dnssec-keygen.c revision 0c27b3fe77ac1d5094ba3521e8142d9e7973133f
/*
* Portions Copyright (C) 1999-2016 Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* Portions Copyright (C) 1995-2000 by Network Associates, Inc.
*
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
* FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/*! \file */
#include <config.h>
#include <ctype.h>
#include <stdlib.h>
#include <unistd.h>
#include <isc/commandline.h>
#include <dns/fixedname.h>
#include <dns/keyvalues.h>
#include <dns/rdataclass.h>
#ifdef PKCS11CRYPTO
#endif
#include "dnssectool.h"
const char *program = "dnssec-keygen";
int verbose;
#define DEFAULT_ALGORITHM "RSASHA1"
#define DEFAULT_NSEC3_ALGORITHM "NSEC3RSASHA1"
ISC_PLATFORM_NORETURN_PRE static void
usage(void) ISC_PLATFORM_NORETURN_POST;
static void progress(int p);
static void
usage(void) {
" | NSEC3DSA |\n");
"HMAC-SHA256 | \n");
"NSEC3RSASHA1 if using -3)\n");
"by 64\n");
" defaults to 2048 for KSK, or 1024 for all "
"others)\n");
"USER | OTHER\n");
#if defined(PKCS11CRYPTO)
"(default is %s)\n", PK11_LIB_LOCATION);
#elif defined(USE_PKCS11)
"(default is \"pkcs11\")\n");
#else
#endif
"(DH only)\n");
"records with (default: 0)\n");
"use KEY for SIG(0))\n");
"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
"(default: AUTHCONF)\n");
"(default: now)\n");
"publication date\n");
"(default: now)\n");
"revocation date\n");
"inactivation date\n");
"deletion date\n");
"all dates\n");
"key\n");
"successor key "
"(default: 30 days)\n");
"K<name>+<alg>+<id>.private\n");
exit (-1);
}
static isc_boolean_t
dsa_size_ok(int size) {
}
static void
progress(int p)
{
char c = '*';
switch (p) {
case 0:
c = '.';
break;
case 1:
c = '+';
break;
case 2:
c = '*';
break;
case 3:
c = ' ';
break;
default:
break;
}
}
int
char *endp;
char filename[255];
const char *predecessor = NULL;
#ifdef USE_PKCS11
const char *engine = PKCS11_ENGINE;
#else
#endif
int dbits = 0;
int prepub = -1;
unsigned char c;
if (argc == 1)
usage();
#ifdef PKCS11CRYPTO
#endif
/*
* Process memory debugging argument first.
*/
#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
"v:V"
switch (ch) {
case 'm':
break;
default:
break;
}
}
switch (ch) {
case '3':
break;
case 'a':
break;
case 'b':
fatal("-b requires a non-negative number");
break;
case 'C':
break;
case 'c':
break;
case 'd':
fatal("-d requires a non-negative number");
break;
case 'E':
break;
case 'e':
"phased-out option -e "
"(was 'use (RSA) large exponent)\n");
break;
case 'f':
c = (unsigned char)(isc_commandline_argument[0]);
if (toupper(c) == 'K')
else if (toupper(c) == 'R')
else
fatal("unknown flag '%s'",
break;
case 'g':
&endp, 10);
fatal("-g requires a positive number");
break;
case 'K':
if (ret != ISC_R_SUCCESS)
fatal("cannot open directory %s: %s",
break;
case 'k':
fatal("The -k option has been deprecated.\n"
"To generate a key-signing key, use -f KSK.\n"
"To generate a key with TYPE=KEY, use -T KEY.\n");
break;
case 'L':
break;
case 'n':
break;
case 'm':
break;
case 'p':
fatal("-p must be followed by a number "
"[0..255]");
break;
case 'q':
break;
case 'r':
break;
case 's':
&endp, 10);
fatal("-s must be followed by a number "
"[0..15]");
break;
case 'T':
options |= DST_TYPE_KEY;
else if (strcasecmp(isc_commandline_argument,
"DNSKEY") == 0)
/* default behavior */
;
else
fatal("unknown type '%s'",
break;
case 't':
break;
case 'v':
if (*endp != '\0')
fatal("-v must be followed by a number");
break;
case 'z':
/* already the default */
break;
case 'G':
break;
case 'P':
/* -Psync ? */
if (setsyncadd)
fatal("-P sync specified more than "
"once");
break;
}
fatal("-P specified more than once");
break;
case 'A':
fatal("-A specified more than once");
break;
case 'R':
fatal("-R specified more than once");
break;
case 'I':
if (setinact || unsetinact)
fatal("-I specified more than once");
unsetinact = !setinact;
break;
case 'D':
/* -Dsync ? */
if (setsyncdel)
fatal("-D sync specified more than "
"once");
break;
}
fatal("-D specified more than once");
break;
case 'S':
break;
case 'i':
break;
case 'F':
/* Reserved for FIPS mode */
/* FALLTHROUGH */
case '?':
if (isc_commandline_option != '?')
