2 * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
10 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
11 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
12 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
13 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
14 * PERFORMANCE OF THIS SOFTWARE.
17 /* $Id: dnssec-revoke.c,v 1.22.124.2 2011/10/20 23:46:27 tbox Exp $ */
27 #include <isc/buffer.h>
28 #include <isc/commandline.h>
29 #include <isc/entropy.h>
33 #include <isc/print.h>
34 #include <isc/string.h>
37 #include <dns/keyvalues.h>
38 #include <dns/result.h>
42 #include "dnssectool.h"
44 const char *program = "dnssec-revoke";
47 static isc_mem_t *mctx = NULL;
49 ISC_PLATFORM_NORETURN_PRE static void
50 usage(void) ISC_PLATFORM_NORETURN_POST;
54 fprintf(stderr, "Usage:\n");
55 fprintf(stderr, " %s [options] keyfile\n\n", program);
56 fprintf(stderr, "Version: %s\n", VERSION);
58 fprintf(stderr, " -E engine: specify OpenSSL engine "
59 "(default \"pkcs11\")\n");
61 fprintf(stderr, " -E engine: specify OpenSSL engine\n");
63 fprintf(stderr, " -f: force overwrite\n");
64 fprintf(stderr, " -K directory: use directory for key files\n");
65 fprintf(stderr, " -h: help\n");
66 fprintf(stderr, " -r: remove old keyfiles after "
67 "creating revoked version\n");
68 fprintf(stderr, " -v level: set level of verbosity\n");
69 fprintf(stderr, "Output:\n");
70 fprintf(stderr, " K<name>+<alg>+<new id>.key, "
71 "K<name>+<alg>+<new id>.private\n");
77 main(int argc, char **argv) {
80 const char *engine = "pkcs11";
82 const char *engine = NULL;
84 char *filename = NULL, *dir = NULL;
85 char newname[1024], oldname[1024];
86 char keystr[DST_KEY_FORMATSIZE];
89 isc_entropy_t *ectx = NULL;
90 dst_key_t *key = NULL;
93 isc_boolean_t force = ISC_FALSE;
94 isc_boolean_t remove = ISC_FALSE;
95 isc_boolean_t id = ISC_FALSE;
100 result = isc_mem_create(0, 0, &mctx);
101 if (result != ISC_R_SUCCESS)
102 fatal("Out of memory");
104 dns_result_register();
106 isc_commandline_errprint = ISC_FALSE;
108 while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:")) != -1) {
111 engine = isc_commandline_argument;
118 * We don't have to copy it here, but do it to
119 * simplify cleanup later
121 dir = isc_mem_strdup(mctx, isc_commandline_argument);
123 fatal("Failed to allocate memory for "
134 verbose = strtol(isc_commandline_argument, &endp, 0);
136 fatal("-v must be followed by a number");
139 if (isc_commandline_option != '?')
140 fprintf(stderr, "%s: invalid argument -%c\n",
141 program, isc_commandline_option);
147 fprintf(stderr, "%s: unhandled option -%c\n",
148 program, isc_commandline_option);
153 if (argc < isc_commandline_index + 1 ||
154 argv[isc_commandline_index] == NULL)
155 fatal("The key file name was not specified");
156 if (argc > isc_commandline_index + 1)
157 fatal("Extraneous arguments");
160 filename = argv[isc_commandline_index];
162 result = isc_file_splitpath(mctx, argv[isc_commandline_index],
164 if (result != ISC_R_SUCCESS)
165 fatal("cannot process filename %s: %s",
166 argv[isc_commandline_index],
167 isc_result_totext(result));
168 if (strcmp(dir, ".") == 0) {
169 isc_mem_free(mctx, dir);
175 setup_entropy(mctx, NULL, &ectx);
176 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
177 if (result != ISC_R_SUCCESS)
178 fatal("Could not initialize hash");
179 result = dst_lib_init2(mctx, ectx, engine,
180 ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
181 if (result != ISC_R_SUCCESS)
182 fatal("Could not initialize dst: %s",
183 isc_result_totext(result));
184 isc_entropy_stopcallbacksources(ectx);
186 result = dst_key_fromnamedfile(filename, dir,
187 DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
189 if (result != ISC_R_SUCCESS)
190 fatal("Invalid keyfile name %s: %s",
191 filename, isc_result_totext(result));
194 fprintf(stdout, "%u\n", dst_key_rid(key));
197 dst_key_format(key, keystr, sizeof(keystr));
200 fprintf(stderr, "%s: %s\n", program, keystr);
205 check_keyversion(key, keystr);
208 flags = dst_key_flags(key);
209 if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
212 if ((flags & DNS_KEYFLAG_KSK) == 0)
213 fprintf(stderr, "%s: warning: Key is not flagged "
214 "as a KSK. Revoking a ZSK is "
215 "legal, but undefined.\n",
218 isc_stdtime_get(&now);
219 dst_key_settime(key, DST_TIME_REVOKE, now);
221 dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);
223 isc_buffer_init(&buf, newname, sizeof(newname));
224 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
226 if (access(newname, F_OK) == 0 && !force) {
227 fatal("Key file %s already exists; "
228 "use -f to force overwrite", newname);
231 result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
233 if (result != ISC_R_SUCCESS) {
234 dst_key_format(key, keystr, sizeof(keystr));
235 fatal("Failed to write key %s: %s", keystr,
236 isc_result_totext(result));
239 isc_buffer_clear(&buf);
240 dst_key_buildfilename(key, 0, dir, &buf);
241 printf("%s\n", newname);
244 * Remove old key file, if told to (and if
245 * it isn't the same as the new file)
247 if (remove && dst_key_alg(key) != DST_ALG_RSAMD5) {
248 isc_buffer_init(&buf, oldname, sizeof(oldname));
249 dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
250 dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
251 if (strcmp(oldname, newname) == 0)
253 if (access(oldname, F_OK) == 0)
255 isc_buffer_clear(&buf);
256 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
257 if (access(oldname, F_OK) == 0)
261 dst_key_format(key, keystr, sizeof(keystr));
262 fatal("Key %s is already revoked", keystr);
269 cleanup_entropy(&ectx);
271 isc_mem_stats(mctx, stdout);
273 isc_mem_free(mctx, dir);
274 isc_mem_destroy(&mctx);