dnssec-signzone.c 38.3 KB
Newer Older
Michael Graff's avatar
Michael Graff committed
1
/*
Bob Halley's avatar
Bob Halley committed
2
 * Copyright (C) 1999, 2000  Internet Software Consortium.
Bob Halley's avatar
Bob Halley committed
3
 * 
Michael Graff's avatar
Michael Graff committed
4 5 6
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
Bob Halley's avatar
Bob Halley committed
7
 * 
Michael Graff's avatar
Michael Graff committed
8 9 10 11 12 13 14 15 16
 * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
 * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
 * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
 * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
 * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 * SOFTWARE.
 */
Brian Wellington's avatar
Brian Wellington committed
17 18 19 20 21

#include <config.h>

#include <stdlib.h>

22
#include <isc/commandline.h>
Brian Wellington's avatar
Brian Wellington committed
23
#include <isc/mem.h>
24
#include <isc/string.h>
Bob Halley's avatar
Bob Halley committed
25
#include <isc/util.h>
Brian Wellington's avatar
Brian Wellington committed
26 27 28

#include <dns/db.h>
#include <dns/dbiterator.h>
29 30 31 32
#include <dns/dnssec.h>
#include <dns/keyvalues.h>
#include <dns/log.h>
#include <dns/nxt.h>
Brian Wellington's avatar
Brian Wellington committed
33 34 35 36
#include <dns/rdata.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
37
#include <dns/rdatastruct.h>
38
#include <dns/rdatatype.h>
Brian Wellington's avatar
Brian Wellington committed
39
#include <dns/result.h>
40
#include <dns/secalg.h>
41
#include <dns/time.h>
Brian Wellington's avatar
Brian Wellington committed
42

43
#include <dst/dst.h>
44
#include <dst/result.h>
Brian Wellington's avatar
Brian Wellington committed
45

46 47
#include "dnssectool.h"

David Lawrence's avatar
David Lawrence committed
48
const char *program = "dnssec-signzone";
49
int verbose;
50

51 52
/*#define USE_ZONESTATUS*/

53
#define BUFSIZE 2048
Brian Wellington's avatar
Brian Wellington committed
54

55 56 57 58 59 60 61 62 63 64 65 66 67 68
typedef struct signer_key_struct signer_key_t;
typedef struct signer_array_struct signer_array_t;

struct signer_key_struct {
	dst_key_t *key;
	isc_boolean_t isdefault;
	ISC_LINK(signer_key_t) link;
};

struct signer_array_struct {
	unsigned char array[BUFSIZE];
	ISC_LINK(signer_array_t) link;
};

69 70 71
static ISC_LIST(signer_key_t) keylist;
static isc_stdtime_t starttime = 0, endtime = 0, now;
static int cycle = -1;
72
static isc_boolean_t tryverify = ISC_FALSE;
Brian Wellington's avatar
Brian Wellington committed
73 74
static isc_mem_t *mctx = NULL;

75
static inline void
Brian Wellington's avatar
Brian Wellington committed
76
set_bit(unsigned char *array, unsigned int index, unsigned int bit) {
77
	unsigned int shift, mask;
78

Brian Wellington's avatar
Brian Wellington committed
79 80 81
	shift = 7 - (index % 8);
	mask = 1 << shift;

82
	if (bit != 0)
Brian Wellington's avatar
Brian Wellington committed
83 84 85 86 87
		array[index / 8] |= mask;
	else
		array[index / 8] &= (~mask & 0xFF);
}

88 89 90
static void
signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdata_t *rdata,
	    dst_key_t *key, isc_buffer_t *b)
Brian Wellington's avatar
Brian Wellington committed
91 92 93
{
	isc_result_t result;

94
	dns_rdata_init(rdata);
95
	result = dns_dnssec_sign(name, rdataset, key, &starttime, &endtime,
96
				 mctx, b, rdata);
97 98
	if (result != ISC_R_SUCCESS)
		fatal("key '%s/%s/%d' failed to sign data: %s",
99
		      nametostr(dst_key_name(key)), algtostr(dst_key_alg(key)),
100
		      dst_key_id(key), isc_result_totext(result));
101

102
	if (tryverify) {
103 104
		result = dns_dnssec_verify(name, rdataset, key,
					   ISC_TRUE, mctx, rdata);
105 106 107 108
		if (result == ISC_R_SUCCESS)
			vbprintf(3, "\tsignature verified\n");
		else
			vbprintf(3, "\tsignature failed to verify\n");
109
	}
110
}
Brian Wellington's avatar
Brian Wellington committed
111

112 113 114
static inline isc_boolean_t
issigningkey(signer_key_t *key) {
	return (key->isdefault);
Brian Wellington's avatar
Brian Wellington committed
115 116
}

117 118
static inline isc_boolean_t
iszonekey(signer_key_t *key, dns_db_t *db) {
119 120 121 122
	return (ISC_TF(dns_name_equal(dst_key_name(key->key),
				      dns_db_origin(db)) &&
		       (dst_key_flags(key->key) & DNS_KEYFLAG_OWNERMASK) ==
		       DNS_KEYOWNER_ZONE));
123 124
}

