1/* $NetBSD: dnssec-verify.c,v 1.2.2.2 2012/12/15 05:39:24 riz Exp $ */ 2 3/* 4 * Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") 5 * 6 * Permission to use, copy, modify, and/or distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 11 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 12 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 13 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 14 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 15 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 16 * PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19/* Id: dnssec-verify.c,v 1.1.2.1 2011/03/16 06:37:51 each Exp */ 20 21/*! \file */ 22 23#include <config.h> 24 25#include <stdlib.h> 26#include <time.h> 27 28#include <isc/app.h> 29#include <isc/base32.h> 30#include <isc/commandline.h> 31#include <isc/entropy.h> 32#include <isc/event.h> 33#include <isc/file.h> 34#include <isc/hash.h> 35#include <isc/hex.h> 36#include <isc/mem.h> 37#include <isc/mutex.h> 38#include <isc/os.h> 39#include <isc/print.h> 40#include <isc/random.h> 41#include <isc/rwlock.h> 42#include <isc/serial.h> 43#include <isc/stdio.h> 44#include <isc/stdlib.h> 45#include <isc/string.h> 46#include <isc/time.h> 47#include <isc/util.h> 48 49#include <dns/db.h> 50#include <dns/dbiterator.h> 51#include <dns/diff.h> 52#include <dns/dnssec.h> 53#include <dns/ds.h> 54#include <dns/fixedname.h> 55#include <dns/keyvalues.h> 56#include <dns/log.h> 57#include <dns/master.h> 58#include <dns/masterdump.h> 59#include <dns/nsec.h> 60#include <dns/nsec3.h> 61#include <dns/rdata.h> 62#include <dns/rdatalist.h> 63#include <dns/rdataset.h> 64#include <dns/rdataclass.h> 65#include <dns/rdatasetiter.h> 66#include <dns/rdatastruct.h> 67#include <dns/rdatatype.h> 68#include <dns/result.h> 69#include <dns/soa.h> 70#include <dns/time.h> 71 72#include <dst/dst.h> 73 74#include "dnssectool.h" 75 76const char *program = "dnssec-verify"; 77int verbose; 78 79static isc_stdtime_t now; 80static isc_mem_t *mctx = NULL; 81static isc_entropy_t *ectx = NULL; 82static dns_masterformat_t inputformat = dns_masterformat_text; 83static dns_db_t *gdb; /* The database */ 84static dns_dbversion_t *gversion; /* The database version */ 85static dns_rdataclass_t gclass; /* The class */ 86static dns_name_t *gorigin; /* The database origin */ 87static isc_boolean_t ignore_kskflag = ISC_FALSE; 88static isc_boolean_t keyset_kskonly = ISC_FALSE; 89 90/*% 91 * Load the zone file from disk 92 */ 93static void 94loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) { 95 isc_buffer_t b; 96 int len; 97 dns_fixedname_t fname; 98 dns_name_t *name; 99 isc_result_t result; 100 101 len = strlen(origin); 102 isc_buffer_init(&b, origin, len); 103 isc_buffer_add(&b, len); 104 105 dns_fixedname_init(&fname); 106 name = dns_fixedname_name(&fname); 107 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL); 108 if (result != ISC_R_SUCCESS) 109 fatal("failed converting name '%s' to dns format: %s", 110 origin, isc_result_totext(result)); 111 112 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, 113 rdclass, 0, NULL, db); 114 check_result(result, "dns_db_create()"); 115 116 result = dns_db_load2(*db, file, inputformat); 117 if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) 118 fatal("failed loading zone from '%s': %s", 119 file, isc_result_totext(result)); 120} 121 122ISC_PLATFORM_NORETURN_PRE static void 123usage(void) ISC_PLATFORM_NORETURN_POST; 124 125static void 126usage(void) { 127 fprintf(stderr, "Usage:\n"); 128 fprintf(stderr, "\t%s [options] zonefile [keys]\n", program); 129 130 fprintf(stderr, "\n"); 131 132 fprintf(stderr, "Version: %s\n", VERSION); 133 134 fprintf(stderr, "Options: (default value in parenthesis) \n"); 135 fprintf(stderr, "\t-v debuglevel (0)\n"); 136 fprintf(stderr, "\t-o origin:\n"); 137 fprintf(stderr, "\t\tzone origin (name of zonefile)\n"); 138 fprintf(stderr, "\t-I format:\n"); 139 fprintf(stderr, "\t\tfile format of input zonefile (text)\n"); 140 fprintf(stderr, "\t-c class (IN)\n"); 141 fprintf(stderr, "\t-E engine:\n"); 142#ifdef USE_PKCS11 143 fprintf(stderr, "\t\tname of an OpenSSL engine to use " 144 "(default is \"pkcs11\")\n"); 145#else 146 fprintf(stderr, "\t\tname of an OpenSSL engine to use\n"); 147#endif 148 fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, " 149 "not ZSKs\n"); 150 fprintf(stderr, "\t-z:\tAll records signed with KSKs\n"); 151 exit(0); 152} 153 154int 155main(int argc, char *argv[]) { 156 char *origin = NULL, *file = NULL; 157 char *inputformatstr = NULL; 158 isc_result_t result; 159 isc_log_t *log = NULL; 160#ifdef USE_PKCS11 161 const char *engine = "pkcs11"; 162#else 163 const char *engine = NULL; 164#endif 165 char *classname = NULL; 166 dns_rdataclass_t rdclass; 167 char ch, *endp; 168 169#define CMDLINE_FLAGS \ 170 "m:o:I:c:E:v:xz" 171 172 /* 173 * Process memory debugging argument first. 