contrib/bind-9.2.4rc7/bin/dnssec/dnssec-makekeyset.c

   1 /*
   2  * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
   3  * Portions Copyright (C) 2000, 2001  Internet Software Consortium.
   4  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
  11  * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
  12  * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
  13  * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
  16  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 /* $Id: dnssec-makekeyset.c,v 1.52.2.2 2004/03/09 06:09:15 marka Exp $ */
  20
  21 #include <config.h>
  22
  23 #include <stdlib.h>
  24
  25 #include <isc/commandline.h>
  26 #include <isc/entropy.h>
  27 #include <isc/mem.h>
  28 #include <isc/string.h>
  29 #include <isc/util.h>
  30
  31 #include <dns/db.h>
  32 #include <dns/dnssec.h>
  33 #include <dns/fixedname.h>
  34 #include <dns/log.h>
  35 #include <dns/rdata.h>
  36 #include <dns/rdatalist.h>
  37 #include <dns/rdataset.h>
  38 #include <dns/result.h>
  39 #include <dns/secalg.h>
  40 #include <dns/time.h>
  41
  42 #include <dst/dst.h>
  43
  44 #include "dnssectool.h"
  45
  46 #define BUFSIZE 2048
  47
  48 const char *program = "dnssec-makekeyset";
  49 int verbose;
  50
  51 typedef struct keynode keynode_t;
  52 struct keynode {
  53         dst_key_t *key;
  54         ISC_LINK(keynode_t) link;
  55 };
  56 typedef ISC_LIST(keynode_t) keylist_t;
  57
  58 static isc_stdtime_t starttime = 0, endtime = 0, now;
  59 static int ttl = -1;
  60
  61 static isc_mem_t *mctx = NULL;
  62 static isc_entropy_t *ectx = NULL;
  63
  64 static keylist_t keylist;
  65
  66 static void
  67 usage(void) {
  68         fprintf(stderr, "Usage:\n");
  69         fprintf(stderr, "\t%s [options] keys\n", program);
  70
  71         fprintf(stderr, "\n");
  72
  73         fprintf(stderr, "Options: (default value in parenthesis) \n");
  74         fprintf(stderr, "\t-a\n");
  75         fprintf(stderr, "\t\tverify generated signatures\n");
  76         fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n");
  77         fprintf(stderr, "\t\tSIG start time - absolute|offset (now)\n");
  78         fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
  79         fprintf(stderr, "\t\tSIG end time  - "
  80                              "absolute|from start|from now (now + 30 days)\n");
  81         fprintf(stderr, "\t-t ttl\n");
  82         fprintf(stderr, "\t-p\n");
  83         fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n");
  84         fprintf(stderr, "\t-r randomdev:\n");
  85         fprintf(stderr, "\t\ta file containing random data\n");
  86         fprintf(stderr, "\t-v level:\n");
  87         fprintf(stderr, "\t\tverbose level (0)\n");
  88
  89         fprintf(stderr, "\n");
  90
  91         fprintf(stderr, "keys:\n");
  92         fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
  93
  94         fprintf(stderr, "\n");
  95
  96         fprintf(stderr, "Output:\n");
  97         fprintf(stderr, "\tkeyset (keyset-<name>)\n");
  98         exit(0);
  99 }
 100
 101 static isc_boolean_t
 102 zonekey_on_list(dst_key_t *key) {
 103         keynode_t *keynode;
 104         for (keynode = ISC_LIST_HEAD(keylist);
 105              keynode != NULL;
 106              keynode = ISC_LIST_NEXT(keynode, link))
 107         {
 108                 if (dst_key_compare(keynode->key, key))
 109                         return (ISC_TRUE);
 110         }
 111         return (ISC_FALSE);
 112 }
 113
 114 static isc_boolean_t
 115 rdata_on_list(dns_rdata_t *rdata, dns_rdatalist_t *list) {
 116         dns_rdata_t *trdata;
 117         for (trdata = ISC_LIST_HEAD(list->rdata);
 118              trdata != NULL;
 119              trdata = ISC_LIST_NEXT(trdata, link))
 120         {
 121                 if (dns_rdata_compare(trdata, rdata) == 0)
 122                         return (ISC_TRUE);
 123         }
 124         return (ISC_FALSE);
 125 }
 126
 127 int
 128 main(int argc, char *argv[]) {
 129         int i, ch;
 130         char *startstr = NULL, *endstr = NULL;
 131         char *randomfile = NULL;
 132         dns_fixedname_t fdomain;
 133         dns_name_t *domain = NULL;
 134         char *output = NULL;
 135         char *endp;
 136         unsigned char *data;
 137         dns_db_t *db;
 138         dns_dbnode_t *node;
 139         dns_dbversion_t *version;
 140         dst_key_t *key = NULL;
 141         dns_rdata_t *rdata;
 142         dns_rdatalist_t rdatalist, sigrdatalist;
 143         dns_rdataset_t rdataset, sigrdataset;
 144         isc_result_t result;
 145         isc_buffer_t b;
 146         isc_region_t r;
 147         isc_log_t *log = NULL;
 148         keynode_t *keynode;
 149         dns_name_t *savedname = NULL;
 150         unsigned int eflags;
 151         isc_boolean_t pseudorandom = ISC_FALSE;
