2 * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 2000, 2001 Internet Software Consortium.
4 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
11 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
12 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
13 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
16 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 /* $Id: dnssec-makekeyset.c,v 1.52.2.2 2004/03/09 06:09:15 marka Exp $ */
25 #include <isc/commandline.h>
26 #include <isc/entropy.h>
28 #include <isc/string.h>
32 #include <dns/dnssec.h>
33 #include <dns/fixedname.h>
35 #include <dns/rdata.h>
36 #include <dns/rdatalist.h>
37 #include <dns/rdataset.h>
38 #include <dns/result.h>
39 #include <dns/secalg.h>
44 #include "dnssectool.h"
48 const char *program
= "dnssec-makekeyset";
51 typedef struct keynode keynode_t
;
54 ISC_LINK(keynode_t
) link
;
56 typedef ISC_LIST(keynode_t
) keylist_t
;
58 static isc_stdtime_t starttime
= 0, endtime
= 0, now
;
61 static isc_mem_t
*mctx
= NULL
;
62 static isc_entropy_t
*ectx
= NULL
;
64 static keylist_t keylist
;
68 fprintf(stderr
, "Usage:\n");
69 fprintf(stderr
, "\t%s [options] keys\n", program
);
71 fprintf(stderr
, "\n");
73 fprintf(stderr
, "Options: (default value in parenthesis) \n");
74 fprintf(stderr
, "\t-a\n");
75 fprintf(stderr
, "\t\tverify generated signatures\n");
76 fprintf(stderr
, "\t-s YYYYMMDDHHMMSS|+offset:\n");
77 fprintf(stderr
, "\t\tSIG start time - absolute|offset (now)\n");
78 fprintf(stderr
, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
79 fprintf(stderr
, "\t\tSIG end time - "
80 "absolute|from start|from now (now + 30 days)\n");
81 fprintf(stderr
, "\t-t ttl\n");
82 fprintf(stderr
, "\t-p\n");
83 fprintf(stderr
, "\t\tuse pseudorandom data (faster but less secure)\n");
84 fprintf(stderr
, "\t-r randomdev:\n");
85 fprintf(stderr
, "\t\ta file containing random data\n");
86 fprintf(stderr
, "\t-v level:\n");
87 fprintf(stderr
, "\t\tverbose level (0)\n");
89 fprintf(stderr
, "\n");
91 fprintf(stderr
, "keys:\n");
92 fprintf(stderr
, "\tkeyfile (Kname+alg+tag)\n");
94 fprintf(stderr
, "\n");
96 fprintf(stderr
, "Output:\n");
97 fprintf(stderr
, "\tkeyset (keyset-<name>)\n");
102 zonekey_on_list(dst_key_t
*key
) {
104 for (keynode
= ISC_LIST_HEAD(keylist
);
106 keynode
= ISC_LIST_NEXT(keynode
, link
))
108 if (dst_key_compare(keynode
->key
, key
))
115 rdata_on_list(dns_rdata_t
*rdata
, dns_rdatalist_t
*list
) {
117 for (trdata
= ISC_LIST_HEAD(list
->rdata
);
119 trdata
= ISC_LIST_NEXT(trdata
, link
))
121 if (dns_rdata_compare(trdata
, rdata
) == 0)
128 main(int argc
, char *argv
[]) {
130 char *startstr
= NULL
, *endstr
= NULL
;
131 char *randomfile
= NULL
;
132 dns_fixedname_t fdomain
;
133 dns_name_t
*domain
= NULL
;
139 dns_dbversion_t
*version
;
140 dst_key_t
*key
= NULL
;
142 dns_rdatalist_t rdatalist
, sigrdatalist
;
143 dns_rdataset_t rdataset
, sigrdataset
;
147 isc_log_t
*log
= NULL
;
149 dns_name_t
*savedname
= NULL
;
151 isc_boolean_t pseudorandom
= ISC_FALSE
;
152 isc_boolean_t tryverify
= ISC_FALSE
;
154 result
= isc_mem_create(0, 0, &mctx
);
155 if (result
!= ISC_R_SUCCESS
)
156 fatal("failed to create memory context: %s",
157 isc_result_totext(result
));
159 dns_result_register();
161 while ((ch
= isc_commandline_parse(argc
, argv
, "as:e:t:r:v:ph")) != -1)
165 tryverify
= ISC_TRUE
;
168 startstr
= isc_commandline_argument
;
172 endstr
= isc_commandline_argument
;
177 ttl
= strtol(isc_commandline_argument
, &endp
, 0);
179 fatal("TTL must be numeric");
183 randomfile
= isc_commandline_argument
;
188 verbose
= strtol(isc_commandline_argument
, &endp
, 0);
