1 /*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
10 */
11
12 /*! \file */
13
14 #include <stdbool.h>
15 #include <stdlib.h>
16 #include <time.h>
17
18 #include <isc/app.h>
19 #include <isc/base32.h>
20 #include <isc/commandline.h>
21 #include <isc/event.h>
22 #include <isc/file.h>
23 #include <isc/hash.h>
24 #include <isc/hex.h>
25 #include <isc/mem.h>
26 #include <isc/mutex.h>
27 #include <isc/os.h>
28 #include <isc/print.h>
29 #include <isc/random.h>
30 #include <isc/rwlock.h>
31 #include <isc/serial.h>
32 #include <isc/stdio.h>
33 #include <isc/string.h>
34 #include <isc/time.h>
35 #include <isc/util.h>
36
37 #include <dns/db.h>
38 #include <dns/dbiterator.h>
39 #include <dns/diff.h>
40 #include <dns/dnssec.h>
41 #include <dns/ds.h>
42 #include <dns/fixedname.h>
43 #include <dns/keyvalues.h>
44 #include <dns/log.h>
45 #include <dns/master.h>
46 #include <dns/masterdump.h>
47 #include <dns/nsec.h>
48 #include <dns/nsec3.h>
49 #include <dns/rdata.h>
50 #include <dns/rdataclass.h>
51 #include <dns/rdatalist.h>
52 #include <dns/rdataset.h>
53 #include <dns/rdatasetiter.h>
54 #include <dns/rdatastruct.h>
55 #include <dns/rdatatype.h>
56 #include <dns/result.h>
57 #include <dns/soa.h>
58 #include <dns/time.h>
59 #include <dns/zoneverify.h>
60
61 #include <dst/dst.h>
62
63 #if USE_PKCS11
64 #include <pk11/result.h>
65 #endif /* if USE_PKCS11 */
66
67 #include "dnssectool.h"
68
69 const char *program = "dnssec-verify";
70
71 static isc_stdtime_t now;
72 static isc_mem_t *mctx = NULL;
73 static dns_masterformat_t inputformat = dns_masterformat_text;
74 static dns_db_t *gdb; /* The database */
75 static dns_dbversion_t *gversion; /* The database version */
76 static dns_rdataclass_t gclass; /* The class */
77 static dns_name_t *gorigin; /* The database origin */
78 static bool ignore_kskflag = false;
79 static bool keyset_kskonly = false;
80
81 static void
report(const char * format,...)82 report(const char *format, ...) {
83 if (!quiet) {
84 va_list args;
85 va_start(args, format);
86 vfprintf(stdout, format, args);
87 va_end(args);
88 }
89 }
90
91 /*%
92 * Load the zone file from disk
93 */
94 static void
loadzone(char * file,char * origin,dns_rdataclass_t rdclass,dns_db_t ** db)95 loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
96 isc_buffer_t b;
97 int len;
98 dns_fixedname_t fname;
99 dns_name_t *name;
100 isc_result_t result;
101
102 len = strlen(origin);
103 isc_buffer_init(&b, origin, len);
104 isc_buffer_add(&b, len);
105
106 name = dns_fixedname_initname(&fname);
107 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
108 if (result != ISC_R_SUCCESS) {
109 fatal("failed converting name '%s' to dns format: %s", origin,
110 isc_result_totext(result));
111 }
112
113 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
114 NULL, db);
115 check_result(result, "dns_db_create()");
116
117 result = dns_db_load(*db, file, inputformat, 0);
118 switch (result) {
119 case DNS_R_SEENINCLUDE:
120 case ISC_R_SUCCESS:
121 break;
122 case DNS_R_NOTZONETOP:
123 /*
124 * Comparing pointers (vs. using strcmp()) is intentional: we
125 * want to check whether -o was supplied on the command line,
126 * not whether origin and file contain the same string.
127 */
128 if (origin == file) {
129 fatal("failed loading zone '%s' from file '%s': "
130 "use -o to specify a different zone origin",
131 origin, file);
132 }
133 /* FALLTHROUGH */
134 default:
135 fatal("failed loading zone from '%s': %s", file,
136 isc_result_totext(result));
137 }
138 }
139
140 ISC_PLATFORM_NORETURN_PRE static void
141 usage(void) ISC_PLATFORM_NORETURN_POST;
142
143 static void
usage(void)144 usage(void) {
145 fprintf(stderr, "Usage:\n");
146 fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
147
148 fprintf(stderr, "\n");
149
150 fprintf(stderr, "Version: %s\n", VERSION);
151
152 fprintf(stderr, "Options: (default value in parenthesis) \n");
153 fprintf(stderr, "\t-v debuglevel (0)\n");
154 fprintf(stderr, "\t-q quiet\n");
155 fprintf(stderr, "\t-V:\tprint version information\n");
156 fprintf(stderr, "\t-o origin:\n");
157 fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
158 fprintf(stderr, "\t-I format:\n");
159 fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
160 fprintf(stderr, "\t-c class (IN)\n");
161 fprintf(stderr, "\t-E engine:\n");
162 #if USE_PKCS11
163 fprintf(stderr,
164 "\t\tpath to PKCS#11 provider library "
165 "(default is %s)\n",
166 PK11_LIB_LOCATION);
167 #else /* if USE_PKCS11 */
168 fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
169 #endif /* if USE_PKCS11 */
170 fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
171 "not ZSKs\n");
172 fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
173 exit(0);
174 }
175
176 int
main(int argc,char * argv[])177 main(int argc, char *argv[]) {
178 char *origin = NULL, *file = NULL;
179 char *inputformatstr = NULL;
180 isc_result_t result;
181 isc_log_t *log = NULL;
182 const char *engine = NULL;
183 char *classname = NULL;
184 dns_rdataclass_t rdclass;
185 char *endp;
186 int ch;
187
188 #define CMDLINE_FLAGS "c:E:hm:o:I:qv:Vxz"
189
190 /*
191 * Process memory debugging argument first.
