"Fossies" - the Fresh Open Source Software Archive

Member "bind-9.16.7/bin/dnssec/dnssec-revoke.c" (4 Sep 2020, 6518 Bytes) of package /linux/misc/dns/bind9/9.16.7/bind-9.16.7.tar.xz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. For more information about "dnssec-revoke.c" see the Fossies "Dox" file reference documentation.

    1 /*
    2  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
    3  *
    4  * This Source Code Form is subject to the terms of the Mozilla Public
    5  * License, v. 2.0. If a copy of the MPL was not distributed with this
    6  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
    7  *
    8  * See the COPYRIGHT file distributed with this work for additional
    9  * information regarding copyright ownership.
   10  */
   11 
   12 /*! \file */
   13 
   14 #include <inttypes.h>
   15 #include <stdbool.h>
   16 #include <stdlib.h>
   17 #include <unistd.h>
   18 
   19 #include <isc/buffer.h>
   20 #include <isc/commandline.h>
   21 #include <isc/file.h>
   22 #include <isc/hash.h>
   23 #include <isc/mem.h>
   24 #include <isc/print.h>
   25 #include <isc/string.h>
   26 #include <isc/util.h>
   27 
   28 #include <dns/keyvalues.h>
   29 #include <dns/result.h>
   30 
   31 #include <dst/dst.h>
   32 
   33 #if USE_PKCS11
   34 #include <pk11/result.h>
   35 #endif /* if USE_PKCS11 */
   36 
   37 #include "dnssectool.h"
   38 
   39 const char *program = "dnssec-revoke";
   40 
   41 static isc_mem_t *mctx = NULL;
   42 
   43 ISC_PLATFORM_NORETURN_PRE static void
   44 usage(void) ISC_PLATFORM_NORETURN_POST;
   45 
   46 static void
   47 usage(void) {
   48     fprintf(stderr, "Usage:\n");
   49     fprintf(stderr, "    %s [options] keyfile\n\n", program);
   50     fprintf(stderr, "Version: %s\n", VERSION);
   51 #if USE_PKCS11
   52     fprintf(stderr,
   53         "    -E engine:    specify PKCS#11 provider "
   54         "(default: %s)\n",
   55         PK11_LIB_LOCATION);
   56 #else  /* if USE_PKCS11 */
   57     fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
   58 #endif /* if USE_PKCS11 */
   59     fprintf(stderr, "    -f:           force overwrite\n");
   60     fprintf(stderr, "    -h:           help\n");
   61     fprintf(stderr, "    -K directory: use directory for key files\n");
   62     fprintf(stderr, "    -r:           remove old keyfiles after "
   63             "creating revoked version\n");
   64     fprintf(stderr, "    -v level:     set level of verbosity\n");
   65     fprintf(stderr, "    -V:           print version information\n");
   66     fprintf(stderr, "Output:\n");
   67     fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
   68             "K<name>+<alg>+<new id>.private\n");
   69 
   70     exit(-1);
   71 }
   72 
   73 int
   74 main(int argc, char **argv) {
   75     isc_result_t result;
   76     const char *engine = NULL;
   77     char const *filename = NULL;
   78     char *dir = NULL;
   79     char newname[1024], oldname[1024];
   80     char keystr[DST_KEY_FORMATSIZE];
   81     char *endp;
   82     int ch;
   83     dst_key_t *key = NULL;
   84     uint32_t flags;
   85     isc_buffer_t buf;
   86     bool force = false;
   87     bool removefile = false;
   88     bool id = false;
   89 
   90     if (argc == 1) {
   91         usage();
   92     }
   93 
   94     isc_mem_create(&mctx);
   95 
   96 #if USE_PKCS11
   97     pk11_result_register();
   98 #endif /* if USE_PKCS11 */
   99     dns_result_register();
  100 
  101     isc_commandline_errprint = false;
  102 
  103     while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
  104         switch (ch) {
  105         case 'E':
  106             engine = isc_commandline_argument;
  107             break;
  108         case 'f':
  109             force = true;
  110             break;
  111         case 'K':
  112             /*
  113              * We don't have to copy it here, but do it to
  114              * simplify cleanup later
  115              */
  116             dir = isc_mem_strdup(mctx, isc_commandline_argument);
  117             break;
  118         case 'r':
  119             removefile = true;
  120             break;
  121         case 'R':
  122             id = true;
  123             break;
  124         case 'v':
  125             verbose = strtol(isc_commandline_argument, &endp, 0);
  126             if (*endp != '\0') {
  127                 fatal("-v must be followed by a number");
  128             }
  129             break;
  130         case '?':
  131             if (isc_commandline_option != '?') {
  132                 fprintf(stderr, "%s: invalid argument -%c\n",
  133                     program, isc_commandline_option);
  134             }
  135         /* FALLTHROUGH */
  136         case 'h':
  137             /* Does not return. */
