ldns  1.7.0
ldns-signzone.c
Go to the documentation of this file.
1 /*
2  * ldns-signzone signs a zone file
3  *
4  * (c) NLnet Labs, 2005 - 2008
5  * See the file LICENSE for the license
6  */
7 
8 #include "config.h"
9 #include <stdlib.h>
10 #include <unistd.h>
11 
12 #include <errno.h>
13 
14 #include <time.h>
15 
16 #include <ldns/ldns.h>
17 #include <ldns/keys.h>
18 
19 #ifdef HAVE_SSL
20 #include <openssl/conf.h>
21 #include <openssl/engine.h>
22 #endif /* HAVE_SSL */
23 
24 #define MAX_FILENAME_LEN 250
25 int verbosity = 1;
26 
27 #ifdef HAVE_SSL
28 #include <openssl/err.h>
29 
30 static void
31 usage(FILE *fp, const char *prog) {
32  fprintf(fp, "%s [OPTIONS] zonefile key [key [key]]\n", prog);
33  fprintf(fp, " signs the zone with the given key(s)\n");
34  fprintf(fp, " -b\t\tuse layout in signed zone and print comments DNSSEC records\n");
35  fprintf(fp, " -d\t\tused keys are not added to the zone\n");
36  fprintf(fp, " -e <date>\texpiration date\n");
37  fprintf(fp, " -f <file>\toutput zone to file (default <name>.signed)\n");
38  fprintf(fp, " -i <date>\tinception date\n");
39  fprintf(fp, " -o <domain>\torigin for the zone\n");
40  fprintf(fp, " -v\t\tprint version and exit\n");
41  fprintf(fp, " -A\t\tsign DNSKEY with all keys instead of minimal\n");
42  fprintf(fp, " -U\t\tSign with every unique algorithm in the provided keys\n");
43  fprintf(fp, " -E <name>\tuse <name> as the crypto engine for signing\n");
44  fprintf(fp, " \tThis can have a lot of extra options, see the manual page for more info\n");
45  fprintf(fp, " -k <id>,<int>\tuse key id with algorithm int from engine\n");
46  fprintf(fp, " -K <id>,<int>\tuse key id with algorithm int from engine as KSK\n");
47  fprintf(fp, "\t\tif no key is given (but an external one is used through the engine support, it might be necessary to provide the right algorithm number.\n");
48  fprintf(fp, " -n\t\tuse NSEC3 instead of NSEC.\n");
49  fprintf(fp, "\t\tIf you use NSEC3, you can specify the following extra options:\n");
50  fprintf(fp, "\t\t-a [algorithm] hashing algorithm\n");
51  fprintf(fp, "\t\t-t [number] number of hash iterations\n");
52  fprintf(fp, "\t\t-s [string] salt\n");
53  fprintf(fp, "\t\t-p set the opt-out flag on all nsec3 rrs\n");
54  fprintf(fp, "\n");
55  fprintf(fp, " keys must be specified by their base name (usually K<name>+<alg>+<id>),\n");
56  fprintf(fp, " i.e. WITHOUT the .private extension.\n");
57  fprintf(fp, " If the public part of the key is not present in the zone, the DNSKEY RR\n");
58  fprintf(fp, " will be read from the file called <base name>.key. If that does not exist,\n");
59  fprintf(fp, " a default DNSKEY will be generated from the private key and added to the zone.\n");
60  fprintf(fp, " A date can be a timestamp (seconds since the epoch), or of\n the form <YYYYMMdd[hhmmss]>\n");
61 }
62 
63 static void check_tm(struct tm tm)
64 {
65  if (tm.tm_year < 70) {
66  fprintf(stderr, "You cannot specify dates before 1970\n");
67  exit(EXIT_FAILURE);
68  }
69  if (tm.tm_mon < 0 || tm.tm_mon > 11) {
70  fprintf(stderr, "The month must be in the range 1 to 12\n");
71  exit(EXIT_FAILURE);
72  }
73  if (tm.tm_mday < 1 || tm.tm_mday > 31) {
74  fprintf(stderr, "The day must be in the range 1 to 31\n");
75  exit(EXIT_FAILURE);
76  }
77 
78  if (tm.tm_hour < 0 || tm.tm_hour > 23) {
79  fprintf(stderr, "The hour must be in the range 0-23\n");
80  exit(EXIT_FAILURE);
81  }
82 
83  if (tm.tm_min < 0 || tm.tm_min > 59) {
84  fprintf(stderr, "The minute must be in the range 0-59\n");
85  exit(EXIT_FAILURE);
86  }
87 
88  if (tm.tm_sec < 0 || tm.tm_sec > 59) {
89  fprintf(stderr, "The second must be in the range 0-59\n");
90  exit(EXIT_FAILURE);
91  }
92 
93 }
94 
95 /*
96  * if the ttls are different, make them equal
97  * if one of the ttls equals LDNS_DEFAULT_TTL, that one is changed
