3761c433912beabe43abeed2c3513b6201c59f64Mark Andrews

854d0238dbc2908490197984b3b9d558008a53dfMark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <config.h>

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley

d981ca645597116d227a48bf37cc5edc061c854dBob Halley#include <stdlib.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews#include <isc/commandline.h>

0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews#include <isc/entropy.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <isc/mem.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <isc/string.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <isc/util.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <dns/db.h>

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews#include <dns/dbiterator.h>

f7b99290c31abeb20c55fc55391510450ce60423Mark Andrews#include <dns/dnssec.h>

d981ca645597116d227a48bf37cc5edc061c854dBob Halley#include <dns/keyvalues.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <dns/log.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/nxt.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/rdata.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/rdatalist.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <dns/rdataset.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/rdatasetiter.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/rdatastruct.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/rdatatype.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/result.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/secalg.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include <dns/time.h>

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <dst/dst.h>

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#include <dst/result.h>

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews#include "dnssectool.h"

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsconst char *program = "dnssec-signzone";

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonint verbose;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson#define BUFSIZE 2048

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssontypedef struct signer_key_struct signer_key_t;

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssontypedef struct signer_array_struct signer_array_t;

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonstruct signer_key_struct {

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson dst_key_t *key;

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson isc_boolean_t isdefault;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews ISC_LINK(signer_key_t) link;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews};

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstruct signer_array_struct {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews unsigned char array[BUFSIZE];

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews ISC_LINK(signer_array_t) link;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews};

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic ISC_LIST(signer_key_t) keylist;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic isc_stdtime_t starttime = 0, endtime = 0, now;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic int cycle = -1;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic isc_boolean_t tryverify = ISC_FALSE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic isc_mem_t *mctx = NULL;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic isc_entropy_t *ectx = NULL;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic dns_ttl_t zonettl;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic inline void

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsset_bit(unsigned char *array, unsigned int index, unsigned int bit) {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews unsigned int shift, mask;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews shift = 7 - (index % 8);

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson mask = 1 << shift;

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (bit != 0)

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews array[index / 8] |= mask;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews else

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson array[index / 8] &= (~mask & 0xFF);

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews}

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonstatic void

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonsignwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdata_t *rdata,

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson dst_key_t *key, isc_buffer_t *b)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews{

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_result_t result;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson dns_rdata_init(rdata);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews result = dns_dnssec_sign(name, rdataset, key, &starttime, &endtime,

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews mctx, b, rdata);

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson isc_entropy_stopcallbacksources(ectx);

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson if (result != ISC_R_SUCCESS)

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews fatal("key '%s/%s/%d' failed to sign data: %s",

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson nametostr(dst_key_name(key)), algtostr(dst_key_alg(key)),

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson dst_key_id(key), isc_result_totext(result));

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson if (tryverify) {

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson result = dns_dnssec_verify(name, rdataset, key,

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson ISC_TRUE, mctx, rdata);

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson if (result == ISC_R_SUCCESS)

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson vbprintf(3, "\tsignature verified\n");

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson else

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson vbprintf(3, "\tsignature failed to verify\n");

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson }

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson}

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonstatic inline isc_boolean_t

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonissigningkey(signer_key_t *key) {

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson return (key->isdefault);

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson}

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssonstatic inline isc_boolean_t

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafssoniszonekey(signer_key_t *key, dns_db_t *db) {

5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson return (ISC_TF(dns_name_equal(dst_key_name(key->key),

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_db_origin(db)) &&

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dst_key_iszonekey(key->key)));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews}

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic signer_key_t *

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewskeythatsigned(dns_rdata_sig_t *sig) {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_result_t result;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dst_key_t *pubkey = NULL, *privkey = NULL;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews signer_key_t *key;

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews

f7b99290c31abeb20c55fc55391510450ce60423Mark Andrews key = ISC_LIST_HEAD(keylist);

d981ca645597116d227a48bf37cc5edc061c854dBob Halley while (key != NULL) {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (sig->keyid == dst_key_id(key->key) &&

1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews sig->algorithm == dst_key_alg(key->key) &&

1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews dns_name_equal(&sig->signer, dst_key_name(key->key)))

1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews return key;

1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews key = ISC_LIST_NEXT(key, link);

1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews }

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews result = dst_key_fromfile(&sig->signer, sig->keyid, sig->algorithm,

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews DST_TYPE_PUBLIC, NULL, mctx, &pubkey);

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews if (result != ISC_R_SUCCESS)

