1 /* $NetBSD: dnssec-revoke.c,v 1.8 2023/01/25 21:43:23 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <inttypes.h> 19 #include <stdbool.h> 20 #include <stdlib.h> 21 #include <unistd.h> 22 23 #include <isc/buffer.h> 24 #include <isc/commandline.h> 25 #include <isc/file.h> 26 #include <isc/hash.h> 27 #include <isc/mem.h> 28 #include <isc/print.h> 29 #include <isc/string.h> 30 #include <isc/util.h> 31 32 #include <dns/keyvalues.h> 33 #include <dns/result.h> 34 35 #include <dst/dst.h> 36 37 #if USE_PKCS11 38 #include <pk11/result.h> 39 #endif /* if USE_PKCS11 */ 40 41 #include "dnssectool.h" 42 43 const char *program = "dnssec-revoke"; 44 45 static isc_mem_t *mctx = NULL; 46 47 ISC_PLATFORM_NORETURN_PRE static void 48 usage(void) ISC_PLATFORM_NORETURN_POST; 49 50 static void 51 usage(void) { 52 fprintf(stderr, "Usage:\n"); 53 fprintf(stderr, " %s [options] keyfile\n\n", program); 54 fprintf(stderr, "Version: %s\n", VERSION); 55 #if USE_PKCS11 56 fprintf(stderr, 57 " -E engine: specify PKCS#11 provider " 58 "(default: %s)\n", 59 PK11_LIB_LOCATION); 60 #else /* if USE_PKCS11 */ 61 fprintf(stderr, " -E engine: specify OpenSSL engine\n"); 62 #endif /* if USE_PKCS11 */ 63 fprintf(stderr, " -f: force overwrite\n"); 64 fprintf(stderr, " -h: help\n"); 65 fprintf(stderr, " -K directory: use directory for key files\n"); 66 fprintf(stderr, " -r: remove old keyfiles after " 67 "creating revoked version\n"); 68 fprintf(stderr, " -v level: set level of verbosity\n"); 69 fprintf(stderr, " -V: print version information\n"); 70 fprintf(stderr, "Output:\n"); 71 fprintf(stderr, " K<name>+<alg>+<new id>.key, " 72 "K<name>+<alg>+<new id>.private\n"); 73 74 exit(-1); 75 } 76 77 int 78 main(int argc, char **argv) { 79 isc_result_t result; 80 const char *engine = NULL; 81 char const *filename = NULL; 82 char *dir = NULL; 83 char newname[1024], oldname[1024]; 84 char keystr[DST_KEY_FORMATSIZE]; 85 char *endp; 86 int ch; 87 dst_key_t *key = NULL; 88 uint32_t flags; 89 isc_buffer_t buf; 90 bool force = false; 91 bool removefile = false; 92 bool id = false; 93 94 if (argc == 1) { 95 usage(); 96 } 97 98 isc_mem_create(&mctx); 99 100 #if USE_PKCS11 101 pk11_result_register(); 102 #endif /* if USE_PKCS11 */ 103 dns_result_register(); 104 105 isc_commandline_errprint = false; 106 107 while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) { 108 switch (ch) { 109 case 'E': 110 engine = isc_commandline_argument; 111 break; 112 case 'f': 113 force = true; 114 break; 115 case 'K': 116 /* 117 * We don't have to copy it here, but do it to 118 * simplify cleanup later 119 */ 120 dir = isc_mem_strdup(mctx, isc_commandline_argument); 121 break; 122 case 'r': 123 removefile = true; 124 break; 125 case 'R': 126 id = true; 127 break; 128 case 'v': 129 verbose = strtol(isc_commandline_argument, &endp, 0); 130 if (*endp != '\0') { 131 fatal("-v must be followed by a number"); 132 } 133 break; 134 case '?': 135 if (isc_commandline_option != '?') { 136 fprintf(stderr, "%s: invalid argument -%c\n", 137 program, isc_commandline_option); 138 } 139 FALLTHROUGH; 140 case 'h': 141 /* Does not return. */ 142 usage(); 143 144 case 'V': 145 /* Does not return. */ 146 version(program); 147 148 default: 149 fprintf(stderr, "%s: unhandled option -%c\n", program, 150 isc_commandline_option); 151 exit(1); 152 } 153 } 154 155 if (argc < isc_commandline_index + 1 || 156 argv[isc_commandline_index] == NULL) 157 { 158 fatal("The key file name was not specified"); 159 } 160 if (argc > isc_commandline_index + 1) { 161 fatal("Extraneous arguments"); 162 } 163 164 if (dir != NULL) { 165 filename = argv[isc_commandline_index]; 166 } else { 167 result = isc_file_splitpath(mctx, argv[isc_commandline_index], 168 &dir, &filename); 169 if (result != ISC_R_SUCCESS) { 170 fatal("cannot process filename %s: %s", 171 argv[isc_commandline_index], 172 isc_result_totext(result)); 173 } 174 if (strcmp(dir, ".") == 0) { 175 isc_mem_free(mctx, dir); 176 dir = NULL; 177 } 178 } 179 180 result = dst_lib_init(mctx, engine); 181 if (result != ISC_R_SUCCESS) { 182 fatal("Could not initialize dst: %s", 183 isc_result_totext(result)); 184 } 185 186 result = dst_key_fromnamedfile( 187 filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key); 188 if (result != ISC_R_SUCCESS) { 189 fatal("Invalid keyfile name %s: %s", filename, 190 isc_result_totext(result)); 191 } 192 193 if (id) { 194 fprintf(stdout, "%u\n", dst_key_rid(key)); 195 goto cleanup; 196 } 197 dst_key_format(key, keystr, sizeof(keystr)); 198 199 if (verbose > 2) { 200 fprintf(stderr, "%s: %s\n", program, keystr); 201 } 202 203 if (force) { 204 set_keyversion(key); 205 } else { 206 check_keyversion(key, keystr); 207 } 208 209 flags = dst_key_flags(key); 210 if ((flags & DNS_KEYFLAG_REVOKE) == 0) { 211 isc_stdtime_t now; 212 213 if ((flags & DNS_KEYFLAG_KSK) == 0) { 214 fprintf(stderr, 215 "%s: warning: Key is not flagged " 216 "as a KSK. Revoking a ZSK is " 217 "legal, but undefined.\n", 218 program); 219 } 220 221 isc_stdtime_get(&now); 222 dst_key_settime(key, DST_TIME_REVOKE, now); 223 224 dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE); 225 226 isc_buffer_init(&buf, newname, sizeof(newname)); 227 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf); 228 229 if (access(newname, F_OK) == 0 && !force) { 230 fatal("Key file %s already exists; " 231 "use -f to force overwrite", 232 newname); 233 } 234 235 result = dst_key_tofile(key, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, 236 dir); 237 if (result != ISC_R_SUCCESS) { 238 dst_key_format(key, keystr, sizeof(keystr)); 239 fatal("Failed to write key %s: %s", keystr, 240 isc_result_totext(result)); 241 } 242 243 isc_buffer_clear(&buf); 244 dst_key_buildfilename(key, 0, dir, &buf); 245 printf("%s\n", newname); 246 247 /* 248 * Remove old key file, if told to (and if 249 * it isn't the same as the new file) 250 */ 251 if (removefile) { 252 isc_buffer_init(&buf, oldname, sizeof(oldname)); 253 dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE); 254 dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf); 255 if (strcmp(oldname, newname) == 0) { 256 goto cleanup; 257 } 258 (void)unlink(oldname); 259 isc_buffer_clear(&buf); 260 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf); 261 (void)unlink(oldname); 262 } 263 } else { 264 dst_key_format(key, keystr, sizeof(keystr)); 265 fatal("Key %s is already revoked", keystr); 266 } 267 268 cleanup: 269 dst_key_free(&key); 270 dst_lib_destroy(); 271 if (verbose > 10) { 272 isc_mem_stats(mctx, stdout); 273 } 274 if (dir != NULL) { 275 isc_mem_free(mctx, dir); 276 } 277 isc_mem_destroy(&mctx); 278 279 return (0); 280 } 281