2 * Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
10 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
11 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
12 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
13 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
14 * PERFORMANCE OF THIS SOFTWARE.
17 /* $Id: dnssec-dsfromkey.c,v 1.2.14.3 2009/03/02 02:54:15 marka Exp $ */
25 #include <isc/buffer.h>
26 #include <isc/commandline.h>
27 #include <isc/entropy.h>
30 #include <isc/print.h>
31 #include <isc/string.h>
35 #include <dns/dbiterator.h>
37 #include <dns/fixedname.h>
40 #include <dns/rdata.h>
41 #include <dns/rdataclass.h>
42 #include <dns/rdataset.h>
43 #include <dns/rdatasetiter.h>
44 #include <dns/rdatatype.h>
45 #include <dns/result.h>
49 #include "dnssectool.h"
51 const char *program = "dnssec-dsfromkey";
54 static dns_rdataclass_t rdclass;
55 static dns_fixedname_t fixed;
56 static dns_name_t *name = NULL;
57 static dns_db_t *db = NULL;
58 static dns_dbnode_t *node = NULL;
59 static dns_rdataset_t keyset;
60 static isc_mem_t *mctx = NULL;
63 loadkeys(char *dirname, char *setname)
69 dns_rdataset_init(&keyset);
70 dns_fixedname_init(&fixed);
71 name = dns_fixedname_name(&fixed);
73 isc_buffer_init(&buf, setname, strlen(setname));
74 isc_buffer_add(&buf, strlen(setname));
75 result = dns_name_fromtext(name, &buf, dns_rootname, ISC_FALSE, NULL);
76 if (result != ISC_R_SUCCESS)
77 fatal("can't convert DNS name %s", setname);
79 isc_buffer_init(&buf, filename, sizeof(filename));
80 if (dirname != NULL) {
81 isc_buffer_putstr(&buf, dirname);
82 if (dirname[strlen(dirname) - 1] != '/')
83 isc_buffer_putstr(&buf, "/");
85 isc_buffer_putstr(&buf, "keyset-");
86 result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
87 check_result(result, "dns_name_tofilenametext()");
88 if (isc_buffer_availablelength(&buf) == 0)
89 fatal("name %s too long", setname);
90 isc_buffer_putuint8(&buf, 0);
92 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
93 rdclass, 0, NULL, &db);
94 if (result != ISC_R_SUCCESS)
95 fatal("can't create database");
97 result = dns_db_load(db, filename);
98 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
99 fatal("can't load %s: %s", filename, isc_result_totext(result));
101 result = dns_db_findnode(db, name, ISC_FALSE, &node);
102 if (result != ISC_R_SUCCESS)
103 fatal("can't find %s node in %s", setname, filename);
105 result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey,
106 0, 0, &keyset, NULL);
107 if (result == ISC_R_NOTFOUND)
108 fatal("no DNSKEY RR for %s in %s", setname, filename);
109 else if (result != ISC_R_SUCCESS)
110 fatal("dns_db_findrdataset");
114 loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
118 dst_key_t *key = NULL;
122 dns_rdataset_init(&keyset);
123 dns_rdata_init(rdata);
125 isc_buffer_init(&keyb, key_buf, key_buf_size);
127 result = dst_key_fromnamedfile(filename, DST_TYPE_PUBLIC, mctx, &key);
128 if (result != ISC_R_SUCCESS)
129 fatal("invalid keyfile name %s: %s",
130 filename, isc_result_totext(result));
133 char keystr[KEY_FORMATSIZE];
135 key_format(key, keystr, sizeof(keystr));
136 fprintf(stderr, "%s: %s\n", program, keystr);
139 result = dst_key_todns(key, &keyb);
140 if (result != ISC_R_SUCCESS)
141 fatal("can't decode key");
143 isc_buffer_usedregion(&keyb, &r);
144 dns_rdata_fromregion(rdata, dst_key_class(key),
145 dns_rdatatype_dnskey, &r);
147 rdclass = dst_key_class(key);
149 dns_fixedname_init(&fixed);
150 name = dns_fixedname_name(&fixed);
151 result = dns_name_copy(dst_key_name(key), name, NULL);
152 if (result != ISC_R_SUCCESS)
153 fatal("can't copy name");
159 logkey(dns_rdata_t *rdata)
162 dst_key_t *key = NULL;
164 char keystr[KEY_FORMATSIZE];
166 isc_buffer_init(&buf, rdata->data, rdata->length);
167 isc_buffer_add(&buf, rdata->length);
168 result = dst_key_fromdns(name, rdclass, &buf, mctx, &key);
169 if (result != ISC_R_SUCCESS)
172 key_format(key, keystr, sizeof(keystr));
173 fprintf(stderr, "%s: %s\n", program, keystr);
179 emitds(unsigned int dtype, dns_rdata_t *rdata)
182 unsigned char buf[DNS_DS_BUFFERSIZE];
183 char text_buf[DST_KEY_MAXTEXTSIZE];
185 isc_buffer_t textb, classb;
189 isc_buffer_init(&textb, text_buf, sizeof(text_buf));