  138             usage();
  139 
  140         case 'V':
  141             /* Does not return. */
  142             version(program);
  143 
  144         default:
  145             fprintf(stderr, "%s: unhandled option -%c\n", program,
  146                 isc_commandline_option);
  147             exit(1);
  148         }
  149     }
  150 
  151     if (argc < isc_commandline_index + 1 ||
  152         argv[isc_commandline_index] == NULL) {
  153         fatal("The key file name was not specified");
  154     }
  155     if (argc > isc_commandline_index + 1) {
  156         fatal("Extraneous arguments");
  157     }
  158 
  159     if (dir != NULL) {
  160         filename = argv[isc_commandline_index];
  161     } else {
  162         result = isc_file_splitpath(mctx, argv[isc_commandline_index],
  163                         &dir, &filename);
  164         if (result != ISC_R_SUCCESS) {
  165             fatal("cannot process filename %s: %s",
  166                   argv[isc_commandline_index],
  167                   isc_result_totext(result));
  168         }
  169         if (strcmp(dir, ".") == 0) {
  170             isc_mem_free(mctx, dir);
  171             dir = NULL;
  172         }
  173     }
  174 
  175     result = dst_lib_init(mctx, engine);
  176     if (result != ISC_R_SUCCESS) {
  177         fatal("Could not initialize dst: %s",
  178               isc_result_totext(result));
  179     }
  180 
  181     result = dst_key_fromnamedfile(
  182         filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
  183     if (result != ISC_R_SUCCESS) {
  184         fatal("Invalid keyfile name %s: %s", filename,
  185               isc_result_totext(result));
  186     }
  187 
  188     if (id) {
  189         fprintf(stdout, "%u\n", dst_key_rid(key));
  190         goto cleanup;
  191     }
  192     dst_key_format(key, keystr, sizeof(keystr));
  193 
  194     if (verbose > 2) {
  195         fprintf(stderr, "%s: %s\n", program, keystr);
  196     }
  197 
  198     if (force) {
  199         set_keyversion(key);
  200     } else {
  201         check_keyversion(key, keystr);
  202     }
  203 
  204     flags = dst_key_flags(key);
  205     if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
  206         isc_stdtime_t now;
  207 
  208         if ((flags & DNS_KEYFLAG_KSK) == 0) {
  209             fprintf(stderr,
  210                 "%s: warning: Key is not flagged "
  211                 "as a KSK. Revoking a ZSK is "
  212                 "legal, but undefined.\n",
  213                 program);
  214         }
  215 
  216         isc_stdtime_get(&now);
  217         dst_key_settime(key, DST_TIME_REVOKE, now);
  218 
  219         dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);
  220 
  221         isc_buffer_init(&buf, newname, sizeof(newname));
  222         dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
  223 
  224         if (access(newname, F_OK) == 0 && !force) {
  225             fatal("Key file %s already exists; "
  226                   "use -f to force overwrite",
  227                   newname);
  228         }
  229 
  230         result = dst_key_tofile(key, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
  231                     dir);
  232         if (result != ISC_R_SUCCESS) {
  233             dst_key_format(key, keystr, sizeof(keystr));
  234             fatal("Failed to write key %s: %s", keystr,
  235                   isc_result_totext(result));
  236         }
  237 
  238         isc_buffer_clear(&buf);
  239         dst_key_buildfilename(key, 0, dir, &buf);
  240         printf("%s\n", newname);
  241 
  242         /*
  243          * Remove old key file, if told to (and if
  244          * it isn't the same as the new file)
  245          */
  246         if (removefile) {
  247             isc_buffer_init(&buf, oldname, sizeof(oldname));
  248             dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
  249             dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
  250             if (strcmp(oldname, newname) == 0) {
  251                 goto cleanup;
  252             }
  253             (void)unlink(oldname);
  254             isc_buffer_clear(&buf);
  255             dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
  256             (void)unlink(oldname);
  257         }
  258     } else {
  259         dst_key_format(key, keystr, sizeof(keystr));
  260         fatal("Key %s is already revoked", keystr);
  261     }
  262 
  263 cleanup:
  264     dst_key_free(&key);
  265     dst_lib_destroy();
  266     if (verbose > 10) {
  267         isc_mem_stats(mctx, stdout);
  268     }
  269     if (dir != NULL) {
  270         isc_mem_free(mctx, dir);
  271     }
  272     isc_mem_destroy(&mctx);
  273 
  274     return (0);
  275 }