1 /* $NetBSD: dnssec-verify.c,v 1.9 2015/07/08 17:28:55 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") 5 * 6 * Permission to use, copy, modify, and/or distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 11 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 12 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 13 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 14 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 15 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 16 * PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 /*! \file */ 20 21 #include <config.h> 22 23 #include <stdlib.h> 24 #include <time.h> 25 26 #include <isc/app.h> 27 #include <isc/base32.h> 28 #include <isc/commandline.h> 29 #include <isc/entropy.h> 30 #include <isc/event.h> 31 #include <isc/file.h> 32 #include <isc/hash.h> 33 #include <isc/hex.h> 34 #include <isc/mem.h> 35 #include <isc/mutex.h> 36 #include <isc/os.h> 37 #include <isc/print.h> 38 #include <isc/random.h> 39 #include <isc/rwlock.h> 40 #include <isc/serial.h> 41 #include <isc/stdio.h> 42 #include <isc/stdlib.h> 43 #include <isc/string.h> 44 #include <isc/time.h> 45 #include <isc/util.h> 46 47 #include <dns/db.h> 48 #include <dns/dbiterator.h> 49 #include <dns/diff.h> 50 #include <dns/dnssec.h> 51 #include <dns/ds.h> 52 #include <dns/fixedname.h> 53 #include <dns/keyvalues.h> 54 #include <dns/log.h> 55 #include <dns/master.h> 56 #include <dns/masterdump.h> 57 #include <dns/nsec.h> 58 #include <dns/nsec3.h> 59 #include <dns/rdata.h> 60 #include <dns/rdatalist.h> 61 #include <dns/rdataset.h> 62 #include <dns/rdataclass.h> 63 #include <dns/rdatasetiter.h> 64 #include <dns/rdatastruct.h> 65 #include <dns/rdatatype.h> 66 #include <dns/result.h> 67 #include <dns/soa.h> 68 #include <dns/time.h> 69 70 #include <dst/dst.h> 71 72 #ifdef PKCS11CRYPTO 73 #include <pk11/result.h> 74 #endif 75 76 #include "dnssectool.h" 77 78 const char *program = "dnssec-verify"; 79 int verbose; 80 81 static isc_stdtime_t now; 82 static isc_mem_t *mctx = NULL; 83 static isc_entropy_t *ectx = NULL; 84 static dns_masterformat_t inputformat = dns_masterformat_text; 85 static dns_db_t *gdb; /* The database */ 86 static dns_dbversion_t *gversion; /* The database version */ 87 static dns_rdataclass_t gclass; /* The class */ 88 static dns_name_t *gorigin; /* The database origin */ 89 static isc_boolean_t ignore_kskflag = ISC_FALSE; 90 static isc_boolean_t keyset_kskonly = ISC_FALSE; 91 92 /*% 93 * Load the zone file from disk 94 */ 95 static void 96 loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) { 97 isc_buffer_t b; 98 int len; 99 dns_fixedname_t fname; 100 dns_name_t *name; 101 isc_result_t result; 102 103 len = strlen(origin); 104 isc_buffer_init(&b, origin, len); 105 isc_buffer_add(&b, len); 106 107 dns_fixedname_init(&fname); 108 name = dns_fixedname_name(&fname); 109 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL); 110 if (result != ISC_R_SUCCESS) 111 fatal("failed converting name '%s' to dns format: %s", 112 origin, isc_result_totext(result)); 113 114 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, 115 rdclass, 0, NULL, db); 116 check_result(result, "dns_db_create()"); 117 118 result = dns_db_load2(*db, file, inputformat); 119 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) 120 fatal("failed loading zone from '%s': %s", 121 file, isc_result_totext(result)); 122 } 123 124 ISC_PLATFORM_NORETURN_PRE static void 125 usage(void) ISC_PLATFORM_NORETURN_POST; 126 127 static void 128 usage(void) { 129 fprintf(stderr, "Usage:\n"); 130 fprintf(stderr, "\t%s [options] zonefile [keys]\n", program); 131 132 fprintf(stderr, "\n"); 133 134 fprintf(stderr, "Version: %s\n", VERSION); 135 136 fprintf(stderr, "Options: (default value in parenthesis) \n"); 137 fprintf(stderr, "\t-v debuglevel (0)\n"); 138 fprintf(stderr, "\t-V:\tprint version information\n"); 139 fprintf(stderr, "\t-o origin:\n"); 140 fprintf(stderr, "\t\tzone origin (name of zonefile)\n"); 141 fprintf(stderr, "\t-I format:\n"); 142 fprintf(stderr, "\t\tfile format of input zonefile (text)\n"); 143 fprintf(stderr, "\t-c class (IN)\n"); 144 fprintf(stderr, "\t-E engine:\n"); 145 #if defined(PKCS11CRYPTO) 146 fprintf(stderr, "\t\tpath to PKCS#11 provider library " 147 "(default is %s)\n", PK11_LIB_LOCATION); 148 #elif defined(USE_PKCS11) 149 fprintf(stderr, "\t\tname of an OpenSSL engine to use " 150 "(default is \"pkcs11\")\n"); 151 #else 152 fprintf(stderr, "\t\tname of an OpenSSL engine to use\n"); 153 #endif 154 fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, " 155 "not ZSKs\n"); 156 fprintf(stderr, "\t-z:\tAll records signed with KSKs\n"); 157 exit(0); 158 } 159 160 int 161 main(int argc, char *argv[]) { 162 char *origin = NULL, *file = NULL; 163 char *inputformatstr = NULL; 164 isc_result_t result; 165 isc_log_t *log = NULL; 166 #ifdef USE_PKCS11 167 const char *engine = PKCS11_ENGINE; 168 #else 169 const char *engine = NULL; 170 #endif 171 char *classname = NULL; 172 dns_rdataclass_t rdclass; 173 char *endp; 174 int ch; 175 176 #define CMDLINE_FLAGS \ 177 "hm:o:I:c:E:v:Vxz" 178 179 /* 180 * Process memory debugging argument first. 