dnssec-dsfromkey.c revision 1.2
1 /* $NetBSD: dnssec-dsfromkey.c,v 1.2 2018/08/12 13:02:27 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 9 * 10 * See the COPYRIGHT file distributed with this work for additional 11 * information regarding copyright ownership. 12 */ 13 14 /*! \file */ 15 16 #include <config.h> 17 18 #include <stdlib.h> 19 20 #include <isc/buffer.h> 21 #include <isc/commandline.h> 22 #include <isc/entropy.h> 23 #include <isc/hash.h> 24 #include <isc/mem.h> 25 #include <isc/print.h> 26 #include <isc/string.h> 27 #include <isc/util.h> 28 29 #include <dns/callbacks.h> 30 #include <dns/db.h> 31 #include <dns/dbiterator.h> 32 #include <dns/ds.h> 33 #include <dns/fixedname.h> 34 #include <dns/keyvalues.h> 35 #include <dns/log.h> 36 #include <dns/master.h> 37 #include <dns/name.h> 38 #include <dns/rdata.h> 39 #include <dns/rdataclass.h> 40 #include <dns/rdataset.h> 41 #include <dns/rdatasetiter.h> 42 #include <dns/rdatatype.h> 43 #include <dns/result.h> 44 45 #include <dst/dst.h> 46 47 #ifdef PKCS11CRYPTO 48 #include <pk11/result.h> 49 #endif 50 51 #include "dnssectool.h" 52 53 #ifndef PATH_MAX 54 #define PATH_MAX 1024 /* AIX, WIN32, and others don't define this. */ 55 #endif 56 57 const char *program = "dnssec-dsfromkey"; 58 int verbose; 59 60 static dns_rdataclass_t rdclass; 61 static dns_fixedname_t fixed; 62 static dns_name_t *name = NULL; 63 static isc_mem_t *mctx = NULL; 64 static isc_uint32_t ttl; 65 static isc_boolean_t emitttl = ISC_FALSE; 66 67 static isc_result_t 68 initname(char *setname) { 69 isc_result_t result; 70 isc_buffer_t buf; 71 72 name = dns_fixedname_initname(&fixed); 73 74 isc_buffer_init(&buf, setname, strlen(setname)); 75 isc_buffer_add(&buf, strlen(setname)); 76 result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL); 77 return (result); 78 } 79 80 static void 81 db_load_from_stream(dns_db_t *db, FILE *fp) { 82 isc_result_t result; 83 dns_rdatacallbacks_t callbacks; 84 85 dns_rdatacallbacks_init(&callbacks); 86 result = dns_db_beginload(db, &callbacks); 87 if (result != ISC_R_SUCCESS) 88 fatal("dns_db_beginload failed: %s", isc_result_totext(result)); 89 90 result = dns_master_loadstream(fp, name, name, rdclass, 0, 91 &callbacks, mctx); 92 if (result != ISC_R_SUCCESS) 93 fatal("can't load from input: %s", isc_result_totext(result)); 94 95 result = dns_db_endload(db, &callbacks); 96 if (result != ISC_R_SUCCESS) 97 fatal("dns_db_endload failed: %s", isc_result_totext(result)); 98 } 99 100 static isc_result_t 101 loadset(const char *filename, dns_rdataset_t *rdataset) { 102 isc_result_t result; 103 dns_db_t *db = NULL; 104 dns_dbnode_t *node = NULL; 105 char setname[DNS_NAME_FORMATSIZE]; 106 107 dns_name_format(name, setname, sizeof(setname)); 108 109 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, 110 rdclass, 0, NULL, &db); 111 if (result != ISC_R_SUCCESS) 112 fatal("can't create database"); 113 114 if (strcmp(filename, "-") == 0) { 115 db_load_from_stream(db, stdin); 116 filename = "input"; 117 } else { 118 result = dns_db_load(db, filename); 119 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) 120 fatal("can't load %s: %s", filename, 121 isc_result_totext(result)); 122 } 123 124 result = dns_db_findnode(db, name, ISC_FALSE, &node); 125 if (result != ISC_R_SUCCESS) 126 fatal("can't find %s node in %s", setname, filename); 127 128 result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey, 129 0, 0, rdataset, NULL); 130 131 if (result == ISC_R_NOTFOUND) 132 fatal("no DNSKEY RR for %s in %s", setname, filename); 133 else if (result != ISC_R_SUCCESS) 134 fatal("dns_db_findrdataset"); 135 136 if (node != NULL) 137 dns_db_detachnode(db, &node); 138 if (db != NULL) 139 dns_db_detach(&db); 140 return (result); 141 } 142 143 static isc_result_t 144 loadkeyset(char *dirname, dns_rdataset_t *rdataset) { 145 isc_result_t result; 146 char filename[PATH_MAX + 1]; 147 isc_buffer_t buf; 148 149 dns_rdataset_init(rdataset); 150 151 isc_buffer_init(&buf, filename, sizeof(filename)); 152 if (dirname != NULL) { 153 /* allow room for a trailing slash */ 154 if (strlen(dirname) >= isc_buffer_availablelength(&buf)) 155 return (ISC_R_NOSPACE); 156 isc_buffer_putstr(&buf, dirname); 157 if (dirname[strlen(dirname) - 1] != '/') 158 isc_buffer_putstr(&buf, "/"); 159 } 160 161 if (isc_buffer_availablelength(&buf) < 7) 162 return (ISC_R_NOSPACE); 163 isc_buffer_putstr(&buf, "keyset-"); 164 165 result = dns_name_tofilenametext(name, ISC_FALSE, &buf); 166 check_result(result, "dns_name_tofilenametext()"); 167 if (isc_buffer_availablelength(&buf) == 0) 168 return (ISC_R_NOSPACE); 169 isc_buffer_putuint8(&buf, 0); 170 171 return (loadset(filename, rdataset)); 172 } 173 174 static void 175 loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size, 176 dns_rdata_t *rdata) 177 { 178 isc_result_t result; 179 dst_key_t *key = NULL; 180 isc_buffer_t keyb; 181 isc_region_t r; 182 183 dns_rdata_init(rdata); 184 185 isc_buffer_init(&keyb, key_buf, key_buf_size); 186 187 result = dst_key_fromnamedfile(filename, NULL, DST_TYPE_PUBLIC, 188 mctx, &key); 189 if (result != ISC_R_SUCCESS) 190 fatal("can't load %s.key: %s", 191 filename, isc_result_totext(result)); 192 193 if (verbose > 2) { 194 char keystr[DST_KEY_FORMATSIZE]; 195 196 dst_key_format(key, keystr, sizeof(keystr)); 197 fprintf(stderr, "%s: %s\n", program, keystr); 198 } 199 200 result = dst_key_todns(key, &keyb); 201 if (result != ISC_R_SUCCESS) 202 fatal("can't decode key"); 203 204 isc_buffer_usedregion(&keyb, &r); 205 dns_rdata_fromregion(rdata, dst_key_class(key), 206 dns_rdatatype_dnskey, &r); 207 208 rdclass = dst_key_class(key); 209 210 name = dns_fixedname_initname(&fixed); 211 result = dns_name_copy(dst_key_name(key), name, NULL); 212 if (result != ISC_R_SUCCESS) 213 fatal("can't copy name"); 214 215 dst_key_free(&key); 216 } 217 218 static void 219 logkey(dns_rdata_t *rdata) 220 { 221 isc_result_t result; 222 dst_key_t *key = NULL; 223 isc_buffer_t buf; 224 char keystr[DST_KEY_FORMATSIZE]; 225 226 isc_buffer_init(&buf, rdata->data, rdata->length); 227 isc_buffer_add(&buf, rdata->length); 228 result = dst_key_fromdns(name, rdclass, &buf, mctx, &key); 229 if (result != ISC_R_SUCCESS) 230 return; 231 232 dst_key_format(key, keystr, sizeof(keystr)); 233 fprintf(stderr, "%s: %s\n", program, keystr); 234 235 dst_key_free(&key); 236 } 237 238 static void 239 emit(unsigned int dtype, isc_boolean_t showall, char *lookaside, 240 isc_boolean_t cds, dns_rdata_t *rdata) 241 { 242 isc_result_t result; 243 unsigned char buf[DNS_DS_BUFFERSIZE]; 244 char text_buf[DST_KEY_MAXTEXTSIZE]; 245 char name_buf[DNS_NAME_MAXWIRE]; 246 char class_buf[10]; 247 isc_buffer_t textb, nameb, classb; 248 isc_region_t r; 249 dns_rdata_t ds; 250 dns_rdata_dnskey_t dnskey; 251 252 isc_buffer_init(&textb, text_buf, sizeof(text_buf)); 253 isc_buffer_init(&nameb, name_buf, sizeof(name_buf)); 254 isc_buffer_init(&classb, class_buf, sizeof(class_buf)); 255 256 dns_rdata_init(&ds); 257 258 result = dns_rdata_tostruct(rdata, &dnskey, NULL); 259 if (result != ISC_R_SUCCESS) 260 fatal("can't convert DNSKEY"); 261 262 if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) 263 return; 264 265 result = dns_ds_buildrdata(name, rdata, dtype, buf, &ds); 266 if (result != ISC_R_SUCCESS) 267 fatal("can't build record"); 268 269 result = dns_name_totext(name, ISC_FALSE, &nameb); 270 if (result != ISC_R_SUCCESS) 271 fatal("can't print name"); 272 273 /* Add lookaside origin, if set */ 274 if (lookaside != NULL) { 275 if (isc_buffer_availablelength(&nameb) < strlen(lookaside)) 276 fatal("DLV origin '%s' is too long", lookaside); 277 isc_buffer_putstr(&nameb, lookaside); 278 if (lookaside[strlen(lookaside) - 1] != '.') { 279 if (isc_buffer_availablelength(&nameb) < 1) 280 fatal("DLV origin '%s' is too long", lookaside); 281 isc_buffer_putstr(&nameb, "."); 282 } 283 } 284 285 result = dns_rdata_tofmttext(&ds, (dns_name_t *) NULL, 0, 0, 0, "", 286 &textb); 287 288 if (result != ISC_R_SUCCESS) 289 fatal("can't print rdata"); 290 291 result = dns_rdataclass_totext(rdclass, &classb); 292 if (result != ISC_R_SUCCESS) 293 fatal("can't print class"); 294 295 isc_buffer_usedregion(&nameb, &r); 296 printf("%.*s ", (int)r.length, r.base); 297 298 if (emitttl) 299 printf("%u ", ttl); 300 301 isc_buffer_usedregion(&classb, &r); 302 printf("%.*s", (int)r.length, r.base); 303 304 if (lookaside == NULL) { 305 if (cds) 306 printf(" CDS "); 307 else 308 printf(" DS "); 309 } else 310 printf(" DLV "); 311 312 isc_buffer_usedregion(&textb, &r); 313 printf("%.*s\n", (int)r.length, r.base); 314 } 315 316 ISC_PLATFORM_NORETURN_PRE static void 317 usage(void) ISC_PLATFORM_NORETURN_POST; 318 319 static void 320 usage(void) { 321 fprintf(stderr, "Usage:\n"); 322 fprintf(stderr, " %s options [-K dir] keyfile\n\n", program); 323 fprintf(stderr, " %s options [-K dir] [-c class] -s dnsname\n\n", 324 program); 325 fprintf(stderr, " %s options -f zonefile (as zone name)\n\n", program); 326 fprintf(stderr, " %s options -f zonefile zonename\n\n", program); 327 fprintf(stderr, "Version: %s\n", VERSION); 328 fprintf(stderr, "Options:\n"); 329 fprintf(stderr, " -v <verbose level>\n"); 330 fprintf(stderr, " -V: print version information\n"); 331 fprintf(stderr, " -K <directory>: directory in which to find " 332 "key file or keyset file\n"); 333 fprintf(stderr, " -a algorithm: digest algorithm " 334 "(SHA-1, SHA-256, GOST or SHA-384)\n"); 335 