dnssec-dsfromkey.c revision 1.1.1.6
1 /* $NetBSD: dnssec-dsfromkey.c,v 1.1.1.6 2019/11/24 19:57:33 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 9 * 10 * See the COPYRIGHT file distributed with this work for additional 11 * information regarding copyright ownership. 12 */ 13 14 /*! \file */ 15 16 #include <config.h> 17 18 #include <inttypes.h> 19 #include <stdbool.h> 20 #include <stdlib.h> 21 22 #include <isc/buffer.h> 23 #include <isc/commandline.h> 24 #include <isc/hash.h> 25 #include <isc/mem.h> 26 #include <isc/print.h> 27 #include <isc/string.h> 28 #include <isc/util.h> 29 30 #include <dns/callbacks.h> 31 #include <dns/db.h> 32 #include <dns/dbiterator.h> 33 #include <dns/ds.h> 34 #include <dns/fixedname.h> 35 #include <dns/keyvalues.h> 36 #include <dns/log.h> 37 #include <dns/master.h> 38 #include <dns/name.h> 39 #include <dns/rdata.h> 40 #include <dns/rdataclass.h> 41 #include <dns/rdataset.h> 42 #include <dns/rdatasetiter.h> 43 #include <dns/rdatatype.h> 44 #include <dns/result.h> 45 46 #include <dst/dst.h> 47 48 #if USE_PKCS11 49 #include <pk11/result.h> 50 #endif 51 52 #include "dnssectool.h" 53 54 #ifndef PATH_MAX 55 #define PATH_MAX 1024 /* WIN32, and others don't define this. */ 56 #endif 57 58 const char *program = "dnssec-dsfromkey"; 59 int verbose; 60 61 static dns_rdataclass_t rdclass; 62 static dns_fixedname_t fixed; 63 static dns_name_t *name = NULL; 64 static isc_mem_t *mctx = NULL; 65 static uint32_t ttl; 66 static bool emitttl = false; 67 68 static isc_result_t 69 initname(char *setname) { 70 isc_result_t result; 71 isc_buffer_t buf; 72 73 name = dns_fixedname_initname(&fixed); 74 75 isc_buffer_init(&buf, setname, strlen(setname)); 76 isc_buffer_add(&buf, strlen(setname)); 77 result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL); 78 return (result); 79 } 80 81 static void 82 db_load_from_stream(dns_db_t *db, FILE *fp) { 83 isc_result_t result; 84 dns_rdatacallbacks_t callbacks; 85 86 dns_rdatacallbacks_init(&callbacks); 87 result = dns_db_beginload(db, &callbacks); 88 if (result != ISC_R_SUCCESS) 89 fatal("dns_db_beginload failed: %s", isc_result_totext(result)); 90 91 result = dns_master_loadstream(fp, name, name, rdclass, 0, 92 &callbacks, mctx); 93 if (result != ISC_R_SUCCESS) 94 fatal("can't load from input: %s", isc_result_totext(result)); 95 96 result = dns_db_endload(db, &callbacks); 97 if (result != ISC_R_SUCCESS) 98 fatal("dns_db_endload failed: %s", isc_result_totext(result)); 99 } 100 101 static isc_result_t 102 loadset(const char *filename, dns_rdataset_t *rdataset) { 103 isc_result_t result; 104 dns_db_t *db = NULL; 105 dns_dbnode_t *node = NULL; 106 char setname[DNS_NAME_FORMATSIZE]; 107 108 dns_name_format(name, setname, sizeof(setname)); 109 110 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, 111 rdclass, 0, NULL, &db); 112 if (result != ISC_R_SUCCESS) 113 fatal("can't create database"); 114 115 if (strcmp(filename, "-") == 0) { 116 db_load_from_stream(db, stdin); 117 filename = "input"; 118 } else { 119 result = dns_db_load(db, filename, dns_masterformat_text, 0); 120 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) 121 fatal("can't load %s: %s", filename, 122 isc_result_totext(result)); 123 } 124 125 result = dns_db_findnode(db, name, false, &node); 126 if (result != ISC_R_SUCCESS) 127 fatal("can't find %s node in %s", setname, filename); 128 129 result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 130 0, 0, rdataset, NULL); 131 132 if (result == ISC_R_NOTFOUND) 133 fatal("no DNSKEY RR for %s in %s", setname, filename); 134 else if (result != ISC_R_SUCCESS) 135 fatal("dns_db_findrdataset"); 136 137 if (node != NULL) 138 dns_db_detachnode(db, &node); 139 if (db != NULL) 140 dns_db_detach(&db); 141 return (result); 142 } 143 144 static isc_result_t 145 loadkeyset(char *dirname, dns_rdataset_t *rdataset) { 146 isc_result_t result; 147 char filename[PATH_MAX + 1]; 148 isc_buffer_t buf; 149 150 dns_rdataset_init(rdataset); 151 152 isc_buffer_init(&buf, filename, sizeof(filename)); 153 if (dirname != NULL) { 154 /* allow room for a trailing slash */ 155 if (strlen(dirname) >= isc_buffer_availablelength(&buf)) 156 return (ISC_R_NOSPACE); 157 isc_buffer_putstr(&buf, dirname); 158 if (dirname[strlen(dirname) - 1] != '/') 159 isc_buffer_putstr(&buf, "/"); 160 } 161 162 if (isc_buffer_availablelength(&buf) < 7) 163 return (ISC_R_NOSPACE); 164 isc_buffer_putstr(&buf, "keyset-"); 165 166 result = dns_name_tofilenametext(name, false, &buf); 167 check_result(result, "dns_name_tofilenametext()"); 168 if (isc_buffer_availablelength(&buf) == 0) 169 return (ISC_R_NOSPACE); 170 isc_buffer_putuint8(&buf, 0); 171 172 return (loadset(filename, rdataset)); 173 } 174 175 static void 176 loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size, 177 dns_rdata_t *rdata) 178 { 179 isc_result_t result; 180 dst_key_t *key = NULL; 181 isc_buffer_t keyb; 182 isc_region_t r; 183 184 dns_rdata_init(rdata); 185 186 isc_buffer_init(&keyb, key_buf, key_buf_size); 187 188 result = dst_key_fromnamedfile(filename, NULL, DST_TYPE_PUBLIC, 189 mctx, &key); 190 if (result != ISC_R_SUCCESS) 191 fatal("can't load %s.key: %s", 192 filename, isc_result_totext(result)); 193 194 if (verbose > 2) { 195 char keystr[DST_KEY_FORMATSIZE]; 196 197 dst_key_format(key, keystr, sizeof(keystr)); 198 fprintf(stderr, "%s: %s\n", program, keystr); 199 } 200 201 result = dst_key_todns(key, &keyb); 202 if (result != ISC_R_SUCCESS) 203 fatal("can't decode key"); 204 205 isc_buffer_usedregion(&keyb, &r); 206 dns_rdata_fromregion(rdata, dst_key_class(key), 207 dns_rdatatype_dnskey, &r); 208 209 rdclass = dst_key_class(key); 210 211 name = dns_fixedname_initname(&fixed); 212 dns_name_copynf(dst_key_name(key), name); 213 214 dst_key_free(&key); 215 } 216 217 static void 218 logkey(dns_rdata_t *rdata) 219 { 220 isc_result_t result; 221 dst_key_t *key = NULL; 222 isc_buffer_t buf; 223 char keystr[DST_KEY_FORMATSIZE]; 224 225 isc_buffer_init(&buf, rdata->data, rdata->length); 226 isc_buffer_add(&buf, rdata->length); 227 result = dst_key_fromdns(name, rdclass, &buf, mctx, &key); 228 