192 */
193 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
194 switch (ch) {
195 case 'm':
196 if (strcasecmp(isc_commandline_argument, "record") == 0)
197 {
198 isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
199 }
200 if (strcasecmp(isc_commandline_argument, "trace") == 0)
201 {
202 isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
203 }
204 if (strcasecmp(isc_commandline_argument, "usage") == 0)
205 {
206 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
207 }
208 if (strcasecmp(isc_commandline_argument, "size") == 0) {
209 isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
210 }
211 if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
212 isc_mem_debugging |= ISC_MEM_DEBUGCTX;
213 }
214 break;
215 default:
216 break;
217 }
218 }
219 isc_commandline_reset = true;
220 check_result(isc_app_start(), "isc_app_start");
221
222 isc_mem_create(&mctx);
223
224 #if USE_PKCS11
225 pk11_result_register();
226 #endif /* if USE_PKCS11 */
227 dns_result_register();
228
229 isc_commandline_errprint = false;
230
231 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
232 switch (ch) {
233 case 'c':
234 classname = isc_commandline_argument;
235 break;
236
237 case 'E':
238 engine = isc_commandline_argument;
239 break;
240
241 case 'I':
242 inputformatstr = isc_commandline_argument;
243 break;
244
245 case 'm':
246 break;
247
248 case 'o':
249 origin = isc_commandline_argument;
250 break;
251
252 case 'v':
253 endp = NULL;
254 verbose = strtol(isc_commandline_argument, &endp, 0);
255 if (*endp != '\0') {
256 fatal("verbose level must be numeric");
257 }
258 break;
259
260 case 'q':
261 quiet = true;
262 break;
263
264 case 'x':
265 keyset_kskonly = true;
266 break;
267
268 case 'z':
269 ignore_kskflag = true;
270 break;
271
272 case '?':
273 if (isc_commandline_option != '?') {
274 fprintf(stderr, "%s: invalid argument -%c\n",
275 program, isc_commandline_option);
276 }
277 /* FALLTHROUGH */
278
279 case 'h':
280 /* Does not return. */
281 usage();
282
283 case 'V':
284 /* Does not return. */
285 version(program);
286
287 default:
288 fprintf(stderr, "%s: unhandled option -%c\n", program,
289 isc_commandline_option);
290 exit(1);
291 }
292 }
293
294 result = dst_lib_init(mctx, engine);
295 if (result != ISC_R_SUCCESS) {
296 fatal("could not initialize dst: %s",
297 isc_result_totext(result));
298 }
299
300 isc_stdtime_get(&now);
301
302 rdclass = strtoclass(classname);
303
304 setup_logging(mctx, &log);
305
306 argc -= isc_commandline_index;
307 argv += isc_commandline_index;
308
309 if (argc < 1) {
310 usage();
311 }
312
313 file = argv[0];
314
315 argc -= 1;
316 argv += 1;
317
318 POST(argc);
319 POST(argv);
320
321 if (origin == NULL) {
322 origin = file;
323 }
324
325 if (inputformatstr != NULL) {
326 if (strcasecmp(inputformatstr, "text") == 0) {
327 inputformat = dns_masterformat_text;
328 } else if (strcasecmp(inputformatstr, "raw") == 0) {
329 inputformat = dns_masterformat_raw;
330 } else {
331 fatal("unknown file format: %s\n", inputformatstr);
332 }
333 }
334
335 gdb = NULL;
336 report("Loading zone '%s' from file '%s'\n", origin, file);
337 loadzone(file, origin, rdclass, &gdb);
338 gorigin = dns_db_origin(gdb);
339 gclass = dns_db_class(gdb);
340
341 gversion = NULL;
342 result = dns_db_newversion(gdb, &gversion);
343 check_result(result, "dns_db_newversion()");
344
345 result = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin, NULL, mctx,
346 ignore_kskflag, keyset_kskonly, report);
347
348 dns_db_closeversion(gdb, &gversion, false);
349 dns_db_detach(&gdb);
350
351 cleanup_logging(&log);
352 dst_lib_destroy();
353 if (verbose > 10) {
354 isc_mem_stats(mctx, stdout);
355 }
356 isc_mem_destroy(&mctx);
357
358 (void)isc_app_finish();
359
360 return (result == ISC_R_SUCCESS ? 0 : 1);
361 }
362