fprintf(stderr, " -1: use SHA-1\n"); 336 fprintf(stderr, " -2: use SHA-256\n"); 337 fprintf(stderr, " -C: print CDS record\n"); 338 fprintf(stderr, " -l: add lookaside zone and print DLV records\n"); 339 fprintf(stderr, " -s: read keyset from keyset-<dnsname> file\n"); 340 fprintf(stderr, " -c class: rdata class for DS set (default: IN)\n"); 341 fprintf(stderr, " -T TTL\n"); 342 fprintf(stderr, " -f file: read keyset from zone file\n"); 343 fprintf(stderr, " -A: when used with -f, " 344 "include all keys in DS set, not just KSKs\n"); 345 fprintf(stderr, "Output: DS or DLV RRs\n"); 346 347 exit (-1); 348 } 349 350 int 351 main(int argc, char **argv) { 352 char *classname = NULL; 353 char *filename = NULL, *dir = NULL, *namestr; 354 char *lookaside = NULL; 355 char *endp; 356 int ch; 357 unsigned int dtype = DNS_DSDIGEST_SHA1; 358 isc_boolean_t cds = ISC_FALSE; 359 isc_boolean_t both = ISC_TRUE; 360 isc_boolean_t usekeyset = ISC_FALSE; 361 isc_boolean_t showall = ISC_FALSE; 362 isc_result_t result; 363 isc_log_t *log = NULL; 364 isc_entropy_t *ectx = NULL; 365 dns_rdataset_t rdataset; 366 dns_rdata_t rdata; 367 368 dns_rdata_init(&rdata); 369 370 if (argc == 1) 371 usage(); 372 373 result = isc_mem_create(0, 0, &mctx); 374 if (result != ISC_R_SUCCESS) 375 fatal("out of memory"); 376 377 #ifdef PKCS11CRYPTO 378 pk11_result_register(); 379 #endif 380 dns_result_register(); 381 382 isc_commandline_errprint = ISC_FALSE; 383 384 #define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV" 385 while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) { 386 switch (ch) { 387 case '1': 388 dtype = DNS_DSDIGEST_SHA1; 389 both = ISC_FALSE; 390 break; 391 case '2': 392 dtype = DNS_DSDIGEST_SHA256; 393 both = ISC_FALSE; 394 break; 395 case 'A': 396 showall = ISC_TRUE; 397 break; 398 case 'a': 399 dtype = strtodsdigest(isc_commandline_argument); 400 both = ISC_FALSE; 401 break; 402 case 'C': 403 if (lookaside != NULL) 404 fatal("lookaside and CDS are mutually" 405 " exclusive"); 406 cds = ISC_TRUE; 407 break; 408 case 'c': 409 classname = isc_commandline_argument; 410 break; 411 case 'd': 412 fprintf(stderr, "%s: the -d option is deprecated; " 413 "use -K\n", program); 414 /* fall through */ 415 case 'K': 416 dir = isc_commandline_argument; 417 if (strlen(dir) == 0U) 418 fatal("directory must be non-empty string"); 419 break; 420 case 'f': 421 filename = isc_commandline_argument; 422 break; 423 case 'l': 424 if (cds) 425 fatal("lookaside and CDS are mutually" 426 " exclusive"); 427 lookaside = isc_commandline_argument; 428 if (strlen(lookaside) == 0U) 429 fatal("lookaside must be a non-empty string"); 430 break; 431 case 's': 432 usekeyset = ISC_TRUE; 433 break; 434 case 'T': 435 emitttl = ISC_TRUE; 436 ttl = strtottl(isc_commandline_argument); 437 break; 438 case 'v': 439 verbose = strtol(isc_commandline_argument, &endp, 0); 440 if (*endp != '\0') 441 fatal("-v must be followed by a number"); 442 break; 443 case 'F': 444 /* Reserved for FIPS mode */ 445 /* FALLTHROUGH */ 446 case '?': 447 if (isc_commandline_option != '?') 