98  * otherwise, rr2 will get the ttl of rr1
99  *
100  * prints a warning if a non-default TTL is changed
101  */
102 static void
103 equalize_ttls(ldns_rr *rr1, ldns_rr *rr2, uint32_t default_ttl)
104 {
105  uint32_t ttl1, ttl2;
106 
107  ttl1 = ldns_rr_ttl(rr1);
108  ttl2 = ldns_rr_ttl(rr2);
109 
110  if (ttl1 != ttl2) {
111  if (ttl1 == default_ttl) {
112  ldns_rr_set_ttl(rr1, ttl2);
113  } else if (ttl2 == default_ttl) {
114  ldns_rr_set_ttl(rr2, ttl1);
115  } else {
116  ldns_rr_set_ttl(rr2, ttl1);
117  fprintf(stderr,
118  "warning: changing non-default TTL %u to %u\n",
119  (unsigned int) ttl2, (unsigned int) ttl1);
120  }
121  }
122 }
123 
124 static void
125 equalize_ttls_rr_list(ldns_rr_list *rr_list, ldns_rr *rr, uint32_t default_ttl)
126 {
127  size_t i;
128  ldns_rr *cur_rr;
129 
130  for (i = 0; i < ldns_rr_list_rr_count(rr_list); i++) {
131  cur_rr = ldns_rr_list_rr(rr_list, i);
132  if (ldns_rr_compare_no_rdata(cur_rr, rr) == 0) {
133  equalize_ttls(cur_rr, rr, default_ttl);
134  }
135  }
136 }
137 
138 static ldns_rr *
139 find_key_in_zone(ldns_rr *pubkey_gen, ldns_zone *zone) {
140  size_t key_i;
141  ldns_rr *pubkey;
142 
143  for (key_i = 0;
144  key_i < ldns_rr_list_rr_count(ldns_zone_rrs(zone));
145  key_i++) {
146  pubkey = ldns_rr_list_rr(ldns_zone_rrs(zone), key_i);
147  if (ldns_rr_get_type(pubkey) == LDNS_RR_TYPE_DNSKEY &&
148  (ldns_calc_keytag(pubkey)
149  ==
150  ldns_calc_keytag(pubkey_gen) ||
151  /* KSK has gen-keytag + 1 */
152  ldns_calc_keytag(pubkey)
153  ==
154  ldns_calc_keytag(pubkey_gen) + 1)
155  ) {
156  if (verbosity >= 2) {
157  fprintf(stderr, "Found it in the zone!\n");
158  }
159  return pubkey;
160  }
161  }
162  return NULL;
163 }
164 
165 static ldns_rr *
166 find_key_in_file(const char *keyfile_name_base, ldns_key* ATTR_UNUSED(key),
167  uint32_t zone_ttl)
168 {
169  char *keyfile_name;
170  FILE *keyfile;
171  int line_nr;
172  uint32_t default_ttl = zone_ttl;
173 
174  ldns_rr *pubkey = NULL;
175  keyfile_name = LDNS_XMALLOC(char,
176  strlen(keyfile_name_base) + 5);
177  snprintf(keyfile_name,
178  strlen(keyfile_name_base) + 5,
179  "%s.key",
180  keyfile_name_base);
181  if (verbosity >= 2) {
182  fprintf(stderr, "Trying to read %s\n", keyfile_name);
183  }
184  keyfile = fopen(keyfile_name, "r");
185  line_nr = 0;
186  if (keyfile) {
187  if (ldns_rr_new_frm_fp_l(&pubkey,
188  keyfile,
189  &default_ttl,
190  NULL,
191  NULL,
192  &line_nr) ==
193  LDNS_STATUS_OK) {
194  if (verbosity >= 2) {
195  printf("Key found in file: %s\n", keyfile_name);
196  }
197  }
198  fclose(keyfile);
199  }
200  LDNS_FREE(keyfile_name);
201  return pubkey;
202 }
203 
204 /* this function tries to find the specified keys either in the zone that
205  * has been read, or in a <basename>.key file. If the key is not found,
206  * a public key is generated, and it is assumed the key is a ZSK
207  *
208  * if add_keys is true; the DNSKEYs are added to the zone prior to signing
209  * if it is false, they are not added.
210  * Even if keys are not added, the function is still needed, to check
211  * whether keys of which we only have key data are KSKs or ZSKS
212  */
213 static void
214 find_or_create_pubkey(const char *keyfile_name_base, ldns_key *key, ldns_zone *orig_zone, bool add_keys, uint32_t default_ttl) {
215  ldns_rr *pubkey_gen, *pubkey;
216  int key_in_zone;
217 
218  if (default_ttl == LDNS_DEFAULT_TTL) {
219  default_ttl = ldns_rr_ttl(ldns_zone_soa(orig_zone));
220  }
221 
222  if (!ldns_key_pubkey_owner(key)) {
223  ldns_key_set_pubkey_owner(key, ldns_rdf_clone(ldns_rr_owner(ldns_zone_soa(orig_zone))));
224  }
225 
226  /* find the public key in the zone, or in a
227  * separate file
228  * we 'generate' one anyway,
229  * then match that to any present in the zone,
230  * if it matches, we drop our own. If not,
231  * we try to see if there is a .key file present.
