dnssec-revoke.c 6.48 KB
Newer Older
1
/*
2
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3
 *
4 5 6
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
7 8 9
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
10 11 12 13 14 15 16 17 18 19 20
 */

/*! \file */

#include <config.h>

#include <stdlib.h>
#include <unistd.h>

#include <isc/buffer.h>
#include <isc/commandline.h>
21
#include <isc/file.h>
22 23 24 25 26 27 28 29 30 31 32
#include <isc/hash.h>
#include <isc/mem.h>
#include <isc/print.h>
#include <isc/string.h>
#include <isc/util.h>

#include <dns/keyvalues.h>
#include <dns/result.h>

#include <dst/dst.h>

Ondřej Surý's avatar
Ondřej Surý committed
33
#if USE_PKCS11
34 35 36
#include <pk11/result.h>
#endif

37 38 39 40 41 42 43
#include "dnssectool.h"

const char *program = "dnssec-revoke";
int verbose;

static isc_mem_t	*mctx = NULL;

Francis Dupont's avatar
Francis Dupont committed
44 45 46
ISC_PLATFORM_NORETURN_PRE static void
usage(void) ISC_PLATFORM_NORETURN_POST;

47 48 49 50 51
static void
usage(void) {
	fprintf(stderr, "Usage:\n");
	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
	fprintf(stderr, "Version: %s\n", VERSION);
Ondřej Surý's avatar
Ondřej Surý committed
52
#if USE_PKCS11
Evan Hunt's avatar
Evan Hunt committed
53 54
	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
					"(default: %s)\n", PK11_LIB_LOCATION);
Francis Dupont's avatar
Francis Dupont committed
55
#else
56
	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
Francis Dupont's avatar
Francis Dupont committed
57
#endif
58 59
	fprintf(stderr, "    -f:	   force overwrite\n");
	fprintf(stderr, "    -K directory: use directory for key files\n");
60 61 62 63
	fprintf(stderr, "    -h:	   help\n");
	fprintf(stderr, "    -r:	   remove old keyfiles after "
					   "creating revoked version\n");
	fprintf(stderr, "    -v level:	   set level of verbosity\n");
64
	fprintf(stderr, "    -V: print version information\n");
65 66 67 68 69 70 71 72 73 74
	fprintf(stderr, "Output:\n");
	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
			     "K<name>+<alg>+<new id>.private\n");

	exit (-1);
}

int
main(int argc, char **argv) {
	isc_result_t result;
Francis Dupont's avatar
Francis Dupont committed
75
	const char *engine = NULL;
76 77
	char const *filename = NULL;
	char *dir = NULL;
78
	char newname[1024], oldname[1024];
79
	char keystr[DST_KEY_FORMATSIZE];
80 81 82 83 84 85
	char *endp;
	int ch;
	dst_key_t *key = NULL;
	isc_uint32_t flags;
	isc_buffer_t buf;
	isc_boolean_t force = ISC_FALSE;
86
	isc_boolean_t removefile = ISC_FALSE;
87
	isc_boolean_t id = ISC_FALSE;
88 89 90 91 92 93 94 95

	if (argc == 1)
		usage();

	result = isc_mem_create(0, 0, &mctx);
	if (result != ISC_R_SUCCESS)
		fatal("Out of memory");

Ondřej Surý's avatar
Ondřej Surý committed
96
#if HAVE_PKCS11
97 98
	pk11_result_register();
#endif
99 100 101 102
	dns_result_register();

	isc_commandline_errprint = ISC_FALSE;

103
	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
104
		switch (ch) {
Francis Dupont's avatar
Francis Dupont committed
105 106 107
		    case 'E':
			engine = isc_commandline_argument;
			break;
108 109 110
		    case 'f':
			force = ISC_TRUE;
			break;
111
		    case 'K':
Evan Hunt's avatar
Evan Hunt committed
112 113 114 115 116 117 118 119 120
			/*
			 * We don't have to copy it here, but do it to
			 * simplify cleanup later
			 */
			dir = isc_mem_strdup(mctx, isc_commandline_argument);
			if (dir == NULL) {
				fatal("Failed to allocate memory for "
				      "directory");
			}
121
			break;
122
		    case 'r':
123
			removefile = ISC_TRUE;
124
			break;
125 126 127
		    case 'R':
			id = ISC_TRUE;
			break;
128 129 130 131 132 133 134 135 136
		    case 'v':
			verbose = strtol(isc_commandline_argument, &endp, 0);
			if (*endp != '\0')
				fatal("-v must be followed by a number");
			break;
		    case '?':
			if (isc_commandline_option != '?')
				fprintf(stderr, "%s: invalid argument -%c\n",
					program, isc_commandline_option);
Evan Hunt's avatar
Evan Hunt committed
137
			/* FALLTHROUGH */
138
		    case 'h':
139
			/* Does not return. */
140 141
			usage();

