Kea: isc::gss_tsig::GssTsigImpl Class Reference

| Kea 3.0.2-git

isc::gss_tsig::GssTsigImpl Class Reference

GSS-TSIG hook implementation. More...

`#include <gss_tsig_impl.h>`

## Public Member Functions
| GssTsigImpl ()
| Constructor.
virtual | ~GssTsigImpl ()
| Destructor.
void | commandProcessed (isc::hooks::CalloutHandle &handle)
| The command_processed handler.
void | configure (isc::data::ConstElementPtr config)
| Configure.
void | createKey (DnsServerPtr server, std::chrono::time_point< std::chrono::system_clock > now)
| Create new GSS-TSIG key.
ManagedKeyPtr | findKey (const d2::DnsServerInfoPtr &server_info, bool &useGssTsig, bool &fallback)
| Find a GSS-TSIG key by server info.
ManagedKeyPtr | findKey (const std::string &name) const
| Find a GSS-TSIG key by name.
void | finishConfigure (isc::d2::D2CfgContextPtr d2_config)
| Finish configure.
void | getAllHandler (isc::hooks::CalloutHandle &handle) const
| The gss-tsig-get-all command handler.
void | getHandler (isc::hooks::CalloutHandle &handle) const
| The gss-tsig-get command handler.
isc::asiolink::IOServicePtr | getIOService ()
| Get the hook I/O service.
DnsServerPtr | getServer (const std::string &id) const
| Get the DNS server from its ID.
void | keyDelHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-key-del command handler.
void | keyExpireHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-key-expire command handler.
void | keyGetHandler (isc::hooks::CalloutHandle &handle) const
| The gss-tsig-key-get command handler.
void | listHandler (isc::hooks::CalloutHandle &handle) const
| The gss-tsig-list command handler.
void | processAllServersKeys (bool rekey=false)
| Process GSS-TSIG keys for all servers.
void | processServerKeys (DnsServerPtr server, bool rekey=false)
| Process GSS-TSIG keys for a specific server.
void | purgeAllHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-purge-all command handler.
void | purgeHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-purge command handler.
void | purgeKeys ()
| Purge very old GSS-TSIG keys.
void | rekeyAllHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-rekey-all command handler.
void | rekeyHandler (isc::hooks::CalloutHandle &handle)
| The gss-tsig-rekey command handler.
void | setIOService (isc::asiolink::IOServicePtr io_service)
| Set the hook I/O service.
void | start ()
| Start method.
void | stop ()
| Stop method.

## Protected Attributes
GssTsigCfg | cfg_
| GSS-TSIG hook configuration.
isc::asiolink::IOServicePtr | io_service_
| The hook I/O service.
ManagedKeyList | keys_
| Map of GSS-TSIG keys by name.
std::unique_ptr< std::string > | krb5_client_ktname_prev_
| The previous value of client key table environment variable.
std::unique_ptr< std::string > | krb5ccname_prev_
| The previous value of credential cache environment variable.
isc::asiolink::IntervalTimerPtr | purge_timer_
| The purge periodic timer.

## Detailed Description

GSS-TSIG hook implementation.

Note
  : currently only the configuration part: the runtime part will be added later.

Definition at line 63 of file gss_tsig_impl.h.

## Constructor & Destructor Documentation

## ◆ GssTsigImpl()

isc::gss_tsig::GssTsigImpl::GssTsigImpl | ( |  | ) |

Constructor.

Definition at line 32 of file gss_tsig_impl.cc.

References cfg_, io_service_, keys_, krb5_client_ktname_prev_, krb5ccname_prev_, and purge_timer_.

## ◆ ~GssTsigImpl()

isc::gss_tsig::GssTsigImpl::~GssTsigImpl | ( |  | ) |
| virtual

Destructor.

Definition at line 36 of file gss_tsig_impl.cc.

References io_service_, and stop().

Here is the call graph for this function:

## Member Function Documentation

## ◆ commandProcessed()

void isc::gss_tsig::GssTsigImpl::commandProcessed | ( | isc::hooks::CalloutHandle & | handle | ) |

The command_processed handler.

Parameters

  handle | CalloutHandle.

Definition at line 933 of file gss_tsig_impl.cc.

References Element::create(), isc::hooks::CalloutHandle::getArgument(), and Element::map.

Here is the call graph for this function:

## ◆ configure()

void isc::gss_tsig::GssTsigImpl::configure | ( | isc::data::ConstElementPtr | config | ) |

Configure.

Parameters

  config | A map element with parameters.

Exceptions

  BadValue | and similar exceptions on error.

Definition at line 42 of file gss_tsig_impl.cc.