232  * If not, we use our own generated one, with
233  * some default values
234  *
235  * Even if -d (do-not-add-keys) is specified,
236  * we still need to do this, because we need
237  * to have any key flags that are set this way
238  */
239  pubkey_gen = ldns_key2rr(key);
240  ldns_rr_set_ttl(pubkey_gen, default_ttl);
241 
242  if (verbosity >= 2) {
243  fprintf(stderr,
244  "Looking for key with keytag %u or %u\n",
245  (unsigned int) ldns_calc_keytag(pubkey_gen),
246  (unsigned int) ldns_calc_keytag(pubkey_gen)+1
247  );
248  }
249 
250  pubkey = find_key_in_zone(pubkey_gen, orig_zone);
251  key_in_zone = 1;
252  if (!pubkey) {
253  key_in_zone = 0;
254  /* it was not in the zone, try to read a .key file */
255  pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
256  if (!pubkey && !(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
257  /* maybe it is a ksk? */
258  ldns_key_set_keytag(key, ldns_key_keytag(key) + 1);
259  pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
260  if (!pubkey) {
261  /* ok, no file, set back to ZSK */
262  ldns_key_set_keytag(key, ldns_key_keytag(key) - 1);
263  }
264  }
265  if(pubkey && ldns_dname_compare(ldns_rr_owner(pubkey), ldns_rr_owner(ldns_zone_soa(orig_zone))) != 0) {
266  fprintf(stderr, "Error %s.key has wrong name: %s\n",
267  keyfile_name_base, ldns_rdf2str(ldns_rr_owner(pubkey)));
268  exit(EXIT_FAILURE); /* leak rdf2str, but we exit */
269  }
270  }
271 
272  if (!pubkey) {
273  /* okay, no public key found,
274  just use our generated one */
275  pubkey = pubkey_gen;
276  if (verbosity >= 2) {
277  fprintf(stderr, "Not in zone, no .key file, generating ZSK DNSKEY from private key data\n");
278  }
279  } else {
280  ldns_rr_free(pubkey_gen);
281  }
282  ldns_key_set_flags(key, ldns_rdf2native_int16(ldns_rr_rdf(pubkey, 0)));
283  ldns_key_set_keytag(key, ldns_calc_keytag(pubkey));
284 
285  if (add_keys && !key_in_zone) {
286  equalize_ttls_rr_list(ldns_zone_rrs(orig_zone), pubkey, default_ttl);
287  ldns_zone_push_rr(orig_zone, pubkey);
288  }
289 }
290 
291 int
292 main(int argc, char *argv[])
293 {
294  const char *zonefile_name;
295  FILE *zonefile = NULL;
296  int line_nr = 0;
297  int c;
298  int argi;
299  ENGINE *engine = NULL;
300 
301  ldns_zone *orig_zone;
302  ldns_rr_list *orig_rrs = NULL;
303  ldns_rr *orig_soa = NULL;
304  ldns_dnssec_zone *signed_zone;
305 
306  char *keyfile_name_base;
307  char *keyfile_name = NULL;
308  FILE *keyfile = NULL;
309  ldns_key *key = NULL;
310  ldns_key_list *keys;
311  ldns_status s;
312  size_t i;
313  ldns_rr_list *added_rrs;
314 
315  char *outputfile_name = NULL;
316  FILE *outputfile;
317 
318  /* tmp vars for engine keys */
319  char *eng_key_l;
320  size_t eng_key_id_len;
321  char *eng_key_id;
322  int eng_key_algo;
323 
324  bool use_nsec3 = false;
325  int signflags = 0;
326 
327  /* Add the given keys to the zone if they are not yet present */
328  bool add_keys = true;
329  uint8_t nsec3_algorithm = 1;
330  uint8_t nsec3_flags = 0;
331  size_t nsec3_iterations_cmd = 1;
332  uint16_t nsec3_iterations = 1;
333  uint8_t nsec3_salt_length = 0;
334  uint8_t *nsec3_salt = NULL;
335 
336  /* we need to know the origin before reading ksk's,
337  * so keep an array of filenames until we know it
338  */
339  struct tm tm;
340  uint32_t inception;
341  uint32_t expiration;
342  ldns_rdf *origin = NULL;
343  uint32_t ttl = LDNS_DEFAULT_TTL;
344  ldns_rr_class class = LDNS_RR_CLASS_IN;
345 
346  char *prog = strdup(argv[0]);
347  ldns_status result;
348 
349  ldns_output_format_storage fmt_st;
350  ldns_output_format* fmt = ldns_output_format_init(&fmt_st);
351 
352  inception = 0;
353  expiration = 0;
354 
355  keys = ldns_key_list_new();
356 
357  while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:vAUE:K:")) != -1) {
358  switch (c) {
359  case 'a':
360  nsec3_algorithm = (uint8_t) atoi(optarg);
361  if (nsec3_algorithm != 1) {
362  fprintf(stderr, "Bad NSEC3 algorithm, only RSASHA1 allowed\n");
363  exit(EXIT_FAILURE);
364  }
365  break;
366  case 'b':
367  ldns_output_format_set(fmt, LDNS_COMMENT_FLAGS
368  | LDNS_COMMENT_LAYOUT
369  | LDNS_COMMENT_NSEC3_CHAIN
370  | LDNS_COMMENT_BUBBLEBABBLE);
