BIND9 Internals: bin/dnssec/dnssec-verify.c Source File

00001 /*
00002  * Copyright (C) 2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
00003  *
00004  * Permission to use, copy, modify, and/or distribute this software for any
00005  * purpose with or without fee is hereby granted, provided that the above
00006  * copyright notice and this permission notice appear in all copies.
00007  *
00008  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
00009  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
00010  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
00011  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
00012  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
00013  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
00014  * PERFORMANCE OF THIS SOFTWARE.
00015  */
00016 
00017 /*! \file */
00018 
00019 #include <config.h>
00020 
00021 #include <stdlib.h>
00022 #include <time.h>
00023 
00024 #include <isc/app.h>
00025 #include <isc/base32.h>
00026 #include <isc/commandline.h>
00027 #include <isc/entropy.h>
00028 #include <isc/event.h>
00029 #include <isc/file.h>
00030 #include <isc/hash.h>
00031 #include <isc/hex.h>
00032 #include <isc/mem.h>
00033 #include <isc/mutex.h>
00034 #include <isc/os.h>
00035 #include <isc/print.h>
00036 #include <isc/random.h>
00037 #include <isc/rwlock.h>
00038 #include <isc/serial.h>
00039 #include <isc/stdio.h>
00040 #include <isc/stdlib.h>
00041 #include <isc/string.h>
00042 #include <isc/time.h>
00043 #include <isc/util.h>
00044 
00045 #include <dns/db.h>
00046 #include <dns/dbiterator.h>
00047 #include <dns/diff.h>
00048 #include <dns/dnssec.h>
00049 #include <dns/ds.h>
00050 #include <dns/fixedname.h>
00051 #include <dns/keyvalues.h>
00052 #include <dns/log.h>
00053 #include <dns/master.h>
00054 #include <dns/masterdump.h>
00055 #include <dns/nsec.h>
00056 #include <dns/nsec3.h>
00057 #include <dns/rdata.h>
00058 #include <dns/rdatalist.h>
00059 #include <dns/rdataset.h>
00060 #include <dns/rdataclass.h>
00061 #include <dns/rdatasetiter.h>
00062 #include <dns/rdatastruct.h>
00063 #include <dns/rdatatype.h>
00064 #include <dns/result.h>
00065 #include <dns/soa.h>
00066 #include <dns/time.h>
00067 
00068 #include <dst/dst.h>
00069 
00070 #ifdef PKCS11CRYPTO
00071 #include <pk11/result.h>
00072 #endif
00073 
00074 #include "dnssectool.h"
00075 
00076 const char *program = "dnssec-verify";
00077 int verbose;
00078 
00079 static isc_stdtime_t now;
00080 static isc_mem_t *mctx = NULL;
00081 static isc_entropy_t *ectx = NULL;
00082 static dns_masterformat_t inputformat = dns_masterformat_text;
00083 static dns_db_t *gdb;                   /* The database */
00084 static dns_dbversion_t *gversion;       /* The database version */
00085 static dns_rdataclass_t gclass;         /* The class */
00086 static dns_name_t *gorigin;             /* The database origin */
00087 static isc_boolean_t ignore_kskflag = ISC_FALSE;
00088 static isc_boolean_t keyset_kskonly = ISC_FALSE;
00089 
00090 /*%
00091  * Load the zone file from disk
00092  */
00093 static void
00094 loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
00095         isc_buffer_t b;
00096         int len;
00097         dns_fixedname_t fname;
00098         dns_name_t *name;
00099         isc_result_t result;
00100 
00101         len = strlen(origin);
00102         isc_buffer_init(&b, origin, len);
00103         isc_buffer_add(&b, len);
00104 
00105         dns_fixedname_init(&fname);
00106         name = dns_fixedname_name(&fname);
00107         result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
00108         if (result != ISC_R_SUCCESS)
00109                 fatal("failed converting name '%s' to dns format: %s",
00110                       origin, isc_result_totext(result));
00111 
00112         result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
00113                                rdclass, 0, NULL, db);
00114         check_result(result, "dns_db_create()");
00115 
00116         result = dns_db_load2(*db, file, inputformat);
00117         if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
00118                 fatal("failed loading zone from '%s': %s",
00119                       file, isc_result_totext(result));
00120 }
00121 
00122 ISC_PLATFORM_NORETURN_PRE static void
00123 usage(void) ISC_PLATFORM_NORETURN_POST;
00124 
00125 static void
00126 usage(void) {
00127         fprintf(stderr, "Usage:\n");
00128         fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
00129 
00130         fprintf(stderr, "\n");
00131 
00132         fprintf(stderr, "Version: %s\n", VERSION);
00133 
00134         fprintf(stderr, "Options: (default value in parenthesis) \n");
00135         fprintf(stderr, "\t-v debuglevel (0)\n");