142 143 144 145
		    case 'V':
			/* Does not return. */
			version(program);

146 147 148 149 150 151 152 153 154 155 156 157 158
		    default:
			fprintf(stderr, "%s: unhandled option -%c\n",
				program, isc_commandline_option);
			exit(1);
		}
	}

	if (argc < isc_commandline_index + 1 ||
	    argv[isc_commandline_index] == NULL)
		fatal("The key file name was not specified");
	if (argc > isc_commandline_index + 1)
		fatal("Extraneous arguments");

159 160 161
	if (dir != NULL) {
		filename = argv[isc_commandline_index];
	} else {
Evan Hunt's avatar
Evan Hunt committed
162 163 164 165 166 167
		result = isc_file_splitpath(mctx, argv[isc_commandline_index],
					    &dir, &filename);
		if (result != ISC_R_SUCCESS)
			fatal("cannot process filename %s: %s",
			      argv[isc_commandline_index],
			      isc_result_totext(result));
168 169 170 171
		if (strcmp(dir, ".") == 0) {
			isc_mem_free(mctx, dir);
			dir = NULL;
		}
Automatic Updater's avatar
Automatic Updater committed
172
	}
173

174
	result = dst_lib_init(mctx, engine);
175
	if (result != ISC_R_SUCCESS)
Francis Dupont's avatar
Francis Dupont committed
176 177
		fatal("Could not initialize dst: %s",
		      isc_result_totext(result));
178

179
	result = dst_key_fromnamedfile(filename, dir,
180 181 182 183 184 185
				       DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
				       mctx, &key);
	if (result != ISC_R_SUCCESS)
		fatal("Invalid keyfile name %s: %s",
		      filename, isc_result_totext(result));

186 187 188 189
	if (id) {
		fprintf(stdout, "%u\n", dst_key_rid(key));
		goto cleanup;
	}
190
	dst_key_format(key, keystr, sizeof(keystr));
191

192
	if (verbose > 2)
193
		fprintf(stderr, "%s: %s\n", program, keystr);
194 195 196 197 198 199

	if (force)
		set_keyversion(key);
	else
		check_keyversion(key, keystr);

200 201 202

	flags = dst_key_flags(key);
	if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
Automatic Updater's avatar
Automatic Updater committed
203
		isc_stdtime_t now;
204

205 206 207 208 209 210
		if ((flags & DNS_KEYFLAG_KSK) == 0)
			fprintf(stderr, "%s: warning: Key is not flagged "
					"as a KSK. Revoking a ZSK is "
					"legal, but undefined.\n",
					program);

Automatic Updater's avatar
Automatic Updater committed
211
		isc_stdtime_get(&now);
212 213
		dst_key_settime(key, DST_TIME_REVOKE, now);

214 215 216 217 218 219 220 221 222 223 224 225 226
		dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);

		isc_buffer_init(&buf, newname, sizeof(newname));
		dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);

		if (access(newname, F_OK) == 0 && !force) {
			fatal("Key file %s already exists; "
			      "use -f to force overwrite", newname);
		}

		result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
					dir);
		if (result != ISC_R_SUCCESS) {
227
			dst_key_format(key, keystr, sizeof(keystr));
228 229 230 231 232
			fatal("Failed to write key %s: %s", keystr,
			      isc_result_totext(result));
		}

		isc_buffer_clear(&buf);
233
		dst_key_buildfilename(key, 0, dir, &buf);
234 235 236 237 238 239
		printf("%s\n", newname);

		/*
		 * Remove old key file, if told to (and if
		 * it isn't the same as the new file)
		 */
240
		if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
241 242 243 244 245
			isc_buffer_init(&buf, oldname, sizeof(oldname));
			dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
			if (strcmp(oldname, newname) == 0)
				goto cleanup;
Mark Andrews's avatar
Mark Andrews committed
246
			(void)unlink(oldname);
247 248
			isc_buffer_clear(&buf);
			dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
Mark Andrews's avatar
Mark Andrews committed
249
			(void)unlink(oldname);
250 251
		}
	} else {
252
		dst_key_format(key, keystr, sizeof(keystr));
253 254 255 256 257
		fatal("Key %s is already revoked", keystr);
	}

cleanup:
	dst_key_free(&key);
Evan Hunt's avatar
Evan Hunt committed
258
	dst_lib_destroy();
259 260
	if (verbose > 10)
		isc_mem_stats(mctx, stdout);
261 262
	if (dir != NULL)
		isc_mem_free(mctx, dir);
263 264 265 266
	isc_mem_destroy(&mctx);

	return (0);
}