371  break;
372  case 'd':
373  add_keys = false;
374  break;
375  case 'e':
376  /* try to parse YYYYMMDD first,
377  * if that doesn't work, it
378  * should be a timestamp (seconds since epoch)
379  */
380  memset(&tm, 0, sizeof(tm));
381 
382  if (strlen(optarg) == 8 &&
383  sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
384  ) {
385  tm.tm_year -= 1900;
386  tm.tm_mon--;
387  check_tm(tm);
388  expiration =
389  (uint32_t) ldns_mktime_from_utc(&tm);
390  } else if (strlen(optarg) == 14 &&
391  sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
392  ) {
393  tm.tm_year -= 1900;
394  tm.tm_mon--;
395  check_tm(tm);
396  expiration =
397  (uint32_t) ldns_mktime_from_utc(&tm);
398  } else {
399  expiration = (uint32_t) atol(optarg);
400  }
401  break;
402  case 'f':
403  outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN);
404  strncpy(outputfile_name, optarg, MAX_FILENAME_LEN);
405  break;
406  case 'i':
407  memset(&tm, 0, sizeof(tm));
408 
409  if (strlen(optarg) == 8 &&
410  sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
411  ) {
412  tm.tm_year -= 1900;
413  tm.tm_mon--;
414  check_tm(tm);
415  inception =
416  (uint32_t) ldns_mktime_from_utc(&tm);
417  } else if (strlen(optarg) == 14 &&
418  sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
419  ) {
420  tm.tm_year -= 1900;
421  tm.tm_mon--;
422  check_tm(tm);
423  inception =
424  (uint32_t) ldns_mktime_from_utc(&tm);
425  } else {
426  inception = (uint32_t) atol(optarg);
427  }
428  break;
429  case 'n':
430  use_nsec3 = true;
431  break;
432  case 'o':
433  if (ldns_str2rdf_dname(&origin, optarg) != LDNS_STATUS_OK) {
434  fprintf(stderr, "Bad origin, not a correct domain name\n");
435  usage(stderr, prog);
436  exit(EXIT_FAILURE);
437  }
438  break;
439  case 'p':
440  nsec3_flags = nsec3_flags | LDNS_NSEC3_VARS_OPTOUT_MASK;
441  break;
442  case 'v':
443  printf("zone signer version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
444  exit(EXIT_SUCCESS);
445  break;
446  case 'A':
447  signflags |= LDNS_SIGN_DNSKEY_WITH_ZSK;
448  break;
449  case 'E':
450  ENGINE_load_builtin_engines();
451  ENGINE_load_dynamic();
452 #ifdef HAVE_ENGINE_LOAD_CRYPTODEV
453  ENGINE_load_cryptodev();
454 #endif
455  engine = ENGINE_by_id(optarg);
456  if (!engine) {
457  printf("No such engine: %s\n", optarg);
458  engine = ENGINE_get_first();
459  printf("Available engines:\n");
460  while (engine) {
461  printf("%s\n", ENGINE_get_id(engine));
462  engine = ENGINE_get_next(engine);
463  }
464  exit(EXIT_FAILURE);
465  } else {
466  if (!ENGINE_init(engine)) {
467  printf("The engine couldn't initialize\n");
468  exit(EXIT_FAILURE);
469  }
470  ENGINE_set_default_RSA(engine);
471  ENGINE_set_default_DSA(engine);
472  ENGINE_set_default(engine, 0);
473  }
474  break;
475  case 'k':
476  eng_key_l = strchr(optarg, ',');
477  if (eng_key_l && strlen(eng_key_l) > 1) {
478  if (eng_key_l > optarg) {
479  eng_key_id_len = (size_t) (eng_key_l - optarg);
480  eng_key_id = malloc(eng_key_id_len + 1);
481  memcpy(eng_key_id, optarg, eng_key_id_len);
482  eng_key_id[eng_key_id_len] = '\0';
483  } else {
484  /* no id given, use default from engine */
485  eng_key_id = NULL;
486  }
487 
488  eng_key_algo = atoi(eng_key_l + 1);
489 
490  printf("Engine key id: %s, algo %d\n", eng_key_id, eng_key_algo);
491 
492  s = ldns_key_new_frm_engine(&key, engine, eng_key_id, eng_key_algo);
493  if (s == LDNS_STATUS_OK) {
494  /* must be dnssec key */
495  switch (ldns_key_algorithm(key)) {
496  case LDNS_SIGN_RSAMD5:
497  case LDNS_SIGN_RSASHA1:
498  case LDNS_SIGN_RSASHA1_NSEC3:
499  case LDNS_SIGN_RSASHA256:
500  case LDNS_SIGN_RSASHA512:
501  case LDNS_SIGN_DSA:
502  case LDNS_SIGN_DSA_NSEC3:
503  case LDNS_SIGN_ECC_GOST:
504 #ifdef USE_ECDSA
505  case LDNS_SIGN_ECDSAP256SHA256:
506  case LDNS_SIGN_ECDSAP384SHA384:
507 #endif
508  ldns_key_list_push_key(keys, key);
509  /*printf("Added key at %p:\n", key);*/
510  /*ldns_key_print(stdout, key);*/
511  break;
512  default:
513  fprintf(stderr, "Warning, key not suitable for signing, ignoring key with algorithm %u\n", ldns_key_algorithm(key));
514  break;
515  }
516  if (expiration != 0) {
517  ldns_key_set_expiration(key,