/* FALLTHROUGH */
case 'h':
/* Does not return. */
usage();
case 'V':
/* Does not return. */
default:
exit(1);
}
}
if (!isatty(0))
if (ret != ISC_R_SUCCESS)
fatal("could not initialize dst: %s",
if (predecessor == NULL) {
if (prepub == -1)
prepub = 0;
fatal("the key name was not specified");
fatal("extraneous arguments");
if (ret != ISC_R_SUCCESS)
fatal("invalid key name %s: %s",
if (use_nsec3)
else
fatal("strdup failed");
if (verbose > 0)
"defaulting to %s\n", algname);
}
"recommended.\nIf you still wish to "
"use RSA (RSAMD5) please specify "
"\"-a RSAMD5\"\n");
return (1);
else {
if (ret != ISC_R_SUCCESS)
if (alg == DST_ALG_DH)
options |= DST_TYPE_KEY;
}
if (!dst_algorithm_supported(alg))
if (use_nsec3 &&
alg != DST_ALG_ECCGOST &&
fatal("%s is incompatible with NSEC3; "
"do not use the -3 option", algname);
}
flags |= (DNS_KEYTYPE_NOAUTH |
if (size < 0)
size = 0;
}
/* nothing */;
else
}
if (size < 0) {
if (use_default) {
if ((kskflag & DNS_KEYFLAG_KSK) != 0)
size = 2048;
else
size = 1024;
if (verbose > 0)
"specified; defaulting"
" to %d\n", size);
} else if (alg != DST_ALG_ECCGOST &&
alg != DST_ALG_ECDSA256 &&
alg != DST_ALG_ECDSA384)
fatal("key size not specified (-b option)");
}
fatal("Activation and publication dates "
"are closer together than the\n\t"
"prepublication interval.");
}
fatal("Time until activation is shorter "
"than the\n\tprepublication interval.");
}
} else {
char keystr[DST_KEY_FORMATSIZE];
if (prepub == -1)
fatal("-S and -a cannot be used together");
if (size >= 0)
fatal("-S and -b cannot be used together");
fatal("-S and -n cannot be used together");
fatal("-S and -t cannot be used together");
fatal("-S and -P cannot be used together");
fatal("-S and -A cannot be used together");
if (use_nsec3)
fatal("-S and -3 cannot be used together");
if (oldstyle)
fatal("-S and -C cannot be used together");
if (genonly)
fatal("-S and -G cannot be used together");
if (ret != ISC_R_SUCCESS)
fatal("Invalid keyfile %s: %s",
if (!dst_key_isprivate(prevkey))
fatal("Key %s has incompatible format version %d.%d\n\t"
"It is not possible to generate a successor key.",
if (ret != ISC_R_SUCCESS)
fatal("Key %s has no activation date.\n\t"
"You must use dnssec-settime -A to set one "
"before generating a successor.", keystr);
if (ret != ISC_R_SUCCESS)
fatal("Key %s has no inactivation date.\n\t"
"You must use dnssec-settime -I to set one "
"before generating a successor.", keystr);
fatal("Key %s becomes inactive\n\t"
"sooner than the prepublication period "
"for the new key ends.\n\t"
"Either change the inactivation date with "
"dnssec-settime -I,\n\t"
"or use the -i option to set a shorter "
"prepublication interval.", keystr);
if (ret != ISC_R_SUCCESS)
"date;\n\t it will remain in the zone "
"indefinitely after rollover.\n\t "
"You can use dnssec-settime -D to "
}
switch (alg) {
case DNS_KEYALG_RSAMD5:
case DNS_KEYALG_RSASHA1:
case DNS_KEYALG_NSEC3RSASHA1:
case DNS_KEYALG_RSASHA256:
break;
case DNS_KEYALG_RSASHA512:
break;
case DNS_KEYALG_DH:
break;
case DNS_KEYALG_DSA:
case DNS_KEYALG_NSEC3DSA:
break;
case DST_ALG_ECCGOST:
size = 256;
break;
case DST_ALG_ECDSA256:
size = 256;
break;
case DST_ALG_ECDSA384:
size = 384;
break;
case DST_ALG_HMACMD5:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-MD5 digest bits %d not divisible by 8",
dbits);
break;
case DST_ALG_HMACSHA1:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-SHA1 digest bits %d not divisible by 8",
dbits);
break;