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews return (NULL);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

26b0f58b6c4d65bc8b131debf40b8c376c2978bfBob Halley key = isc_mem_get(mctx, sizeof(signer_key_t));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (key == NULL)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews fatal("out of memory");

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews result = dst_key_fromfile(&sig->signer, sig->keyid, sig->algorithm,

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews DST_TYPE_PRIVATE, NULL, mctx, &privkey);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (result == ISC_R_SUCCESS) {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews key->key = privkey;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dst_key_free(&pubkey);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews }

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews else

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews key->key = pubkey;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews key->isdefault = ISC_FALSE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews ISC_LIST_APPEND(keylist, key, link);

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley return key;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews}

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic isc_boolean_t

52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrewsexpecttofindkey(dns_name_t *name, dns_db_t *db, dns_dbversion_t *version) {

52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews unsigned int options = DNS_DBFIND_NOWILD;

52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews dns_fixedname_t fname;

52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews isc_result_t result;

52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_fixedname_init(&fname);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews result = dns_db_find(db, name, version, dns_rdatatype_key, options,

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews 0, NULL, dns_fixedname_name(&fname), NULL, NULL);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews switch (result) {

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews case ISC_R_SUCCESS:

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews case DNS_R_NXDOMAIN:

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews case DNS_R_NXRRSET:

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews return ISC_TRUE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews case DNS_R_DELEGATION:

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews case DNS_R_CNAME:

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews case DNS_R_DNAME:

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews return ISC_FALSE;

bfb2a81b65579882a80855c279cedc45aebd62e8Mark Andrews default:

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews fatal("failure looking for '%s KEY' in database: %s",

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews nametostr(name), isc_result_totext(result));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews return ISC_FALSE; /* removes a warning */

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews }

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews}

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewsstatic inline isc_boolean_t

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewssetverifies(dns_name_t *name, dns_rdataset_t *set, signer_key_t *key,

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley dns_rdata_t *sig)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews{

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_result_t result;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews result = dns_dnssec_verify(name, set, key->key, ISC_FALSE, mctx, sig);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews return (ISC_TF(result == ISC_R_SUCCESS));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews}

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews#define allocbufferandrdata \

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews isc_buffer_t b; \

d981ca645597116d227a48bf37cc5edc061c854dBob Halley trdata = isc_mem_get(mctx, sizeof(dns_rdata_t)); \

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews tdata = isc_mem_get(mctx, sizeof(signer_array_t)); \

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews ISC_LIST_APPEND(arraylist, tdata, link); \

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (trdata == NULL || tdata == NULL) \

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews fatal("out of memory"); \

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_buffer_init(&b, tdata->array, sizeof(tdata->array));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

7c0539bea56022274da04263eb41fbb5b8835c38Mark Andrewsstatic void

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrewssignset(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_name_t *name, dns_rdataset_t *set)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews{

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews dns_rdatalist_t siglist;

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews dns_rdataset_t sigset, oldsigset;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_rdata_t oldsigrdata;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_rdata_t *trdata;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_rdata_sig_t sig;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews signer_key_t *key;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_result_t result;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_boolean_t notsigned = ISC_TRUE, nosigs = ISC_FALSE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_boolean_t wassignedby[256], nowsignedby[256];

7c0539bea56022274da04263eb41fbb5b8835c38Mark Andrews signer_array_t *tdata;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews ISC_LIST(signer_array_t) arraylist;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews int i;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews ISC_LIST_INIT(siglist.rdata);

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews ISC_LIST_INIT(arraylist);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews for (i = 0; i < 256; i++)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews wassignedby[i] = nowsignedby[i] = ISC_FALSE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley dns_rdataset_init(&oldsigset);

d981ca645597116d227a48bf37cc5edc061c854dBob Halley result = dns_db_findrdataset(db, node, version, dns_rdatatype_sig,

0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews set->type, 0, &oldsigset, NULL);

0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews if (result == ISC_R_NOTFOUND) {

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews result = ISC_R_SUCCESS;

f7b99290c31abeb20c55fc55391510450ce60423Mark Andrews nosigs = ISC_TRUE;

d981ca645597116d227a48bf37cc5edc061c854dBob Halley }

f7b99290c31abeb20c55fc55391510450ce60423Mark Andrews if (result != ISC_R_SUCCESS)

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews fatal("failed while looking for '%s SIG %s': %s",