518  expiration);
519  }
520  if (inception != 0) {
521  ldns_key_set_inception(key,
522  inception);
523  }
524  } else {
525  printf("Error reading key '%s' from engine: %s\n", eng_key_id, ldns_get_errorstr_by_id(s));
526  #ifdef HAVE_SSL
527  if (ERR_peek_error()) {
528  ERR_load_crypto_strings();
529  ERR_print_errors_fp(stderr);
530  ERR_free_strings();
531  }
532  #endif
533  exit(EXIT_FAILURE);
534  }
535 
536  if (eng_key_id) {
537  free(eng_key_id);
538  }
539  } else {
540  printf("Error: bad engine key specification (should be: -k <id>,<algorithm>)).\n");
541  exit(EXIT_FAILURE);
542  }
543  break;
544  case 'K':
545  printf("Not implemented yet\n");
546  exit(EXIT_FAILURE);
547  break;
548  case 'U':
549  signflags |= LDNS_SIGN_WITH_ALL_ALGORITHMS;
550  break;
551  case 's':
552  if (strlen(optarg) % 2 != 0) {
553  fprintf(stderr, "Salt value is not valid hex data, not a multiple of 2 characters\n");
554  exit(EXIT_FAILURE);
555  }
556  nsec3_salt_length = (uint8_t) strlen(optarg) / 2;
557  nsec3_salt = LDNS_XMALLOC(uint8_t, nsec3_salt_length);
558  for (c = 0; c < (int) strlen(optarg); c += 2) {
559  if (isxdigit((int) optarg[c]) && isxdigit((int) optarg[c+1])) {
560  nsec3_salt[c/2] = (uint8_t) ldns_hexdigit_to_int(optarg[c]) * 16 +
561  ldns_hexdigit_to_int(optarg[c+1]);
562  } else {
563  fprintf(stderr, "Salt value is not valid hex data.\n");
564  exit(EXIT_FAILURE);
565  }
566  }
567 
568  break;
569  case 't':
570  nsec3_iterations_cmd = (size_t) atol(optarg);
571  if (nsec3_iterations_cmd > LDNS_NSEC3_MAX_ITERATIONS) {
572  fprintf(stderr, "Iterations count can not exceed %u, quitting\n", LDNS_NSEC3_MAX_ITERATIONS);
573  exit(EXIT_FAILURE);
574  }
575  nsec3_iterations = (uint16_t) nsec3_iterations_cmd;
576  break;
577  default:
578  usage(stderr, prog);
579  exit(EXIT_SUCCESS);
580  }
581  }
582 
583  argc -= optind;
584  argv += optind;
585 
586  if (argc < 1) {
587  printf("Error: not enough arguments\n");
588  usage(stdout, prog);
589  exit(EXIT_FAILURE);
590  } else {
591  zonefile_name = argv[0];
592  }
593 
594  /* read zonefile first to find origin if not specified */
595 
596  if (strncmp(zonefile_name, "-", 2) == 0) {
597  s = ldns_zone_new_frm_fp_l(&orig_zone,
598  stdin,
599  origin,
600  ttl,
601  class,
602  &line_nr);
603  if (s != LDNS_STATUS_OK) {
604  fprintf(stderr, "Zone not read, error: %s at stdin line %d\n",
605  ldns_get_errorstr_by_id(s),
606  line_nr);
607  exit(EXIT_FAILURE);
608  } else {
609  orig_soa = ldns_zone_soa(orig_zone);
610  if (!orig_soa) {
611  fprintf(stderr,
612  "Error reading zonefile: missing SOA record\n");
613  exit(EXIT_FAILURE);
614  }
615  orig_rrs = ldns_zone_rrs(orig_zone);
616  if (!orig_rrs) {
617  fprintf(stderr,
618  "Error reading zonefile: no resource records\n");
619  exit(EXIT_FAILURE);
620  }
621  }
622  } else {
623  zonefile = fopen(zonefile_name, "r");
624 
625  if (!zonefile) {
626  fprintf(stderr,
627  "Error: unable to read %s (%s)\n",
628  zonefile_name,
629  strerror(errno));
630  exit(EXIT_FAILURE);
631  } else {
632  s = ldns_zone_new_frm_fp_l(&orig_zone,
633  zonefile,
634  origin,
635  ttl,
636  class,
637  &line_nr);
638  if (s != LDNS_STATUS_OK) {
639  fprintf(stderr, "Zone not read, error: %s at %s line %d\n",
640  ldns_get_errorstr_by_id(s),
641  zonefile_name, line_nr);
642  exit(EXIT_FAILURE);
643  } else {
644  orig_soa = ldns_zone_soa(orig_zone);
645  if (!orig_soa) {
646  fprintf(stderr,
647  "Error reading zonefile: missing SOA record\n");
648  exit(EXIT_FAILURE);
649  }
650  orig_rrs = ldns_zone_rrs(orig_zone);
651  if (!orig_rrs) {
652  fprintf(stderr,
653  "Error reading zonefile: no resource records\n");
654  exit(EXIT_FAILURE);
655  }
656  }
657  fclose(zonefile);
658  }
659  }
660 
661  /* read the ZSKs */
662  argi = 1;
663  while (argi < argc) {
664  keyfile_name_base = argv[argi];
665  keyfile_name = LDNS_XMALLOC(char, strlen(keyfile_name_base) + 9);
666  snprintf(keyfile_name,
667  strlen(keyfile_name_base) + 9,
668  "%s.private",
669  keyfile_name_base);
670  keyfile = fopen(keyfile_name, "r");
671  line_nr = 0;
672  if (!keyfile) {
673  fprintf(stderr,
674  "Error: unable to read %s: %s\n",
