dnssec-keyfromlabel.c revision 0c27b3fe77ac1d5094ba3521e8142d9e7973133f
/*
* Copyright (C) 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*/
/*! \file */
#include <config.h>
#include <ctype.h>
#include <stdlib.h>
#include <isc/commandline.h>
#include <dns/fixedname.h>
#include <dns/keyvalues.h>
#include <dns/rdataclass.h>
#ifdef PKCS11CRYPTO
#endif
#include "dnssectool.h"
const char *program = "dnssec-keyfromlabel";
int verbose;
#define DEFAULT_ALGORITHM "RSASHA1"
#define DEFAULT_NSEC3_ALGORITHM "NSEC3RSASHA1"
static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 |"
" NSEC3DSA | NSEC3RSASHA1 |"
" RSASHA256 | RSASHA512 | ECCGOST |"
" ECDSAP256SHA256 | ECDSAP384SHA384";
ISC_PLATFORM_NORETURN_PRE static void
usage(void) ISC_PLATFORM_NORETURN_POST;
static void
usage(void) {
program);
"NSEC3RSASHA1 if using -3)\n");
#if defined(PKCS11CRYPTO)
"(default is %s)\n", PK11_LIB_LOCATION);
#elif defined(USE_PKCS11)
"(default is \"pkcs11\")\n");
#else
#endif
"key files\n");
"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
"(default: AUTHCONF)\n");
"publication date\n");
"deletion date\n");
" all dates\n");
"key\n");
"successor key "
"(default: 30 days)\n");
"K<name>+<alg>+<id>.private\n");
exit (-1);
}
int
const char *predecessor = NULL;
#ifdef USE_PKCS11
const char *engine = PKCS11_ENGINE;
#else
#endif
char *endp;
int ch;
char filename[255];
int prepub = -1;
unsigned char c;
if (argc == 1)
usage();
#ifdef PKCS11CRYPTO
#endif
#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
switch (ch) {
case '3':
break;
case 'a':
break;
case 'C':
break;
case 'c':
break;
case 'E':
break;
case 'f':
c = (unsigned char)(isc_commandline_argument[0]);
if (toupper(c) == 'K')
else if (toupper(c) == 'R')
else
fatal("unknown flag '%s'",
break;
case 'K':
if (ret != ISC_R_SUCCESS)
fatal("cannot open directory %s: %s",
break;
case 'k':
options |= DST_TYPE_KEY;
break;
case 'L':
break;
case 'l':
break;
case 'n':
break;
case 'p':
fatal("-p must be followed by a number "
"[0..255]");
break;
case 't':
break;
case 'v':
if (*endp != '\0')
fatal("-v must be followed by a number");
break;
case 'y':
break;
case 'G':
break;
case 'P':
/* -Psync ? */
if (unsetsyncadd || setsyncadd)
fatal("-P sync specified more than "
"once");
break;
}
/* -Pdnskey ? */
fatal("-P specified more than once");
break;
case 'A':
fatal("-A specified more than once");
break;
case 'R':
fatal("-R specified more than once");
break;
case 'I':
if (setinact || unsetinact)
fatal("-I specified more than once");
unsetinact = !setinact;
break;
case 'D':
/* -Dsync ? */
if (unsetsyncdel || setsyncdel)
fatal("-D sync specified more than "
"once");
break;
}
/* -Ddnskey ? */
fatal("-D specified more than once");
break;
case 'S':
break;
case 'i':
break;
case 'F':
/* Reserved for FIPS mode */
/* FALLTHROUGH */
case '?':
if (isc_commandline_option != '?')
