1/*	$NetBSD: dnssec-verify.c,v 1.2.2.2 2012/12/15 05:39:24 riz Exp $	*/
2
3/*
4 * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
5 *
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
11 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
12 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
13 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
14 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
15 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
16 * PERFORMANCE OF THIS SOFTWARE.
17 */
18
19/* Id: dnssec-verify.c,v 1.1.2.1 2011/03/16 06:37:51 each Exp  */
20
21/*! \file */
22
23#include <config.h>
24
25#include <stdlib.h>
26#include <time.h>
27
28#include <isc/app.h>
29#include <isc/base32.h>
30#include <isc/commandline.h>
31#include <isc/entropy.h>
32#include <isc/event.h>
33#include <isc/file.h>
34#include <isc/hash.h>
35#include <isc/hex.h>
36#include <isc/mem.h>
37#include <isc/mutex.h>
38#include <isc/os.h>
39#include <isc/print.h>
40#include <isc/random.h>
41#include <isc/rwlock.h>
42#include <isc/serial.h>
43#include <isc/stdio.h>
44#include <isc/stdlib.h>
45#include <isc/string.h>
46#include <isc/time.h>
47#include <isc/util.h>
48
49#include <dns/db.h>
50#include <dns/dbiterator.h>
51#include <dns/diff.h>
52#include <dns/dnssec.h>
53#include <dns/ds.h>
54#include <dns/fixedname.h>
55#include <dns/keyvalues.h>
56#include <dns/log.h>
57#include <dns/master.h>
58#include <dns/masterdump.h>
59#include <dns/nsec.h>
60#include <dns/nsec3.h>
61#include <dns/rdata.h>
62#include <dns/rdatalist.h>
63#include <dns/rdataset.h>
64#include <dns/rdataclass.h>
65#include <dns/rdatasetiter.h>
66#include <dns/rdatastruct.h>
67#include <dns/rdatatype.h>
68#include <dns/result.h>
69#include <dns/soa.h>
70#include <dns/time.h>
71
72#include <dst/dst.h>
73
74#include "dnssectool.h"
75
76const char *program = "dnssec-verify";
77int verbose;
78
79static isc_stdtime_t now;
80static isc_mem_t *mctx = NULL;
81static isc_entropy_t *ectx = NULL;
82static dns_masterformat_t inputformat = dns_masterformat_text;
83static dns_db_t *gdb;			/* The database */
84static dns_dbversion_t *gversion;	/* The database version */
85static dns_rdataclass_t gclass;		/* The class */
86static dns_name_t *gorigin;		/* The database origin */
87static isc_boolean_t ignore_kskflag = ISC_FALSE;
88static isc_boolean_t keyset_kskonly = ISC_FALSE;
89
90/*%
91 * Load the zone file from disk
92 */
93static void
94loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
95	isc_buffer_t b;
96	int len;
97	dns_fixedname_t fname;
98	dns_name_t *name;
99	isc_result_t result;
100
101	len = strlen(origin);
102	isc_buffer_init(&b, origin, len);
103	isc_buffer_add(&b, len);
104
105	dns_fixedname_init(&fname);
106	name = dns_fixedname_name(&fname);
107	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
108	if (result != ISC_R_SUCCESS)
109		fatal("failed converting name '%s' to dns format: %s",
110		      origin, isc_result_totext(result));
111
112	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
113			       rdclass, 0, NULL, db);
114	check_result(result, "dns_db_create()");
115
116	result = dns_db_load2(*db, file, inputformat);
117	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
118		fatal("failed loading zone from '%s': %s",
119		      file, isc_result_totext(result));
120}
121
122ISC_PLATFORM_NORETURN_PRE static void
123usage(void) ISC_PLATFORM_NORETURN_POST;
124
125static void
126usage(void) {
127	fprintf(stderr, "Usage:\n");
128	fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
129
130	fprintf(stderr, "\n");
131
132	fprintf(stderr, "Version: %s\n", VERSION);
133
134	fprintf(stderr, "Options: (default value in parenthesis) \n");
135	fprintf(stderr, "\t-v debuglevel (0)\n");
136	fprintf(stderr, "\t-o origin:\n");
137	fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
138	fprintf(stderr, "\t-I format:\n");
139	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
140	fprintf(stderr, "\t-c class (IN)\n");
141	fprintf(stderr, "\t-E engine:\n");
142#ifdef USE_PKCS11
143	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
144				"(default is \"pkcs11\")\n");
145#else
146	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
147#endif
148	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
149			"not ZSKs\n");
150	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
151	exit(0);
152}
153
154int
155main(int argc, char *argv[]) {
156	char *origin = NULL, *file = NULL;
157	char *inputformatstr = NULL;
158	isc_result_t result;
159	isc_log_t *log = NULL;
160#ifdef USE_PKCS11
161	const char *engine = "pkcs11";
162#else
163	const char *engine = NULL;
164#endif
165	char *classname = NULL;
166	dns_rdataclass_t rdclass;
167	char ch, *endp;
168
169#define CMDLINE_FLAGS \
170	"m:o:I:c:E:v:xz"
171
172	/*
173	 * Process memory debugging argument first.