 152         isc_boolean_t tryverify = ISC_FALSE;
 153
 154         result = isc_mem_create(0, 0, &mctx);
 155         if (result != ISC_R_SUCCESS)
 156                 fatal("failed to create memory context: %s",
 157                       isc_result_totext(result));
 158
 159         dns_result_register();
 160
 161         while ((ch = isc_commandline_parse(argc, argv, "as:e:t:r:v:ph")) != -1)
 162         {
 163                 switch (ch) {
 164                 case 'a':
 165                         tryverify = ISC_TRUE;
 166                         break;
 167                 case 's':
 168                         startstr = isc_commandline_argument;
 169                         break;
 170
 171                 case 'e':
 172                         endstr = isc_commandline_argument;
 173                         break;
 174
 175                 case 't':
 176                         endp = NULL;
 177                         ttl = strtol(isc_commandline_argument, &endp, 0);
 178                         if (*endp != '\0')
 179                                 fatal("TTL must be numeric");
 180                         break;
 181
 182                 case 'r':
 183                         randomfile = isc_commandline_argument;
 184                         break;
 185
 186                 case 'v':
 187                         endp = NULL;
 188                         verbose = strtol(isc_commandline_argument, &endp, 0);
 189                         if (*endp != '\0')
 190                                 fatal("verbose level must be numeric");
 191                         break;
 192
 193                 case 'p':
 194                         pseudorandom = ISC_TRUE;
 195                         break;
 196
 197                 case 'h':
 198                 default:
 199                         usage();
 200
 201                 }
 202         }
 203
 204         argc -= isc_commandline_index;
 205         argv += isc_commandline_index;
 206
 207         if (argc < 1)
 208                 usage();
 209
 210         setup_entropy(mctx, randomfile, &ectx);
 211         eflags = ISC_ENTROPY_BLOCKING;
 212         if (!pseudorandom)
 213                 eflags |= ISC_ENTROPY_GOODONLY;
 214         result = dst_lib_init(mctx, ectx, eflags);
 215         if (result != ISC_R_SUCCESS)
 216                 fatal("could not initialize dst: %s",
 217                       isc_result_totext(result));
 218
 219         isc_stdtime_get(&now);
 220
 221         if (startstr != NULL)
 222                 starttime = strtotime(startstr, now, now);
 223         else
 224                 starttime = now;
 225
 226         if (endstr != NULL)
 227                 endtime = strtotime(endstr, now, starttime);
 228         else
 229                 endtime = starttime + (30 * 24 * 60 * 60);
 230
 231         if (ttl == -1) {
 232                 ttl = 3600;
 233                 fprintf(stderr, "%s: TTL not specified, assuming 3600\n",
 234                         program);
 235         }
 236
 237         setup_logging(verbose, mctx, &log);
 238
 239         dns_rdatalist_init(&rdatalist);
 240         rdatalist.rdclass = 0;
 241         rdatalist.type = dns_rdatatype_key;
 242         rdatalist.covers = 0;
 243         rdatalist.ttl = ttl;
 244
 245         ISC_LIST_INIT(keylist);
 246
 247         for (i = 0; i < argc; i++) {
 248                 char namestr[DNS_NAME_FORMATSIZE];
 249                 isc_buffer_t namebuf;
 250
 251                 key = NULL;
 252                 result = dst_key_fromnamedfile(argv[i], DST_TYPE_PUBLIC,
 253                                                mctx, &key);
 254                 if (result != ISC_R_SUCCESS)
 255                         fatal("error loading key from %s: %s", argv[i],
 256                               isc_result_totext(result));
 257                 if (rdatalist.rdclass == 0)
 258                         rdatalist.rdclass = dst_key_class(key);
 259
 260                 isc_buffer_init(&namebuf, namestr, sizeof namestr);
 261                 result = dns_name_tofilenametext(dst_key_name(key),
 262                                                  ISC_FALSE,
 263                                                  &namebuf);
 264                 check_result(result, "dns_name_tofilenametext");
 265                 isc_buffer_putuint8(&namebuf, 0);
 266
 267                 if (savedname == NULL) {
 268                         savedname = isc_mem_get(mctx, sizeof(dns_name_t));
 269                         if (savedname == NULL)
 270                                 fatal("out of memory");
 271                         dns_name_init(savedname, NULL);
 272                         result = dns_name_dup(dst_key_name(key), mctx,
 273                                               savedname);
 274                         if (result != ISC_R_SUCCESS)
