2 * testcode/signit.c - debug tool to sign rrsets with given keys.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This program signs rrsets with the given keys. It can be used to
40 * construct input to test the validator with.
43 #include <ldns/ldns.h>
46 #define DNSKEY_BIT_ZSK 0x0100
52 /** signature inception */
54 /** signature expiration */
64 /** print usage and exit */
68 printf("usage: signit expi ince keytag owner keyfile\n");
69 printf("present rrset data on stdin.\n");
70 printf("signed data is printed to stdout.\n");
72 printf("Or use: signit NSEC3PARAM hash flags iter salt\n");
73 printf("present names on stdin, hashed names are printed to stdout.\n");
78 convert_timeval(const char* str)
82 memset(&tm, 0, sizeof(tm));
85 if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon,
86 &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6)
91 if (tm.tm_year < 70) return 0;
92 if (tm.tm_mon < 0 || tm.tm_mon > 11) return 0;
93 if (tm.tm_mday < 1 || tm.tm_mday > 31) return 0;
94 if (tm.tm_hour < 0 || tm.tm_hour > 23) return 0;
95 if (tm.tm_min < 0 || tm.tm_min > 59) return 0;
96 if (tm.tm_sec < 0 || tm.tm_sec > 59) return 0;
97 /* call ldns conversion function */
98 t = ldns_mktime_from_utc(&tm);
102 static void fatal_exit(const char* format, ...)
105 va_start(args, format);
106 printf("fatal exit: ");
107 vprintf(format, args);
112 /** read expi ince keytag owner from cmdline */
114 parse_cmdline(char *argv[], struct keysets* s)
116 s->expi = convert_timeval(argv[1]);
117 s->incep = convert_timeval(argv[2]);
118 s->keytag = (uint16_t)atoi(argv[3]);
120 s->flags = DNSKEY_BIT_ZSK; /* to enforce signing */
123 /** read all key files, exit on error */
124 static ldns_key_list*
125 read_keys(int num, char* names[], struct keysets* set)
128 ldns_key_list* keys = ldns_key_list_new();
135 if(!keys) fatal_exit("alloc failure");
136 for(i=0; i<num; i++) {
137 printf("read keyfile %s\n", names[i]);
138 in = fopen(names[i], "r");
139 if(!in) fatal_exit("could not open %s: %s", names[i],
141 s = ldns_key_new_frm_fp(&k, in);
143 if(s != LDNS_STATUS_OK)
144 fatal_exit("bad keyfile %s: %s", names[i],
145 ldns_get_errorstr_by_id(s));
146 ldns_key_set_expiration(k, set->expi);
147 ldns_key_set_inception(k, set->incep);
148 s = ldns_str2rdf_dname(&rdf, set->owner);
149 if(s != LDNS_STATUS_OK)
150 fatal_exit("bad owner name %s: %s", set->owner,
151 ldns_get_errorstr_by_id(s));
152 ldns_key_set_pubkey_owner(k, rdf);
153 ldns_key_set_flags(k, set->flags);
154 ldns_key_set_keytag(k, set->keytag);
155 b = ldns_key_list_push_key(keys, k);
161 /** read list of rrs from the file */
165 uint32_t my_ttl = 3600;
166 ldns_rdf *my_origin = NULL;
167 ldns_rdf *my_prev = NULL;
175 list = ldns_rr_list_new();
176 if(!list) fatal_exit("alloc error");
179 s = ldns_rr_new_frm_fp_l(&rr, in, &my_ttl, &my_origin,
181 if(s == LDNS_STATUS_SYNTAX_TTL ||
182 s == LDNS_STATUS_SYNTAX_ORIGIN ||
183 s == LDNS_STATUS_SYNTAX_EMPTY)
185 else if(s != LDNS_STATUS_OK)
186 fatal_exit("parse error in line %d: %s", line_nr,
187 ldns_get_errorstr_by_id(s));
188 b = ldns_rr_list_push_rr(list, rr);
191 printf("read %d lines\n", line_nr);
196 /** sign the rrs with the keys */
198 signit(ldns_rr_list* rrs, ldns_key_list* keys)
203 while(ldns_rr_list_rr_count(rrs) > 0) {
204 rrset = ldns_rr_list_pop_rrset(rrs);
205 if(!rrset) fatal_exit("copy alloc failure");
206 sigs = ldns_sign_public(rrset, keys);
207 if(!sigs) fatal_exit("failed to sign");
208 ldns_rr_list_print(stdout, rrset);
209 ldns_rr_list_print(stdout, sigs);
211 ldns_rr_list_free(rrset);
212 ldns_rr_list_free(sigs);
216 /** process keys and signit */
218 process_keys(int argc, char* argv[])
222 struct keysets settings;
225 parse_cmdline(argv, &settings);
226 keys = read_keys(1, argv+5, &settings);
227 rrs = read_rrs(stdin);
230 ldns_rr_list_deep_free(rrs);
231 ldns_key_list_free(keys);
234 /** process nsec3 params and perform hashing */
236 process_nsec3(int argc, char* argv[])
242 status = ldns_str2rdf_nsec3_salt(&salt, argv[5]);
243 if(status != LDNS_STATUS_OK)
244 fatal_exit("Could not parse salt %s: %s", argv[5],
245 ldns_get_errorstr_by_id(status));
247 while(fgets(line, (int)sizeof(line), stdin)) {
249 line[strlen(line)-1] = 0; /* remove trailing newline */
252 status = ldns_str2rdf_dname(&in, line);
253 if(status != LDNS_STATUS_OK)
254 fatal_exit("Could not parse name %s: %s", line,
255 ldns_get_errorstr_by_id(status));
256 ldns_rdf_print(stdout, in);
258 /* arg 3 is flags, unused */
259 out = ldns_nsec3_hash_name(in, (uint8_t)atoi(argv[2]),
260 (uint16_t)atoi(argv[4]),
261 ldns_rdf_data(salt)[0], ldns_rdf_data(salt)+1);
263 fatal_exit("Could not hash %s", line);
264 ldns_rdf_print(stdout, out);
266 ldns_rdf_deep_free(in);
267 ldns_rdf_deep_free(out);
269 ldns_rdf_deep_free(salt);
273 int main(int argc, char* argv[])
278 if(strcmp(argv[1], "NSEC3PARAM") == 0) {
279 process_nsec3(argc, argv);
282 process_keys(argc, argv);