448 fprintf(stderr, "%s: invalid argument -%c\n", 449 program, isc_commandline_option); 450 /* FALLTHROUGH */ 451 case 'h': 452 /* Does not return. */ 453 usage(); 454 455 case 'V': 456 /* Does not return. */ 457 version(program); 458 459 default: 460 fprintf(stderr, "%s: unhandled option -%c\n", 461 program, isc_commandline_option); 462 exit(1); 463 } 464 } 465 466 rdclass = strtoclass(classname); 467 468 if (usekeyset && filename != NULL) 469 fatal("cannot use both -s and -f"); 470 471 /* When not using -f, -A is implicit */ 472 if (filename == NULL) 473 showall = ISC_TRUE; 474 475 if (argc < isc_commandline_index + 1 && filename == NULL) 476 fatal("the key file name was not specified"); 477 if (argc > isc_commandline_index + 1) 478 fatal("extraneous arguments"); 479 480 if (ectx == NULL) 481 setup_entropy(mctx, NULL, &ectx); 482 result = dst_lib_init(mctx, ectx, 483 ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY); 484 if (result != ISC_R_SUCCESS) 485 fatal("could not initialize dst: %s", 486 isc_result_totext(result)); 487 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE); 488 if (result != ISC_R_SUCCESS) 489 fatal("could not initialize hash"); 490 isc_entropy_stopcallbacksources(ectx); 491 492 setup_logging(mctx, &log); 493 494 dns_rdataset_init(&rdataset); 495 496 if (usekeyset || filename != NULL) { 497 if (argc < isc_commandline_index + 1 && filename != NULL) { 498 /* using zone name as the zone file name */ 499 namestr = filename; 500 } else 501 namestr = argv[isc_commandline_index]; 502 503 result = initname(namestr); 504 if (result != ISC_R_SUCCESS) 505 fatal("could not initialize name %s", namestr); 506 507 if (usekeyset) 508 result = loadkeyset(dir, &rdataset); 509 else 510 result = loadset(filename, &rdataset); 511 512 if (result != ISC_R_SUCCESS) 513 fatal("could not load DNSKEY set: %s\n", 514 isc_result_totext(result)); 515 516 for (result = dns_rdataset_first(&rdataset); 517 result == ISC_R_SUCCESS; 518 result = dns_rdataset_next(&rdataset)) { 519 dns_rdata_init(&rdata); 520 dns_rdataset_current(&rdataset, &rdata); 521 522 if (verbose > 2) 523 logkey(&rdata); 524 525 if (both) { 526 emit(DNS_DSDIGEST_SHA1, showall, lookaside, 527 cds, &rdata); 528 emit(DNS_DSDIGEST_SHA256, showall, lookaside, 529 cds, &rdata); 530 } else 531 emit(dtype, showall, lookaside, cds, &rdata); 532 } 533 } else { 534 unsigned char key_buf[DST_KEY_MAXSIZE]; 535 536 loadkey(argv[isc_commandline_index], key_buf, 537 DST_KEY_MAXSIZE, &rdata); 538 539 if (both) { 540 emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds, 541 &rdata); 542 emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds, 543 &rdata); 544 } else 545 emit(dtype, showall, lookaside, cds, &rdata); 546 } 547 548 if (dns_rdataset_isassociated(&rdataset)) 549 dns_rdataset_disassociate(&rdataset); 550 cleanup_logging(&log); 551 isc_hash_destroy(); 552 dst_lib_destroy(); 553 cleanup_entropy(&ectx); 554 dns_name_destroy(); 555 if (verbose > 10) 556 isc_mem_stats(mctx, stdout); 557 isc_mem_destroy(&mctx); 558 559 fflush(stdout); 560 if (ferror(stdout)) { 561 fprintf(stderr, "write error\n"); 562 return (1); 563 } else 564 return (0); 565 } 566
Indexes created Sun Oct 25 00:26:45 UTC 2026