From dd3346a020052dba871c30cf07efe4f4a5de01e4 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Mar 05 2015 13:27:36 +0000 Subject: import opendnssec-1.4.6-3.el7 --- diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1772253 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/opendnssec-1.4.6.tar.gz diff --git a/.opendnssec.metadata b/.opendnssec.metadata new file mode 100644 index 0000000..7deff2d --- /dev/null +++ b/.opendnssec.metadata @@ -0,0 +1 @@ +2318b31546d0d4118cd03b9591ba76d259e1b0b0 SOURCES/opendnssec-1.4.6.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index 98f42b4..0000000 --- a/README.md +++ /dev/null @@ -1,4 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/0000-add-libhsm-configuration-option-AllowExtraction.patch b/SOURCES/0000-add-libhsm-configuration-option-AllowExtraction.patch new file mode 100644 index 0000000..6875041 --- /dev/null +++ b/SOURCES/0000-add-libhsm-configuration-option-AllowExtraction.patch @@ -0,0 +1,162 @@ +From 672d2c75ccd3cd5f2317bb76af4c9cc4e5aa4a37 Mon Sep 17 00:00:00 2001 +From: Petr Spacek +Date: Fri, 18 Jul 2014 16:19:36 +0200 +Subject: [PATCH] add libhsm configuration option + +This option allows user to generate private keys with CKA_EXTRACTABLE +flag set to TRUE. Defaults to FALSE. +--- + NEWS | 5 +++++ + conf/conf.rnc | 5 ++++- + conf/conf.xml.in | 3 +++ + libhsm/src/lib/libhsm.c | 15 ++++++++++++--- + libhsm/src/lib/libhsm.h | 1 + + 5 files changed, 25 insertions(+), 4 deletions(-) + +diff --git a/NEWS b/NEWS +index 4db7038..2efa176 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,3 +1,8 @@ ++* Enforcer: New repository option allows to generate keys ++ with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped ++ and extracted from HSM. ++ ++ + OpenDNSSEC 1.4.6 - 2014-07-21 + + * Signer Engine: Print secondary server address when logging notify reply +diff --git a/conf/conf.rnc b/conf/conf.rnc +index 71d527f..65f837e 100644 +--- a/conf/conf.rnc ++++ b/conf/conf.rnc +@@ -50,7 +50,10 @@ start = element Configuration { + element RequireBackup { empty }?, + + # Do not maintain public keys in the repository (optional) +- element SkipPublicKey { empty }? ++ element SkipPublicKey { empty }?, ++ ++ # Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional) ++ element AllowExtraction { empty }? + }* + }, + +diff --git a/conf/conf.xml.in b/conf/conf.xml.in +index 0ef2ab9..0536681 100644 +--- a/conf/conf.xml.in ++++ b/conf/conf.xml.in +@@ -9,6 +9,9 @@ + OpenDNSSEC + 1234 + ++ + + + + + + + + + + + + local0 + + + /etc/opendnssec/kasp.xml + /etc/opendnssec/zonelist.xml + + + + + + + ods + ods + + + /var/opendnssec/kasp.db + PT3600S + + + + + + + + + + ods + ods + + + /var/opendnssec/tmp + 4 + + + + + + + diff --git a/SOURCES/ods-enforcerd.service b/SOURCES/ods-enforcerd.service new file mode 100644 index 0000000..b660d86 --- /dev/null +++ b/SOURCES/ods-enforcerd.service @@ -0,0 +1,12 @@ +[Unit] +Description=OpenDNSSEC Enforcer daemon +After=syslog.target network.target + +[Service] +Type=forking +PIDFile=/var/run/opendnssec/enforcerd.pid +EnvironmentFile=-/etc/sysconfig/ods +ExecStart=/usr/sbin/ods-enforcerd $ODS_ENFORCERD_OPT + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/ods-signerd.service b/SOURCES/ods-signerd.service new file mode 100644 index 0000000..f8a097c --- /dev/null +++ b/SOURCES/ods-signerd.service @@ -0,0 +1,13 @@ +[Unit] +Description=OpenDNSSEC signer daemon +After=syslog.target network.target + +[Service] +Type=simple +PIDFile=/var/run/opendnssec/signerd.pid +EnvironmentFile=-/etc/sysconfig/ods +ExecStart=/usr/sbin/ods-signerd -d $ODS_SIGNERD_OPT +After=ods-enforcerd + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/ods.sysconfig b/SOURCES/ods.sysconfig new file mode 100644 index 0000000..1cf67f2 --- /dev/null +++ b/SOURCES/ods.sysconfig @@ -0,0 +1,2 @@ +ODS_SIGNERD_OPT="" +ODS_ENFORCERD_OPT="" diff --git a/SOURCES/opendnssec.cron b/SOURCES/opendnssec.cron new file mode 100644 index 0000000..776de9b --- /dev/null +++ b/SOURCES/opendnssec.cron @@ -0,0 +1,4 @@ +# Ensure multiple ods-enforcerd's on different system roll at the same time +# independant of when the daemon was started. Since TLDs often update their +# zone "on the hour" we do the key rollover checks just before the hour. +50,20 * * * * root test -f /var/lock/subsys/ods-enforcerd && kill -s SIGHUP `cat /var/run/opendnssec/enforcerd.pid` > /dev/null 2> /dev/null diff --git a/SOURCES/tmpfiles-opendnssec.conf b/SOURCES/tmpfiles-opendnssec.conf new file mode 100644 index 0000000..aa50e89 --- /dev/null +++ b/SOURCES/tmpfiles-opendnssec.conf @@ -0,0 +1 @@ +D /var/run/opendnssec 0700 ods ods - diff --git a/SPECS/opendnssec.spec