2 * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
4 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
11 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
12 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
13 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
16 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 /* $Id: dnssec-signkey.c,v 1.50.2.4 2004/03/09 06:09:15 marka Exp $ */
25 #include <isc/string.h>
26 #include <isc/commandline.h>
27 #include <isc/entropy.h>
32 #include <dns/dbiterator.h>
33 #include <dns/dnssec.h>
34 #include <dns/fixedname.h>
36 #include <dns/rdata.h>
37 #include <dns/rdataclass.h>
38 #include <dns/rdatalist.h>
39 #include <dns/rdataset.h>
40 #include <dns/rdatasetiter.h>
41 #include <dns/rdatastruct.h>
42 #include <dns/result.h>
43 #include <dns/secalg.h>
47 #include "dnssectool.h"
49 const char *program
= "dnssec-signkey";
54 typedef struct keynode keynode_t
;
57 isc_boolean_t verified
;
58 ISC_LINK(keynode_t
) link
;
60 typedef ISC_LIST(keynode_t
) keylist_t
;
62 static isc_stdtime_t starttime
= 0, endtime
= 0, now
;
64 static isc_mem_t
*mctx
= NULL
;
65 static isc_entropy_t
*ectx
= NULL
;
66 static keylist_t keylist
;
70 fprintf(stderr
, "Usage:\n");
71 fprintf(stderr
, "\t%s [options] keyset keys\n", program
);
73 fprintf(stderr
, "\n");
75 fprintf(stderr
, "Options: (default value in parenthesis) \n");
76 fprintf(stderr
, "\t-a\n");
77 fprintf(stderr
, "\t\tverify generated signatures\n");
78 fprintf(stderr
, "\t-c class (IN)\n");
79 fprintf(stderr
, "\t-s YYYYMMDDHHMMSS|+offset:\n");
80 fprintf(stderr
, "\t\tSIG start time - absolute|offset (from keyset)\n");
81 fprintf(stderr
, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
82 fprintf(stderr
, "\t\tSIG end time - absolute|from start|from now "
84 fprintf(stderr
, "\t-v level:\n");
85 fprintf(stderr
, "\t\tverbose level (0)\n");
86 fprintf(stderr
, "\t-p\n");
87 fprintf(stderr
, "\t\tuse pseudorandom data (faster but less secure)\n");
88 fprintf(stderr
, "\t-r randomdev:\n");
89 fprintf(stderr
, "\t\ta file containing random data\n");
91 fprintf(stderr
, "\n");
93 fprintf(stderr
, "keyset:\n");
94 fprintf(stderr
, "\tfile with keyset to be signed (keyset-<name>)\n");
95 fprintf(stderr
, "keys:\n");
96 fprintf(stderr
, "\tkeyfile (Kname+alg+tag)\n");
98 fprintf(stderr
, "\n");
99 fprintf(stderr
, "Output:\n");
100 fprintf(stderr
, "\tsigned keyset (signedkey-<name>)\n");
105 loadkeys(dns_name_t
*name
, dns_rdataset_t
*rdataset
) {
107 dns_rdata_t rdata
= DNS_RDATA_INIT
;
111 ISC_LIST_INIT(keylist
);
112 result
= dns_rdataset_first(rdataset
);
113 check_result(result
, "dns_rdataset_first");
114 for (; result
== ISC_R_SUCCESS
; result
= dns_rdataset_next(rdataset
)) {
115 dns_rdata_reset(&rdata
);
116 dns_rdataset_current(rdataset
, &rdata
);
118 result
= dns_dnssec_keyfromrdata(name
, &rdata
, mctx
, &key
);
119 if (result
!= ISC_R_SUCCESS
)
121 if (!dst_key_iszonekey(key
))
123 keynode
