Represents KASP configuration file Also loads salt in from <zone_config>.xml SignerConfiguration file.
# File ../../auditor/lib/kasp_auditor/config.rb, line 41 def initialize(zone_name, kasp_file_loc, policy, config_file_loc, syslog) return if !zone_name # @zones = [] # print "Opening config file : #{config_file_loc}\n" # Read the kasp.xml file @name = (zone_name.to_s+"").untaint @err = 0 @partial_audit = false begin File.open((kasp_file_loc+"").untaint, 'r') {|file| doc = REXML::Document.new(file) # Now find the appropiate policy found_policy = false doc.elements.each('KASP/Policy') {|p| if (p.attributes['name'] == policy) found_policy = true # Now load the policy in! # @TODO@ Check out Zone.SOA - should be able to monitor SOA with that # # Fill out new zone @audit_tag_present = false p.elements.each('Audit') {|a| # Read the information present in the Audit element, and # figure out what sort of auditor to use - full or partial @audit_tag_present = true a.elements.each('Partial') {|partial| @partial_audit = true } } begin @signatures = Signatures.new(p.elements['Signatures']) @denial = Denial.new(p.elements['Denial']) @keys = Keys.new(p.elements['Keys']) @soa = SOA.new(p.elements['Zone/SOA']) rescue Exception => e raise ConfigLoadError.new("ERROR - Configuration file #{kasp_file_loc} can't be loaded. Try running ods-kaspcheck to check the configuration.") end end } if (!found_policy) raise ConfigLoadError.new("ERROR - Can't find policy #{policy.inspect} in KASP Policy.") end } rescue Exception => e raise ConfigLoadError.new("ERROR - Can't find KASP file : #{kasp_file_loc.inspect} : #{e}") end # # Read the salt ONLY from the SignerConfiguration if (@denial.nsec3) conf_f = (config_file_loc.to_s+"").untaint begin File.open(conf_f, 'r') {|file| doc = REXML::Document.new(file) e = doc.elements['SignerConfiguration/Zone/Denial/NSEC3/Hash/'] if (e) @denial.nsec3.hash.salt = e.elements['Salt'].text decoded_salt = Dnsruby::RR::NSEC3.decode_salt(@denial.nsec3.hash.salt) if (decoded_salt.length.to_i != @denial.nsec3.hash.salt_length.to_i) # @TODO@ Only log this if this is a zone of interest! msg = "ERROR : SALT LENGTH IS #{decoded_salt.length}, but should be #{@denial.nsec3.hash.salt_length}" print "#{Syslog::LOG_ERR}: #{msg}\n" begin syslog.log(Syslog::LOG_ERR, msg) rescue ArgumentError # Make sure we continue no matter what end @err = Syslog::LOG_ERR end else raise ConfigLoadError.new("ERROR - can't read salt from SignerConfiguration file : #{conf_f}") end } rescue Errno::ENOENT raise ConfigLoadError.new("ERROR - Can't find SignerConfiguration file : #{conf_f}") end end end
# File ../../auditor/lib/kasp_auditor/config.rb, line 138 def self.xsd_duration_to_seconds xsd_duration # XSDDuration hack xsd_duration = "P0DT#{$1}" if xsd_duration =~ /^PT(.*)$/ xsd_duration = "-P0DT#{$1}" if xsd_duration =~ /^-PT(.*)$/ a = XSD::XSDDuration.new xsd_duration from_min = 0 | a.min * 60 from_hour = 0 | a.hour * 60 * 60 from_day = 0 | a.day * 60 * 60 * 24 from_month = 0 | a.month * 60 * 60 * 24 * 31 from_year = 0 | a.year * 60 * 60 * 24 * 365 # XSD::XSDDuration seconds hack. x = a.sec.to_s.to_i + from_min + from_hour + from_day + from_month + from_year return x end
Check the defined hash algorithm against the denial type. If NSEC3 is being used, then make sure that the key algorithm is consistent with NSEC3. Return true if an inconsistent key algorithm is used with NSEC3. Return false otherwise.
# File ../../auditor/lib/kasp_auditor/config.rb, line 124 def inconsistent_nsec3_algorithm? if (@denial.nsec3) @keys.keys.each {|key| if ((key.algorithm != Dnsruby::Algorithms.DSA_NSEC3_SHA1) && (key.algorithm != Dnsruby::Algorithms.RSASHA1_NSEC3_SHA1) && (key.algorithm != Dnsruby::Algorithms.RSASHA256) && (key.algorithm != Dnsruby::Algorithms.RSASHA512)) return true end } end return false end
Generated with the Darkfish Rdoc Generator 2.