125 126 127 128
/*
 * Finds the key that generated a SIG, if possible.  First look at the keys
 * that we've loaded already, and then see if there's a key on disk.
 */
129
static signer_key_t *
130
keythatsigned(dns_rdata_sig_t *sig) {
131
	isc_result_t result;
132 133 134 135 136 137 138
	dst_key_t *pubkey = NULL, *privkey = NULL;
	signer_key_t *key;

	key = ISC_LIST_HEAD(keylist);
	while (key != NULL) {
		if (sig->keyid == dst_key_id(key->key) &&
		    sig->algorithm == dst_key_alg(key->key) &&
139
		    dns_name_equal(&sig->signer, dst_key_name(key->key)))
140
			return key;
141
		key = ISC_LIST_NEXT(key, link);
142
	}
143

144
	result = dst_key_fromfile(&sig->signer, sig->keyid, sig->algorithm,
145 146 147
				  DST_TYPE_PUBLIC, mctx, &pubkey);
	if (result != ISC_R_SUCCESS)
		return (NULL);
148

149 150
	key = isc_mem_get(mctx, sizeof(signer_key_t));
	if (key == NULL)
151
		fatal("out of memory");
152

153
	result = dst_key_fromfile(&sig->signer, sig->keyid, sig->algorithm,
Brian Wellington's avatar
Brian Wellington committed
154
				  DST_TYPE_PRIVATE, mctx, &privkey);
155 156
	if (result == ISC_R_SUCCESS) {
		key->key = privkey;
157
		dst_key_free(&pubkey);
158 159 160 161 162 163
	}
	else
		key->key = pubkey;
	key->isdefault = ISC_FALSE;
	ISC_LIST_APPEND(keylist, key, link);
	return key;
164 165
}

166 167 168 169 170
/*
 * Check to see if we expect to find a key at this name.  If we see a SIG
 * and can't find the signing key that we expect to find, we drop the sig.
 * I'm not sure if this is completely correct, but it seems to work.
 */
171 172 173
static isc_boolean_t
expecttofindkey(dns_name_t *name, dns_db_t *db, dns_dbversion_t *version) {
	unsigned int options = DNS_DBFIND_NOWILD;
174
	dns_fixedname_t fname;
175 176
	isc_result_t result;

177
	dns_fixedname_init(&fname);
178
	result = dns_db_find(db, name, version, dns_rdatatype_key, options,
179
			     0, NULL, dns_fixedname_name(&fname), NULL, NULL);
180
	switch (result) {
181
		case ISC_R_SUCCESS:
182
		case DNS_R_NXDOMAIN:
183
		case DNS_R_NXRRSET:
184 185 186 187 188 189
			return ISC_TRUE;
		case DNS_R_DELEGATION:
		case DNS_R_CNAME:
		case DNS_R_DNAME:
			return ISC_FALSE;
		default:
190 191
			fatal("failure looking for '%s KEY' in database: %s",
			      nametostr(name), isc_result_totext(result));
192
			return ISC_FALSE; /* removes a warning */
193 194 195
	}
}

196
static inline isc_boolean_t
197 198
setverifies(dns_name_t *name, dns_rdataset_t *set, signer_key_t *key,
	    dns_rdata_t *sig)
199
{
200 201
	isc_result_t result;
	result = dns_dnssec_verify(name, set, key->key, ISC_FALSE, mctx, sig);
202
	return (ISC_TF(result == ISC_R_SUCCESS));
203 204 205 206 207 208 209 210
}

#define allocbufferandrdata \
	isc_buffer_t b; \
	trdata = isc_mem_get(mctx, sizeof(dns_rdata_t)); \
	tdata = isc_mem_get(mctx, sizeof(signer_array_t)); \
	ISC_LIST_APPEND(arraylist, tdata, link); \
	if (trdata == NULL || tdata == NULL) \
211
		fatal("out of memory"); \
212
	isc_buffer_init(&b, tdata->array, sizeof(tdata->array));
213

214 215 216 217 218
/*
 * Signs a set.  Goes through contortions to decide if each SIG should
 * be dropped or retained, and then determines if any new SIGs need to
 * be generated.
 */
219 220 221 222 223 224 225 226
static void
signset(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
	 dns_name_t *name, dns_rdataset_t *set)
{
	dns_rdatalist_t siglist;
	dns_rdataset_t sigset, oldsigset;
	dns_rdata_t oldsigrdata;
	dns_rdata_t *trdata;
227
	dns_rdata_sig_t sig;
228
	signer_key_t *key;
229
	isc_result_t result;
230
	isc_boolean_t notsigned = ISC_TRUE, nosigs = ISC_FALSE;
231 232 233
	isc_boolean_t wassignedby[256], nowsignedby[256];
	signer_array_t *tdata;
	ISC_LIST(signer_array_t) arraylist;
234
	int i;
235 236 237 238 239 240 241 242 243 244

	ISC_LIST_INIT(siglist.rdata);
	ISC_LIST_INIT(arraylist);

	for (i = 0; i < 256; i++)
		wassignedby[i] = nowsignedby[i] = ISC_FALSE;

	dns_rdataset_init(&oldsigset);
	result = dns_db_findrdataset(db, node, version, dns_rdatatype_sig,
				     set->type, 0, &oldsigset, NULL);
245 246 247 248
	if (result == ISC_R_NOTFOUND) {
		result = ISC_R_SUCCESS;
		nosigs = ISC_TRUE;
	}
249 250 251 252
	if (result != ISC_R_SUCCESS)
		fatal("failed while looking for '%s SIG %s': %s",
		      nametostr(name), typetostr(set->type),
		      isc_result_totext(result));
253