190 isc_buffer_init(&classb, class_buf, sizeof(class_buf));
194 result = dns_ds_buildrdata(name, rdata, dtype, buf, &ds);
195 if (result != ISC_R_SUCCESS)
196 fatal("can't build DS");
198 result = dns_rdata_totext(&ds, (dns_name_t *) NULL, &textb);
199 if (result != ISC_R_SUCCESS)
200 fatal("can't print DS rdata");
202 result = dns_rdataclass_totext(rdclass, &classb);
203 if (result != ISC_R_SUCCESS)
204 fatal("can't print DS class");
206 result = dns_name_print(name, stdout);
207 if (result != ISC_R_SUCCESS)
208 fatal("can't print DS name");
212 isc_buffer_usedregion(&classb, &r);
213 fwrite(r.base, 1, r.length, stdout);
217 isc_buffer_usedregion(&textb, &r);
218 fwrite(r.base, 1, r.length, stdout);
224 fprintf(stderr, "Usage:\n");
225 fprintf(stderr, " %s options keyfile\n\n", program);
226 fprintf(stderr, " %s options [-c class] [-d dir] -s dnsname\n\n",
228 fprintf(stderr, "Version: %s\n", VERSION);
229 fprintf(stderr, "Options:\n");
230 fprintf(stderr, " -v <verbose level>\n");
231 fprintf(stderr, " -1: use SHA-1\n");
232 fprintf(stderr, " -2: use SHA-256\n");
233 fprintf(stderr, " -a algorithm: use algorithm\n");
234 fprintf(stderr, "Keyset options:\n");
235 fprintf(stderr, " -s: keyset mode\n");
236 fprintf(stderr, " -c class\n");
237 fprintf(stderr, " -d directory\n");
238 fprintf(stderr, "Output: DS RRs\n");
244 main(int argc, char **argv) {
245 char *algname = NULL, *classname = NULL, *dirname = NULL;
248 unsigned int dtype = DNS_DSDIGEST_SHA1;
249 isc_boolean_t both = ISC_TRUE;
250 isc_boolean_t usekeyset = ISC_FALSE;
252 isc_log_t *log = NULL;
253 isc_entropy_t *ectx = NULL;
256 dns_rdata_init(&rdata);
261 result = isc_mem_create(0, 0, &mctx);
262 if (result != ISC_R_SUCCESS)
263 fatal("out of memory");
265 dns_result_register();
267 isc_commandline_errprint = ISC_FALSE;
269 while ((ch = isc_commandline_parse(argc, argv,
270 "12a:c:d:sv:h")) != -1) {
273 dtype = DNS_DSDIGEST_SHA1;
277 dtype = DNS_DSDIGEST_SHA256;
281 algname = isc_commandline_argument;
285 classname = isc_commandline_argument;
288 dirname = isc_commandline_argument;
291 usekeyset = ISC_TRUE;
294 verbose = strtol(isc_commandline_argument, &endp, 0);
296 fatal("-v must be followed by a number");
299 if (isc_commandline_option != '?')
300 fprintf(stderr, "%s: invalid argument -%c\n",
301 program, isc_commandline_option);
307 fprintf(stderr, "%s: unhandled option -%c\n",
308 program, isc_commandline_option);
313 if (algname != NULL) {
314 if (strcasecmp(algname, "SHA1") == 0 ||
315 strcasecmp(algname, "SHA-1") == 0)
316 dtype = DNS_DSDIGEST_SHA1;
317 else if (strcasecmp(algname, "SHA256") == 0 ||
318 strcasecmp(algname, "SHA-256") == 0)
319 dtype = DNS_DSDIGEST_SHA256;
321 fatal("unknown algorithm %s", algname);
324 rdclass = strtoclass(classname);
326 if (argc < isc_commandline_index + 1)
327 fatal("the key file name was not specified");
328 if (argc > isc_commandline_index + 1)
329 fatal("extraneous arguments");
332 setup_entropy(mctx, NULL, &ectx);
333 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
334 if (result != ISC_R_SUCCESS)
335 fatal("could not initialize hash");
336 result = dst_lib_init(mctx, ectx,
337 ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
338 if (result != ISC_R_SUCCESS)
339 fatal("could not initialize dst");
340 isc_entropy_stopcallbacksources(ectx);
342 setup_logging(verbose, mctx, &log);
345 loadkeys(dirname, argv[isc_commandline_index]);
347 for (result = dns_rdataset_first(&keyset);
348 result == ISC_R_SUCCESS;
349 result = dns_rdataset_next(&keyset)) {
350 dns_rdata_init(&rdata);
351 dns_rdataset_current(&keyset, &rdata);
357 emitds(DNS_DSDIGEST_SHA1, &rdata);
358 emitds(DNS_DSDIGEST_SHA256, &rdata);
360 emitds(dtype, &rdata);
363 unsigned char key_buf[DST_KEY_MAXSIZE];
365 loadkey(argv[isc_commandline_index], key_buf,
366 DST_KEY_MAXSIZE, &rdata);
369 emitds(DNS_DSDIGEST_SHA1, &rdata);
370 emitds(DNS_DSDIGEST_SHA256, &rdata);
372 emitds(dtype, &rdata);
375 if (dns_rdataset_isassociated(&keyset))
376 dns_rdataset_disassociate(&keyset);
378 dns_db_detachnode(db, &node);
381 cleanup_logging(&log);
384 cleanup_entropy(&ectx);
387 isc_mem_stats(mctx, stdout);
388 isc_mem_destroy(&mctx);
391 if (ferror(stdout)) {
392 fprintf(stderr, "write error\n");