2 * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
4 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
11 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
12 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
13 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
16 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 /* $Id: dnssec-signkey.c,v 1.50.2.4 2004/03/09 06:09:15 marka Exp $ */
25 #include <isc/string.h>
26 #include <isc/commandline.h>
27 #include <isc/entropy.h>
32 #include <dns/dbiterator.h>
33 #include <dns/dnssec.h>
34 #include <dns/fixedname.h>
36 #include <dns/rdata.h>
37 #include <dns/rdataclass.h>
38 #include <dns/rdatalist.h>
39 #include <dns/rdataset.h>
40 #include <dns/rdatasetiter.h>
41 #include <dns/rdatastruct.h>
42 #include <dns/result.h>
43 #include <dns/secalg.h>
47 #include "dnssectool.h"
49 const char *program = "dnssec-signkey";
54 typedef struct keynode keynode_t;
57 isc_boolean_t verified;
58 ISC_LINK(keynode_t) link;
60 typedef ISC_LIST(keynode_t) keylist_t;
62 static isc_stdtime_t starttime = 0, endtime = 0, now;
64 static isc_mem_t *mctx = NULL;
65 static isc_entropy_t *ectx = NULL;
66 static keylist_t keylist;
70 fprintf(stderr, "Usage:\n");
71 fprintf(stderr, "\t%s [options] keyset keys\n", program);
73 fprintf(stderr, "\n");
75 fprintf(stderr, "Options: (default value in parenthesis) \n");
76 fprintf(stderr, "\t-a\n");
77 fprintf(stderr, "\t\tverify generated signatures\n");
78 fprintf(stderr, "\t-c class (IN)\n");
79 fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n");
80 fprintf(stderr, "\t\tSIG start time - absolute|offset (from keyset)\n");
81 fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
82 fprintf(stderr, "\t\tSIG end time - absolute|from start|from now "
84 fprintf(stderr, "\t-v level:\n");
85 fprintf(stderr, "\t\tverbose level (0)\n");
86 fprintf(stderr, "\t-p\n");
87 fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n");
88 fprintf(stderr, "\t-r randomdev:\n");
89 fprintf(stderr, "\t\ta file containing random data\n");
91 fprintf(stderr, "\n");
93 fprintf(stderr, "keyset:\n");
94 fprintf(stderr, "\tfile with keyset to be signed (keyset-<name>)\n");
95 fprintf(stderr, "keys:\n");
96 fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
98 fprintf(stderr, "\n");
99 fprintf(stderr, "Output:\n");
100 fprintf(stderr, "\tsigned keyset (signedkey-<name>)\n");
105 loadkeys(dns_name_t *name, dns_rdataset_t *rdataset) {
107 dns_rdata_t rdata = DNS_RDATA_INIT;
111 ISC_LIST_INIT(keylist);
112 result = dns_rdataset_first(rdataset);
113 check_result(result, "dns_rdataset_first");
114 for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(rdataset)) {
115 dns_rdata_reset(&rdata);
116 dns_rdataset_current(rdataset, &rdata);
118 result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &key);
119 if (result != ISC_R_SUCCESS)
121 if (!dst_key_iszonekey(key))
123 keynode = isc_mem_get(mctx, sizeof (keynode_t));
125 fatal("out of memory");
127 keynode->verified = ISC_FALSE;
128 ISC_LIST_INITANDAPPEND(keylist, keynode, link);
130 if (result != ISC_R_NOMORE)
131 fatal("failure traversing key list");
135 findkey(dns_rdata_sig_t *sig) {
137 for (keynode = ISC_LIST_HEAD(keylist);
139 keynode = ISC_LIST_NEXT(keynode, link))
141 if (dst_key_id(keynode->key) == sig->keyid &&
142 dst_key_alg(keynode->key) == sig->algorithm) {
143 keynode->verified = ISC_TRUE;
144 return (keynode->key);
147 fatal("signature generated by non-zone or missing key");
152 main(int argc, char *argv[]) {
154 char *startstr = NULL, *endstr = NULL, *classname = NULL;
156 dns_fixedname_t fdomain;
161 char *randomfile = NULL;
164 dns_dbversion_t *version;
165 dns_dbiterator_t *dbiter;
166 dns_rdatasetiter_t *rdsiter;
167 dst_key_t *key = NULL;
169 dns_rdata_t sigrdata = DNS_RDATA_INIT;
170 dns_rdatalist_t sigrdatalist;