181 */ 182 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { 183 switch (ch) { 184 case 'm': 185 if (strcasecmp(isc_commandline_argument, "record") == 0) 186 isc_mem_debugging |= ISC_MEM_DEBUGRECORD; 187 if (strcasecmp(isc_commandline_argument, "trace") == 0) 188 isc_mem_debugging |= ISC_MEM_DEBUGTRACE; 189 if (strcasecmp(isc_commandline_argument, "usage") == 0) 190 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE; 191 if (strcasecmp(isc_commandline_argument, "size") == 0) 192 isc_mem_debugging |= ISC_MEM_DEBUGSIZE; 193 if (strcasecmp(isc_commandline_argument, "mctx") == 0) 194 isc_mem_debugging |= ISC_MEM_DEBUGCTX; 195 break; 196 default: 197 break; 198 } 199 } 200 isc_commandline_reset = ISC_TRUE; 201 check_result(isc_app_start(), "isc_app_start"); 202 203 result = isc_mem_create(0, 0, &mctx); 204 if (result != ISC_R_SUCCESS) 205 fatal("out of memory"); 206 207 #ifdef PKCS11CRYPTO 208 pk11_result_register(); 209 #endif 210 dns_result_register(); 211 212 isc_commandline_errprint = ISC_FALSE; 213 214 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { 215 switch (ch) { 216 case 'c': 217 classname = isc_commandline_argument; 218 break; 219 220 case 'E': 221 engine = isc_commandline_argument; 222 break; 223 224 case 'I': 225 inputformatstr = isc_commandline_argument; 226 break; 227 228 case 'm': 229 break; 230 231 case 'o': 232 origin = isc_commandline_argument; 233 break; 234 235 case 'v': 236 endp = NULL; 237 verbose = strtol(isc_commandline_argument, &endp, 0); 238 if (*endp != '\0') 239 fatal("verbose level must be numeric"); 240 break; 241 242 case 'x': 243 keyset_kskonly = ISC_TRUE; 244 break; 245 246 case 'z': 247 ignore_kskflag = ISC_TRUE; 248 break; 249 250 case '?': 251 if (isc_commandline_option != '?') 252 fprintf(stderr, "%s: invalid argument -%c\n", 253 program, isc_commandline_option); 254 /* FALLTHROUGH */ 255 256 case 'h': 257 /* Does not return. */ 258 usage(); 259 260 case 'V': 261 /* Does not return. */ 262 version(program); 263 264 default: 265 fprintf(stderr, "%s: unhandled option -%c\n", 266 program, isc_commandline_option); 267 exit(1); 268 } 269 } 270 271 if (ectx == NULL) 272 setup_entropy(mctx, NULL, &ectx); 273 274 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE); 275 if (result != ISC_R_SUCCESS) 276 fatal("could not create hash context"); 277 278 result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING); 279 if (result != ISC_R_SUCCESS) 280 fatal("could not initialize dst: %s", 281 isc_result_totext(result)); 282 283 isc_stdtime_get(&now); 284 285 rdclass = strtoclass(classname); 286 287 setup_logging(mctx, &log); 288 289 argc -= isc_commandline_index; 290 argv += isc_commandline_index; 291 292 if (argc < 1) 293 usage(); 294 295 file = argv[0]; 296 297 argc -= 1; 298 argv += 1; 299 300 POST(argc); 301 POST(argv); 302 303 if (origin == NULL) 304 origin = file; 305 306 if (inputformatstr != NULL) { 307 if (strcasecmp(inputformatstr, "text") == 0) 308 inputformat = dns_masterformat_text; 309 else if (strcasecmp(inputformatstr, "raw") == 0) 310 inputformat = dns_masterformat_raw; 311 else 312 fatal("unknown file format: %s\n", inputformatstr); 313 } 314 315 gdb = NULL; 316 fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file); 317 loadzone(file, origin, rdclass, &gdb); 318 gorigin = dns_db_origin(gdb); 319 gclass = dns_db_class(gdb); 320 321 gversion = NULL; 322 result = dns_db_newversion(gdb, &gversion); 323 check_result(result, "dns_db_newversion()"); 324 325 verifyzone(gdb, gversion, gorigin, mctx, 326 ignore_kskflag, keyset_kskonly); 327 328 dns_db_closeversion(gdb, &gversion, ISC_FALSE); 329 dns_db_detach(&gdb); 330 331 cleanup_logging(&log); 332 dst_lib_destroy(); 333 isc_hash_destroy(); 334 cleanup_entropy(&ectx); 335 dns_name_destroy(); 336 if (verbose > 10) 337 isc_mem_stats(mctx, stdout); 338 isc_mem_destroy(&mctx); 339 340 (void) isc_app_finish(); 341 342 return (0); 343 } 344