1 /* $NetBSD: dnssec-verify.c,v 1.9 2015/07/08 17:28:55 christos Exp $ */
2
3 /*
4 * Copyright (C) 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
5 *
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
11 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
12 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
13 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
14 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
15 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
16 * PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /*! \file */
20
21 #include <config.h>
22
23 #include <stdlib.h>
24 #include <time.h>
25
26 #include <isc/app.h>
27 #include <isc/base32.h>
28 #include <isc/commandline.h>
29 #include <isc/entropy.h>
30 #include <isc/event.h>
31 #include <isc/file.h>
32 #include <isc/hash.h>
33 #include <isc/hex.h>
34 #include <isc/mem.h>
35 #include <isc/mutex.h>
36 #include <isc/os.h>
37 #include <isc/print.h>
38 #include <isc/random.h>
39 #include <isc/rwlock.h>
40 #include <isc/serial.h>
41 #include <isc/stdio.h>
42 #include <isc/stdlib.h>
43 #include <isc/string.h>
44 #include <isc/time.h>
45 #include <isc/util.h>
46
47 #include <dns/db.h>
48 #include <dns/dbiterator.h>
49 #include <dns/diff.h>
50 #include <dns/dnssec.h>
51 #include <dns/ds.h>
52 #include <dns/fixedname.h>
53 #include <dns/keyvalues.h>
54 #include <dns/log.h>
55 #include <dns/master.h>
56 #include <dns/masterdump.h>
57 #include <dns/nsec.h>
58 #include <dns/nsec3.h>
59 #include <dns/rdata.h>
60 #include <dns/rdatalist.h>
61 #include <dns/rdataset.h>
62 #include <dns/rdataclass.h>
63 #include <dns/rdatasetiter.h>
64 #include <dns/rdatastruct.h>
65 #include <dns/rdatatype.h>
66 #include <dns/result.h>
67 #include <dns/soa.h>
68 #include <dns/time.h>
69
70 #include <dst/dst.h>
71
72 #ifdef PKCS11CRYPTO
73 #include <pk11/result.h>
74 #endif
75
76 #include "dnssectool.h"
77
78 const char *program = "dnssec-verify";
79 int verbose;
80
81 static isc_stdtime_t now;
82 static isc_mem_t *mctx = NULL;
83 static isc_entropy_t *ectx = NULL;
84 static dns_masterformat_t inputformat = dns_masterformat_text;
85 static dns_db_t *gdb; /* The database */
86 static dns_dbversion_t *gversion; /* The database version */
87 static dns_rdataclass_t gclass; /* The class */
88 static dns_name_t *gorigin; /* The database origin */
89 static isc_boolean_t ignore_kskflag = ISC_FALSE;
90 static isc_boolean_t keyset_kskonly = ISC_FALSE;
91
92 /*%
93 * Load the zone file from disk
94 */
95 static void
loadzone(char * file,char * origin,dns_rdataclass_t rdclass,dns_db_t ** db)96 loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
97 isc_buffer_t b;
98 int len;
99 dns_fixedname_t fname;
100 dns_name_t *name;
101 isc_result_t result;
102
103 len = strlen(origin);
104 isc_buffer_init(&b, origin, len);
105 isc_buffer_add(&b, len);
106
107 dns_fixedname_init(&fname);
108 name = dns_fixedname_name(&fname);
109 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
110 if (result != ISC_R_SUCCESS)
111 fatal("failed converting name '%s' to dns format: %s",
112 origin, isc_result_totext(result));
113
114 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
115 rdclass, 0, NULL, db);
116 check_result(result, "dns_db_create()");
117
118 result = dns_db_load2(*db, file, inputformat);
119 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
120 fatal("failed loading zone from '%s': %s",
121 file, isc_result_totext(result));
122 }
123
124 ISC_PLATFORM_NORETURN_PRE static void
125 usage(void) ISC_PLATFORM_NORETURN_POST;
126
127 static void
usage(void)128 usage(void) {
129 fprintf(stderr, "Usage:\n");
130 fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
131
132 fprintf(stderr, "\n");
133
134 fprintf(stderr, "Version: %s\n", VERSION);
135
136 fprintf(stderr, "Options: (default value in parenthesis) \n");
137 fprintf(stderr, "\t-v debuglevel (0)\n");
138 fprintf(stderr, "\t-V:\tprint version information\n");
139 fprintf(stderr, "\t-o origin:\n");
140 fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
141 fprintf(stderr, "\t-I format:\n");
142 fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
143 fprintf(stderr, "\t-c class (IN)\n");
144 fprintf(stderr, "\t-E engine:\n");
145 #if defined(PKCS11CRYPTO)
146 fprintf(stderr, "\t\tpath to PKCS#11 provider library "
147 "(default is %s)\n", PK11_LIB_LOCATION);
148 #elif defined(USE_PKCS11)
149 fprintf(stderr, "\t\tname of an OpenSSL engine to use "
150 "(default is \"pkcs11\")\n");
151 #else
152 fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
153 #endif
154 fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
155 "not ZSKs\n");
156 fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
157 exit(0);
158 }
159
160 int
main(int argc,char * argv[])161 main(int argc, char *argv[]) {
162 char *origin = NULL, *file = NULL;
163 char *inputformatstr = NULL;
164 isc_result_t result;
165 isc_log_t *log = NULL;
166 #ifdef USE_PKCS11
167 const char *engine = PKCS11_ENGINE;
168 #else
169 const char *engine = NULL;
170 #endif
171 char *classname = NULL;
172 dns_rdataclass_t rdclass;
173 char *endp;
174 int ch;
175
176 #define CMDLINE_FLAGS \
177 "hm:o:I:c:E:v:Vxz"
178
179 /*
180 * Process memory debugging argument first.