174	 */
175	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
176		switch (ch) {
177		case 'm':
178			if (strcasecmp(isc_commandline_argument, "record") == 0)
179				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
180			if (strcasecmp(isc_commandline_argument, "trace") == 0)
181				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
182			if (strcasecmp(isc_commandline_argument, "usage") == 0)
183				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
184			if (strcasecmp(isc_commandline_argument, "size") == 0)
185				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
186			if (strcasecmp(isc_commandline_argument, "mctx") == 0)
187				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
188			break;
189		default:
190			break;
191		}
192	}
193	isc_commandline_reset = ISC_TRUE;
194	check_result(isc_app_start(), "isc_app_start");
195
196	result = isc_mem_create(0, 0, &mctx);
197	if (result != ISC_R_SUCCESS)
198		fatal("out of memory");
199
200	dns_result_register();
201
202	isc_commandline_errprint = ISC_FALSE;
203
204	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
205		switch (ch) {
206		case 'c':
207			classname = isc_commandline_argument;
208			break;
209
210		case 'E':
211			engine = isc_commandline_argument;
212			break;
213
214		case 'h':
215			usage();
216			break;
217
218		case 'I':
219			inputformatstr = isc_commandline_argument;
220			break;
221
222		case 'm':
223			break;
224
225		case 'o':
226			origin = isc_commandline_argument;
227			break;
228
229		case 'v':
230			endp = NULL;
231			verbose = strtol(isc_commandline_argument, &endp, 0);
232			if (*endp != '\0')
233				fatal("verbose level must be numeric");
234			break;
235
236		case 'x':
237			keyset_kskonly = ISC_TRUE;
238			break;
239
240		case 'z':
241			ignore_kskflag = ISC_TRUE;
242			break;
243
244		case '?':
245			if (isc_commandline_option != '?')
246				fprintf(stderr, "%s: invalid argument -%c\n",
247					program, isc_commandline_option);
248			usage();
249			break;
250
251		default:
252			fprintf(stderr, "%s: unhandled option -%c\n",
253				program, isc_commandline_option);
254			exit(1);
255		}
256	}
257
258	if (ectx == NULL)
259		setup_entropy(mctx, NULL, &ectx);
260
261	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
262	if (result != ISC_R_SUCCESS)
263		fatal("could not create hash context");
264
265	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
266	if (result != ISC_R_SUCCESS)
267		fatal("could not initialize dst: %s",
268		      isc_result_totext(result));
269
270	isc_stdtime_get(&now);
271
272	rdclass = strtoclass(classname);
273
274	setup_logging(verbose, mctx, &log);
275
276	argc -= isc_commandline_index;
277	argv += isc_commandline_index;
278
279	if (argc < 1)
280		usage();
281
282	file = argv[0];
283
284	argc -= 1;
285	argv += 1;
286
287	if (origin == NULL)
288		origin = file;
289
290	if (inputformatstr != NULL) {
291		if (strcasecmp(inputformatstr, "text") == 0)
292			inputformat = dns_masterformat_text;
293		else if (strcasecmp(inputformatstr, "raw") == 0)
294			inputformat = dns_masterformat_raw;
295		else
296			fatal("unknown file format: %s\n", inputformatstr);
297	}
298
299	gdb = NULL;
300	fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file);
301	loadzone(file, origin, rdclass, &gdb);
302	gorigin = dns_db_origin(gdb);
303	gclass = dns_db_class(gdb);
304
305	gversion = NULL;
306	result = dns_db_newversion(gdb, &gversion);
307	check_result(result, "dns_db_newversion()");
308
309	verifyzone(gdb, gversion, gorigin, mctx,
310		   ignore_kskflag, keyset_kskonly);
311
312	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
313	dns_db_detach(&gdb);
314
315	cleanup_logging(&log);
316	dst_lib_destroy();
317	isc_hash_destroy();
318	cleanup_entropy(&ectx);
319	dns_name_destroy();
320	if (verbose > 10)
321		isc_mem_stats(mctx, stdout);
322	isc_mem_destroy(&mctx);
323
324	(void) isc_app_finish();
325
326	return (0);
327}
328