675  keyfile_name,
676  strerror(errno));
677  } else {
678  s = ldns_key_new_frm_fp_l(&key, keyfile, &line_nr);
679  fclose(keyfile);
680  if (s == LDNS_STATUS_OK) {
681  /* set times in key? they will end up
682  in the rrsigs
683  */
684  if (expiration != 0) {
685  ldns_key_set_expiration(key, expiration);
686  }
687  if (inception != 0) {
688  ldns_key_set_inception(key, inception);
689  }
690 
691  LDNS_FREE(keyfile_name);
692 
693  ldns_key_list_push_key(keys, key);
694  } else {
695  fprintf(stderr, "Error reading key from %s at line %d: %s\n", argv[argi], line_nr, ldns_get_errorstr_by_id(s));
696  }
697  }
698  /* and, if not unset by -p, find or create the corresponding DNSKEY record */
699  if (key) {
700  find_or_create_pubkey(keyfile_name_base, key,
701  orig_zone, add_keys, ttl);
702  }
703  argi++;
704  }
705 
706  if (ldns_key_list_key_count(keys) < 1) {
707  fprintf(stderr, "Error: no keys to sign with. Aborting.\n\n");
708  usage(stderr, prog);
709  exit(EXIT_FAILURE);
710  }
711 
712  signed_zone = ldns_dnssec_zone_new();
713  if (ldns_dnssec_zone_add_rr(signed_zone, ldns_zone_soa(orig_zone)) !=
714  LDNS_STATUS_OK) {
715  fprintf(stderr,
716  "Error adding SOA to dnssec zone, skipping record\n");
717  }
718 
719  for (i = 0;
720  i < ldns_rr_list_rr_count(ldns_zone_rrs(orig_zone));
721  i++) {
722  if (ldns_dnssec_zone_add_rr(signed_zone,
723  ldns_rr_list_rr(ldns_zone_rrs(orig_zone),
724  i)) !=
725  LDNS_STATUS_OK) {
726  fprintf(stderr,
727  "Error adding RR to dnssec zone");
728  fprintf(stderr, ", skipping record:\n");
729  ldns_rr_print(stderr,
730  ldns_rr_list_rr(ldns_zone_rrs(orig_zone), i));
731  }
732  }
733 
734  /* list to store newly created rrs, so we can free them later */
735  added_rrs = ldns_rr_list_new();
736 
737  if (use_nsec3) {
738  result = ldns_dnssec_zone_sign_nsec3_flg_mkmap(signed_zone,
739  added_rrs,
740  keys,
741  ldns_dnssec_default_replace_signatures,
742  NULL,
743  nsec3_algorithm,
744  nsec3_flags,
745  nsec3_iterations,
746  nsec3_salt_length,
747  nsec3_salt,
748  signflags,
749  &fmt_st.hashmap);
750  } else {
751  result = ldns_dnssec_zone_sign_flg(signed_zone,
752  added_rrs,
753  keys,
754  ldns_dnssec_default_replace_signatures,
755  NULL,
756  signflags);
757  }
758  if (result != LDNS_STATUS_OK) {
759  fprintf(stderr, "Error signing zone: %s\n",
760  ldns_get_errorstr_by_id(result));
761  }
762 
763  if (!outputfile_name) {
764  outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN);
765  snprintf(outputfile_name, MAX_FILENAME_LEN, "%s.signed", zonefile_name);
766  }
767 
768  if (signed_zone) {
769  if (strncmp(outputfile_name, "-", 2) == 0) {
770  ldns_dnssec_zone_print(stdout, signed_zone);
771  } else {
772  outputfile = fopen(outputfile_name, "w");
773  if (!outputfile) {
774  fprintf(stderr, "Unable to open %s for writing: %s\n",
775  outputfile_name, strerror(errno));
776  } else {
777  ldns_dnssec_zone_print_fmt(
778  outputfile, fmt, signed_zone);
779  fclose(outputfile);
780  }
781  }
782  } else {
783  fprintf(stderr, "Error signing zone.\n");
784 
785 #ifdef HAVE_SSL
786  if (ERR_peek_error()) {
787  ERR_load_crypto_strings();
788  ERR_print_errors_fp(stderr);
789  ERR_free_strings();
790  }
791 #endif
792  exit(EXIT_FAILURE);
793  }
794 
795  ldns_key_list_free(keys);
796  /* since the ldns_rr records are pointed to in both the ldns_zone
797  * and the ldns_dnssec_zone, we can either deep_free the
798  * dnssec_zone and 'shallow' free the original zone and added
799  * records, or the other way around
800  */
801  ldns_dnssec_zone_free(signed_zone);
802  ldns_zone_deep_free(orig_zone);
803  ldns_rr_list_deep_free(added_rrs);
804 
805  LDNS_FREE(outputfile_name);
806 
807  CRYPTO_cleanup_all_ex_data();
808 
809  free(prog);
810  exit(EXIT_SUCCESS);
811 }
812 #else
813 int
814 main(int argc, char **argv)
815 {
816  fprintf(stderr, "ldns-signzone needs OpenSSL support, which has not been compiled in\n");
817  return 1;
818 }
819 #endif /* HAVE_SSL */
ldns_rr_rdf
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:895
LDNS_COMMENT_NSEC3_CHAIN
#define LDNS_COMMENT_NSEC3_CHAIN
Show the unhashed owner and next owner names for NSEC3 RR's as comment.