 275                                 fatal("out of memory");
 276                 } else {
 277                         char savednamestr[DNS_NAME_FORMATSIZE];
 278                         dns_name_format(savedname, savednamestr,
 279                                         sizeof savednamestr);
 280                         if (!dns_name_equal(savedname, dst_key_name(key)) != 0)
 281                                 fatal("all keys must have the same owner - %s "
 282                                       "and %s do not match",
 283                                       savednamestr, namestr);
 284                 }
 285                 if (output == NULL) {
 286                         output = isc_mem_allocate(mctx,
 287                                                   strlen("keyset-") +
 288                                                   strlen(namestr) + 1);
 289                         if (output == NULL)
 290                                 fatal("out of memory");
 291                         strcpy(output, "keyset-");
 292                         strcat(output, namestr);
 293                 }
 294                 if (domain == NULL) {
 295                         dns_fixedname_init(&fdomain);
 296                         domain = dns_fixedname_name(&fdomain);
 297                         dns_name_copy(dst_key_name(key), domain, NULL);
 298                 }
 299                 if (dst_key_iszonekey(key)) {
 300                         dst_key_t *zonekey = NULL;
 301                         result = dst_key_fromnamedfile(argv[i],
 302                                                        DST_TYPE_PUBLIC |
 303                                                        DST_TYPE_PRIVATE,
 304                                                        mctx, &zonekey);
 305                         if (result != ISC_R_SUCCESS)
 306                                 fatal("failed to read private key %s: %s",
 307                                       argv[i], isc_result_totext(result));
 308                         if (!zonekey_on_list(zonekey)) {
 309                                 keynode = isc_mem_get(mctx,
 310                                                       sizeof (keynode_t));
 311                                 if (keynode == NULL)
 312                                         fatal("out of memory");
 313                                 keynode->key = zonekey;
 314                                 ISC_LIST_INITANDAPPEND(keylist, keynode, link);
 315                         } else
 316                                 dst_key_free(&zonekey);
 317                 }
 318                 rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
 319                 if (rdata == NULL)
 320                         fatal("out of memory");
 321                 dns_rdata_init(rdata);
 322                 data = isc_mem_get(mctx, BUFSIZE);
 323                 if (data == NULL)
 324                         fatal("out of memory");
 325                 isc_buffer_init(&b, data, BUFSIZE);
 326                 result = dst_key_todns(key, &b);
 327                 if (result != ISC_R_SUCCESS)
 328                         fatal("failed to convert key %s to a DNS KEY: %s",
 329                               argv[i], isc_result_totext(result));
 330                 isc_buffer_usedregion(&b, &r);
 331                 dns_rdata_fromregion(rdata, rdatalist.rdclass,
 332                                      dns_rdatatype_key, &r);
 333                 if (!rdata_on_list(rdata, &rdatalist))
 334                         ISC_LIST_APPEND(rdatalist.rdata, rdata, link);
 335                 else {
 336                         isc_mem_put(mctx, data, BUFSIZE);
 337                         isc_mem_put(mctx, rdata, sizeof *rdata);
 338                 }
 339                 dst_key_free(&key);
 340         }
 341
 342         dns_rdataset_init(&rdataset);
 343         result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
 344         check_result(result, "dns_rdatalist_tordataset()");
 345
 346         dns_rdatalist_init(&sigrdatalist);
 347         sigrdatalist.rdclass = rdatalist.rdclass;
 348         sigrdatalist.type = dns_rdatatype_sig;
 349         sigrdatalist.covers = dns_rdatatype_key;
 350         sigrdatalist.ttl = ttl;
 351
 352         if (ISC_LIST_EMPTY(keylist))
 353                 fprintf(stderr,
 354                         "%s: no private zone key found; not self-signing\n",
 355                         program);
 356         for (keynode = ISC_LIST_HEAD(keylist);
 357              keynode != NULL;
 358              keynode = ISC_LIST_NEXT(keynode, link))
 359         {
 360                 rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
 361                 if (rdata == NULL)
 362                         fatal("out of memory");
 363                 dns_rdata_init(rdata);
