Merge from vendor branch TEXINFO:
[dragonfly.git] / contrib / bind-9.2.4rc7 / bin / dnssec / dnssec-makekeyset.c
1 /*
2  * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
3  * Portions Copyright (C) 2000, 2001  Internet Software Consortium.
4  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
11  * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
12  * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
13  * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
16  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 /* $Id: dnssec-makekeyset.c,v 1.52.2.2 2004/03/09 06:09:15 marka Exp $ */
20
21 #include <config.h>
22
23 #include <stdlib.h>
24
25 #include <isc/commandline.h>
26 #include <isc/entropy.h>
27 #include <isc/mem.h>
28 #include <isc/string.h>
29 #include <isc/util.h>
30
31 #include <dns/db.h>
32 #include <dns/dnssec.h>
33 #include <dns/fixedname.h>
34 #include <dns/log.h>
35 #include <dns/rdata.h>
36 #include <dns/rdatalist.h>
37 #include <dns/rdataset.h>
38 #include <dns/result.h>
39 #include <dns/secalg.h>
40 #include <dns/time.h>
41
42 #include <dst/dst.h>
43
44 #include "dnssectool.h"
45
46 #define BUFSIZE 2048
47
48 const char *program = "dnssec-makekeyset";
49 int verbose;
50
51 typedef struct keynode keynode_t;
52 struct keynode {
53         dst_key_t *key;
54         ISC_LINK(keynode_t) link;
55 };
56 typedef ISC_LIST(keynode_t) keylist_t;
57
58 static isc_stdtime_t starttime = 0, endtime = 0, now;
59 static int ttl = -1;
60
61 static isc_mem_t *mctx = NULL;
62 static isc_entropy_t *ectx = NULL;
63
64 static keylist_t keylist;
65
66 static void
67 usage(void) {
68         fprintf(stderr, "Usage:\n");
69         fprintf(stderr, "\t%s [options] keys\n", program);
70
71         fprintf(stderr, "\n");
72
73         fprintf(stderr, "Options: (default value in parenthesis) \n");
74         fprintf(stderr, "\t-a\n");
75         fprintf(stderr, "\t\tverify generated signatures\n");
76         fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n");
77         fprintf(stderr, "\t\tSIG start time - absolute|offset (now)\n");
78         fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
79         fprintf(stderr, "\t\tSIG end time  - "
80                              "absolute|from start|from now (now + 30 days)\n");
81         fprintf(stderr, "\t-t ttl\n");
82         fprintf(stderr, "\t-p\n");
83         fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n");
84         fprintf(stderr, "\t-r randomdev:\n");
85         fprintf(stderr, "\t\ta file containing random data\n");
86         fprintf(stderr, "\t-v level:\n");
87         fprintf(stderr, "\t\tverbose level (0)\n");
88
89         fprintf(stderr, "\n");
90
91         fprintf(stderr, "keys:\n");
92         fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
93
94         fprintf(stderr, "\n");
95
96         fprintf(stderr, "Output:\n");
97         fprintf(stderr, "\tkeyset (keyset-<name>)\n");
98         exit(0);
99 }
100
101 static isc_boolean_t
102 zonekey_on_list(dst_key_t *key) {
103         keynode_t *keynode;
104         for (keynode = ISC_LIST_HEAD(keylist);
105              keynode != NULL;
106              keynode = ISC_LIST_NEXT(keynode, link))
107         {
108                 if (dst_key_compare(keynode->key, key))
109                         return (ISC_TRUE);
110         }
111         return (ISC_FALSE);
112 }
113
114 static isc_boolean_t
115 rdata_on_list(dns_rdata_t *rdata, dns_rdatalist_t *list) {
116         dns_rdata_t *trdata;
117         for (trdata = ISC_LIST_HEAD(list->rdata);
118              trdata != NULL;
119              trdata = ISC_LIST_NEXT(trdata, link))
120         {
121                 if (dns_rdata_compare(trdata, rdata) == 0)
122                         return (ISC_TRUE);
123         }
124         return (ISC_FALSE);
125 }
126
127 int
128 main(int argc, char *argv[]) {
129         int i, ch;
130         char *startstr = NULL, *endstr = NULL;
131         char *randomfile = NULL;
132         dns_fixedname_t fdomain;
133         dns_name_t *domain = NULL;
134         char *output = NULL;
135         char *endp;
136         unsigned char *data;
137         dns_db_t *db;
138         dns_dbnode_t *node;
139         dns_dbversion_t *version;
140         dst_key_t *key = NULL;
141         dns_rdata_t *rdata;
142         dns_rdatalist_t rdatalist, sigrdatalist;
143         dns_rdataset_t rdataset, sigrdataset;
144         isc_result_t result;
145         isc_buffer_t b;
146         isc_region_t r;
147         isc_log_t *log = NULL;
148         keynode_t *keynode;
149         dns_name_t *savedname = NULL;
150         unsigned int eflags;
151         isc_boolean_t pseudorandom = ISC_FALSE;
152         isc_boolean_t tryverify = ISC_FALSE;
153