/* FALLTHROUGH */
case 'h':
/* Does not return. */
usage();
case 'V':
/* Does not return. */
default:
exit(1);
}
}
if (ret != ISC_R_SUCCESS)
fatal("could not initialize dst: %s",
if (predecessor == NULL) {
fatal("the key label was not specified");
fatal("the key name was not specified");
fatal("extraneous arguments");
if (ret != ISC_R_SUCCESS)
fatal("invalid key name %s: %s",
char *l;
int len;
if (l == NULL)
fatal("cannot allocate memory");
label = l;
}
if (use_nsec3)
else
fatal("strdup failed");
if (verbose > 0)
"defaulting to %s\n", algname);
}
"recommended.\nIf you still wish to "
"use RSA (RSAMD5) please specify "
"\"-a RSAMD5\"\n");
return (1);
} else {
if (ret != ISC_R_SUCCESS)
if (alg == DST_ALG_DH)
options |= DST_TYPE_KEY;
}
if (use_nsec3 &&
alg != DST_ALG_ECCGOST &&
fatal("%s is incompatible with NSEC3; "
"do not use the -3 option", algname);
}
flags |= (DNS_KEYTYPE_NOAUTH |
/* nothing */;
else
}
fatal("Activation and publication dates "
"are closer together than the\n\t"
"prepublication interval.");
}
fatal("Time until activation is shorter "
"than the\n\tprepublication interval.");
}
} else {
char keystr[DST_KEY_FORMATSIZE];
if (prepub == -1)
fatal("-S and -a cannot be used together");
fatal("-S and -n cannot be used together");
fatal("-S and -t cannot be used together");
fatal("-S and -P cannot be used together");
fatal("-S and -A cannot be used together");
if (use_nsec3)
fatal("-S and -3 cannot be used together");
if (oldstyle)
fatal("-S and -C cannot be used together");
if (genonly)
fatal("-S and -G cannot be used together");
if (ret != ISC_R_SUCCESS)
fatal("Invalid keyfile %s: %s",
if (!dst_key_isprivate(prevkey))
fatal("Key %s has incompatible format version %d.%d\n\t"
"It is not possible to generate a successor key.",
if (ret != ISC_R_SUCCESS)
fatal("Key %s has no activation date.\n\t"
"You must use dnssec-settime -A to set one "
"before generating a successor.", keystr);
if (ret != ISC_R_SUCCESS)
fatal("Key %s has no inactivation date.\n\t"
"You must use dnssec-settime -I to set one "
"before generating a successor.", keystr);
fatal("Key %s becomes inactive\n\t"
"sooner than the prepublication period "
"for the new key ends.\n\t"
"Either change the inactivation date with "
"dnssec-settime -I,\n\t"
"or use the -i option to set a shorter "
"prepublication interval.", keystr);
if (ret != ISC_R_SUCCESS)
"date;\n\t it will remain in the zone "
"indefinitely after rollover.\n\t "
"You can use dnssec-settime -D to "
}
fatal("no nametype specified");
else
directory = ".";
}
if (protocol == -1)
else if ((options & DST_TYPE_KEY) == 0 &&
if ((flags & DNS_KEYFLAG_SIGNATORYMASK) != 0)
fatal("specified null key with signing authority");
}
alg == DNS_KEYALG_DH)
fatal("a key with algorithm '%s' cannot be a zone key",
algname);
/* associate the key */
if (ret != ISC_R_SUCCESS) {
char namestr[DNS_NAME_FORMATSIZE];
char algstr[DNS_SECALG_FORMATSIZE];
fatal("failed to get key %s/%s: %s",
/* NOTREACHED */
exit(-1);
}
/*
* Set key timing metadata (unless using -C)
*
* Publish and activation dates are set to "now" by default, but
* can be overridden. Creation date is always set to "now".
*/
if (!oldstyle) {
fatal("cannot use -G together with -P or -A options");
if (setpub)
else if (setact)
if (setact)
if (setrev) {
if (kskflag == 0)
"not flagged as a KSK, but -R "
"was used. Revoking a ZSK is "
"legal, but undefined.\n",
program);
}
if (setinact)
if (setdel)
if (setsyncadd)
if (setsyncdel)
} else {
setsyncadd || setsyncdel)
fatal("cannot use -C together with "
"-P, -A, -R, -I, -D, or -G options");
/*
* Compatibility mode: Private-key-format
* should be set to 1.2.
*/
}
/* Set default key TTL */
if (setttl)
/*
* Do not overwrite an existing key. Warn LOUDLY if there
* is a risk of ID collision due to this key or another key
* being revoked.
*/
if (ret != ISC_R_SUCCESS)
fatal("dst_key_buildfilename returned: %s\n",
if (exact)
if (avoid_collisions)
fatal("%s: %s could collide with another key upon "
"another key upon revokation. If you plan "
"to revoke keys, destroy this key and "
"generate a different one.\n",
}
if (ret != ISC_R_SUCCESS) {
char keystr[DST_KEY_FORMATSIZE];
}
if (ret != ISC_R_SUCCESS)
fatal("dst_key_buildfilename returned: %s\n",
dst_key_free(&key);
if (verbose > 10)
return (0);
}