1 /*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
10 */
11
12 /*! \file */
13
14 /**
15 * rndc-confgen generates configuration files for rndc. It can be used
16 * as a convenient alternative to writing the rndc.conf file and the
17 * corresponding controls and key statements in named.conf by hand.
18 * Alternatively, it can be run with the -a option to set up a
19 * rndc.key file and avoid the need for a rndc.conf file and a
20 * controls statement altogether.
21 */
22
23 #include <stdarg.h>
24 #include <stdbool.h>
25 #include <stdlib.h>
26
27 #include <isc/assertions.h>
28 #include <isc/attributes.h>
29 #include <isc/base64.h>
30 #include <isc/buffer.h>
31 #include <isc/commandline.h>
32 #include <isc/file.h>
33 #include <isc/mem.h>
34 #include <isc/net.h>
35 #include <isc/print.h>
36 #include <isc/result.h>
37 #include <isc/string.h>
38 #include <isc/time.h>
39 #include <isc/util.h>
40
41 #include <dns/keyvalues.h>
42 #include <dns/name.h>
43
44 #include <dst/dst.h>
45
46 #include <confgen/os.h>
47
48 #include "keygen.h"
49 #include "util.h"
50
51 #define DEFAULT_KEYNAME "rndc-key"
52 #define DEFAULT_SERVER "127.0.0.1"
53 #define DEFAULT_PORT 953
54
55 static char program[256];
56 const char *progname;
57
58 bool verbose = false;
59
60 const char *keyfile, *keydef;
61
62 ISC_NORETURN static void
63 usage(int status);
64
65 static void
usage(int status)66 usage(int status) {
67 fprintf(stderr, "\
68 Usage:\n\
69 %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] \
70 [-s addr] [-t chrootdir] [-u user]\n\
71 -a: generate just the key clause and write it to keyfile (%s)\n\
72 -A alg: algorithm (default hmac-sha256)\n\
73 -b bits: from 1 through 512, default 256; total length of the secret\n\
74 -c keyfile: specify an alternate key file (requires -a)\n\
75 -k keyname: the name as it will be used in named.conf and rndc.conf\n\
76 -p port: the port named will listen on and rndc will connect to\n\
77 -q: suppress printing written key path\n\
78 -s addr: the address to which rndc should connect\n\
79 -t chrootdir: write a keyfile in chrootdir as well (requires -a)\n\
80 -u user: set the keyfile owner to \"user\" (requires -a)\n",
81 progname, keydef);
82
83 exit(status);
84 }
85
86 int
main(int argc,char ** argv)87 main(int argc, char **argv) {
88 bool show_final_mem = false;
89 isc_buffer_t key_txtbuffer;
90 char key_txtsecret[256];
91 isc_mem_t *mctx = NULL;
92 isc_result_t result = ISC_R_SUCCESS;
93 const char *keyname = NULL;
94 const char *serveraddr = NULL;
95 dns_secalg_t alg;
96 const char *algname;
97 char *p;
98 int ch;
99 int port;
100 int keysize = -1;
101 struct in_addr addr4_dummy;
102 struct in6_addr addr6_dummy;
103 char *chrootdir = NULL;
104 char *user = NULL;
105 bool keyonly = false;
106 bool quiet = false;
107 int len;
108
109 keydef = keyfile = RNDC_KEYFILE;
110
111 result = isc_file_progname(*argv, program, sizeof(program));
112 if (result != ISC_R_SUCCESS) {
113 memmove(program, "rndc-confgen", 13);
114 }
115 progname = program;
116
117 keyname = DEFAULT_KEYNAME;
118 alg = DST_ALG_HMACSHA256;
119 serveraddr = DEFAULT_SERVER;
120 port = DEFAULT_PORT;
121
122 isc_commandline_errprint = false;
123
124 while ((ch = isc_commandline_parse(argc, argv,
125 "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1)
126 {
127 switch (ch) {
128 case 'a':
129 keyonly = true;
130 break;
131 case 'A':
132 algname = isc_commandline_argument;
133 alg = alg_fromtext(algname);
134 if (alg == DST_ALG_UNKNOWN) {
135 fatal("Unsupported algorithm '%s'", algname);
136 }
137 break;
138 case 'b':
139 keysize = strtol(isc_commandline_argument, &p, 10);