254 255
	vbprintf(1, "%s/%s:\n", nametostr(name), typetostr(set->type));

256
	if (!nosigs) {
257 258
		result = dns_rdataset_first(&oldsigset);
		while (result == ISC_R_SUCCESS) {
259
			isc_boolean_t expired, future;
260 261 262 263 264 265 266
			isc_boolean_t keep = ISC_FALSE, resign = ISC_FALSE;

			dns_rdataset_current(&oldsigset, &oldsigrdata);

			result = dns_rdata_tostruct(&oldsigrdata, &sig, mctx);
			check_result(result, "dns_rdata_tostruct");

267 268
			expired = ISC_TF(now + cycle > sig.timeexpire);
			future = ISC_TF(now < sig.timesigned);
269 270 271

			key = keythatsigned(&sig);

272 273 274 275 276 277 278 279
			if (sig.timesigned > sig.timeexpire) {
				/* sig is dropped and not replaced */
				vbprintf(2, "\tsig by %s/%s/%d dropped - "
					 "invalid validity period\n",
					 nametostr(&sig.signer),
					 algtostr(sig.algorithm),
					 sig.keyid);
			}
280
			else if (key == NULL && !future &&
281
				 expecttofindkey(&sig.signer, db, version))
282 283 284 285 286 287 288 289
			{
				/* sig is dropped and not replaced */
				vbprintf(2, "\tsig by %s/%s/%d dropped - "
					 "private key not found\n",
					 nametostr(&sig.signer),
					 algtostr(sig.algorithm),
					 sig.keyid);
			}
290
			else if (key == NULL || future) {
291 292 293 294 295 296
				vbprintf(2, "\tsig by %s/%s/%d %s - "
					 "key not found\n",
					 expired ? "retained" : "dropped",
					 nametostr(&sig.signer),
					 algtostr(sig.algorithm),
					 sig.keyid);
297 298 299
				if (!expired)
					keep = ISC_TRUE;
			}
300 301 302 303
			else if (issigningkey(key)) {
				if (!expired &&
				    setverifies(name, set, key, &oldsigrdata))
				{
304
					vbprintf(2,
305
						"\tsig by %s/%s/%d retained\n",
306 307 308
						 nametostr(&sig.signer),
						 algtostr(sig.algorithm),
						 sig.keyid);
309 310 311 312
					keep = ISC_TRUE;
					wassignedby[sig.algorithm] = ISC_TRUE;
				}
				else {
313
					vbprintf(2,
314
						 "\tsig by %s/%s/%d dropped - "
315 316 317
						 "%s\n",
						 nametostr(&sig.signer),
						 algtostr(sig.algorithm),
318 319 320
						 sig.keyid,
						 expired ? "expired" :
							   "failed to verify");
321 322 323
					wassignedby[sig.algorithm] = ISC_TRUE;
					resign = ISC_TRUE;
				}
Brian Wellington's avatar
Brian Wellington committed
324
			}
325 326 327 328
			else if (iszonekey(key, db)) {
				if (!expired &&
				    setverifies(name, set, key, &oldsigrdata))
				{
329
					vbprintf(2,
330
						"\tsig by %s/%s/%d retained\n",
331 332 333
						 nametostr(&sig.signer),
						 algtostr(sig.algorithm),
						 sig.keyid);
334 335 336 337 338
					keep = ISC_TRUE;
					wassignedby[sig.algorithm] = ISC_TRUE;
					nowsignedby[sig.algorithm] = ISC_TRUE;
				}
				else {
339
					vbprintf(2,
340 341
						 "\tsig by %s/%s/%d "
						 "dropped - %s\n",
342 343
						 nametostr(&sig.signer),
						 algtostr(sig.algorithm),
344 345 346
						 sig.keyid,
						 expired ? "expired" :
							   "failed to verify");
347 348 349 350 351
					wassignedby[sig.algorithm] = ISC_TRUE;
					if (dst_key_isprivate(key->key))
						resign = ISC_TRUE;
				}
			}
352
			else if (!expired) {
Brian Wellington's avatar
Brian Wellington committed
353
				vbprintf(2, "\tsig by %s/%s/%d retained\n",
354 355 356
					 nametostr(&sig.signer),
					 algtostr(sig.algorithm),
					 sig.keyid);
357
				keep = ISC_TRUE;
358 359
			}
			else {
Brian Wellington's avatar
Brian Wellington committed
360
				vbprintf(2, "\tsig by %s/%s/%d expired\n",
361 362 363 364
					 nametostr(&sig.signer),
					 algtostr(sig.algorithm),
					 sig.keyid);
			}
365 366 367 368 369

			if (keep) {
				allocbufferandrdata;
				result = dns_rdata_fromstruct(trdata,
							      set->rdclass,
370
							     dns_rdatatype_sig,
371 372 373 374 375 376
							      &sig, &b);
				nowsignedby[sig.algorithm] = ISC_TRUE;
				ISC_LIST_APPEND(siglist.rdata, trdata, link);
			}
			else if (resign) {
				allocbufferandrdata;
377
				vbprintf(1, "\tresigning with key %s/%s/%d\n",
378
				       nametostr(dst_key_name(key->key)),
379 380
				       algtostr(dst_key_alg(key->key)),
				       dst_key_id(key->key));
381 382 383 384 385 386 387
				signwithkey(name, set, trdata, key->key, &b);
				nowsignedby[sig.algorithm] = ISC_TRUE;
				ISC_LIST_APPEND(siglist.rdata, trdata, link);
			}