154         result = isc_mem_create(0, 0, &mctx);
155         if (result != ISC_R_SUCCESS)
156                 fatal("failed to create memory context: %s",
157                       isc_result_totext(result));
158
159         dns_result_register();
160
161         while ((ch = isc_commandline_parse(argc, argv, "as:e:t:r:v:ph")) != -1)
162         {
163                 switch (ch) {
164                 case 'a':
165                         tryverify = ISC_TRUE;
166                         break;
167                 case 's':
168                         startstr = isc_commandline_argument;
169                         break;
170
171                 case 'e':
172                         endstr = isc_commandline_argument;
173                         break;
174
175                 case 't':
176                         endp = NULL;
177                         ttl = strtol(isc_commandline_argument, &endp, 0);
178                         if (*endp != '\0')
179                                 fatal("TTL must be numeric");
180                         break;
181
182                 case 'r':
183                         randomfile = isc_commandline_argument;
184                         break;
185
186                 case 'v':
187                         endp = NULL;
188                         verbose = strtol(isc_commandline_argument, &endp, 0);
189                         if (*endp != '\0')
190                                 fatal("verbose level must be numeric");
191                         break;
192
193                 case 'p':
194                         pseudorandom = ISC_TRUE;
195                         break;
196
197                 case 'h':
198                 default:
199                         usage();
200
201                 }
202         }
203
204         argc -= isc_commandline_index;
205         argv += isc_commandline_index;
206
207         if (argc < 1)
208                 usage();
209
210         setup_entropy(mctx, randomfile, &ectx);
211         eflags = ISC_ENTROPY_BLOCKING;
212         if (!pseudorandom)
213                 eflags |= ISC_ENTROPY_GOODONLY;
214         result = dst_lib_init(mctx, ectx, eflags);
215         if (result != ISC_R_SUCCESS)
216                 fatal("could not initialize dst: %s",
217                       isc_result_totext(result));
218
219         isc_stdtime_get(&now);
220
221         if (startstr != NULL)
222                 starttime = strtotime(startstr, now, now);
223         else
224                 starttime = now;
225
226         if (endstr != NULL)
227                 endtime = strtotime(endstr, now, starttime);
228         else
229                 endtime = starttime + (30 * 24 * 60 * 60);
230
231         if (ttl == -1) {
232                 ttl = 3600;
233                 fprintf(stderr, "%s: TTL not specified, assuming 3600\n",
234                         program);
235         }
236
237         setup_logging(verbose, mctx, &log);
238
239         dns_rdatalist_init(&rdatalist);
240         rdatalist.rdclass = 0;
241         rdatalist.type = dns_rdatatype_key;
242         rdatalist.covers = 0;
243         rdatalist.ttl = ttl;
244
245         ISC_LIST_INIT(keylist);
246
247         for (i = 0; i < argc; i++) {
248                 char namestr[DNS_NAME_FORMATSIZE];
249                 isc_buffer_t namebuf;
250
251                 key = NULL;
252                 result = dst_key_fromnamedfile(argv[i], DST_TYPE_PUBLIC,
253                                                mctx, &key);
254                 if (result != ISC_R_SUCCESS)
255                         fatal("error loading key from %s: %s", argv[i],
256                               isc_result_totext(result));
257                 if (rdatalist.rdclass == 0)
258                         rdatalist.rdclass = dst_key_class(key);
259
260                 isc_buffer_init(&namebuf, namestr, sizeof namestr);
261                 result = dns_name_tofilenametext(dst_key_name(key),
262                                                  ISC_FALSE,
263                                                  &namebuf);
264                 check_result(result, "dns_name_tofilenametext");
265                 isc_buffer_putuint8(&namebuf, 0);
266                 
267                 if (savedname == NULL) {
268                         savedname = isc_mem_get(mctx, sizeof(dns_name_t));
269                         if (savedname == NULL)
270                                 fatal("out of memory");
271                         dns_name_init(savedname, NULL);
272                         result = dns_name_dup(dst_key_name(key), mctx,
273                                               savedname);
274                         if (result != ISC_R_SUCCESS)
275                                 fatal("out of memory");