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews nametostr(name), typetostr(set->type),

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews isc_result_totext(result));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews vbprintf(1, "%s/%s:\n", nametostr(name), typetostr(set->type));

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley if (!nosigs) {

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews result = dns_rdataset_first(&oldsigset);

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews while (result == ISC_R_SUCCESS) {

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews isc_boolean_t expired, future;

05f90cac85760b4edef2962209df49ea019c180fMark Andrews isc_boolean_t keep = ISC_FALSE, resign = ISC_FALSE;

05f90cac85760b4edef2962209df49ea019c180fMark Andrews

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews dns_rdataset_current(&oldsigset, &oldsigrdata);

3d5cad69ec20157912e95cf3b79316dfb0a314f3Mark Andrews

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews result = dns_rdata_tostruct(&oldsigrdata, &sig, mctx);

f7b99290c31abeb20c55fc55391510450ce60423Mark Andrews check_result(result, "dns_rdata_tostruct");

d981ca645597116d227a48bf37cc5edc061c854dBob Halley

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews expired = ISC_TF(now + cycle > sig.timeexpire);

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews future = ISC_TF(now < sig.timesigned);

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews

05f90cac85760b4edef2962209df49ea019c180fMark Andrews key = keythatsigned(&sig);

05f90cac85760b4edef2962209df49ea019c180fMark Andrews

05f90cac85760b4edef2962209df49ea019c180fMark Andrews if (sig.timesigned > sig.timeexpire) {

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews /* sig is dropped and not replaced */

05f90cac85760b4edef2962209df49ea019c180fMark Andrews vbprintf(2, "\tsig by %s/%s/%d dropped - "

05f90cac85760b4edef2962209df49ea019c180fMark Andrews "invalid validity period\n",

05f90cac85760b4edef2962209df49ea019c180fMark Andrews nametostr(&sig.signer),

05f90cac85760b4edef2962209df49ea019c180fMark Andrews algtostr(sig.algorithm),

05f90cac85760b4edef2962209df49ea019c180fMark Andrews sig.keyid);

05f90cac85760b4edef2962209df49ea019c180fMark Andrews }

05f90cac85760b4edef2962209df49ea019c180fMark Andrews else if (key == NULL && !future &&

05f90cac85760b4edef2962209df49ea019c180fMark Andrews expecttofindkey(&sig.signer, db, version))

05f90cac85760b4edef2962209df49ea019c180fMark Andrews {

05f90cac85760b4edef2962209df49ea019c180fMark Andrews /* sig is dropped and not replaced */

05f90cac85760b4edef2962209df49ea019c180fMark Andrews vbprintf(2, "\tsig by %s/%s/%d dropped - "

05f90cac85760b4edef2962209df49ea019c180fMark Andrews "private key not found\n",

05f90cac85760b4edef2962209df49ea019c180fMark Andrews nametostr(&sig.signer),

05f90cac85760b4edef2962209df49ea019c180fMark Andrews algtostr(sig.algorithm),

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews sig.keyid);

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews }

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews else if (key == NULL || future) {

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews vbprintf(2, "\tsig by %s/%s/%d %s - "

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews "key not found\n",

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews expired ? "retained" : "dropped",

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews nametostr(&sig.signer),

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews algtostr(sig.algorithm),

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews sig.keyid);

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews if (!expired)

a560a0bfb2fd48ddd1900f61a655397a5c4f7343Mark Andrews keep = ISC_TRUE;

5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews }

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews else if (issigningkey(key)) {

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley if (!expired &&

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews setverifies(name, set, key, &oldsigrdata))

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews {

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews vbprintf(2,

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews "\tsig by %s/%s/%d retained\n",

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews nametostr(&sig.signer),

05f90cac85760b4edef2962209df49ea019c180fMark Andrews algtostr(sig.algorithm),

05f90cac85760b4edef2962209df49ea019c180fMark Andrews sig.keyid);

05f90cac85760b4edef2962209df49ea019c180fMark Andrews keep = ISC_TRUE;

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews wassignedby[sig.algorithm] = ISC_TRUE;