			dns_rdata_freestruct(&sig);
			result = dns_rdataset_next(&oldsigset);
388
		}
389
		if (result == ISC_R_NOMORE)
390 391 392
			result = ISC_R_SUCCESS;
		check_result(result, "dns_db_dns_rdataset_first()/next()");
		dns_rdataset_disassociate(&oldsigset);
Brian Wellington's avatar
Brian Wellington committed
393
	}
394 395 396 397 398

	for (i = 0; i < 256; i++)
		if (wassignedby[i] != 0) {
			notsigned = ISC_FALSE;
			break;
Brian Wellington's avatar
Brian Wellington committed
399
		}
400 401 402

	key = ISC_LIST_HEAD(keylist);
	while (key != NULL) {
403
		unsigned int alg = dst_key_alg(key->key);
404 405 406 407
		if (key->isdefault &&
		    (notsigned || (wassignedby[alg] && !nowsignedby[alg])))
		{
			allocbufferandrdata;
408
			vbprintf(1, "\tsigning with key %s/%s/%d\n",
409
			       nametostr(dst_key_name(key->key)),
410 411
			       algtostr(dst_key_alg(key->key)),
			       dst_key_id(key->key));
412
			signwithkey(name, set, trdata, key->key, &b);
413 414 415 416 417
			ISC_LIST_APPEND(siglist.rdata, trdata, link);
		}
		key = ISC_LIST_NEXT(key, link);
	}

418 419 420 421
	if (!ISC_LIST_EMPTY(siglist.rdata)) {
		siglist.rdclass = set->rdclass;
		siglist.type = dns_rdatatype_sig;
		siglist.covers = set->type;
422 423
		if (endtime - starttime < set->ttl)
			siglist.ttl = endtime - starttime;
424 425 426 427 428 429
		else
			siglist.ttl = set->ttl;
		dns_rdataset_init(&sigset);
		result = dns_rdatalist_tordataset(&siglist, &sigset);
		check_result(result, "dns_rdatalist_tordataset");
		result = dns_db_addrdataset(db, node, version, 0, &sigset,
430
					    0, NULL);
431 432 433 434 435 436
		if (result == DNS_R_UNCHANGED)
			result = ISC_R_SUCCESS;
		check_result(result, "dns_db_addrdataset");
		dns_rdataset_disassociate(&sigset);
	}
	else if (!nosigs) {
437 438 439 440 441 442
#if 0
		/*
		 * If this is compiled in, running a signed set through the
		 * signer with no private keys causes DNS_R_BADDB to occur
		 * later.  This is bad.
		 */
Brian Wellington's avatar
Brian Wellington committed
443 444 445 446 447
		result = dns_db_deleterdataset(db, node, version,
					       dns_rdatatype_sig, set->type);
		if (result == ISC_R_NOTFOUND)
			result = ISC_R_SUCCESS;
		check_result(result, "dns_db_deleterdataset");
448
#endif
449 450
		fatal("File is currently signed but no private keys were "
		      "found.  This won't work.");
451
	}
452 453 454 455 456 457

	trdata = ISC_LIST_HEAD(siglist.rdata);
	while (trdata != NULL) {
		dns_rdata_t *next = ISC_LIST_NEXT(trdata, link);
		isc_mem_put(mctx, trdata, sizeof(dns_rdata_t));
		trdata = next;
458
	}
Brian Wellington's avatar
Brian Wellington committed
459

460 461 462 463 464 465 466 467
	tdata = ISC_LIST_HEAD(arraylist);
	while (tdata != NULL) {
		signer_array_t *next = ISC_LIST_NEXT(tdata, link);
		isc_mem_put(mctx, tdata, sizeof(signer_array_t));
		tdata = next;
	}
}

468
#ifndef USE_ZONESTATUS
469
/* Determine if a KEY set contains a null key */
470
static isc_boolean_t
471
hasnullkey(dns_rdataset_t *rdataset) {
472 473
	isc_result_t result;
	dns_rdata_t rdata;
474
	isc_boolean_t found = ISC_FALSE;
475

476
	result = dns_rdataset_first(rdataset);
477 478 479
	while (result == ISC_R_SUCCESS) {
		dst_key_t *key = NULL;

480
		dns_rdataset_current(rdataset, &rdata);
481 482
		result = dns_dnssec_keyfromrdata(dns_rootname,
						 &rdata, mctx, &key);
483 484
		if (result != ISC_R_SUCCESS)
			fatal("could not convert KEY into internal format");
485 486
		if (dst_key_isnullkey(key))
			found = ISC_TRUE;
487
                dst_key_free(&key);
488
		if (found == ISC_TRUE)
489
			return (ISC_TRUE);
490 491 492
                result = dns_rdataset_next(rdataset);
        }
        if (result != ISC_R_NOMORE)
493
                fatal("failure looking for null keys");
494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522
        return (ISC_FALSE);
}
#endif