190 fatal("verbose level must be numeric");
194 pseudorandom
= ISC_TRUE
;
204 argc
-= isc_commandline_index
;
205 argv
+= isc_commandline_index
;
210 setup_entropy(mctx
, randomfile
, &ectx
);
211 eflags
= ISC_ENTROPY_BLOCKING
;
213 eflags
|= ISC_ENTROPY_GOODONLY
;
214 result
= dst_lib_init(mctx
, ectx
, eflags
);
215 if (result
!= ISC_R_SUCCESS
)
216 fatal("could not initialize dst: %s",
217 isc_result_totext(result
));
219 isc_stdtime_get(&now
);
221 if (startstr
!= NULL
)
222 starttime
= strtotime(startstr
, now
, now
);
227 endtime
= strtotime(endstr
, now
, starttime
);
229 endtime
= starttime
+ (30 * 24 * 60 * 60);
233 fprintf(stderr
, "%s: TTL not specified, assuming 3600\n",
237 setup_logging(verbose
, mctx
, &log
);
239 dns_rdatalist_init(&rdatalist
);
240 rdatalist
.rdclass
= 0;
241 rdatalist
.type
= dns_rdatatype_key
;
242 rdatalist
.covers
= 0;
245 ISC_LIST_INIT(keylist
);
247 for (i
= 0; i
< argc
; i
++) {
248 char namestr
[DNS_NAME_FORMATSIZE
];
249 isc_buffer_t namebuf
;
252 result
= dst_key_fromnamedfile(argv
[i
], DST_TYPE_PUBLIC
,
254 if (result
!= ISC_R_SUCCESS
)
255 fatal("error loading key from %s: %s", argv
[i
],
256 isc_result_totext(result
));
257 if (rdatalist
.rdclass
== 0)
258 rdatalist
.rdclass
= dst_key_class(key
);
260 isc_buffer_init(&namebuf
, namestr
, sizeof namestr
);
261 result
= dns_name_tofilenametext(dst_key_name(key
),
264 check_result(result
, "dns_name_tofilenametext");
265 isc_buffer_putuint8(&namebuf
, 0);
267 if (savedname
== NULL
) {
268 savedname
= isc_mem_get(mctx
, sizeof(dns_name_t
));
269 if (savedname
== NULL
)
270 fatal("out of memory");
271 dns_name_init(savedname
, NULL
);
272 result
= dns_name_dup(dst_key_name(key
), mctx
,
274 if (result
!= ISC_R_SUCCESS
)
275 fatal("out of memory");
277 char savednamestr
[DNS_NAME_FORMATSIZE
];
278 dns_name_format(savedname
, savednamestr
,
279 sizeof savednamestr
);
280 if (!dns_name_equal(savedname
, dst_key_name(key
)) != 0)
281 fatal("all keys must have the same owner - %s "
282 "and %s do not match",
283 savednamestr
, namestr
);
285 if (output
== NULL
) {
286 output
= isc_mem_allocate(mctx
,
288 strlen(namestr
) + 1);
290 fatal("out of memory");
291 strcpy(output
, "keyset-");
292 strcat(output
, namestr
);
294 if (domain
== NULL
) {
295 dns_fixedname_init(&fdomain
);
296 domain
= dns_fixedname_name(&fdomain
);
297 dns_name_copy(dst_key_name(key
), domain
, NULL
);
299 if (dst_key_iszonekey(key
)) {
300 dst_key_t
*zonekey
= NULL
;
301 result
= dst_key_fromnamedfile(argv
[i
],
305 if (result
!= ISC_R_SUCCESS
)
306 fatal("failed to read private key %s: %s",
307 argv
[i
], isc_result_totext(result
));
308 if (!zonekey_on_list(zonekey
)) {
309 keynode
= isc_mem_get(mctx
,
312 fatal("out of memory");
313 keynode
->key
= zonekey
;
314 ISC_LIST_INITANDAPPEND(keylist
, keynode
, link
);
316 dst_key_free(&zonekey
);
318 rdata
= isc_mem_get(mctx
, sizeof(dns_rdata_t
));
320 fatal("out of memory");
321 dns_rdata_init(rdata
);
322 data
= isc_mem_get(mctx
, BUFSIZE
);
324 fatal("out of memory");
325 isc_buffer_init(&b
, data
, BUFSIZE
);
326 result
= dst_key_todns(key
, &b
);
327 if (result
!= ISC_R_SUCCESS
)
328 fatal("failed to convert key %s to a DNS KEY: %s",
329 argv
[i
], isc_result_totext(result
));
330 isc_buffer_usedregion(&b
, &r
);
331 dns_rdata_fromregion(rdata
, rdatalist
.rdclass
,
332 dns_rdatatype_key
, &r
);
333 if (!rdata_on_list(rdata
, &rdatalist
))
334 ISC_LIST_APPEND(rdatalist
.rdata
, rdata
, link
);
336 isc_mem_put(mctx
, data
, BUFSIZE
);
337 isc_mem_put(mctx
, rdata
, sizeof *rdata
);
342 dns_rdataset_init(&rdataset
);
343 result
= dns_rdatalist_tordataset(&rdatalist