case DST_ALG_HMACSHA224:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-SHA224 digest bits %d not divisible by 8",
dbits);
break;
case DST_ALG_HMACSHA256:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-SHA256 digest bits %d not divisible by 8",
dbits);
break;
case DST_ALG_HMACSHA384:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-SHA384 digest bits %d not divisible by 8",
dbits);
break;
case DST_ALG_HMACSHA512:
options |= DST_TYPE_KEY;
if ((dbits % 8) != 0)
fatal("HMAC-SHA512 digest bits %d not divisible by 8",
dbits);
break;
}
fatal("specified DH generator for a non-DH key");
fatal("no nametype specified");
else
directory = ".";
}
if (protocol == -1)
else if ((options & DST_TYPE_KEY) == 0 &&
if (size > 0)
fatal("specified null key with non-zero size");
if ((flags & DNS_KEYFLAG_SIGNATORYMASK) != 0)
fatal("specified null key with signing authority");
}
alg == DST_ALG_HMACSHA512))
fatal("a key with algorithm '%s' cannot be a zone key",
algname);
switch(alg) {
case DNS_KEYALG_RSAMD5:
case DNS_KEYALG_RSASHA1:
case DNS_KEYALG_NSEC3RSASHA1:
case DNS_KEYALG_RSASHA256:
case DNS_KEYALG_RSASHA512:
break;
case DNS_KEYALG_DH:
break;
case DNS_KEYALG_DSA:
case DNS_KEYALG_NSEC3DSA:
case DST_ALG_ECCGOST:
case DST_ALG_ECDSA256:
case DST_ALG_ECDSA384:
/* fall through */
case DST_ALG_HMACMD5:
case DST_ALG_HMACSHA1:
case DST_ALG_HMACSHA224:
case DST_ALG_HMACSHA256:
case DST_ALG_HMACSHA384:
case DST_ALG_HMACSHA512:
param = 0;
break;
}
do {
if (!quiet && show_progress) {
&progress);
} else {
NULL);
}
if (ret != ISC_R_SUCCESS) {
char namestr[DNS_NAME_FORMATSIZE];
char algstr[DNS_SECALG_FORMATSIZE];
fatal("failed to generate key %s/%s: %s\n",
/* NOTREACHED */
exit(-1);
}
/*
* Set key timing metadata (unless using -C)
*
* Creation date is always set to "now".
*
* For a new key without an explicit predecessor, publish
* and activation dates are set to "now" by default, but
* can both be overridden.
*
* For a successor key, activation is set to match the
* predecessor's inactivation date. Publish is set to 30
* days earlier than that (XXX: this should be configurable).
* If either of the resulting dates are in the past, that's
* an error; the inactivation date of the predecessor key
* must be updated before a successor key can be created.
*/
if (!oldstyle) {
fatal("cannot use -G together with "
"-P or -A options");
if (setpub)
if (setact)
activate);
if (setrev) {
if (kskflag == 0)
"not flagged as a KSK, but -R "
"was used. Revoking a ZSK is "
"legal, but undefined.\n",
program);
}
if (setinact)
inactive);
if (setdel) {
"scheduled to be deleted "
"before it is scheduled to be "
"made inactive.\n",
program);
}
if (setsyncadd)
syncadd);
if (setsyncdel)
syncdel);
} else {
setsyncadd || setsyncdel)
fatal("cannot use -C together with "
"-P, -A, -R, -I, -D, or -G options");
/*
* Compatibility mode: Private-key-format
* should be set to 1.2.
*/
}
/* Set the default key TTL */
if (setttl)
/*
* Do not overwrite an existing key, or create a key
* if there is a risk of ID collision due to this key
* or another key being revoked.
*/
if (null_key) {
dst_key_free(&key);
break;
}
if (verbose > 0) {
if (ret == ISC_R_SUCCESS)
"%s: %s already exists, or "
"might collide with another "
"key upon revokation. "
"Generating a new key\n",
}
dst_key_free(&key);
}
if (conflict)
fatal("cannot generate a null key due to possible key ID "
"collision");
if (ret != ISC_R_SUCCESS) {
char keystr[DST_KEY_FORMATSIZE];
}
if (ret != ISC_R_SUCCESS)
fatal("dst_key_buildfilename returned: %s\n",
dst_key_free(&key);
if (verbose > 10)
return (0);
}