171 dns_rdataset_t rdataset, sigrdataset, newsigrdataset;
176 isc_log_t *log = NULL;
178 isc_boolean_t pseudorandom = ISC_FALSE;
180 dns_rdataclass_t rdclass;
181 static isc_boolean_t tryverify = ISC_FALSE;
183 result = isc_mem_create(0, 0, &mctx);
184 check_result(result, "isc_mem_create()");
186 dns_result_register();
188 while ((ch = isc_commandline_parse(argc, argv, "ac:s:e:pr:v:h")) != -1)
192 tryverify = ISC_TRUE;
195 classname = isc_commandline_argument;
199 startstr = isc_commandline_argument;
203 endstr = isc_commandline_argument;
207 pseudorandom = ISC_TRUE;
211 randomfile = isc_commandline_argument;
216 verbose = strtol(isc_commandline_argument, &endp, 0);
218 fatal("verbose level must be numeric");
228 argc -= isc_commandline_index;
229 argv += isc_commandline_index;
234 if (classname != NULL) {
236 tr.length = strlen(classname);
237 result = dns_rdataclass_fromtext(&rdclass, &tr);
238 if (result != ISC_R_SUCCESS)
239 fatal("unknown class %s",classname);
241 rdclass = dns_rdataclass_in;
243 setup_entropy(mctx, randomfile, &ectx);
244 eflags = ISC_ENTROPY_BLOCKING;
246 eflags |= ISC_ENTROPY_GOODONLY;
247 result = dst_lib_init(mctx, ectx, eflags);
248 if (result != ISC_R_SUCCESS)
249 fatal("could not initialize dst: %s",
250 isc_result_totext(result));
252 isc_stdtime_get(&now);
254 if ((startstr == NULL || endstr == NULL) &&
255 !(startstr == NULL && endstr == NULL))
256 fatal("if -s or -e is specified, both must be");
258 setup_logging(verbose, mctx, &log);
260 if (strlen(argv[0]) < 8U || strncmp(argv[0], "keyset-", 7) != 0)
261 fatal("keyset file '%s' must start with keyset-", argv[0]);
264 result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
265 rdclass, 0, NULL, &db);
266 check_result(result, "dns_db_create()");
268 result = dns_db_load(db, argv[0]);
269 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
270 fatal("failed to load database from '%s': %s", argv[0],
271 isc_result_totext(result));
273 dns_fixedname_init(&fdomain);
274 domain = dns_fixedname_name(&fdomain);
277 result = dns_db_createiterator(db, ISC_FALSE, &dbiter);
278 check_result(result, "dns_db_createiterator()");
280 result = dns_dbiterator_first(dbiter);
281 check_result(result, "dns_dbiterator_first()");
282 while (result == ISC_R_SUCCESS) {
284 dns_dbiterator_current(dbiter, &node, domain);
286 result = dns_db_allrdatasets(db, node, NULL, 0, &rdsiter);
287 check_result(result, "dns_db_allrdatasets()");
288 result = dns_rdatasetiter_first(rdsiter);
289 dns_rdatasetiter_destroy(&rdsiter);
290 if (result == ISC_R_SUCCESS)
292 dns_db_detachnode(db, &node);
293 result = dns_dbiterator_next(dbiter);
295 dns_dbiterator_destroy(&dbiter);
296 if (result != ISC_R_SUCCESS)
297 fatal("failed to find data in keyset file");
299 isc_buffer_init(&b, tdomain, sizeof(tdomain) - 1);
300 result = dns_name_tofilenametext(domain, ISC_FALSE, &b);
301 check_result(result, "dns_name_tofilenametext()");
302 isc_buffer_putuint8(&b, 0);
304 output = isc_mem_allocate(mctx,
305 strlen("signedkey-") + strlen(tdomain) + 1);
307 fatal("out of memory");
308 strcpy(output, "signedkey-");
309 strcat(output, tdomain);
312 dns_db_newversion(db, &version);
314 dns_rdataset_init(&rdataset);
315 dns_rdataset_init(&sigrdataset);
316 result = dns_db_findrdataset(db, node, version, dns_rdatatype_key, 0,
317 0, &rdataset, &sigrdataset);
318 if (result != ISC_R_SUCCESS) {
319 char domainstr[DNS_NAME_FORMATSIZE];
320 dns_name_format(domain, domainstr, sizeof domainstr);
321 fatal("failed to find rdataset '%s KEY': %s",
322 domainstr, isc_result_totext(result));
325 loadkeys(domain, &rdataset);
327 if (!dns_rdataset_isassociated(&sigrdataset))
328 fatal("no SIG KEY set present");
330 result = dns_rdataset_first(&sigrdataset);
331 check_result(result, "dns_rdataset_first()");