Definition: host2str.h:60
ldns_struct_rr_list
List or Set of Resource Records.
Definition: rr.h:330
ldns_rr_class
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:64
LDNS_NSEC3_VARS_OPTOUT_MASK
#define LDNS_NSEC3_VARS_OPTOUT_MASK
Definition: rdata.h:40
ldns_zone_new_frm_fp_l
ldns_status ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t ttl, ldns_rr_class c __attribute__((unused)), int *line_nr)
Definition: zone.c:194
ldns_dnssec_zone_new
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:569
LDNS_COMMENT_LAYOUT
#define LDNS_COMMENT_LAYOUT
Print mark up.
Definition: host2str.h:62
ldns_key2rr
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition: keys.c:1816
ldns_key_set_inception
void ldns_key_set_inception(ldns_key *k, uint32_t i)
Set the key's inception date (seconds after epoch)
Definition: keys.c:1475
ldns_key_set_keytag
void ldns_key_set_keytag(ldns_key *k, uint16_t tag)
Set the key's key tag.
Definition: keys.c:1493
ldns_struct_rr
Resource Record.
Definition: rr.h:302
keys.h
LDNS_FREE
#define LDNS_FREE(ptr)
Definition: util.h:60
ldns_dnssec_zone_add_rr
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:927
ldns_version
const char * ldns_version(void)
Show the internal library version.
Definition: util.c:160
ldns_struct_output_format
Output format specifier.
Definition: host2str.h:86
LDNS_STATUS_OK
@ LDNS_STATUS_OK
Definition: error.h:26
ldns_zone_push_rr
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:53
LDNS_COMMENT_FLAGS
#define LDNS_COMMENT_FLAGS
Show when a NSEC3 RR has the optout flag set as comment.
Definition: host2str.h:58
ldns_key_list_push_key
bool ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
pushes a key to a keylist
Definition: keys.c:1653
ldns_rr_print
void ldns_rr_print(FILE *output, const ldns_rr *rr)
Prints the data in the resource record to the given file stream (in presentation format)
Definition: host2str.c:2431
LDNS_KEY_SEP_KEY
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
ldns_struct_key_list
Same as rr_list, but now for keys.
Definition: keys.h:176
ldns_rr_set_ttl
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:802
LDNS_RR_CLASS_IN
@ LDNS_RR_CLASS_IN
the Internet
Definition: rr.h:50
LDNS_SIGN_ECDSAP256SHA256
@ LDNS_SIGN_ECDSAP256SHA256
Definition: keys.h:99
ldns_rr_list_deep_free
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:1006
ldns_key_flags
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1606
ldns_dnssec_zone_sign_flg
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1354
ldns_key_list_new
ldns_key_list * ldns_key_list_new(void)
Creates a new empty key list.
Definition: keys.c:58
ldns_zone_rrs
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
ldns_key_set_expiration
void ldns_key_set_expiration(ldns_key *k, uint32_t e)
Set the key's expiration date (seconds after epoch)
Definition: keys.c:1481
ldns_rdf2str
char * ldns_rdf2str(const ldns_rdf *rdf)
Converts the data in the rdata field to presentation format and returns that as a char *.
Definition: host2str.c:2288
ldns_str2rdf_dname
ldns_status ldns_str2rdf_dname(ldns_rdf **d, const char *str)
convert a dname string into wireformat
Definition: str2host.c:311
ldns_rr_free
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
LDNS_SIGN_ECC_GOST
@ LDNS_SIGN_ECC_GOST
Definition: keys.h:98
LDNS_SIGN_RSASHA1
@ LDNS_SIGN_RSASHA1
Definition: keys.h:92
ldns_hexdigit_to_int
int ldns_hexdigit_to_int(char ch)
Returns the int value of the given (hex) digit.
Definition: util.c:88
MAX_FILENAME_LEN
#define MAX_FILENAME_LEN
Definition: ldns-signzone.c:24
ldns_struct_dnssec_zone
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_dnssec_zone_free
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:796
ldns_mktime_from_utc
time_t ldns_mktime_from_utc(const struct tm *tm)
Convert TM to seconds since epoch (midnight, January 1st, 1970).
Definition: util.c:194
ldns_key_set_pubkey_owner
void ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
Set the key's pubkey owner.