174 */ 175 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { 176 switch (ch) { 177 case 'm': 178 if (strcasecmp(isc_commandline_argument, "record") == 0) 179 isc_mem_debugging |= ISC_MEM_DEBUGRECORD; 180 if (strcasecmp(isc_commandline_argument, "trace") == 0) 181 isc_mem_debugging |= ISC_MEM_DEBUGTRACE; 182 if (strcasecmp(isc_commandline_argument, "usage") == 0) 183 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE; 184 if (strcasecmp(isc_commandline_argument, "size") == 0) 185 isc_mem_debugging |= ISC_MEM_DEBUGSIZE; 186 if (strcasecmp(isc_commandline_argument, "mctx") == 0) 187 isc_mem_debugging |= ISC_MEM_DEBUGCTX; 188 break; 189 default: 190 break; 191 } 192 } 193 isc_commandline_reset = ISC_TRUE; 194 check_result(isc_app_start(), "isc_app_start"); 195 196 result = isc_mem_create(0, 0, &mctx); 197 if (result != ISC_R_SUCCESS) 198 fatal("out of memory"); 199 200 dns_result_register(); 201 202 isc_commandline_errprint = ISC_FALSE; 203 204 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) { 205 switch (ch) { 206 case 'c': 207 classname = isc_commandline_argument; 208 break; 209 210 case 'E': 211 engine = isc_commandline_argument; 212 break; 213 214 case 'h': 215 usage(); 216 break; 217 218 case 'I': 219 inputformatstr = isc_commandline_argument; 220 break; 221 222 case 'm': 223 break; 224 225 case 'o': 226 origin = isc_commandline_argument; 227 break; 228 229 case 'v': 230 endp = NULL; 231 verbose = strtol(isc_commandline_argument, &endp, 0); 232 if (*endp != '\0') 233 fatal("verbose level must be numeric"); 234 break; 235 236 case 'x': 237 keyset_kskonly = ISC_TRUE; 238 break; 239 240 case 'z': 241 ignore_kskflag = ISC_TRUE; 242 break; 243 244 case '?': 245 if (isc_commandline_option != '?') 246 fprintf(stderr, "%s: invalid argument -%c\n", 247 program, isc_commandline_option); 248 usage(); 249 break; 250 251 default: 252 fprintf(stderr, "%s: unhandled option -%c\n", 253 program, isc_commandline_option); 254 exit(1); 255 } 256 } 257 258 if (ectx == NULL) 259 setup_entropy(mctx, NULL, &ectx); 260 261 result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE); 262 if (result != ISC_R_SUCCESS) 263 fatal("could not create hash context"); 264 265 result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING); 266 if (result != ISC_R_SUCCESS) 267 fatal("could not initialize dst: %s", 268 isc_result_totext(result)); 269 270 isc_stdtime_get(&now); 271 272 rdclass = strtoclass(classname); 273 274 setup_logging(verbose, mctx, &log); 275 276 argc -= isc_commandline_index; 277 argv += isc_commandline_index; 278 279 if (argc < 1) 280 usage(); 281 282 file = argv[0]; 283 284 argc -= 1; 285 argv += 1; 286 287 if (origin == NULL) 288 origin = file; 289 290 if (inputformatstr != NULL) { 291 if (strcasecmp(inputformatstr, "text") == 0) 292 inputformat = dns_masterformat_text; 293 else if (strcasecmp(inputformatstr, "raw") == 0) 294 inputformat = dns_masterformat_raw; 295 else 296 fatal("unknown file format: %s\n", inputformatstr); 297 } 298 299 gdb = NULL; 300 fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file); 301 loadzone(file, origin, rdclass, &gdb); 302 gorigin = dns_db_origin(gdb); 303 gclass = dns_db_class(gdb); 304 305 gversion = NULL; 306 result = dns_db_newversion(gdb, &gversion); 307 check_result(result, "dns_db_newversion()"); 308 309 verifyzone(gdb, gversion, gorigin, mctx, 310 ignore_kskflag, keyset_kskonly); 311 312 dns_db_closeversion(gdb, &gversion, ISC_FALSE); 313 dns_db_detach(&gdb); 314 315 cleanup_logging(&log); 316 dst_lib_destroy(); 317 isc_hash_destroy(); 318 cleanup_entropy(&ectx); 319 dns_name_destroy(); 320 if (verbose > 10) 321 isc_mem_stats(mctx, stdout); 322 isc_mem_destroy(&mctx); 323 324 (void) isc_app_finish(); 325 326 return (0); 327} 328