Parent

KASPAuditor::Config

Represents KASP configuration file Also loads salt in from <zone_config>.xml SignerConfiguration file.

Attributes

audit_tag_present[RW]
changed_config[RW]
denial[RW]
err[R]
keys[RW]
name[RW]
partial_audit[R]

Should the PartialAuditor be used instead of the full Auditor?

signatures[RW]
soa[RW]

Public Class Methods

new(zone_name, kasp_file_loc, policy, config_file_loc, syslog) click to toggle source
# File ../../auditor/lib/kasp_auditor/config.rb, line 41
def initialize(zone_name, kasp_file_loc, policy, config_file_loc, syslog)
  return if !zone_name
  #      @zones = []
  #      print "Opening config file : #{config_file_loc}\n"
  # Read the kasp.xml file
  @name = (zone_name.to_s+"").untaint
  @err = 0
  @partial_audit = false
  begin
    File.open((kasp_file_loc+"").untaint, 'r') {|file|
      doc = REXML::Document.new(file)


      # Now find the appropiate policy
      found_policy = false
      doc.elements.each('KASP/Policy') {|p|
        if (p.attributes['name'] == policy)
          found_policy = true
          # Now load the policy in!
      
          # @TODO@ Check out Zone.SOA - should be able to monitor SOA with that

          #        # Fill out new zone
          @audit_tag_present = false
          p.elements.each('Audit') {|a|
            # Read the information present in the Audit element, and
            # figure out what sort of auditor to use - full or partial
            @audit_tag_present = true
            a.elements.each('Partial') {|partial|
              @partial_audit = true
            }
          }
          begin
            @signatures = Signatures.new(p.elements['Signatures'])
            @denial = Denial.new(p.elements['Denial'])
            @keys = Keys.new(p.elements['Keys'])
            @soa = SOA.new(p.elements['Zone/SOA'])
          rescue Exception => e
            raise ConfigLoadError.new("ERROR - Configuration file #{kasp_file_loc} can't be loaded. Try running ods-kaspcheck to check the configuration.")
          end
        end
      }
      if (!found_policy)
        raise ConfigLoadError.new("ERROR - Can't find policy #{policy.inspect} in KASP Policy.")
      end
    }
  rescue Exception => e
    raise ConfigLoadError.new("ERROR - Can't find KASP file : #{kasp_file_loc.inspect} : #{e}")
  end
  #
  # Read the salt ONLY from the SignerConfiguration
  if (@denial.nsec3)
    conf_f = (config_file_loc.to_s+"").untaint
    begin
      File.open(conf_f, 'r') {|file|
        doc = REXML::Document.new(file)
        e = doc.elements['SignerConfiguration/Zone/Denial/NSEC3/Hash/']
        if (e)
          @denial.nsec3.hash.salt = e.elements['Salt'].text
          decoded_salt = Dnsruby::RR::NSEC3.decode_salt(@denial.nsec3.hash.salt)
          if (decoded_salt.length.to_i != @denial.nsec3.hash.salt_length.to_i)
            # @TODO@ Only log this if this is a zone of interest!
            msg = "ERROR : SALT LENGTH IS #{decoded_salt.length}, but should be #{@denial.nsec3.hash.salt_length}"
            print "#{Syslog::LOG_ERR}: #{msg}\n"
            begin
              syslog.log(Syslog::LOG_ERR, msg)
            rescue ArgumentError # Make sure we continue no matter what
            end
            @err = Syslog::LOG_ERR
          end
        else
          raise ConfigLoadError.new("ERROR - can't read salt from SignerConfiguration file : #{conf_f}")
        end
      }
    rescue Errno::ENOENT
      raise ConfigLoadError.new("ERROR - Can't find SignerConfiguration file : #{conf_f}")
    end
  end
end
xsd_duration_to_seconds(xsd_duration) click to toggle source
# File ../../auditor/lib/kasp_auditor/config.rb, line 138
def self.xsd_duration_to_seconds xsd_duration
  # XSDDuration hack
  xsd_duration = "P0DT#{$1}" if xsd_duration =~ /^PT(.*)$/
  xsd_duration = "-P0DT#{$1}" if xsd_duration =~ /^-PT(.*)$/
  a = XSD::XSDDuration.new xsd_duration
  from_min = 0 | a.min * 60
  from_hour = 0 | a.hour * 60 * 60
  from_day = 0 | a.day * 60 * 60 * 24
  from_month = 0 | a.month * 60 * 60 * 24 * 31
  from_year = 0 | a.year * 60 * 60 * 24 * 365
  # XSD::XSDDuration seconds hack.
  x = a.sec.to_s.to_i + from_min + from_hour + from_day + from_month + from_year
  return x
end

Public Instance Methods

inconsistent_nsec3_algorithm?() click to toggle source

Check the defined hash algorithm against the denial type. If NSEC3 is being used, then make sure that the key algorithm is consistent with NSEC3. Return true if an inconsistent key algorithm is used with NSEC3. Return false otherwise.

# File ../../auditor/lib/kasp_auditor/config.rb, line 124
def inconsistent_nsec3_algorithm?
  if (@denial.nsec3)
    @keys.keys.each {|key|
      if ((key.algorithm != Dnsruby::Algorithms.DSA_NSEC3_SHA1) &&
            (key.algorithm != Dnsruby::Algorithms.RSASHA1_NSEC3_SHA1) &&
            (key.algorithm != Dnsruby::Algorithms.RSASHA256) &&
            (key.algorithm != Dnsruby::Algorithms.RSASHA512))
        return true
      end
    }
  end
  return false
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.