= isc_mem_get(mctx
, sizeof (keynode_t
));
125 fatal("out of memory");
127 keynode
->verified
= ISC_FALSE
;
128 ISC_LIST_INITANDAPPEND(keylist
, keynode
, link
);
130 if (result
!= ISC_R_NOMORE
)
131 fatal("failure traversing key list");
135 findkey(dns_rdata_sig_t
*sig
) {
137 for (keynode
= ISC_LIST_HEAD(keylist
);
139 keynode
= ISC_LIST_NEXT(keynode
, link
))
141 if (dst_key_id(keynode
->key
) == sig
->keyid
&&
142 dst_key_alg(keynode
->key
) == sig
->algorithm
) {
143 keynode
->verified
= ISC_TRUE
;
144 return (keynode
->key
);
147 fatal("signature generated by non-zone or missing key");
152 main(int argc
, char *argv
[]) {
154 char *startstr
= NULL
, *endstr
= NULL
, *classname
= NULL
;
156 dns_fixedname_t fdomain
;
161 char *randomfile
= NULL
;
164 dns_dbversion_t
*version
;
165 dns_dbiterator_t
*dbiter
;
166 dns_rdatasetiter_t
*rdsiter
;
167 dst_key_t
*key
= NULL
;
169 dns_rdata_t sigrdata
= DNS_RDATA_INIT
;
170 dns_rdatalist_t sigrdatalist
;
171 dns_rdataset_t rdataset
, sigrdataset
, newsigrdataset
;
176 isc_log_t
*log
= NULL
;
178 isc_boolean_t pseudorandom
= ISC_FALSE
;
180 dns_rdataclass_t rdclass
;
181 static isc_boolean_t tryverify
= ISC_FALSE
;
183 result
= isc_mem_create(0, 0, &mctx
);
184 check_result(result
, "isc_mem_create()");
186 dns_result_register();
188 while ((ch
= isc_commandline_parse(argc
, argv
, "ac:s:e:pr:v:h")) != -1)
192 tryverify
= ISC_TRUE
;
195 classname
= isc_commandline_argument
;
199 startstr
= isc_commandline_argument
;
203 endstr
= isc_commandline_argument
;
207 pseudorandom
= ISC_TRUE
;
211 randomfile
= isc_commandline_argument
;
216 verbose
= strtol(isc_commandline_argument
, &endp
, 0);
218 fatal("verbose level must be numeric");
228 argc
-= isc_commandline_index
;
229 argv
+= isc_commandline_index
;
234 if (classname
!= NULL
) {
236 tr
.length
= strlen(classname
);
237 result
= dns_rdataclass_fromtext(&rdclass
, &tr
);
238 if (result
!= ISC_R_SUCCESS
)
239 fatal("unknown class %s",classname
);
241 rdclass
= dns_rdataclass_in
;
243 setup_entropy(mctx
, randomfile
, &ectx
);
244 eflags
= ISC_ENTROPY_BLOCKING
;
246 eflags
|= ISC_ENTROPY_GOODONLY
;
247 result
= dst_lib_init(mctx
, ectx
, eflags
);
248 if (result
!= ISC_R_SUCCESS
)
249 fatal("could not initialize dst: %s",
250 isc_result_totext(result
));
252 isc_stdtime_get(&now
);
254 if ((startstr
== NULL
|| endstr
== NULL
) &&
255 !(startstr
== NULL
&& endstr
== NULL
))
256 fatal("if -s or -e is specified, both must be");
258 setup_logging(verbose
, mctx
, &log
);
260 if (strlen(argv
[0]) < 8U || strncmp(argv
[0], "keyset-", 7) != 0)
261 fatal("keyset file '%s' must start with keyset-", argv
[0]);
264 result
= dns_db_create(mctx
, "rbt", dns_rootname
, dns_dbtype_zone
,
265 rdclass
, 0, NULL
, &db
);
266 check_result(result
, "dns_db_create()");
268 result
= dns_db_load(db
, argv
[0]);
269 if (result
!= ISC_R_SUCCESS
&& result
!= DNS_R_SEENINCLUDE
)
270 fatal("failed to load database from '%s': %s", argv
[0],