/*
 * Looks for signatures of the zone keys by the parent, and imports them
 * if found.
 */
static void
importparentsig(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
		dns_name_t *name, dns_rdataset_t *set)
{
	unsigned char filename[256];
	isc_buffer_t b;
	isc_region_t r;
	dns_db_t *newdb = NULL;
	dns_dbnode_t *newnode = NULL;
	dns_rdataset_t newset, sigset;
	dns_rdata_t rdata, newrdata;
	isc_result_t result;

	isc_buffer_init(&b, filename, sizeof(filename) - 10);
	result = dns_name_totext(name, ISC_FALSE, &b);
	check_result(result, "dns_name_totext()");
	isc_buffer_usedregion(&b, &r);
	strcpy((char *)r.base + r.length, "signedkey");
	result = dns_db_create(mctx, "rbt", name, ISC_FALSE, dns_db_class(db),
			       0, NULL, &newdb);
	check_result(result, "dns_db_create()");
523
	result = dns_db_load(newdb, (char *)filename);
524 525 526 527 528 529 530
	if (result != ISC_R_SUCCESS)
		goto failure;
	result = dns_db_findnode(newdb, name, ISC_FALSE, &newnode);
	if (result != ISC_R_SUCCESS)
		goto failure;
	dns_rdataset_init(&newset);
	dns_rdataset_init(&sigset);
531 532
	result = dns_db_findrdataset(newdb, newnode, NULL, dns_rdatatype_key,
				     0, 0, &newset, &sigset);
533 534 535 536 537 538 539 540 541 542
	if (result != ISC_R_SUCCESS)
		goto failure;

	if (dns_rdataset_count(set) != dns_rdataset_count(&newset))
		goto failure;

	dns_rdata_init(&rdata);
	dns_rdata_init(&newrdata);

	result = dns_rdataset_first(set);
543
	check_result(result, "dns_rdataset_first()");
544 545 546
	for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(set)) {
		dns_rdataset_current(set, &rdata);
		result = dns_rdataset_first(&newset);
547
		check_result(result, "dns_rdataset_first()");
548 549 550 551 552 553 554 555 556 557
		for (;
		     result == ISC_R_SUCCESS;
		     result = dns_rdataset_next(&newset))
		{
			dns_rdataset_current(&newset, &newrdata);
			if (dns_rdata_compare(&rdata, &newrdata) == 0)
				break;
		}
		if (result != ISC_R_SUCCESS)
			break;
558
	}
559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601
	if (result != ISC_R_NOMORE) 
		goto failure;

	vbprintf(2, "found the parent's signature of our zone key\n");

	result = dns_db_addrdataset(db, node, version, 0, &sigset, 0, NULL);
	check_result(result, "dns_db_addrdataset");
	dns_rdataset_disassociate(&newset);
	dns_rdataset_disassociate(&sigset);

 failure:
	if (newnode != NULL)
		dns_db_detachnode(newdb, &newnode);
	if (newdb != NULL)
		dns_db_detach(&newdb);
}

/*
 * Looks for our signatures of child keys.  If present, inform the caller,
 * who will set the zone status (KEY) bit in the NXT record.
 */
static isc_boolean_t
haschildkey(dns_db_t *db, dns_name_t *name) {
	unsigned char filename[256];
	isc_buffer_t b;
	isc_region_t r;
	dns_db_t *newdb = NULL;
	dns_dbnode_t *newnode = NULL;
	dns_rdataset_t set, sigset;
	dns_rdata_t sigrdata;
	isc_result_t result;
	isc_boolean_t found = ISC_FALSE;
	dns_rdata_sig_t sig;
	signer_key_t *key;

	isc_buffer_init(&b, filename, sizeof(filename) - 10);
	result = dns_name_totext(name, ISC_FALSE, &b);
	check_result(result, "dns_name_totext()");
	isc_buffer_usedregion(&b, &r);
	strcpy((char *)r.base + r.length, "signedkey");
	result = dns_db_create(mctx, "rbt", name, ISC_FALSE, dns_db_class(db),
			       0, NULL, &newdb);
	check_result(result, "dns_db_create()");
602
	result = dns_db_load(newdb, (char *)filename);
603 604 605 606 607 608 609
	if (result != ISC_R_SUCCESS)
		goto failure;
	result = dns_db_findnode(newdb, name, ISC_FALSE, &newnode);
	if (result != ISC_R_SUCCESS)
		goto failure;
	dns_rdataset_init(&set);
	dns_rdataset_init(&sigset);
610 611
	result = dns_db_findrdataset(newdb, newnode, NULL, dns_rdatatype_key,
				     0, 0, &set, &sigset);
612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651
	if (result != ISC_R_SUCCESS)
		goto failure;

	if (!dns_rdataset_isassociated(&set) ||
	    !dns_rdataset_isassociated(&sigset))
		goto disfail;

	result = dns_rdataset_first(&sigset);
	check_result(result, "dns_rdataset_first()");
	dns_rdata_init(&sigrdata);
	for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(&sigset)) {
		dns_rdataset_current(&sigset, &sigrdata);
		result = dns_rdata_tostruct(&sigrdata, &sig, mctx);
		if (result != ISC_R_SUCCESS)
			goto disfail;
		key = keythatsigned(&sig);
		dns_rdata_freestruct(&sig);
		if (key == NULL)
			goto disfail;
		result = dns_dnssec_verify(name, &set, key->key,
					   ISC_FALSE, mctx, &sigrdata);
		if (result == ISC_R_SUCCESS) {
			found = ISC_TRUE;
			break;
		}
	}

