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
WHERE keyData.role = 2);
|
|
|
f6021d |
|
|
|
f6021d |
--KSK
|
|
|
f6021d |
UPDATE keyState
|
|
|
f6021d |
SET state = 4
|
|
|
f6021d |
WHERE keyState.type = 1 AND keyDataId IN (
|
|
|
f6021d |
SELECT keyData.id
|
|
|
f6021d |
FROM keyData
|
|
|
f6021d |
WHERE keyData.role = 1);
|
|
|
f6021d |
|
|
|
f6021d |
-- For rpm based systems to see if db was migrated already. store opendnssec major minor version
|
|
|
f6021d |
CREATE TABLE rpm_migration (
|
|
|
f6021d |
major INTEGER,
|
|
|
f6021d |
minor INTEGER
|
|
|
f6021d |
);
|
|
|
f6021d |
INSERT INTO rpm_migration VALUES(2, 1);
|
|
|
f6021d |
|