271 isc_result_totext(result
));
273 dns_fixedname_init(&fdomain
);
274 domain
= dns_fixedname_name(&fdomain
);
277 result
= dns_db_createiterator(db
, ISC_FALSE
, &dbiter
);
278 check_result(result
, "dns_db_createiterator()");
280 result
= dns_dbiterator_first(dbiter
);
281 check_result(result
, "dns_dbiterator_first()");
282 while (result
== ISC_R_SUCCESS
) {
284 dns_dbiterator_current(dbiter
, &node
, domain
);
286 result
= dns_db_allrdatasets(db
, node
, NULL
, 0, &rdsiter
);
287 check_result(result
, "dns_db_allrdatasets()");
288 result
= dns_rdatasetiter_first(rdsiter
);
289 dns_rdatasetiter_destroy(&rdsiter
);
290 if (result
== ISC_R_SUCCESS
)
292 dns_db_detachnode(db
, &node
);
293 result
= dns_dbiterator_next(dbiter
);
295 dns_dbiterator_destroy(&dbiter
);
296 if (result
!= ISC_R_SUCCESS
)
297 fatal("failed to find data in keyset file");
299 isc_buffer_init(&b
, tdomain
, sizeof(tdomain
) - 1);
300 result
= dns_name_tofilenametext(domain
, ISC_FALSE
, &b
);
301 check_result(result
, "dns_name_tofilenametext()");
302 isc_buffer_putuint8(&b
, 0);
304 output
= isc_mem_allocate(mctx
,
305 strlen("signedkey-") + strlen(tdomain
) + 1);
307 fatal("out of memory");
308 strcpy(output
, "signedkey-");
309 strcat(output
, tdomain
);
312 dns_db_newversion(db
, &version
);
314 dns_rdataset_init(&rdataset
);
315 dns_rdataset_init(&sigrdataset
);
316 result
= dns_db_findrdataset(db
, node
, version
, dns_rdatatype_key
, 0,
317 0, &rdataset
, &sigrdataset
);
318 if (result
!= ISC_R_SUCCESS
) {
319 char domainstr
[DNS_NAME_FORMATSIZE
];
320 dns_name_format(domain
, domainstr
, sizeof domainstr
);
321 fatal("failed to find rdataset '%s KEY': %s",
322 domainstr
, isc_result_totext(result
));
325 loadkeys(domain
, &rdataset
);
327 if (!dns_rdataset_isassociated(&sigrdataset
))
328 fatal("no SIG KEY set present");
330 result
= dns_rdataset_first(&sigrdataset
);
331 check_result(result
, "dns_rdataset_first()");
333 dns_rdataset_current(&sigrdataset
, &sigrdata
);
334 result
= dns_rdata_tostruct(&sigrdata
, &sig
, mctx
);
335 check_result(result
, "dns_rdata_tostruct()");
337 result
= dns_dnssec_verify(domain
, &rdataset
, key
,
338 ISC_TRUE
, mctx
, &sigrdata
);
339 if (result
!= ISC_R_SUCCESS
) {
340 char keystr
[KEY_FORMATSIZE
];
341 key_format(key
, keystr
, sizeof keystr
);
342 fatal("signature by key '%s' did not verify: %s",
343 keystr
, isc_result_totext(result
));
345 dns_rdata_reset(&sigrdata
);
346 dns_rdata_freestruct(&sig
);
347 result
= dns_rdataset_next(&sigrdataset
);
348 } while (result
== ISC_R_SUCCESS
);
350 if (startstr
!= NULL
) {
351 starttime
= strtotime(startstr
, now
, now
);
352 endtime
= strtotime(endstr
, now
, starttime
);
354 starttime
= sig
.timesigned
;
355 endtime
= sig
.timeexpire
;
359 for (keynode
= ISC_LIST_HEAD(keylist
);
361 keynode
= ISC_LIST_NEXT(keynode
, link
))
362 if (!keynode
->verified
)
363 fatal("Not all zone keys self signed the key set");
365 result
= dns_rdataset_first(&sigrdataset