94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews }

d981ca645597116d227a48bf37cc5edc061c854dBob Halley else {

4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley vbprintf(2,

d981ca645597116d227a48bf37cc5edc061c854dBob Halley "\tsig by %s/%s/%d dropped - "

d981ca645597116d227a48bf37cc5edc061c854dBob Halley "%s\n",

d981ca645597116d227a48bf37cc5edc061c854dBob Halley nametostr(&sig.signer),

d981ca645597116d227a48bf37cc5edc061c854dBob Halley algtostr(sig.algorithm),

d981ca645597116d227a48bf37cc5edc061c854dBob Halley sig.keyid,

d981ca645597116d227a48bf37cc5edc061c854dBob Halley expired ? "expired" :

d981ca645597116d227a48bf37cc5edc061c854dBob Halley "failed to verify");

d981ca645597116d227a48bf37cc5edc061c854dBob Halley wassignedby[sig.algorithm] = ISC_TRUE;

d981ca645597116d227a48bf37cc5edc061c854dBob Halley resign = ISC_TRUE;

d981ca645597116d227a48bf37cc5edc061c854dBob Halley }

d981ca645597116d227a48bf37cc5edc061c854dBob Halley }

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley else if (iszonekey(key, db)) {

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley if (!expired &&

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley setverifies(name, set, key, &oldsigrdata))

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley {

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley vbprintf(2,

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley "\tsig by %s/%s/%d retained\n",

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley nametostr(&sig.signer),

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley algtostr(sig.algorithm),

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley sig.keyid);

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley keep = ISC_TRUE;

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley wassignedby[sig.algorithm] = ISC_TRUE;

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley nowsignedby[sig.algorithm] = ISC_TRUE;

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley }

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley else {

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley vbprintf(2,

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley "\tsig by %s/%s/%d "

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley "dropped - %s\n",

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley nametostr(&sig.signer),

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley algtostr(sig.algorithm),

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley sig.keyid,

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley expired ? "expired" :

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley "failed to verify");

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley wassignedby[sig.algorithm] = ISC_TRUE;

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley if (dst_key_isprivate(key->key))

e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley resign = ISC_TRUE;

854d0238dbc2908490197984b3b9d558008a53dfMark Andrews }

}

else if (!expired) {

vbprintf(2, "\tsig by %s/%s/%d retained\n",

nametostr(&sig.signer),

algtostr(sig.algorithm),

sig.keyid);

keep = ISC_TRUE;

}

else {

vbprintf(2, "\tsig by %s/%s/%d expired\n",

nametostr(&sig.signer),

algtostr(sig.algorithm),

sig.keyid);

}

if (keep) {

allocbufferandrdata;

result = dns_rdata_fromstruct(trdata,

set->rdclass,

dns_rdatatype_sig,

&sig, &b);

nowsignedby[sig.algorithm] = ISC_TRUE;

ISC_LIST_APPEND(siglist.rdata, trdata, link);

}

else if (resign) {

allocbufferandrdata;

vbprintf(1, "\tresigning with key %s/%s/%d\n",

nametostr(dst_key_name(key->key)),

algtostr(dst_key_alg(key->key)),

dst_key_id(key->key));

signwithkey(name, set, trdata, key->key, &b);

nowsignedby[sig.algorithm] = ISC_TRUE;

ISC_LIST_APPEND(siglist.rdata, trdata, link);

}

dns_rdata_freestruct(&sig);

result = dns_rdataset_next(&oldsigset);

}

if (result == ISC_R_NOMORE)

result = ISC_R_SUCCESS;

check_result(result, "dns_db_dns_rdataset_first()/next()");

dns_rdataset_disassociate(&oldsigset);

}

for (i = 0; i < 256; i++)

if (wassignedby[i] != 0) {

notsigned = ISC_FALSE;

break;

}

key = ISC_LIST_HEAD(keylist);

while (key != NULL) {

unsigned int alg = dst_key_alg(key->key);

if (key->isdefault &&

(notsigned || (wassignedby[alg] && !nowsignedby[alg])))

{

allocbufferandrdata;

vbprintf(1, "\tsigning with key %s/%s/%d\n",

nametostr(dst_key_name(key->key)),

algtostr(dst_key_alg(key->key)),

dst_key_id(key->key));

signwithkey(name, set, trdata, key->key, &b);

ISC_LIST_APPEND(siglist.rdata, trdata, link);

}

key = ISC_LIST_NEXT(key, link);

}

if (!ISC_LIST_EMPTY(siglist.rdata)) {

siglist.rdclass = set->rdclass;

siglist.type = dns_rdatatype_sig;

siglist.covers = set->type;

if (endtime - starttime < set->ttl)

siglist.ttl = endtime - starttime;

else

siglist.ttl = set->ttl;

dns_rdataset_init(&sigset);

result = dns_rdatalist_tordataset(&siglist, &sigset);

check_result(result, "dns_rdatalist_tordataset");

result = dns_db_addrdataset(db, node, version, 0, &sigset,

0, NULL);

if (result == DNS_R_UNCHANGED)

result = ISC_R_SUCCESS;

check_result(result, "dns_db_addrdataset");

dns_rdataset_disassociate(&sigset);