if (result != ISC_R_SUCCESS) 229 return; 230 231 dst_key_format(key, keystr, sizeof(keystr)); 232 fprintf(stderr, "%s: %s\n", program, keystr); 233 234 dst_key_free(&key); 235 } 236 237 static void 238 emit(dns_dsdigest_t dtype, bool showall, char *lookaside, 239 bool cds, dns_rdata_t *rdata) 240 { 241 isc_result_t result; 242 unsigned char buf[DNS_DS_BUFFERSIZE]; 243 char text_buf[DST_KEY_MAXTEXTSIZE]; 244 char name_buf[DNS_NAME_MAXWIRE]; 245 char class_buf[10]; 246 isc_buffer_t textb, nameb, classb; 247 isc_region_t r; 248 dns_rdata_t ds; 249 dns_rdata_dnskey_t dnskey; 250 251 isc_buffer_init(&textb, text_buf, sizeof(text_buf)); 252 isc_buffer_init(&nameb, name_buf, sizeof(name_buf)); 253 isc_buffer_init(&classb, class_buf, sizeof(class_buf)); 254 255 dns_rdata_init(&ds); 256 257 result = dns_rdata_tostruct(rdata, &dnskey, NULL); 258 if (result != ISC_R_SUCCESS) 259 fatal("can't convert DNSKEY"); 260 261 if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) 262 return; 263 264 result = dns_ds_buildrdata(name, rdata, dtype, buf, &ds); 265 if (result != ISC_R_SUCCESS) 266 fatal("can't build record"); 267 268 result = dns_name_totext(name, false, &nameb); 269 if (result != ISC_R_SUCCESS) 270 fatal("can't print name"); 271 272 /* Add lookaside origin, if set */ 273 if (lookaside != NULL) { 274 if (isc_buffer_availablelength(&nameb) < strlen(lookaside)) 275 fatal("DLV origin '%s' is too long", lookaside); 276 isc_buffer_putstr(&nameb, lookaside); 277 if (lookaside[strlen(lookaside) - 1] != '.') { 278 if (isc_buffer_availablelength(&nameb) < 1) 279 fatal("DLV origin '%s' is too long", lookaside); 280 isc_buffer_putstr(&nameb, "."); 281 } 282 } 283 284 result = dns_rdata_tofmttext(&ds, (dns_name_t *) NULL, 0, 0, 0, "", 285 &textb); 286 287 if (result != ISC_R_SUCCESS) 288 fatal("can't print rdata"); 289 290 result = dns_rdataclass_totext(rdclass, &classb); 291 if (result != ISC_R_SUCCESS) 292 fatal("can't print class"); 293 294 isc_buffer_usedregion(&nameb, &r); 295 printf("%.*s ", (int)r.length, r.base); 296 297 if (emitttl) 298 printf("%u ", ttl); 299 300 isc_buffer_usedregion(&classb, &r); 301 printf("%.*s", (int)r.length, r.base); 302 303 if (lookaside == NULL) { 304 if (cds) 305 printf(" CDS "); 306 else 307 printf(" DS "); 308 } else 309 printf(" DLV "); 310 311 isc_buffer_usedregion(&textb, &r); 312 printf("%.*s\n", (int)r.length, r.base); 313 } 314 315 ISC_PLATFORM_NORETURN_PRE static void 316 usage(void) ISC_PLATFORM_NORETURN_POST; 317 318 static void 319 usage(void) { 320 fprintf(stderr, "Usage:\n"); 321 fprintf(stderr, " %s [options] keyfile\n\n", program); 322 fprintf(stderr, " %s [options] -f zonefile [zonename]\n\n", program); 323 fprintf(stderr, " %s [options] -s dnsname\n\n", program); 324 fprintf(stderr, " %s [-h|-V]\n\n", program); 325 fprintf(stderr, "Version: %s\n", VERSION); 326 fprintf(stderr, "Options:\n" 327 " -1: digest algorithm SHA-1\n" 328 " -2: digest algorithm SHA-256\n" 329 " -a algorithm: digest algorithm (SHA-1, SHA-256 or SHA-384)\n" 330 " -A: include all keys in