external/bsd/bind/dist/bin/dnssec/dnssec-verify.c

   1 /*      $NetBSD: dnssec-verify.c,v 1.9 2015/07/08 17:28:55 christos Exp $       */
   2
   3 /*
   4  * Copyright (C) 2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  11  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  12  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  13  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  14  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  15  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  16  * PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 /*! \file */
  20
  21 #include <config.h>
  22
  23 #include <stdlib.h>
  24 #include <time.h>
  25
  26 #include <isc/app.h>
  27 #include <isc/base32.h>
  28 #include <isc/commandline.h>
  29 #include <isc/entropy.h>
  30 #include <isc/event.h>
  31 #include <isc/file.h>
  32 #include <isc/hash.h>
  33 #include <isc/hex.h>
  34 #include <isc/mem.h>
  35 #include <isc/mutex.h>
  36 #include <isc/os.h>
  37 #include <isc/print.h>
  38 #include <isc/random.h>
  39 #include <isc/rwlock.h>
  40 #include <isc/serial.h>
  41 #include <isc/stdio.h>
  42 #include <isc/stdlib.h>
  43 #include <isc/string.h>
  44 #include <isc/time.h>
  45 #include <isc/util.h>
  46
  47 #include <dns/db.h>
  48 #include <dns/dbiterator.h>
  49 #include <dns/diff.h>
  50 #include <dns/dnssec.h>
  51 #include <dns/ds.h>
  52 #include <dns/fixedname.h>
  53 #include <dns/keyvalues.h>
  54 #include <dns/log.h>
  55 #include <dns/master.h>
  56 #include <dns/masterdump.h>
  57 #include <dns/nsec.h>
  58 #include <dns/nsec3.h>
  59 #include <dns/rdata.h>
  60 #include <dns/rdatalist.h>
  61 #include <dns/rdataset.h>
  62 #include <dns/rdataclass.h>
  63 #include <dns/rdatasetiter.h>
  64 #include <dns/rdatastruct.h>
  65 #include <dns/rdatatype.h>
  66 #include <dns/result.h>
  67 #include <dns/soa.h>
  68 #include <dns/time.h>
  69
  70 #include <dst/dst.h>
  71
  72 #ifdef PKCS11CRYPTO
  73 #include <pk11/result.h>
  74 #endif
  75
  76 #include "dnssectool.h"
  77
  78 const char *program = "dnssec-verify";
  79 int verbose;
  80
  81 static isc_stdtime_t now;
  82 static isc_mem_t *mctx = NULL;
  83 static isc_entropy_t *ectx = NULL;
  84 static dns_masterformat_t inputformat = dns_masterformat_text;
  85 static dns_db_t *gdb;                   /* The database */
  86 static dns_dbversion_t *gversion;       /* The database version */
  87 static dns_rdataclass_t gclass;         /* The class */
  88 static dns_name_t *gorigin;             /* The database origin */
  89 static isc_boolean_t ignore_kskflag = ISC_FALSE;
  90 static isc_boolean_t keyset_kskonly = ISC_FALSE;
  91
  92 /*%
  93  * Load the zone file from disk
  94  */
  95 static void
  96 loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
  97         isc_buffer_t b;
  98         int len;
  99         dns_fixedname_t fname;
 100         dns_name_t *name;
 101         isc_result_t result;
 102
 103         len = strlen(origin);
 104         isc_buffer_init(&b, origin, len);
 105         isc_buffer_add(&b, len);
 106
 107         dns_fixedname_init(&fname);
 108         name = dns_fixedname_name(&fname);
 109         result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 110         if (result != ISC_R_SUCCESS)
 111                 fatal("failed converting name '%s' to dns format: %s",
 112                       origin, isc_result_totext(result));
 113
 114         result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
 115                                rdclass, 0, NULL, db);
 116         check_result(result, "dns_db_create()");
 117
 118         result = dns_db_load2(*db, file, inputformat);
 119         if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 120                 fatal("failed loading zone from '%s': %s",
 121                       file, isc_result_totext(result));
 122 }
 123
 124 ISC_PLATFORM_NORETURN_PRE static void
 125 usage(void) ISC_PLATFORM_NORETURN_POST;
 126
 127 static void
 128 usage(void) {
 129         fprintf(stderr, "Usage:\n");
 130         fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
 131
 132         fprintf(stderr, "\n");
 133
 134         fprintf(stderr, "Version: %s\n", VERSION);
 135
 136         fprintf(stderr, "Options: (default value in parenthesis) \n");
 137         fprintf(stderr, "\t-v debuglevel (0)\n");
 138         fprintf(stderr, "\t-V:\tprint version information\n");
 139         fprintf(stderr, "\t-o origin:\n");
 140         fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
 141         fprintf(stderr, "\t-I format:\n");
 142         fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 143         fprintf(stderr, "\t-c class (IN)\n");
 144         fprintf(stderr, "\t-E engine:\n");
 145 #if defined(PKCS11CRYPTO)
 146         fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 147                 "(default is %s)\n", PK11_LIB_LOCATION);
 148 #elif defined(USE_PKCS11)
 149         fprintf(stderr, "\t\tname of an OpenSSL engine to use "
 150                                 "(default is \"pkcs11\")\n");
 151 #else
 152         fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 153 #endif
 154         fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 155                         "not ZSKs\n");
 156         fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
 157         exit(0);
 158 }
 159
 160 int
 161 main(int argc, char *argv[]) {
 162         char *origin = NULL, *file = NULL;
 163         char *inputformatstr = NULL;
 164         isc_result_t result;
 165         isc_log_t *log = NULL;
 166 #ifdef USE_PKCS11
 167         const char *engine = PKCS11_ENGINE;
 168 #else
 169         const char *engine = NULL;
 170 #endif
 171         char *classname = NULL;
 172         dns_rdataclass_t rdclass;
 173         char *endp;
 174         int ch;
 175
 176 #define CMDLINE_FLAGS \
 177         "hm:o:I:c:E:v:Vxz"
 178
 179         /*
 180          * Process memory debugging argument first.