276                 } else {
277                         char savednamestr[DNS_NAME_FORMATSIZE];
278                         dns_name_format(savedname, savednamestr,
279                                         sizeof savednamestr);
280                         if (!dns_name_equal(savedname, dst_key_name(key)) != 0)
281                                 fatal("all keys must have the same owner - %s "
282                                       "and %s do not match",
283                                       savednamestr, namestr);
284                 }
285                 if (output == NULL) {
286                         output = isc_mem_allocate(mctx,
287                                                   strlen("keyset-") +
288                                                   strlen(namestr) + 1);
289                         if (output == NULL)
290                                 fatal("out of memory");
291                         strcpy(output, "keyset-");
292                         strcat(output, namestr);
293                 }
294                 if (domain == NULL) {
295                         dns_fixedname_init(&fdomain);
296                         domain = dns_fixedname_name(&fdomain);
297                         dns_name_copy(dst_key_name(key), domain, NULL);
298                 }
299                 if (dst_key_iszonekey(key)) {
300                         dst_key_t *zonekey = NULL;
301                         result = dst_key_fromnamedfile(argv[i],
302                                                        DST_TYPE_PUBLIC |
303                                                        DST_TYPE_PRIVATE,
304                                                        mctx, &zonekey);
305                         if (result != ISC_R_SUCCESS)
306                                 fatal("failed to read private key %s: %s",
307                                       argv[i], isc_result_totext(result));
308                         if (!zonekey_on_list(zonekey)) {
309                                 keynode = isc_mem_get(mctx,
310                                                       sizeof (keynode_t));
311                                 if (keynode == NULL)
312                                         fatal("out of memory");
313                                 keynode->key = zonekey;
314                                 ISC_LIST_INITANDAPPEND(keylist, keynode, link);
315                         } else
316                                 dst_key_free(&zonekey);
317                 }
318                 rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
319                 if (rdata == NULL)
320                         fatal("out of memory");
321                 dns_rdata_init(rdata);
322                 data = isc_mem_get(mctx, BUFSIZE);
323                 if (data == NULL)
324                         fatal("out of memory");
325                 isc_buffer_init(&b, data, BUFSIZE);
326                 result = dst_key_todns(key, &b);
327                 if (result != ISC_R_SUCCESS)
328                         fatal("failed to convert key %s to a DNS KEY: %s",
329                               argv[i], isc_result_totext(result));
330                 isc_buffer_usedregion(&b, &r);
331                 dns_rdata_fromregion(rdata, rdatalist.rdclass,
332                                      dns_rdatatype_key, &r);
333                 if (!rdata_on_list(rdata, &rdatalist))
334                         ISC_LIST_APPEND(rdatalist.rdata, rdata, link);
335                 else {
336                         isc_mem_put(mctx, data, BUFSIZE);
337                         isc_mem_put(mctx, rdata, sizeof *rdata);
338                 }
339                 dst_key_free(&key);
340         }
341
342         dns_rdataset_init(&rdataset);
343         result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
344         check_result(result, "dns_rdatalist_tordataset()");
345
346         dns_rdatalist_init(&sigrdatalist);
347         sigrdatalist.rdclass = rdatalist.rdclass;
348         sigrdatalist.type = dns_rdatatype_sig;
349         sigrdatalist.covers = dns_rdatatype_key;
350         sigrdatalist.ttl = ttl;
351
352         if (ISC_LIST_EMPTY(keylist))
353                 fprintf(stderr,
354                         "%s: no private zone key found; not self-signing\n",
355                         program);
356         for (keynode = ISC_LIST_HEAD(keylist);
357              keynode != NULL;
358              keynode = ISC_LIST_NEXT(keynode, link))
359         {
360                 rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
361                 if (rdata == NULL)
362                         fatal("out of memory");
363                 dns_rdata_init(rdata);