DS set, not just KSKs (-f only)\n" 331 " -c class: rdata class for DS set (default IN) (-f or -s only)\n" 332 " -C: print CDS records\n" 333 " -f zonefile: read keys from a zone file\n" 334 " -h: print help information\n" 335 " -K directory: where to find key or keyset files\n" 336 " -l zone: print DLV records in the given lookaside zone\n" 337 " -s: read keys from keyset-<dnsname> file\n" 338 " -T: TTL of output records (omitted by default)\n" 339 " -v level: verbosity\n" 340 " -V: print version information\n"); 341 fprintf(stderr, "Output: DS, DLV, or CDS RRs\n"); 342 343 exit (-1); 344 } 345 346 int 347 main(int argc, char **argv) { 348 char *classname = NULL; 349 char *filename = NULL, *dir = NULL, *namestr; 350 char *lookaside = NULL; 351 char *endp, *arg1; 352 int ch; 353 dns_dsdigest_t dtype = DNS_DSDIGEST_SHA1; 354 bool cds = false; 355 bool both = true; 356 bool usekeyset = false; 357 bool showall = false; 358 isc_result_t result; 359 isc_log_t *log = NULL; 360 dns_rdataset_t rdataset; 361 dns_rdata_t rdata; 362 363 dns_rdata_init(&rdata); 364 365 if (argc == 1) { 366 usage(); 367 } 368 369 result = isc_mem_create(0, 0, &mctx); 370 if (result != ISC_R_SUCCESS) { 371 fatal("out of memory"); 372 } 373 374 #if USE_PKCS11 375 pk11_result_register(); 376 #endif 377 dns_result_register(); 378 379 isc_commandline_errprint = false; 380 381 #define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV" 382 while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) { 383 switch (ch) { 384 case '1': 385 dtype = DNS_DSDIGEST_SHA1; 386 both = false; 387 break; 388 case '2': 389 dtype = DNS_DSDIGEST_SHA256; 390 both = false; 391 break; 392 case 'A': 393 showall = true; 394 break; 395 case 'a': 396 dtype = strtodsdigest(isc_commandline_argument); 397 both = false; 398 break; 399 case 'C': 400 if (lookaside != NULL) { 401 fatal("lookaside and CDS are mutually" 402 " exclusive"); 403 } 404 cds = true; 405 break; 406 case 'c': 407 classname = isc_commandline_argument; 408 break; 409 case 'd': 410 fprintf(stderr, "%s: the -d option is deprecated; " 411 "use -K\n", program); 412 /* fall through */ 413 case 'K': 414 dir = isc_commandline_argument; 415 if (strlen(dir) == 0U) { 416 fatal("directory must be non-empty string"); 417 } 418 break; 419 case 'f': 420 filename = isc_commandline_argument; 421 break; 422 case 'l': 423 if (cds) { 424 fatal("lookaside and CDS are mutually" 425 " exclusive"); 426 } 427 lookaside = isc_commandline_argument; 428 if (strlen(lookaside) == 0U) 429 fatal("lookaside must be a non-empty string"); 430 break; 431 case 's': 432 usekeyset = true; 433 break; 434 case 'T': 435 emitttl = true; 436 ttl = strtottl(isc_commandline_argument); 437 break; 438 case 'v': 439 verbose = strtol(isc_commandline_argument, &endp, 0); 440 if (*endp != '\0') { 441 fatal("-v must be followed by a number"); 442 } 443 break; 444 case 'F': 445 /* Reserved for FIPS mode */ 446 /* FALLTHROUGH */ 447 case '?': 448 if (isc_commandline_option != '?') { 449 fprintf(stderr, "%s: invalid argument -%c\n", 450 