00136         fprintf(stderr, "\t-V:\tprint version information\n");
00137         fprintf(stderr, "\t-o origin:\n");
00138         fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
00139         fprintf(stderr, "\t-I format:\n");
00140         fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
00141         fprintf(stderr, "\t-c class (IN)\n");
00142         fprintf(stderr, "\t-E engine:\n");
00143 #if defined(PKCS11CRYPTO)
00144         fprintf(stderr, "\t\tpath to PKCS#11 provider library "
00145                 "(default is %s)\n", PK11_LIB_LOCATION);
00146 #elif defined(USE_PKCS11)
00147         fprintf(stderr, "\t\tname of an OpenSSL engine to use "
00148                                 "(default is \"pkcs11\")\n");
00149 #else
00150         fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
00151 #endif
00152         fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
00153                         "not ZSKs\n");
00154         fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
00155         exit(0);
00156 }
00157 
00158 int
00159 main(int argc, char *argv[]) {
00160         char *origin = NULL, *file = NULL;
00161         char *inputformatstr = NULL;
00162         isc_result_t result;
00163         isc_log_t *log = NULL;
00164 #ifdef USE_PKCS11
00165         const char *engine = PKCS11_ENGINE;
00166 #else
00167         const char *engine = NULL;
00168 #endif
00169         char *classname = NULL;
00170         dns_rdataclass_t rdclass;
00171         char *endp;
00172         int ch;
00173 
00174 #define CMDLINE_FLAGS \
00175         "hm:o:I:c:E:v:Vxz"
00176 
00177         /*
00178          * Process memory debugging argument first.
00179          */
00180         while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
00181                 switch (ch) {
00182                 case 'm':
00183                         if (strcasecmp(isc_commandline_argument, "record") == 0)
00184                                 isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
00185                         if (strcasecmp(isc_commandline_argument, "trace") == 0)
00186                                 isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
00187                         if (strcasecmp(isc_commandline_argument, "usage") == 0)
00188                                 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
00189                         if (strcasecmp(isc_commandline_argument, "size") == 0)
00190                                 isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
00191                         if (strcasecmp(isc_commandline_argument, "mctx") == 0)
00192                                 isc_mem_debugging |= ISC_MEM_DEBUGCTX;
00193                         break;
00194                 default:
00195                         break;
00196                 }
00197         }
00198         isc_commandline_reset = ISC_TRUE;
00199         check_result(isc_app_start(), "isc_app_start");
00200 
00201         result = isc_mem_create(0, 0, &mctx);
00202         if (result != ISC_R_SUCCESS)
00203                 fatal("out of memory");
00204 
00205 #ifdef PKCS11CRYPTO
00206         pk11_result_register();
00207 #endif
00208         dns_result_register();
00209 
00210         isc_commandline_errprint = ISC_FALSE;
00211 
00212         while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
00213                 switch (ch) {
00214                 case 'c':
00215                         classname = isc_commandline_argument;
00216                         break;
00217 
00218                 case 'E':
00219                         engine = isc_commandline_argument;
00220                         break;
00221 
00222                 case 'I':
00223                         inputformatstr = isc_commandline_argument;
00224                         break;
00225 
00226                 case 'm':
00227                         break;
00228 
00229                 case 'o':
00230                         origin = isc_commandline_argument;
00231                         break;
00232 
00233                 case 'v':
00234                         endp = NULL;
00235                         verbose = strtol(isc_commandline_argument, &endp, 0);
00236                         if (*endp != '\0')
00237                                 fatal("verbose level must be numeric");
00238                         break;
00239 
00240                 case 'x':
00241                         keyset_kskonly = ISC_TRUE;
00242                         break;
00243 
00244                 case 'z':
00245                         ignore_kskflag = ISC_TRUE;
00246                         break;
00247 
00248                 case '?':
00249                         if (isc_commandline_option != '?')