 364                 data = isc_mem_get(mctx, BUFSIZE);
 365                 if (data == NULL)
 366                         fatal("out of memory");
 367                 isc_buffer_init(&b, data, BUFSIZE);
 368                 result = dns_dnssec_sign(domain, &rdataset, keynode->key,
 369                                          &starttime, &endtime, mctx, &b,
 370                                          rdata);
 371                 isc_entropy_stopcallbacksources(ectx);
 372                 if (result != ISC_R_SUCCESS) {
 373                         char keystr[KEY_FORMATSIZE];
 374                         key_format(keynode->key, keystr, sizeof keystr);
 375                         fatal("failed to sign keyset with key %s: %s",
 376                               keystr, isc_result_totext(result));
 377                 }
 378                 if (tryverify) {
 379                         result = dns_dnssec_verify(domain, &rdataset,
 380                                                    keynode->key, ISC_TRUE,
 381                                                    mctx, rdata);
 382                         if (result != ISC_R_SUCCESS) {
 383                                 char keystr[KEY_FORMATSIZE];
 384                                 key_format(keynode->key, keystr, sizeof keystr);
 385                                 fatal("signature from key '%s' failed to "
 386                                       "verify: %s",
 387                                       keystr, isc_result_totext(result));
 388                         }
 389                 }
 390                 ISC_LIST_APPEND(sigrdatalist.rdata, rdata, link);
 391                 dns_rdataset_init(&sigrdataset);
 392                 result = dns_rdatalist_tordataset(&sigrdatalist, &sigrdataset);
 393                 check_result(result, "dns_rdatalist_tordataset()");
 394         }
 395
 396         db = NULL;
 397         result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 398                                rdataset.rdclass, 0, NULL, &db);
 399         if (result != ISC_R_SUCCESS) {
 400                 char domainstr[DNS_NAME_FORMATSIZE];
 401                 dns_name_format(domain, domainstr, sizeof domainstr);
 402                 fatal("failed to create a database for %s", domainstr);
 403         }
 404
 405         version = NULL;
 406         dns_db_newversion(db, &version);
 407
 408         node = NULL;
 409         result = dns_db_findnode(db, domain, ISC_TRUE, &node);
 410         check_result(result, "dns_db_findnode()");
 411
 412         dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL);
 413         if (!ISC_LIST_EMPTY(keylist))
 414                 dns_db_addrdataset(db, node, version, 0, &sigrdataset, 0,
 415                                    NULL);
 416
 417         dns_db_detachnode(db, &node);
 418         dns_db_closeversion(db, &version, ISC_TRUE);
 419         result = dns_db_dump(db, version, output);
 420         if (result != ISC_R_SUCCESS) {
 421                 char domainstr[DNS_NAME_FORMATSIZE];
 422                 dns_name_format(domain, domainstr, sizeof domainstr);
 423                 fatal("failed to write database for %s to %s",
 424                       domainstr, output);
 425         }
 426
 427         printf("%s\n", output);
 428
 429         dns_db_detach(&db);
 430
 431         dns_rdataset_disassociate(&rdataset);
 432         while (!ISC_LIST_EMPTY(rdatalist.rdata)) {
 433                 rdata = ISC_LIST_HEAD(rdatalist.rdata);
 434                 ISC_LIST_UNLINK(rdatalist.rdata, rdata, link);
 435                 isc_mem_put(mctx, rdata->data, BUFSIZE);
 436                 isc_mem_put(mctx, rdata, sizeof *rdata);
 437         }
 438         while (!ISC_LIST_EMPTY(sigrdatalist.rdata)) {
 439                 rdata = ISC_LIST_HEAD(sigrdatalist.rdata);
 440                 ISC_LIST_UNLINK(sigrdatalist.rdata, rdata, link);
 441                 isc_mem_put(mctx, rdata->data, BUFSIZE);
 442                 isc_mem_put(mctx, rdata, sizeof *rdata);
 443         }
 444
 445         while (!ISC_LIST_EMPTY(keylist)) {
 446                 keynode = ISC_LIST_HEAD(keylist);
 447                 ISC_LIST_UNLINK(keylist, keynode, link);
 448                 dst_key_free(&keynode->key);
 449                 isc_mem_put(mctx, keynode, sizeof(keynode_t));
 450         }
 451
 452         if (savedname != NULL) {
 453                 dns_name_free(savedname, mctx);
 454                 isc_mem_put(mctx, savedname, sizeof(dns_name_t));
 455         }
 456
 457         cleanup_logging(&log);
 458         cleanup_entropy(&ectx);
 459
 460         isc_mem_free(mctx, output);
 461         dst_lib_destroy();
 462         if (verbose > 10)
 463                 isc_mem_stats(mctx, stdout);
 464         isc_mem_destroy(&mctx);
 465         return (0);
 466 }