program, isc_commandline_option); 451 } 452 /* FALLTHROUGH */ 453 case 'h': 454 /* Does not return. */ 455 usage(); 456 457 case 'V': 458 /* Does not return. */ 459 version(program); 460 461 default: 462 fprintf(stderr, "%s: unhandled option -%c\n", 463 program, isc_commandline_option); 464 exit(1); 465 } 466 } 467 468 rdclass = strtoclass(classname); 469 470 if (usekeyset && filename != NULL) { 471 fatal("cannot use both -s and -f"); 472 } 473 474 /* When not using -f, -A is implicit */ 475 if (filename == NULL) { 476 showall = true; 477 } 478 479 /* 480 * Use local variable arg1 so that clang can correctly analyse 481 * reachable paths rather than 'argc < isc_commandline_index + 1'. 482 */ 483 arg1 = argv[isc_commandline_index]; 484 if (arg1 == NULL && filename == NULL) { 485 fatal("the key file name was not specified"); 486 } 487 if (arg1 != NULL && argv[isc_commandline_index + 1] != NULL) { 488 fatal("extraneous arguments"); 489 } 490 491 result = dst_lib_init(mctx, NULL); 492 if (result != ISC_R_SUCCESS) { 493 fatal("could not initialize dst: %s", 494 isc_result_totext(result)); 495 } 496 497 setup_logging(mctx, &log); 498 499 dns_rdataset_init(&rdataset); 500 501 if (usekeyset || filename != NULL) { 502 if (arg1 == NULL) { 503 /* using file name as the zone name */ 504 namestr = filename; 505 } else { 506 namestr = arg1; 507 } 508 509 result = initname(namestr); 510 if (result != ISC_R_SUCCESS) { 511 fatal("could not initialize name %s", namestr); 512 } 513 514 if (usekeyset) { 515 result = loadkeyset(dir, &rdataset); 516 } else { 517 INSIST(filename != NULL); 518 result = loadset(filename, &rdataset); 519 } 520 521 if (result != ISC_R_SUCCESS) { 522 fatal("could not load DNSKEY set: %s\n", 523 isc_result_totext(result)); 524 } 525 526 for (result = dns_rdataset_first(&rdataset); 527 result == ISC_R_SUCCESS; 528 result = dns_rdataset_next(&rdataset)) { 529 dns_rdata_init(&rdata); 530 dns_rdataset_current(&rdataset, &rdata); 531 532 if (verbose > 2) { 533 logkey(&rdata); 534 } 535 536 if (both) { 537 emit(DNS_DSDIGEST_SHA1, showall, lookaside, 538 cds, &rdata); 539 emit(DNS_DSDIGEST_SHA256, showall, lookaside, 540 cds, &rdata); 541 } else { 542 emit(dtype, showall, lookaside, cds, &rdata); 543 } 544 } 545 } else { 546 unsigned char key_buf[DST_KEY_MAXSIZE]; 547 548 loadkey(arg1, key_buf, DST_KEY_MAXSIZE, &rdata); 549 550 if (both) { 551 emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds, 552 &rdata); 553 emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds, 554 &rdata); 555 } else { 556 emit(dtype, showall, lookaside, cds, &rdata); 557 } 558 } 559 560 if (dns_rdataset_isassociated(&rdataset)) 561 dns_rdataset_disassociate(&rdataset); 562 cleanup_logging(&log); 563 dst_lib_destroy(); 564 dns_name_destroy(); 565 if (verbose > 10) { 566 isc_mem_stats(mctx, stdout); 567 } 568 isc_mem_destroy(&mctx); 569 570 fflush(stdout); 571 if (ferror(stdout)) { 572 fprintf(stderr, "write error\n"); 573 return (1); 574 } else { 575 return (0); 576 } 577 } 578
Indexes created Mon Oct 26 00:26:21 UTC 2026