, &rdataset
);
344 check_result(result
, "dns_rdatalist_tordataset()");
346 dns_rdatalist_init(&sigrdatalist
);
347 sigrdatalist
.rdclass
= rdatalist
.rdclass
;
348 sigrdatalist
.type
= dns_rdatatype_sig
;
349 sigrdatalist
.covers
= dns_rdatatype_key
;
350 sigrdatalist
.ttl
= ttl
;
352 if (ISC_LIST_EMPTY(keylist
))
354 "%s: no private zone key found; not self-signing\n",
356 for (keynode
= ISC_LIST_HEAD(keylist
);
358 keynode
= ISC_LIST_NEXT(keynode
, link
))
360 rdata
= isc_mem_get(mctx
, sizeof(dns_rdata_t
));
362 fatal("out of memory");
363 dns_rdata_init(rdata
);
364 data
= isc_mem_get(mctx
, BUFSIZE
);
366 fatal("out of memory");
367 isc_buffer_init(&b
, data
, BUFSIZE
);
368 result
= dns_dnssec_sign(domain
, &rdataset
, keynode
->key
,
369 &starttime
, &endtime
, mctx
, &b
,
371 isc_entropy_stopcallbacksources(ectx
);
372 if (result
!= ISC_R_SUCCESS
) {
373 char keystr
[KEY_FORMATSIZE
];
374 key_format(keynode
->key
, keystr
, sizeof keystr
);
375 fatal("failed to sign keyset with key %s: %s",
376 keystr
, isc_result_totext(result
));
379 result
= dns_dnssec_verify(domain
, &rdataset
,
380 keynode
->key
, ISC_TRUE
,
382 if (result
!= ISC_R_SUCCESS
) {
383 char keystr
[KEY_FORMATSIZE
];
384 key_format(keynode
->key
, keystr
, sizeof keystr
);
385 fatal("signature from key '%s' failed to "
387 keystr
, isc_result_totext(result
));
390 ISC_LIST_APPEND(sigrdatalist
.rdata
, rdata
, link
);
391 dns_rdataset_init(&sigrdataset
);
392 result
= dns_rdatalist_tordataset(&sigrdatalist
, &sigrdataset
);
393 check_result(result
, "dns_rdatalist_tordataset()");
397 result
= dns_db_create(mctx
, "rbt", dns_rootname
, dns_dbtype_zone
,
398 rdataset
.rdclass
, 0, NULL
, &db
);
399 if (result
!= ISC_R_SUCCESS
) {
400 char domainstr
[DNS_NAME_FORMATSIZE
];
401 dns_name_format(domain
, domainstr
, sizeof domainstr
);
402 fatal("failed to create a database for %s", domainstr
);
406 dns_db_newversion(db
, &version
);
409 result
= dns_db_findnode(db
, domain
, ISC_TRUE
, &node
);
410 check_result(result
, "dns_db_findnode()");
412 dns_db_addrdataset(db
, node
, version
, 0, &rdataset
, 0, NULL
);
413 if (!ISC_LIST_EMPTY(keylist
))
414 dns_db_addrdataset(db
, node
, version
, 0, &sigrdataset
, 0,
417 dns_db_detachnode(db
, &node
);
418 dns_db_closeversion(db
, &version
, ISC_TRUE
);
419 result
= dns_db_dump(db
, version
, output
);
420 if (result
!= ISC_R_SUCCESS
) {
421 char domainstr
[DNS_NAME_FORMATSIZE
];
422 dns_name_format(domain
, domainstr
, sizeof domainstr
);
423 fatal("failed to write database for %s to %s",
427 printf("%s\n", output
);
431 dns_rdataset_disassociate(&rdataset
);
432 while (!ISC_LIST_EMPTY(rdatalist
.rdata
)) {
433 rdata
= ISC_LIST_HEAD(rdatalist
.rdata
);
434 ISC_LIST_UNLINK(rdatalist
.rdata
, rdata
, link
);
435 isc_mem_put(mctx
, rdata
->data
, BUFSIZE
);
436 isc_mem_put(mctx
, rdata
, sizeof *rdata
);
438 while (!ISC_LIST_EMPTY(sigrdatalist
.rdata
)) {
439 rdata
= ISC_LIST_HEAD(sigrdatalist
.rdata
);
440 ISC_LIST_UNLINK(sigrdatalist
.rdata
, rdata
, link
);
441 isc_mem_put(mctx
, rdata
->data
, BUFSIZE
);
442 isc_mem_put(mctx
, rdata
, sizeof *rdata
);
445 while (!ISC_LIST_EMPTY(keylist
)) {
446 keynode
= ISC_LIST_HEAD(keylist
);
447 ISC_LIST_UNLINK(keylist
, keynode
, link
);
448 dst_key_free(&keynode
->key
);
449 isc_mem_put(mctx
, keynode
, sizeof(keynode_t
));
452 if (savedname
!= NULL
) {
453 dns_name_free(savedname
, mctx
);
454 isc_mem_put(mctx
, savedname
, sizeof(dns_name_t
));
457 cleanup_logging(&log
);
458 cleanup_entropy(&ectx
);
460 isc_mem_free(mctx
, output
);
463 isc_mem_stats(mctx
, stdout
);
464 isc_mem_destroy(&mctx
);