[Opendnssec-user] Question about ods-enforcerd and how it chooses keys

[Jake Zack]

In a previous version of OpenDNSSEC (1.4.8.2), two separate machines running ods-enforcerd while using the same HSM (either AEP Keyper or SoftHSM) would select keys in the same order. This occurred after the initial 'ods-ksmutil setup' (and start of ods-enforcerd), as well as during a key rotation.

Because of this, I made the assumption that so long as the 'ods-hsmutil list' output on two machines were identical, the logic inside ods-enforcerd would make them select initial and subsequent keys using the same decision-making, thus always ending up with the same result.

Now I'm testing OpenDNSSEC-1.4.14 (and preparing to test OpenDNSSEC-2), and I've noticed that the behaviour of OpenDNSSEC-1.4.14 seems different.

Two machines with access to the same HSM's, upon initial ods-enforcerd start, are selecting different initial keys.
Running 'ods-ksmutil setup' to blow away the database, then restarting ods-enforcerd, also has it selecting different initial keys. (Both different keys from each other, but also different keys from the initial setup altogether.)

Has something drastically changed here? Or did I do something different this time in setting up this test environment that could be causing this?

Thanks,
-jake

[Yuri Schaeffer]

Hi Jack,

Post by Jake Zack
Has something drastically changed here? Or did I do something different
this time in setting up this test environment that could be causing this?

There is no explicit feature regarding the order of unused keys. If this
work before it was by luck. There might have been changes in the key
selection. We had quite some fixes in the HSM interfacing code. However
if you run the two enforcers of the same version I see no reason why
they would not select the same key.

I suspect you also upgraded the database software the enforcer uses to
store references to these keys. Unless specified, SQL results return in
no specific order. So this might depend on version, build, or windspeed.

This will be no different for OpenDNSSEC 2. Also you have very little
guarantee both enforcers would run exactly the same without drift.
Especially on operations where user input is required.

Regards,
Yuri