References cfg_, isc::stats::StatsMgr::instance(), krb5_client_ktname_prev_, krb5ccname_prev_, isc::stats::StatsMgr::setValue(), and isc::gss_tsig::DnsServer::STAT_NAMES.

Here is the call graph for this function:

## ◆ createKey()

void isc::gss_tsig::GssTsigImpl::createKey | ( | DnsServerPtr | server,
|  | std::chrono::time_point< std::chrono::system_clock > | now )

Create new GSS-TSIG key.

Parameters

  server | The server for which the new key is added.
  now | The current timestamp.

Definition at line 147 of file gss_tsig_impl.cc.

References isc::stats::StatsMgr::addValue(), isc::stats::StatsMgr::generateName(), isc::gss_tsig::ManagedKey::genName(), isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::GSS_TSIG_NEW_KEY, isc::stats::StatsMgr::instance(), io_service_, keys_, LOG_INFO, and isc::gss_tsig::TKeyExchange::TKEY_EXCHANGE_FLAGS.

Referenced by processServerKeys(), and rekeyHandler().

Here is the call graph for this function:

## ◆ findKey() [1/2]

ManagedKeyPtr isc::gss_tsig::GssTsigImpl::findKey | ( | const d2::DnsServerInfoPtr & | server_info,
|  | bool & | useGssTsig,
|  | bool & | fallback )

Find a GSS-TSIG key by server info.

Parameters

  | server_info | Pointer to a DNS server.
  [out] | useGssTsig | Set to true when GSS-TSIG is used.
  [out] | fallback | Set to true when GSS-TSIG should be used and no key is available fallbacks to the no GSS-TSIG behavior (vs. skips this DNS server).

Returns
  an usable key or null if none was found.

Definition at line 294 of file gss_tsig_impl.cc.

References cfg_, isc::log::DBGLVL_TRACE_BASIC, isc::gss_tsig::ManagedKey::EXPIRED, isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::KEY_LOOKUP_DISABLED, isc::gss_tsig::KEY_LOOKUP_FOUND, isc::gss_tsig::KEY_LOOKUP_NONE, keys_, LOG_DEBUG, and isc::gss_tsig::ManagedKey::USABLE.

Referenced by keyDelHandler(), keyExpireHandler(), and keyGetHandler().

## ◆ findKey() [2/2]

ManagedKeyPtr isc::gss_tsig::GssTsigImpl::findKey | ( | const std::string & | name | ) | const

Find a GSS-TSIG key by name.

Parameters

  name | Name of the key.

Returns
  the key with the name or null if none was found.

Definition at line 329 of file gss_tsig_impl.cc.

References keys_.

## ◆ finishConfigure()

void isc::gss_tsig::GssTsigImpl::finishConfigure | ( | isc::d2::D2CfgContextPtr | d2_config | ) |

Finish configure.

Parameters

  d2_config | D2 server running configuration.

Definition at line 69 of file gss_tsig_impl.cc.

References cfg_.

## ◆ getAllHandler()

void isc::gss_tsig::GssTsigImpl::getAllHandler | ( | isc::hooks::CalloutHandle & | handle | ) | const

The gss-tsig-get-all command handler.

Parameters

  handle | CalloutHandle.

Definition at line 441 of file gss_tsig_impl.cc.

References cfg_, isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), Element::createList(), Element::createMap(), keys_, and isc::hooks::CalloutHandle::setArgument().

Here is the call graph for this function:

## ◆ getHandler()

void isc::gss_tsig::GssTsigImpl::getHandler | ( | isc::hooks::CalloutHandle & | handle | ) | const

The gss-tsig-get command handler.

Parameters

  handle | CalloutHandle.

Definition at line 370 of file gss_tsig_impl.cc.

References cfg_, isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), Element::createList(), isc::hooks::CalloutHandle::getArgument(), isc_throw, keys_, Element::map, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), and Element::string.

Here is the call graph for this function:

## ◆ getIOService()

isc::asiolink::IOServicePtr isc::gss_tsig::GssTsigImpl::getIOService | ( |  | ) |
| inline

Get the hook I/O service.

Returns
  the hook I/O service.

Definition at line 85 of file gss_tsig_impl.h.

References io_service_.

## ◆ getServer()

DnsServerPtr isc::gss_tsig::GssTsigImpl::getServer | ( | const std::string & | id | ) | const

Get the DNS server from its ID.

Parameters

  id | The server ID.

Returns
  the DNS server or null if not found.

Definition at line 289 of file gss_tsig_impl.cc.

References cfg_.

## ◆ keyDelHandler()

void isc::gss_tsig::GssTsigImpl::keyDelHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-key-del command handler.

Parameters

  handle | CalloutHandle.

Definition at line 652 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), findKey(), isc::hooks::CalloutHandle::getArgument(), isc_throw, keys_, Element::map, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), and Element::string.