140 if (*p != '\0' || keysize < 0) {
141 fatal("-b requires a non-negative number");
142 }
143 break;
144 case 'c':
145 keyfile = isc_commandline_argument;
146 break;
147 case 'h':
148 usage(0);
149 case 'k':
150 case 'y': /* Compatible with rndc -y. */
151 keyname = isc_commandline_argument;
152 break;
153 case 'M':
154 isc_mem_debugging = ISC_MEM_DEBUGTRACE;
155 break;
156
157 case 'm':
158 show_final_mem = true;
159 break;
160 case 'p':
161 port = strtol(isc_commandline_argument, &p, 10);
162 if (*p != '\0' || port < 0 || port > 65535) {
163 fatal("port '%s' out of range",
164 isc_commandline_argument);
165 }
166 break;
167 case 'q':
168 quiet = true;
169 break;
170 case 'r':
171 fatal("The -r option has been deprecated.");
172 break;
173 case 's':
174 serveraddr = isc_commandline_argument;
175 if (inet_pton(AF_INET, serveraddr, &addr4_dummy) != 1 &&
176 inet_pton(AF_INET6, serveraddr, &addr6_dummy) != 1)
177 {
178 fatal("-s should be an IPv4 or IPv6 address");
179 }
180 break;
181 case 't':
182 chrootdir = isc_commandline_argument;
183 break;
184 case 'u':
185 user = isc_commandline_argument;
186 break;
187 case 'V':
188 verbose = true;
189 break;
190 case '?':
191 if (isc_commandline_option != '?') {
192 fprintf(stderr, "%s: invalid argument -%c\n",
193 program, isc_commandline_option);
194 usage(1);
195 } else {
196 usage(0);
197 }
198 break;
199 default:
200 fprintf(stderr, "%s: unhandled option -%c\n", program,
201 isc_commandline_option);
202 exit(1);
203 }
204 }
205
206 argc -= isc_commandline_index;
207 argv += isc_commandline_index;
208 POST(argv);
209
210 if (argc > 0) {
211 usage(1);
212 }
213
214 if (alg == DST_ALG_HMACMD5) {
215 fprintf(stderr, "warning: use of hmac-md5 for RNDC keys "
216 "is deprecated; hmac-sha256 is now "
217 "recommended.\n");
218 }
219
220 if (keysize < 0) {
221 keysize = alg_bits(alg);
222 }
223 algname = alg_totext(alg);
224
225 isc_mem_create(&mctx);
226 isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
227
228 generate_key(mctx, alg, keysize, &key_txtbuffer);
229
230 if (keyonly) {
231 write_key_file(keyfile, chrootdir == NULL ? user : NULL,
232 keyname, &key_txtbuffer, alg);
233 if (!quiet) {
234 printf("wrote key file \"%s\"\n", keyfile);
235 }
236
237 if (chrootdir != NULL) {
238 char *buf;
239 len = strlen(chrootdir) + strlen(keyfile) + 2;
240 buf = isc_mem_get(mctx, len);
241 snprintf(buf, len, "%s%s%s", chrootdir,
242 (*keyfile != '/') ? "/" : "", keyfile);
243
244 write_key_file(buf, user, keyname, &key_txtbuffer, alg);
245 if (!quiet) {
246 printf("wrote key file \"%s\"\n", buf);
247 }
248 isc_mem_put(mctx, buf, len);
249 }
250 } else {
251 printf("\
252 # Start of rndc.conf\n\
253 key \"%s\" {\n\
254 algorithm %s;\n\
255 secret \"%.*s\";\n\
256 };\n\
257 \n\
258 options {\n\
259 default-key \"%s\";\n\
260 default-server %s;\n\
261 default-port %d;\n\
262 };\n\
263 # End of rndc.conf\n\
264 \n\
265 # Use with the following in named.conf, adjusting the allow list as needed:\n\
266 # key \"%s\" {\n\
267 # algorithm %s;\n\
268 # secret \"%.*s\";\n\
269 # };\n\
270 # \n\
271 # controls {\n\
272 # inet %s port %d\n\
273 # allow { %s; } keys { \"%s\"; };\n\
274 # };\n\
275 # End of named.conf\n",
276 keyname, algname,
277 (int)isc_buffer_usedlength(&key_txtbuffer),
278 (char *)isc_buffer_base(&key_txtbuffer), keyname,
279 serveraddr, port, keyname, algname,
280 (int)isc_buffer_usedlength(&key_txtbuffer),
281 (char *)isc_buffer_base(&key_txtbuffer), serveraddr,
282 port, serveraddr, keyname);
283 }
284
285 if (show_final_mem) {
286 isc_mem_stats(mctx, stderr);
287 }
288
289 isc_mem_destroy(&mctx);
290
291 return (0);
292 }
293