00250                                 fprintf(stderr, "%s: invalid argument -%c\n",
00251                                         program, isc_commandline_option);
00252                         /* FALLTHROUGH */
00253 
00254                 case 'h':
00255                         /* Does not return. */
00256                         usage();
00257 
00258                 case 'V':
00259                         /* Does not return. */
00260                         version(program);
00261 
00262                 default:
00263                         fprintf(stderr, "%s: unhandled option -%c\n",
00264                                 program, isc_commandline_option);
00265                         exit(1);
00266                 }
00267         }
00268 
00269         if (ectx == NULL)
00270                 setup_entropy(mctx, NULL, &ectx);
00271 
00272         result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
00273         if (result != ISC_R_SUCCESS)
00274                 fatal("could not create hash context");
00275 
00276         result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
00277         if (result != ISC_R_SUCCESS)
00278                 fatal("could not initialize dst: %s",
00279                       isc_result_totext(result));
00280 
00281         isc_stdtime_get(&now);
00282 
00283         rdclass = strtoclass(classname);
00284 
00285         setup_logging(mctx, &log);
00286 
00287         argc -= isc_commandline_index;
00288         argv += isc_commandline_index;
00289 
00290         if (argc < 1)
00291                 usage();
00292 
00293         file = argv[0];
00294 
00295         argc -= 1;
00296         argv += 1;
00297 
00298         POST(argc);
00299         POST(argv);
00300 
00301         if (origin == NULL)
00302                 origin = file;
00303 
00304         if (inputformatstr != NULL) {
00305                 if (strcasecmp(inputformatstr, "text") == 0)
00306                         inputformat = dns_masterformat_text;
00307                 else if (strcasecmp(inputformatstr, "raw") == 0)
00308                         inputformat = dns_masterformat_raw;
00309                 else
00310                         fatal("unknown file format: %s\n", inputformatstr);
00311         }
00312 
00313         gdb = NULL;
00314         fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file);
00315         loadzone(file, origin, rdclass, &gdb);
00316         gorigin = dns_db_origin(gdb);
00317         gclass = dns_db_class(gdb);
00318 
00319         gversion = NULL;
00320         result = dns_db_newversion(gdb, &gversion);
00321         check_result(result, "dns_db_newversion()");
00322 
00323         verifyzone(gdb, gversion, gorigin, mctx,
00324                    ignore_kskflag, keyset_kskonly);
00325 
00326         dns_db_closeversion(gdb, &gversion, ISC_FALSE);
00327         dns_db_detach(&gdb);
00328 
00329         cleanup_logging(&log);
00330         dst_lib_destroy();
00331         isc_hash_destroy();
00332         cleanup_entropy(&ectx);
00333         dns_name_destroy();
00334         if (verbose > 10)
00335                 isc_mem_stats(mctx, stdout);
00336         isc_mem_destroy(&mctx);
00337 
00338         (void) isc_app_finish();
00339 
00340         return (0);
00341 }