181 */
182 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
183 switch (ch) {
184 case 'm':
185 if (strcasecmp(isc_commandline_argument, "record") == 0)
186 isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
187 if (strcasecmp(isc_commandline_argument, "trace") == 0)
188 isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
189 if (strcasecmp(isc_commandline_argument, "usage") == 0)
190 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
191 if (strcasecmp(isc_commandline_argument, "size") == 0)
192 isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
193 if (strcasecmp(isc_commandline_argument, "mctx") == 0)
194 isc_mem_debugging |= ISC_MEM_DEBUGCTX;
195 break;
196 default:
197 break;
198 }
199 }
200 isc_commandline_reset = ISC_TRUE;
201 check_result(isc_app_start(), "isc_app_start");
202
203 result = isc_mem_create(0, 0, &mctx);
204 if (result != ISC_R_SUCCESS)
205 fatal("out of memory");
206
207 #ifdef PKCS11CRYPTO
208 pk11_result_register();
209 #endif
210 dns_result_register();
211
212 isc_commandline_errprint = ISC_FALSE;
213
214 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
215 switch (ch) {
216 case 'c':
217 classname = isc_commandline_argument;
218 break;
219
220 case 'E':
221 engine = isc_commandline_argument;
222 break;
223
224 case 'I':
225 inputformatstr = isc_commandline_argument;
226 break;
227
228 case 'm':
229 break;
230
231 case 'o':
232 origin = isc_commandline_argument;
233 break;
234
235 case 'v':
236 endp = NULL;
237 verbose = strtol(isc_commandline_argument, &endp, 0);
238 if (*endp != '\0')
239 fatal("verbose level must be numeric");
240 break;
241
242 case 'x':
243 keyset_kskonly = ISC_TRUE;
244 break;
245
246 case 'z':
247 ignore_kskflag = ISC_TRUE;
248 break;
249
250 case '?':
251 if (isc_commandline_option != '?')
252 fprintf(stderr, "%s: invalid argument -%c\n",
253 program, isc_commandline_option);
254 /* FALLTHROUGH */
255
256 case 'h':
257 /* Does not return. */
258 usage();
259
260 case 'V':
261 /* Does not return. */
262 version(program);
263
264 default:
265 fprintf(stderr, "%s: unhandled option -%c\n",
266 program, isc_commandline_option);
267 exit(1);
268 }
269 }
270
271 if (ectx == NULL)
272 setup_entropy(mctx, NULL, &ectx);
273
274 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
275 if (result != ISC_R_SUCCESS)
276 fatal("could not create hash context");
277
278 result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
279 if (result != ISC_R_SUCCESS)
280 fatal("could not initialize dst: %s",
281 isc_result_totext(result));
282
283 isc_stdtime_get(&now);
284
285 rdclass = strtoclass(classname);
286
287 setup_logging(mctx, &log);
288
289 argc -= isc_commandline_index;
290 argv += isc_commandline_index;
291
292 if (argc < 1)
293 usage();
294
295 file = argv[0];
296
297 argc -= 1;
298 argv += 1;
299
300 POST(argc);
301 POST(argv);
302
303 if (origin == NULL)
304 origin = file;
305
306 if (inputformatstr != NULL) {
307 if (strcasecmp(inputformatstr, "text") == 0)
308 inputformat = dns_masterformat_text;
309 else if (strcasecmp(inputformatstr, "raw") == 0)
310 inputformat = dns_masterformat_raw;
311 else
312 fatal("unknown file format: %s\n", inputformatstr);
313 }
314
315 gdb = NULL;
316 fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file);
317 loadzone(file, origin, rdclass, &gdb);
318 gorigin = dns_db_origin(gdb);
319 gclass = dns_db_class(gdb);
320
321 gversion = NULL;
322 result = dns_db_newversion(gdb, &gversion);
323 check_result(result, "dns_db_newversion()");
324
325 verifyzone(gdb, gversion, gorigin, mctx,
326 ignore_kskflag, keyset_kskonly);
327
328 dns_db_closeversion(gdb, &gversion, ISC_FALSE);
329 dns_db_detach(&gdb);
330
331 cleanup_logging(&log);
332 dst_lib_destroy();
333 isc_hash_destroy();
334 cleanup_entropy(&ectx);
335 dns_name_destroy();
336 if (verbose > 10)
337 isc_mem_stats(mctx, stdout);
338 isc_mem_destroy(&mctx);
339
340 (void) isc_app_finish();
341
342 return (0);
343 }
344