b/SPECS/opendnssec.spec new file mode 100644 index 0000000..26e6d36 --- /dev/null +++ b/SPECS/opendnssec.spec @@ -0,0 +1,140 @@ +#global prever rcX +%global _hardened_build 1 + +Summary: DNSSEC key and zone management software +Name: opendnssec +Version: 1.4.6 +Release: 3%{?prever}%{?dist} +License: BSD +Url: http://www.opendnssec.org/ +Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source1: ods-enforcerd.service +Source2: ods-signerd.service +Source3: ods.sysconfig +Source4: conf.xml +Source5: tmpfiles-opendnssec.conf +Source6: opendnssec.cron + +Patch0: 0000-add-libhsm-configuration-option-AllowExtraction.patch +Patch1: 0001-use-system-trang.patch +Patch2: 0002-get-started.patch + +Group: Applications/System +Requires: opencryptoki, softhsm >= 2.0.0b1-2, systemd-units +BuildRequires: libxml2, libxslt +Requires: libxml2, libxslt +BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel +BuildRequires: libxml2-devel, doxygen, trang +# It tests for pkill/killall and would use /bin/false if not found +BuildRequires: procps-ng +BuildRequires: systemd-units +BuildRequires: sed +Requires(pre): shadow-utils +Requires(post): systemd-units +Requires(preun): systemd-units +Requires(postun): systemd-units +%if 0%{?prever:1} +#For building snapshots +Buildrequires: autoconf, automake, libtool, java +%endif + +%description +OpenDNSSEC was created as an open-source turn-key solution for DNSSEC. +It secures zone data just before it is published in an authoritative +name server. It requires a PKCS#11 crypto module library, such as softhsm. + +This is UNSUPPORTED EXPERIMENTAL package. + +%prep +%setup -q -n %{name}-%{version}%{?prever} +# bump default policy ZSK keysize to 2048 +sed -i "s/1024/2048/" conf/kasp.xml.in +%patch0 -p1 -b .p0.allow_extraction +%patch1 -p1 -b .p0.system_trang +%patch2 -p1 +# fix platform-specific paths in conf.xml +sed -i 's:/usr/lib64:%{_libdir}:' %{SOURCE4} + +%build +export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" +export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security" +export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" +%configure --with-ldns=%{_libdir} --without-cunit +make %{?_smp_mflags} + +%check +# Requires sample db not shipped with upstream +# It also requires CUnit-devel package which is not in RHEL +# make check + +%install +rm -rf %{buildroot} +make DESTDIR=%{buildroot} install +mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} +install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ +install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec +rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample +install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig +install -d -m 0755 %{buildroot}%{_unitdir} +install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ +install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ +install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods +install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ +mkdir -p %{buildroot}%{_sysconfdir}/tmpfiles.d/ +install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/tmpfiles.d/opendnssec.conf +mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec + +%files +%{_unitdir}/ods-enforcerd.service +%{_unitdir}/ods-signerd.service +%config(noreplace) %{_sysconfdir}/tmpfiles.d/opendnssec.conf +%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signed +%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf +%attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods +%attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec +%doc NEWS README.md LICENSE GETSTARTED +%{_mandir}/*/* +%{_sbindir}/* +%{_bindir}/* +%attr(0770,root,ods) %dir %{_datadir}/%{name} +%{_datadir}/%{name}/* + +%pre +getent group ods >/dev/null || groupadd -r ods +getent passwd ods >/dev/null || \ +useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ +-c "opendnssec daemon account" ods +exit 0 + +%post +# in case we update any xml conf file +ods-ksmutil update all >/dev/null 2>/dev/null ||: +%systemd_post ods-enforcerd.service +%systemd_post ods-signerd.service + + +%preun +%systemd_preun ods-enforcerd.service +%systemd_preun ods-signerd.service + +%postun +%systemd_postun_with_restart ods-enforcerd.service +%systemd_postun_with_restart ods-signerd.service + +%changelog +* Tue Sep 30 2014 Petr Spacek - 1.4.6-3 +- Updated spec to build platform-indepent conf.xml + +* Tue Sep 30 2014 Paul Wouters - 1.4.6-2 +- Changed conf.xml to reference softhsm at /usr/lib64/pkcs11/libsofthsm2.so +- Updated Requires: to softhsm >= 2.0.0b1-2 + +* Mon Sep 22 2014 Petr Spacek - 1.4.6-1 +- Imported version 1.4.6 +- Added patch which adds configuration option +