 disfail:
	if (dns_rdataset_isassociated(&set))
		dns_rdataset_disassociate(&set);
	if (dns_rdataset_isassociated(&sigset))
		dns_rdataset_disassociate(&sigset);

 failure:
	if (newnode != NULL)
		dns_db_detachnode(newdb, &newnode);
	if (newdb != NULL)
		dns_db_detach(&newdb);

	return (found);
652 653
}

654 655
/*
 * Signs all records at a name.  This mostly just signs each set individually,
656 657
 * but also adds the SIG bit to any NXTs generated earlier, deals with
 * parent/child KEY signatures, and handles other exceptional cases.
658
 */
Brian Wellington's avatar
Brian Wellington committed
659
static void
660
signname(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
Brian Wellington's avatar
Brian Wellington committed
661
	 dns_name_t *name, isc_boolean_t atorigin)
Brian Wellington's avatar
Brian Wellington committed
662 663
{
	isc_result_t result;
664
	dns_rdata_t rdata;
665
	dns_rdataset_t rdataset;
Brian Wellington's avatar
Brian Wellington committed
666
	dns_rdatasetiter_t *rdsiter;
Brian Wellington's avatar
Brian Wellington committed
667
	isc_boolean_t isdelegation = ISC_FALSE;
668
	isc_boolean_t childkey = ISC_FALSE;
669 670 671
	static int warnwild = 0;

	if (dns_name_iswildcard(name)) {
Brian Wellington's avatar
Brian Wellington committed
672 673
		if (warnwild++ == 0) {
			fprintf(stderr, "%s: warning: BIND 9 doesn't properly "
David Lawrence's avatar
David Lawrence committed
674
				"handle wildcards in secure zones:\n",
675
				program);
Brian Wellington's avatar
Brian Wellington committed
676 677 678 679 680 681
			fprintf(stderr, "\t- wildcard nonexistence proof is "
				"not generated by the server\n");
			fprintf(stderr, "\t- wildcard nonexistence proof is "
				"not required by the resolver\n");
		}
		fprintf(stderr, "%s: warning: wildcard name seen: %s\n",
682
			program, nametostr(name));
683
	}
684
	if (!atorigin) {
685 686
		dns_rdataset_t nsset;

687 688 689 690 691 692 693 694 695 696
		dns_rdataset_init(&nsset);
		result = dns_db_findrdataset(db, node, version,
					     dns_rdatatype_ns, 0, 0, &nsset,
					     NULL);
		/* Is this a delegation point? */
		if (result == ISC_R_SUCCESS) {
			isdelegation = ISC_TRUE;
			dns_rdataset_disassociate(&nsset);
		}
	}
Brian Wellington's avatar
Brian Wellington committed
697 698 699 700 701 702 703
	dns_rdataset_init(&rdataset);
	rdsiter = NULL;
	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
	check_result(result, "dns_db_allrdatasets()");
	result = dns_rdatasetiter_first(rdsiter);
	while (result == ISC_R_SUCCESS) {
		dns_rdatasetiter_current(rdsiter, &rdataset);
Brian Wellington's avatar
Brian Wellington committed
704

705 706 707
		/* If this is a SIG set, skip it. */
		if (rdataset.type == dns_rdatatype_sig)
			goto skip;
Brian Wellington's avatar
Brian Wellington committed
708

709 710 711 712 713
		/*
		 * If this is a KEY set at the apex, look for a signedkey file.
		 */
		if (rdataset.type == dns_rdatatype_key && atorigin) {
			importparentsig(db, version, node, name, &rdataset);
714
			goto skip;
715
		}
716 717 718

		/*
		 * If this name is a delegation point, skip all records
719 720 721
		 * except an NXT set, unless we're using null keys, in
		 * which case we need to check for a null key and add one
		 * if it's not present.
722 723 724
		 */
		if (isdelegation) {
			switch (rdataset.type) {
725 726 727 728 729 730
			case dns_rdatatype_nxt:
				childkey = haschildkey(db, name);
				break;
#ifndef USE_ZONESTATUS
			case dns_rdatatype_key:
				if (hasnullkey(&rdataset))
731
					break;
732 733 734 735
				goto skip;
#endif
			default:
				goto skip;
736
			}
737

738 739
		}

740
		/*
741 742 743
		 * There probably should be a dns_nxtsetbit, but it can get
		 * complicated if we need to extend the length of the
		 * bit set.  In this case, since the NXT bit is set and
744
		 * SIG < NXT and KEY < NXT, the easy way works.
745
		 */
746
		if (rdataset.type == dns_rdatatype_nxt) {
Brian Wellington's avatar
Brian Wellington committed
747 748 749
			unsigned char *nxt_bits;
			dns_name_t nxtname;
			isc_region_t r, r2;
750 751 752
			unsigned char keydata[4];
			dst_key_t *dstkey;
			isc_buffer_t b;
Brian Wellington's avatar
Brian Wellington committed
753 754 755 756 757 758 759 760 761 762

			result = dns_rdataset_first(&rdataset);
			check_result(result, "dns_rdataset_first()");
			dns_rdataset_current(&rdataset, &rdata);
			dns_rdata_toregion(&rdata, &r);
			dns_name_init(&nxtname, NULL);
			dns_name_fromregion(&nxtname, &r);
			dns_name_toregion(&nxtname, &r2);
			nxt_bits = r.base + r2.length;
			set_bit(nxt_bits, dns_rdatatype_sig, 1);
763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787
#ifdef USE_ZONESTATUS
			if (isdelegation && childkey) {
				set_bit(nxt_bits, dns_rdatatype_key, 1);
				vbprintf(2, "found a child key for %s, "
					 "setting KEY bit in NXT\n",
					 nametostr(name));
			}