333 dns_rdataset_current(&sigrdataset, &sigrdata);
334 result = dns_rdata_tostruct(&sigrdata, &sig, mctx);
335 check_result(result, "dns_rdata_tostruct()");
337 result = dns_dnssec_verify(domain, &rdataset, key,
338 ISC_TRUE, mctx, &sigrdata);
339 if (result != ISC_R_SUCCESS) {
340 char keystr[KEY_FORMATSIZE];
341 key_format(key, keystr, sizeof keystr);
342 fatal("signature by key '%s' did not verify: %s",
343 keystr, isc_result_totext(result));
345 dns_rdata_reset(&sigrdata);
346 dns_rdata_freestruct(&sig);
347 result = dns_rdataset_next(&sigrdataset);
348 } while (result == ISC_R_SUCCESS);
350 if (startstr != NULL) {
351 starttime = strtotime(startstr, now, now);
352 endtime = strtotime(endstr, now, starttime);
354 starttime = sig.timesigned;
355 endtime = sig.timeexpire;
359 for (keynode = ISC_LIST_HEAD(keylist);
361 keynode = ISC_LIST_NEXT(keynode, link))
362 if (!keynode->verified)
363 fatal("Not all zone keys self signed the key set");
365 result = dns_rdataset_first(&sigrdataset);
366 check_result(result, "dns_rdataset_first()");
367 dns_rdataset_current(&sigrdataset, &sigrdata);
368 result = dns_rdata_tostruct(&sigrdata, &sig, mctx);
369 check_result(result, "dns_rdata_tostruct()");
371 dns_rdataset_disassociate(&sigrdataset);
376 dns_rdatalist_init(&sigrdatalist);
377 sigrdatalist.rdclass = rdataset.rdclass;
378 sigrdatalist.type = dns_rdatatype_sig;
379 sigrdatalist.covers = dns_rdatatype_key;
380 sigrdatalist.ttl = rdataset.ttl;
382 for (i = 0; i < argc; i++) {
384 result = dst_key_fromnamedfile(argv[i],
388 if (result != ISC_R_SUCCESS)
389 fatal("failed to read key %s from disk: %s",
390 argv[i], isc_result_totext(result));
392 rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
394 fatal("out of memory");
395 dns_rdata_init(rdata);
396 data = isc_mem_get(mctx, BUFSIZE);
398 fatal("out of memory");
399 isc_buffer_init(&b, data, BUFSIZE);
400 result = dns_dnssec_sign(domain, &rdataset, key,
401 &starttime, &endtime,
403 isc_entropy_stopcallbacksources(ectx);
404 if (result != ISC_R_SUCCESS) {
405 char keystr[KEY_FORMATSIZE];
406 key_format(key, keystr, sizeof keystr);
407 fatal("key '%s' failed to sign data: %s",
408 keystr, isc_result_totext(result));
411 result = dns_dnssec_verify(domain, &rdataset, key,
412 ISC_TRUE, mctx, rdata);
413 if (result != ISC_R_SUCCESS) {
414 char keystr[KEY_FORMATSIZE];
415 key_format(key, keystr, sizeof keystr);
416 fatal("signature from key '%s' failed to "
418 keystr, isc_result_totext(result));
421 ISC_LIST_APPEND(sigrdatalist.rdata, rdata, link);
425 dns_rdataset_init(&newsigrdataset);
426 result = dns_rdatalist_tordataset(&sigrdatalist, &newsigrdataset);
427 check_result (result, "dns_rdatalist_tordataset()");
429 dns_db_addrdataset(db, node, version, 0, &newsigrdataset, 0, NULL);
430 check_result (result, "dns_db_addrdataset()");
432 dns_db_detachnode(db, &node);
433 dns_db_closeversion(db, &version, ISC_TRUE);
434 result = dns_db_dump(db, version, output);
435 if (result != ISC_R_SUCCESS)
436 fatal("failed to write database to '%s': %s",
437 output, isc_result_totext(result));
439 printf("%s\n", output);
441 dns_rdataset_disassociate(&rdataset);
442 dns_rdataset_disassociate(&newsigrdataset);
444 dns_rdata_freestruct(&sig);
446 while (!ISC_LIST_EMPTY(sigrdatalist.rdata)) {
447 rdata = ISC_LIST_HEAD(sigrdatalist.rdata);
448 ISC_LIST_UNLINK(sigrdatalist.rdata, rdata, link);
449 isc_mem_put(mctx, rdata->data, BUFSIZE);
450 isc_mem_put(mctx, rdata, sizeof *rdata);
455 while (!ISC_LIST_EMPTY(keylist)) {
456 keynode = ISC_LIST_HEAD(keylist);
457 ISC_LIST_UNLINK(keylist, keynode, link);
458 dst_key_free(&keynode->key);
459 isc_mem_put(mctx, keynode, sizeof(keynode_t));
462 cleanup_logging(&log);
464 isc_mem_free(mctx, output);
465 cleanup_entropy(&ectx);
468 isc_mem_stats(mctx, stdout);
469 isc_mem_destroy(&mctx);