 181          */
 182         while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 183                 switch (ch) {
 184                 case 'm':
 185                         if (strcasecmp(isc_commandline_argument, "record") == 0)
 186                                 isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 187                         if (strcasecmp(isc_commandline_argument, "trace") == 0)
 188                                 isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 189                         if (strcasecmp(isc_commandline_argument, "usage") == 0)
 190                                 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 191                         if (strcasecmp(isc_commandline_argument, "size") == 0)
 192                                 isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
 193                         if (strcasecmp(isc_commandline_argument, "mctx") == 0)
 194                                 isc_mem_debugging |= ISC_MEM_DEBUGCTX;
 195                         break;
 196                 default:
 197                         break;
 198                 }
 199         }
 200         isc_commandline_reset = ISC_TRUE;
 201         check_result(isc_app_start(), "isc_app_start");
 202
 203         result = isc_mem_create(0, 0, &mctx);
 204         if (result != ISC_R_SUCCESS)
 205                 fatal("out of memory");
 206
 207 #ifdef PKCS11CRYPTO
 208         pk11_result_register();
 209 #endif
 210         dns_result_register();
 211
 212         isc_commandline_errprint = ISC_FALSE;
 213
 214         while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 215                 switch (ch) {
 216                 case 'c':
 217                         classname = isc_commandline_argument;
 218                         break;
 219
 220                 case 'E':
 221                         engine = isc_commandline_argument;
 222                         break;
 223
 224                 case 'I':
 225                         inputformatstr = isc_commandline_argument;
 226                         break;
 227
 228                 case 'm':
 229                         break;
 230
 231                 case 'o':
 232                         origin = isc_commandline_argument;
 233                         break;
 234
 235                 case 'v':
 236                         endp = NULL;
 237                         verbose = strtol(isc_commandline_argument, &endp, 0);
 238                         if (*endp != '\0')
 239                                 fatal("verbose level must be numeric");
 240                         break;
 241
 242                 case 'x':
 243                         keyset_kskonly = ISC_TRUE;
 244                         break;
 245
 246                 case 'z':
 247                         ignore_kskflag = ISC_TRUE;
 248                         break;
 249
 250                 case '?':
 251                         if (isc_commandline_option != '?')
 252                                 fprintf(stderr, "%s: invalid argument -%c\n",
 253                                         program, isc_commandline_option);
 254                         /* FALLTHROUGH */
 255
 256                 case 'h':
 257                         /* Does not return. */
 258                         usage();
 259
 260                 case 'V':
 261                         /* Does not return. */
 262                         version(program);
 263
 264                 default:
 265                         fprintf(stderr, "%s: unhandled option -%c\n",
 266                                 program, isc_commandline_option);
 267                         exit(1);
 268                 }
 269         }
 270
 271         if (ectx == NULL)
 272                 setup_entropy(mctx, NULL, &ectx);
 273
 274         result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
 275         if (result != ISC_R_SUCCESS)
 276                 fatal("could not create hash context");
 277
 278         result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
 279         if (result != ISC_R_SUCCESS)
 280                 fatal("could not initialize dst: %s",
 281                       isc_result_totext(result));
 282
 283         isc_stdtime_get(&now);
 284
 285         rdclass = strtoclass(classname);
 286
 287         setup_logging(mctx, &log);
 288
 289         argc -= isc_commandline_index;
 290         argv += isc_commandline_index;
 291
 292         if (argc < 1)
 293                 usage();
 294
 295         file = argv[0];
 296
 297         argc -= 1;
 298         argv += 1;
 299
 300         POST(argc);
 301         POST(argv);
 302
 303         if (origin == NULL)
 304                 origin = file;
 305
 306         if (inputformatstr != NULL) {
 307                 if (strcasecmp(inputformatstr, "text") == 0)
 308                         inputformat = dns_masterformat_text;
 309                 else if (strcasecmp(inputformatstr, "raw") == 0)
 310                         inputformat = dns_masterformat_raw;
 311                 else
 312                         fatal("unknown file format: %s\n", inputformatstr);
 313         }
 314
 315         gdb = NULL;
 316         fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file);
 317         loadzone(file, origin, rdclass, &gdb);
 318         gorigin = dns_db_origin(gdb);
 319         gclass = dns_db_class(gdb);
 320
 321         gversion = NULL;
 322         result = dns_db_newversion(gdb, &gversion);
 323         check_result(result, "dns_db_newversion()");
 324
 325         verifyzone(gdb, gversion, gorigin, mctx,
 326                    ignore_kskflag, keyset_kskonly);
 327
 328         dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 329         dns_db_detach(&gdb);
 330
 331         cleanup_logging(&log);
 332         dst_lib_destroy();
 333         isc_hash_destroy();
 334         cleanup_entropy(&ectx);
 335         dns_name_destroy();
 336         if (verbose > 10)
 337                 isc_mem_stats(mctx, stdout);
 338         isc_mem_destroy(&mctx);
 339
 340         (void) isc_app_finish();
 341
 342         return (0);
 343 }