#else
			if (isdelegation && !childkey) {
				dns_rdataset_t keyset;
				dns_rdatalist_t keyrdatalist;
				dns_rdata_t keyrdata;

				dns_rdataset_init(&keyset);
				result = dns_db_findrdataset(db, node, version,
							     dns_rdatatype_key,
							     0, 0, &keyset,
							     NULL);
				if (result == ISC_R_SUCCESS &&
				    hasnullkey(&keyset))
					goto alreadyhavenullkey;

				if (result == ISC_R_NOTFOUND)
					result = ISC_R_SUCCESS;
788 789 790 791
				if (result != ISC_R_SUCCESS)
					fatal("failure looking for null key "
					      "at '%s': %s", nametostr(name),
					      isc_result_totext(result));
792 793 794 795 796 797 798 799 800 801

				if (dns_rdataset_isassociated(&keyset))
					dns_rdataset_disassociate(&keyset);

				vbprintf(2, "no child key for %s, "
					 "adding null key\n",
					 nametostr(name));
				dns_rdatalist_init(&keyrdatalist);
				dstkey = NULL;
				
802
				result = dst_key_generate(name, DNS_KEYALG_DSA,
803
							  0, 0,
804 805
							  DNS_KEYTYPE_NOKEY |
							  DNS_KEYOWNER_ZONE,
806 807
							  DNS_KEYPROTO_DNSSEC,
							  mctx, &dstkey);
808 809
				if (result != ISC_R_SUCCESS)
					fatal("failed to generate null key");
810 811
				isc_buffer_init(&b, keydata, sizeof keydata);
				result = dst_key_todns(dstkey, &b);
812
				dst_key_free(&dstkey);
813 814 815 816 817 818 819 820 821 822 823
				isc_buffer_usedregion(&b, &r);
				dns_rdata_fromregion(&keyrdata,
						     rdataset.rdclass,
						     dns_rdatatype_key, &r);
				
				ISC_LIST_APPEND(keyrdatalist.rdata, &keyrdata,
						link);
				keyrdatalist.rdclass = rdataset.rdclass;
				keyrdatalist.type = dns_rdatatype_key;
				keyrdatalist.covers = 0;
				keyrdatalist.ttl = rdataset.ttl;
824 825 826
				result =
					dns_rdatalist_tordataset(&keyrdatalist,
								 &keyset);
827 828 829 830 831 832 833 834 835 836 837
				check_result(result,
					     "dns_rdatalist_tordataset");
				dns_db_addrdataset(db, node, version, 0,
						   &keyset, DNS_DBADD_MERGE,
						   NULL);
				set_bit(nxt_bits, dns_rdatatype_key, 1);
				signset(db, version, node, name, &keyset);

				dns_rdataset_disassociate(&keyset);

 alreadyhavenullkey:
838
				;
839 840
			}
#endif
Brian Wellington's avatar
Brian Wellington committed
841
		}
Brian Wellington's avatar
Brian Wellington committed
842

843
		signset(db, version, node, name, &rdataset);
Brian Wellington's avatar
Brian Wellington committed
844

845
 skip:
Brian Wellington's avatar
Brian Wellington committed
846 847 848
		dns_rdataset_disassociate(&rdataset);
		result = dns_rdatasetiter_next(rdsiter);
	}
849
	if (result != ISC_R_NOMORE)
850 851
		fatal("rdataset iteration for name '%s' failed: %s",
		      nametostr(name), isc_result_totext(result));
Brian Wellington's avatar
Brian Wellington committed
852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874
	dns_rdatasetiter_destroy(&rdsiter);
}

static inline isc_boolean_t
active_node(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {
	dns_rdatasetiter_t *rdsiter;
	isc_boolean_t active = ISC_FALSE;
	isc_result_t result;
	dns_rdataset_t rdataset;

	dns_rdataset_init(&rdataset);
	rdsiter = NULL;
	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
	check_result(result, "dns_db_allrdatasets()");
	result = dns_rdatasetiter_first(rdsiter);
	while (result == ISC_R_SUCCESS) {
		dns_rdatasetiter_current(rdsiter, &rdataset);
		if (rdataset.type != dns_rdatatype_nxt)
			active = ISC_TRUE;
		dns_rdataset_disassociate(&rdataset);
		if (!active)
			result = dns_rdatasetiter_next(rdsiter);
		else
875
			result = ISC_R_NOMORE;
Brian Wellington's avatar
Brian Wellington committed
876
	}
877
	if (result != ISC_R_NOMORE)
878 879
		fatal("rdataset iteration failed: %s",
		      isc_result_totext(result));
Brian Wellington's avatar
Brian Wellington committed
880 881 882 883 884 885 886
	dns_rdatasetiter_destroy(&rdsiter);