Definition: keys.c:1487
LDNS_SIGN_RSASHA512
@ LDNS_SIGN_RSASHA512
Definition: keys.h:96
ldns_struct_key
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:126
ldns_struct_output_format_storage
Output format struct with additional data for flags that use them.
Definition: host2str.h:100
ldns_key_list_key_count
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1500
ldns_rdf_clone
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
LDNS_VERSION
#define LDNS_VERSION
Definition: util.h:30
ldns_calc_keytag
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
Definition: dnssec.c:271
ldns_status
enum ldns_enum_status ldns_status
Definition: error.h:134
ATTR_UNUSED
#define ATTR_UNUSED(x)
Definition: common.h:69
LDNS_NSEC3_MAX_ITERATIONS
#define LDNS_NSEC3_MAX_ITERATIONS
Definition: dnssec.h:87
LDNS_XMALLOC
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
LDNS_SIGN_DSA
@ LDNS_SIGN_DSA
Definition: keys.h:93
ldns_zone_soa
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17
verbosity
int verbosity
Definition: ldns-signzone.c:25
ldns_struct_rdf
Resource record data field.
Definition: rdata.h:174
ldns_rdf2native_int16
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rr_ttl
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:917
ldns_key_pubkey_owner
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1630
ldns_key_keytag
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1624
ldns_dnssec_zone_sign_nsec3_flg_mkmap
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1409
ldns_struct_output_format_storage::hashmap
ldns_rbtree_t * hashmap
Definition: host2str.h:102
ldns.h
ldns_struct_zone
DNS Zone.
Definition: zone.h:42
LDNS_DEFAULT_TTL
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
ldns_rr_list_new
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:986
ldns_dnssec_default_replace_signatures
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1725
ldns_get_errorstr_by_id
const char * ldns_get_errorstr_by_id(ldns_status err)
look up a descriptive text by each error.
Definition: error.c:164
LDNS_SIGN_DSA_NSEC3
@ LDNS_SIGN_DSA_NSEC3
Definition: keys.h:97
main
int main(int argc, char *argv[])
Definition: ldns-signzone.c:292
config.h
ldns_dname_compare
int ldns_dname_compare(const ldns_rdf *dname1, const ldns_rdf *dname2)
Compares the two dname rdf's according to the algorithm for ordering in RFC4034 Section 6.
Definition: dname.c:359
ldns_rr_list_rr
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:976
LDNS_RR_TYPE_DNSKEY
@ LDNS_RR_TYPE_DNSKEY
Definition: rr.h:175
ldns_key_new_frm_fp_l
ldns_status ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
Creates a new private key based on the contents of the file pointed by fp.
Definition: keys.c:454
LDNS_SIGN_RSASHA256
@ LDNS_SIGN_RSASHA256
Definition: keys.h:95
LDNS_SIGN_RSAMD5
@ LDNS_SIGN_RSAMD5
Definition: keys.h:91
ldns_key_set_flags
void ldns_key_set_flags(ldns_key *k, uint16_t f)
Set the key's flags.
Definition: keys.c:1395
LDNS_SIGN_WITH_ALL_ALGORITHMS
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition: dnssec_sign.h:16
LDNS_COMMENT_BUBBLEBABBLE
#define LDNS_COMMENT_BUBBLEBABBLE
Provide bubblebabble representation for DS RR's as comment.
Definition: host2str.h:56
ldns_zone_deep_free
void ldns_zone_deep_free(ldns_zone *zone)
Frees the allocated memory for the zone, the soa rr in it, and the rr_list structure in it,...
Definition: zone.c:312
ldns_dnssec_zone_print
void ldns_dnssec_zone_print(FILE *out, const ldns_dnssec_zone *zone)
Prints the complete zone to the given file descriptor.
Definition: dnssec_zone.c:1034
LDNS_SIGN_RSASHA1_NSEC3
@ LDNS_SIGN_RSASHA1_NSEC3
Definition: keys.h:94
ldns_rr_owner
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:905
LDNS_SIGN_DNSKEY_WITH_ZSK
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
ldns_key_list_free
void ldns_key_list_free(ldns_key_list *key_list)
Frees a key list structure.
Definition: keys.c:2090
ldns_key_algorithm
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1516
ldns_key_new_frm_engine
ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
Read the key with the given id from the given engine and store it in the given ldns_key structure.
Definition: keys.c:104
LDNS_SIGN_ECDSAP384SHA384
@ LDNS_SIGN_ECDSAP384SHA384
Definition: keys.h:100
ldns_rr_compare_no_rdata
int ldns_rr_compare_no_rdata(const ldns_rr *rr1, const ldns_rr *rr2)
compares two rrs, up to the rdata.
Definition: rr.c:1544
ldns_rr_new_frm_fp_l
ldns_status ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev, int *line_nr)
creates a new rr from a file containing a string.
Definition: rr.c:706
ldns_dnssec_zone_print_fmt
void ldns_dnssec_zone_print_fmt(FILE *out, const ldns_output_format *fmt, const ldns_dnssec_zone *zone)
Prints the complete zone to the given file descriptor.
Definition: dnssec_zone.c:1006
ldns_rr_get_type
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:929
ldns_rr_list_rr_count
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:943
Generated on Mon Apr 13 2020 01:12:45 for ldns by   doxygen 1.8.17