);
366 check_result(result
, "dns_rdataset_first()");
367 dns_rdataset_current(&sigrdataset
, &sigrdata
);
368 result
= dns_rdata_tostruct(&sigrdata
, &sig
, mctx
);
369 check_result(result
, "dns_rdata_tostruct()");
371 dns_rdataset_disassociate(&sigrdataset
);
376 dns_rdatalist_init(&sigrdatalist
);
377 sigrdatalist
.rdclass
= rdataset
.rdclass
;
378 sigrdatalist
.type
= dns_rdatatype_sig
;
379 sigrdatalist
.covers
= dns_rdatatype_key
;
380 sigrdatalist
.ttl
= rdataset
.ttl
;
382 for (i
= 0; i
< argc
; i
++) {
384 result
= dst_key_fromnamedfile(argv
[i
],
388 if (result
!= ISC_R_SUCCESS
)
389 fatal("failed to read key %s from disk: %s",
390 argv
[i
], isc_result_totext(result
));
392 rdata
= isc_mem_get(mctx
, sizeof(dns_rdata_t
));
394 fatal("out of memory");
395 dns_rdata_init(rdata
);
396 data
= isc_mem_get(mctx
, BUFSIZE
);
398 fatal("out of memory");
399 isc_buffer_init(&b
, data
, BUFSIZE
);
400 result
= dns_dnssec_sign(domain
, &rdataset
, key
,
401 &starttime
, &endtime
,
403 isc_entropy_stopcallbacksources(ectx
);
404 if (result
!= ISC_R_SUCCESS
) {
405 char keystr
[KEY_FORMATSIZE
];
406 key_format(key
, keystr
, sizeof keystr
);
407 fatal("key '%s' failed to sign data: %s",
408 keystr
, isc_result_totext(result
));
411 result
= dns_dnssec_verify(domain
, &rdataset
, key
,
412 ISC_TRUE
, mctx
, rdata
);
413 if (result
!= ISC_R_SUCCESS
) {
414 char keystr
[KEY_FORMATSIZE
];
415 key_format(key
, keystr
, sizeof keystr
);
416 fatal("signature from key '%s' failed to "
418 keystr
, isc_result_totext(result
));
421 ISC_LIST_APPEND(sigrdatalist
.rdata
, rdata
, link
);
425 dns_rdataset_init(&newsigrdataset
);
426 result
= dns_rdatalist_tordataset(&sigrdatalist
, &newsigrdataset
);
427 check_result (result
, "dns_rdatalist_tordataset()");
429 dns_db_addrdataset(db
, node
, version
, 0, &newsigrdataset
, 0, NULL
);
430 check_result (result
, "dns_db_addrdataset()");
432 dns_db_detachnode(db
, &node
);
433 dns_db_closeversion(db
, &version
, ISC_TRUE
);
434 result
= dns_db_dump(db
, version
, output
);
435 if (result
!= ISC_R_SUCCESS
)
436 fatal("failed to write database to '%s': %s",
437 output
, isc_result_totext(result
));
439 printf("%s\n", output
);
441 dns_rdataset_disassociate(&rdataset
);
442 dns_rdataset_disassociate(&newsigrdataset
);
444 dns_rdata_freestruct(&sig
);
446 while (!ISC_LIST_EMPTY(sigrdatalist
.rdata
)) {
447 rdata
= ISC_LIST_HEAD(sigrdatalist
.rdata
);
448 ISC_LIST_UNLINK(sigrdatalist
.rdata
, rdata
, link
);
449 isc_mem_put(mctx
, rdata
->data
, BUFSIZE
);
450 isc_mem_put(mctx
, rdata
, sizeof *rdata
);
455 while (!ISC_LIST_EMPTY(keylist
)) {
456 keynode
= ISC_LIST_HEAD(keylist
);
457 ISC_LIST_UNLINK(keylist
, keynode
, link
);
458 dst_key_free(&keynode
->key
);
459 isc_mem_put(mctx
, keynode
, sizeof(keynode_t
));
462 cleanup_logging(&log
);
464 isc_mem_free(mctx
, output
);
465 cleanup_entropy(&ectx
);
468 isc_mem_stats(mctx
, stdout
);
469 isc_mem_destroy(&mctx
);