	if (!active) {
		/*
		 * Make sure there is no NXT record for this node.
		 */
		result = dns_db_deleterdataset(db, node, version,
887
					       dns_rdatatype_nxt, 0);
Brian Wellington's avatar
Brian Wellington committed
888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917
		if (result == DNS_R_UNCHANGED)
			result = ISC_R_SUCCESS;
		check_result(result, "dns_db_deleterdataset");
	}

	return (active);
}

static inline isc_result_t
next_active(dns_db_t *db, dns_dbversion_t *version, dns_dbiterator_t *dbiter,
	    dns_name_t *name, dns_dbnode_t **nodep)
{
	isc_result_t result;
	isc_boolean_t active;

	do {
		active = ISC_FALSE;
		result = dns_dbiterator_current(dbiter, nodep, name);
		if (result == ISC_R_SUCCESS) {
			active = active_node(db, version, *nodep);
			if (!active) {
				dns_db_detachnode(db, nodep);
				result = dns_dbiterator_next(dbiter);
			}
		}
	} while (result == ISC_R_SUCCESS && !active);

	return (result);
}

918 919
static inline isc_result_t
next_nonglue(dns_db_t *db, dns_dbversion_t *version, dns_dbiterator_t *dbiter,
Brian Wellington's avatar
Brian Wellington committed
920 921
	    dns_name_t *name, dns_dbnode_t **nodep, dns_name_t *origin,
	    dns_name_t *lastcut)
922 923 924 925 926 927
{
	isc_result_t result;

	do {
		result = next_active(db, version, dbiter, name, nodep);
		if (result == ISC_R_SUCCESS) {
Brian Wellington's avatar
Brian Wellington committed
928 929 930
			if (dns_name_issubdomain(name, origin) &&
			    (lastcut == NULL ||
			     !dns_name_issubdomain(name, lastcut)))
931 932 933 934 935 936 937 938
				return (ISC_R_SUCCESS);
			dns_db_detachnode(db, nodep);
			result = dns_dbiterator_next(dbiter);
		}
	} while (result == ISC_R_SUCCESS);
	return (result);
}

939 940 941
/*
 * Generates NXTs and SIGs for each non-glue name in the zone.
 */
Brian Wellington's avatar
Brian Wellington committed
942
static void
943
signzone(dns_db_t *db, dns_dbversion_t *version) {
944
	isc_result_t result, nxtresult;
Brian Wellington's avatar
Brian Wellington committed
945
	dns_dbnode_t *node, *nextnode, *curnode;
Brian Wellington's avatar
Brian Wellington committed
946
	dns_fixedname_t fname, fnextname, fcurname;
947
	dns_name_t *name, *nextname, *target, *curname, *lastcut;
Brian Wellington's avatar
Brian Wellington committed
948
	dns_dbiterator_t *dbiter;
Brian Wellington's avatar
Brian Wellington committed
949
	isc_boolean_t atorigin = ISC_TRUE;
Brian Wellington's avatar
Brian Wellington committed
950
	dns_name_t *origin;
951 952 953 954
	dns_rdataset_t soaset;
	dns_rdata_t soarr;
	dns_rdata_soa_t soa;
	dns_ttl_t zonettl;
Brian Wellington's avatar
Brian Wellington committed
955 956 957 958 959

	dns_fixedname_init(&fname);
	name = dns_fixedname_name(&fname);
	dns_fixedname_init(&fnextname);
	nextname = dns_fixedname_name(&fnextname);
Brian Wellington's avatar
Brian Wellington committed
960 961
	dns_fixedname_init(&fcurname);
	curname = dns_fixedname_name(&fcurname);
Brian Wellington's avatar
Brian Wellington committed
962

963 964 965 966 967
	origin = dns_db_origin(db);

	dns_rdataset_init(&soaset);
	result = dns_db_find(db, origin, version, dns_rdatatype_soa,
			     0, 0, NULL, name, &soaset, NULL);
968 969 970
	if (result != ISC_R_SUCCESS)
		fatal("failed to find '%s SOA' in the zone: %s",
		      nametostr(name), isc_result_totext(result));
971
	result = dns_rdataset_first(&soaset);
972
	check_result(result, "dns_rdataset_first()");
973 974
	dns_rdataset_current(&soaset, &soarr);
	result = dns_rdata_tostruct(&soarr, &soa, mctx);
975
	check_result(result, "dns_rdataset_tostruct()");
976 977 978 979
	zonettl = soa.minimum;
	dns_rdata_freestruct(&soa);
	dns_rdataset_disassociate(&soaset);

980
	lastcut = NULL;
Brian Wellington's avatar
Brian Wellington committed
981 982 983 984 985
	dbiter = NULL;
	result = dns_db_createiterator(db, ISC_FALSE, &dbiter);
	check_result(result, "dns_db_createiterator()");
	result = dns_dbiterator_first(dbiter);
	node = NULL;
Brian Wellington's avatar
Brian Wellington committed
986 987 988
	dns_name_clone(origin, name);
	result = next_nonglue(db, version, dbiter, name, &node, origin,
			      lastcut);
Brian Wellington's avatar
Brian Wellington committed
989 990 991
	while (result == ISC_R_SUCCESS) {
		nextnode = NULL;
		curnode = NULL;
Brian Wellington's avatar
Brian Wellington committed
992
		dns_dbiterator_current(dbiter, &curnode, curname);
993 994 995 996 997 998 999 1000 1001 1002 1003