364                 data = isc_mem_get(mctx, BUFSIZE);
365                 if (data == NULL)
366                         fatal("out of memory");
367                 isc_buffer_init(&b, data, BUFSIZE);
368                 result = dns_dnssec_sign(domain, &rdataset, keynode->key,
369                                          &starttime, &endtime, mctx, &b,
370                                          rdata);
371                 isc_entropy_stopcallbacksources(ectx);
372                 if (result != ISC_R_SUCCESS) {
373                         char keystr[KEY_FORMATSIZE];
374                         key_format(keynode->key, keystr, sizeof keystr);
375                         fatal("failed to sign keyset with key %s: %s",
376                               keystr, isc_result_totext(result));
377                 }
378                 if (tryverify) {
379                         result = dns_dnssec_verify(domain, &rdataset,
380                                                    keynode->key, ISC_TRUE,
381                                                    mctx, rdata);
382                         if (result != ISC_R_SUCCESS) {
383                                 char keystr[KEY_FORMATSIZE];
384                                 key_format(keynode->key, keystr, sizeof keystr);
385                                 fatal("signature from key '%s' failed to "
386                                       "verify: %s",
387                                       keystr, isc_result_totext(result));
388                         }
389                 }
390                 ISC_LIST_APPEND(sigrdatalist.rdata, rdata, link);
391                 dns_rdataset_init(&sigrdataset);
392                 result = dns_rdatalist_tordataset(&sigrdatalist, &sigrdataset);
393                 check_result(result, "dns_rdatalist_tordataset()");
394         }
395
396         db = NULL;
397         result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
398                                rdataset.rdclass, 0, NULL, &db);
399         if (result != ISC_R_SUCCESS) {
400                 char domainstr[DNS_NAME_FORMATSIZE];
401                 dns_name_format(domain, domainstr, sizeof domainstr);
402                 fatal("failed to create a database for %s", domainstr);
403         }
404
405         version = NULL;
406         dns_db_newversion(db, &version);
407
408         node = NULL;
409         result = dns_db_findnode(db, domain, ISC_TRUE, &node);
410         check_result(result, "dns_db_findnode()");
411
412         dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL);
413         if (!ISC_LIST_EMPTY(keylist))
414                 dns_db_addrdataset(db, node, version, 0, &sigrdataset, 0,
415                                    NULL);
416
417         dns_db_detachnode(db, &node);
418         dns_db_closeversion(db, &version, ISC_TRUE);
419         result = dns_db_dump(db, version, output);
420         if (result != ISC_R_SUCCESS) {
421                 char domainstr[DNS_NAME_FORMATSIZE];
422                 dns_name_format(domain, domainstr, sizeof domainstr);
423                 fatal("failed to write database for %s to %s",
424                       domainstr, output);
425         }
426
427         printf("%s\n", output);
428
429         dns_db_detach(&db);
430
431         dns_rdataset_disassociate(&rdataset);
432         while (!ISC_LIST_EMPTY(rdatalist.rdata)) {
433                 rdata = ISC_LIST_HEAD(rdatalist.rdata);
434                 ISC_LIST_UNLINK(rdatalist.rdata, rdata, link);
435                 isc_mem_put(mctx, rdata->data, BUFSIZE);
436                 isc_mem_put(mctx, rdata, sizeof *rdata);
437         }
438         while (!ISC_LIST_EMPTY(sigrdatalist.rdata)) {
439                 rdata = ISC_LIST_HEAD(sigrdatalist.rdata);
440                 ISC_LIST_UNLINK(sigrdatalist.rdata, rdata, link);
441                 isc_mem_put(mctx, rdata->data, BUFSIZE);
442                 isc_mem_put(mctx, rdata, sizeof *rdata);
443         }
444
445         while (!ISC_LIST_EMPTY(keylist)) {
446                 keynode = ISC_LIST_HEAD(keylist);
447                 ISC_LIST_UNLINK(keylist, keynode, link);
448                 dst_key_free(&keynode->key);
449                 isc_mem_put(mctx, keynode, sizeof(keynode_t));
450         }
451
452         if (savedname != NULL) {
453                 dns_name_free(savedname, mctx);
454                 isc_mem_put(mctx, savedname, sizeof(dns_name_t));
455         }
456
457         cleanup_logging(&log);
458         cleanup_entropy(&ectx);
459
460         isc_mem_free(mctx, output);
461         dst_lib_destroy();
462         if (verbose > 10)
463                 isc_mem_stats(mctx, stdout);
464         isc_mem_destroy(&mctx);
465         return (0);
466 }