Here is the call graph for this function:

## ◆ keyExpireHandler()

void isc::gss_tsig::GssTsigImpl::keyExpireHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-key-expire command handler.

Parameters

  handle | CalloutHandle.

Definition at line 575 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), isc::gss_tsig::ManagedKey::EXPIRED, findKey(), isc::hooks::CalloutHandle::getArgument(), isc_throw, Element::map, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), and Element::string.

Here is the call graph for this function:

## ◆ keyGetHandler()

void isc::gss_tsig::GssTsigImpl::keyGetHandler | ( | isc::hooks::CalloutHandle & | handle | ) | const

The gss-tsig-key-get command handler.

Parameters

  handle | CalloutHandle.

Definition at line 511 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), findKey(), isc::hooks::CalloutHandle::getArgument(), isc_throw, Element::map, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), and Element::string.

Here is the call graph for this function:

## ◆ listHandler()

void isc::gss_tsig::GssTsigImpl::listHandler | ( | isc::hooks::CalloutHandle & | handle | ) | const

The gss-tsig-list command handler.

Parameters

  handle | CalloutHandle.

Definition at line 477 of file gss_tsig_impl.cc.

References cfg_, isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_SUCCESS, Element::create(), isc::config::createAnswer(), Element::createList(), Element::createMap(), keys_, and isc::hooks::CalloutHandle::setArgument().

Here is the call graph for this function:

## ◆ processAllServersKeys()

void isc::gss_tsig::GssTsigImpl::processAllServersKeys | ( | bool | rekey = false | ) |

Process GSS-TSIG keys for all servers.

Parameters

  rekey | The flag which indicates if unconditionally rekey all servers.

Definition at line 191 of file gss_tsig_impl.cc.

References cfg_, processServerKeys(), and rekey().

Referenced by rekeyAllHandler(), and start().

Here is the call graph for this function:

## ◆ processServerKeys()

void isc::gss_tsig::GssTsigImpl::processServerKeys | ( | DnsServerPtr | server,
|  | bool | rekey = false )

Process GSS-TSIG keys for a specific server.

Parameters

  server | The server with keys to be processed.
  rekey | The flag which indicates if unconditionally rekey server.

Definition at line 198 of file gss_tsig_impl.cc.

References createKey(), isc::log::DBGLVL_TRACE_BASIC, isc::gss_tsig::ManagedKey::EXPIRED, isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::KEY_PROCESSING_FAILED, isc::gss_tsig::KEY_PROCESSING_FAILED_UNSPECIFIED_ERROR, keys_, LOG_DEBUG, LOG_ERROR, isc::gss_tsig::ManagedKey::NOT_READY, isc::asiolink::IntervalTimer::ONE_SHOT, processServerKeys(), rekey(), isc::gss_tsig::START_REKEY_TIMER, isc::gss_tsig::START_RETRY_TIMER, and isc::gss_tsig::ManagedKey::USABLE.

Referenced by processAllServersKeys(), and processServerKeys().

Here is the call graph for this function:

## ◆ purgeAllHandler()

void isc::gss_tsig::GssTsigImpl::purgeAllHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-purge-all command handler.

Parameters

  handle | CalloutHandle.

Definition at line 813 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), isc::gss_tsig::ManagedKey::EXPIRED, keys_, isc::gss_tsig::ManagedKey::NOT_READY, isc::hooks::CalloutHandle::setArgument(), and isc::gss_tsig::ManagedKey::USABLE.

Here is the call graph for this function:

## ◆ purgeHandler()

void isc::gss_tsig::GssTsigImpl::purgeHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-purge command handler.

Parameters

  handle | CalloutHandle.

Definition at line 720 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), isc::gss_tsig::ManagedKey::EXPIRED, isc::hooks::CalloutHandle::getArgument(), isc_throw, keys_, Element::map, isc::gss_tsig::ManagedKey::NOT_READY, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), Element::string, and isc::gss_tsig::ManagedKey::USABLE.

Here is the call graph for this function:

## ◆ purgeKeys()

void isc::gss_tsig::GssTsigImpl::purgeKeys | ( |  | ) |

Purge very old GSS-TSIG keys.

Handler of the purge periodic timer.

log a message with the count.

Definition at line 338 of file gss_tsig_impl.cc.

References cfg_, isc::log::DBGLVL_TRACE_BASIC, isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::GSS_TSIG_OLD_KEY_REMOVED, keys_, and LOG_DEBUG.

Referenced by start().

## ◆ rekeyAllHandler()

void isc::gss_tsig::GssTsigImpl::rekeyAllHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-rekey-all command handler.

Parameters

  handle | CalloutHandle.

Definition at line 926 of file gss_tsig_impl.cc.

References isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), io_service_, processAllServersKeys(), and isc::hooks::CalloutHandle::setArgument().

Here is the call graph for this function:

## ◆ rekeyHandler()

void isc::gss_tsig::GssTsigImpl::rekeyHandler | ( | isc::hooks::CalloutHandle & | handle | ) |

The gss-tsig-rekey command handler.

Parameters

  handle | CalloutHandle.

Definition at line 861 of file gss_tsig_impl.cc.

References cfg_, isc::config::CONTROL_RESULT_EMPTY, isc::config::CONTROL_RESULT_ERROR, isc::config::CONTROL_RESULT_SUCCESS, isc::config::createAnswer(), createKey(), isc::hooks::CalloutHandle::getArgument(), isc_throw, Element::map, isc::config::parseCommand(), isc::hooks::CalloutHandle::setArgument(), and Element::string.

Here is the call graph for this function:

## ◆ setIOService()

void isc::gss_tsig::GssTsigImpl::setIOService | ( | isc::asiolink::IOServicePtr | io_service | ) |
| inline

Set the hook I/O service.

Parameters

  io_service | the hook I/O service.

Definition at line 92 of file gss_tsig_impl.h.

References io_service_.

## ◆ start()

void isc::gss_tsig::GssTsigImpl::start | ( |  | ) |

Start method.

Note
  This method is called from the I/O context after the d2_srv_configured callout.

Definition at line 74 of file gss_tsig_impl.cc.

References cfg_, isc::log::DBGLVL_TRACE_BASIC, isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::GSS_TSIG_MANAGER_STARTED, io_service_, LOG_DEBUG, processAllServersKeys(), purge_timer_, purgeKeys(), and isc::asiolink::IntervalTimer::REPEATING.

Here is the call graph for this function:

## ◆ stop()

void isc::gss_tsig::GssTsigImpl::stop | ( |  | ) |

Stop method.

Note
  This method is called before unloading.

Definition at line 93 of file gss_tsig_impl.cc.

References cfg_, isc::log::DBGLVL_TRACE_BASIC, isc::stats::StatsMgr::del(), isc::gss_tsig::gss_tsig_logger, isc::gss_tsig::GSS_TSIG_MANAGER_STOP_ERROR, isc::gss_tsig::GSS_TSIG_MANAGER_STOP_GENERAL_ERROR, isc::gss_tsig::GSS_TSIG_MANAGER_STOPPED, isc::stats::StatsMgr::instance(), io_service_, keys_, krb5_client_ktname_prev_, krb5ccname_prev_, LOG_DEBUG, LOG_ERROR, purge_timer_, and isc::gss_tsig::DnsServer::STAT_NAMES.

Referenced by ~GssTsigImpl().

Here is the call graph for this function:

## Member Data Documentation

## ◆ cfg_

GssTsigCfg isc::gss_tsig::GssTsigImpl::cfg_
| protected

GSS-TSIG hook configuration.

Definition at line 211 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), configure(), findKey(), finishConfigure(), getAllHandler(), getHandler(), getServer(), listHandler(), processAllServersKeys(), purgeKeys(), rekeyHandler(), start(), and stop().

## ◆ io_service_

isc::asiolink::IOServicePtr isc::gss_tsig::GssTsigImpl::io_service_
| protected

The hook I/O service.

Definition at line 217 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), ~GssTsigImpl(), createKey(), getIOService(), rekeyAllHandler(), setIOService(), start(), and stop().

## ◆ keys_

ManagedKeyList isc::gss_tsig::GssTsigImpl::keys_
| protected

Map of GSS-TSIG keys by name.

Definition at line 214 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), createKey(), findKey(), findKey(), getAllHandler(), getHandler(), keyDelHandler(), listHandler(), processServerKeys(), purgeAllHandler(), purgeHandler(), purgeKeys(), and stop().

## ◆ krb5_client_ktname_prev_

std::unique_ptr<std::string> isc::gss_tsig::GssTsigImpl::krb5_client_ktname_prev_
| protected

The previous value of client key table environment variable.

Definition at line 220 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), configure(), and stop().

## ◆ krb5ccname_prev_

std::unique_ptr<std::string> isc::gss_tsig::GssTsigImpl::krb5ccname_prev_
| protected

The previous value of credential cache environment variable.

Definition at line 223 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), configure(), and stop().

## ◆ purge_timer_

isc::asiolink::IntervalTimerPtr isc::gss_tsig::GssTsigImpl::purge_timer_
| protected

The purge periodic timer.

Definition at line 226 of file gss_tsig_impl.h.

Referenced by GssTsigImpl(), start(), and stop().

The documentation for this class was generated from the following files:

- gss_tsig_impl.h
- gss_tsig_impl.cc