}

else if (!nosigs) {

#if 0

/*

result = dns_db_deleterdataset(db, node, version,

dns_rdatatype_sig, set->type);

if (result == ISC_R_NOTFOUND)

result = ISC_R_SUCCESS;

check_result(result, "dns_db_deleterdataset");

#endif

fatal("File is currently signed but no private keys were "

"found. This won't work.");

}

trdata = ISC_LIST_HEAD(siglist.rdata);

while (trdata != NULL) {

dns_rdata_t *next = ISC_LIST_NEXT(trdata, link);

isc_mem_put(mctx, trdata, sizeof(dns_rdata_t));

trdata = next;

}

tdata = ISC_LIST_HEAD(arraylist);

while (tdata != NULL) {

signer_array_t *next = ISC_LIST_NEXT(tdata, link);

isc_mem_put(mctx, tdata, sizeof(signer_array_t));

tdata = next;

}

}

#ifndef USE_ZONESTATUS

static isc_boolean_t

hasnullkey(dns_rdataset_t *rdataset) {

isc_result_t result;

dns_rdata_t rdata;

isc_boolean_t found = ISC_FALSE;

result = dns_rdataset_first(rdataset);

while (result == ISC_R_SUCCESS) {

dst_key_t *key = NULL;

dns_rdataset_current(rdataset, &rdata);

result = dns_dnssec_keyfromrdata(dns_rootname,

&rdata, mctx, &key);

if (result != ISC_R_SUCCESS)

fatal("could not convert KEY into internal format");

if (dst_key_isnullkey(key))

found = ISC_TRUE;

dst_key_free(&key);

if (found == ISC_TRUE)

return (ISC_TRUE);

result = dns_rdataset_next(rdataset);

}

if (result != ISC_R_NOMORE)

fatal("failure looking for null keys");

return (ISC_FALSE);

}

#endif

static void

importparentsig(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,

dns_name_t *name, dns_rdataset_t *set)

{

unsigned char filename[256];

isc_buffer_t b;

dns_db_t *newdb = NULL;

dns_dbnode_t *newnode = NULL;

dns_rdataset_t newset, sigset;

dns_rdata_t rdata, newrdata;

isc_result_t result;

isc_buffer_init(&b, filename, sizeof(filename));

isc_buffer_putstr(&b, "signedkey-");

result = dns_name_totext(name, ISC_FALSE, &b);

check_result(result, "dns_name_totext()");

if (isc_buffer_availablelength(&b) == 0)

fatal("name '%s' is too long", nametostr(name));

isc_buffer_putmem(&b, "", 1);

result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,

dns_db_class(db), 0, NULL, &newdb);

check_result(result, "dns_db_create()");

result = dns_db_load(newdb, (char *)filename);

if (result != ISC_R_SUCCESS)

goto failure;

result = dns_db_findnode(newdb, name, ISC_FALSE, &newnode);

if (result != ISC_R_SUCCESS)

goto failure;

dns_rdataset_init(&newset);

dns_rdataset_init(&sigset);

result = dns_db_findrdataset(newdb, newnode, NULL, dns_rdatatype_key,

0, 0, &newset, &sigset);

if (result != ISC_R_SUCCESS)

goto failure;

if (dns_rdataset_count(set) != dns_rdataset_count(&newset))

goto failure;

dns_rdata_init(&rdata);

dns_rdata_init(&newrdata);

result = dns_rdataset_first(set);

check_result(result, "dns_rdataset_first()");

for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(set)) {

dns_rdataset_current(set, &rdata);

result = dns_rdataset_first(&newset);

check_result(result, "dns_rdataset_first()");

for (;

result == ISC_R_SUCCESS;

result = dns_rdataset_next(&newset))

{

dns_rdataset_current(&newset, &newrdata);

if (dns_rdata_compare(&rdata, &newrdata) == 0)

break;

}

if (result != ISC_R_SUCCESS)

break;

}

if (result != ISC_R_NOMORE)

goto failure;

vbprintf(2, "found the parent's signature of our zone key\n");

result = dns_db_addrdataset(db, node, version, 0, &sigset, 0, NULL);

check_result(result, "dns_db_addrdataset");

dns_rdataset_disassociate(&newset);

dns_rdataset_disassociate(&sigset);

failure:

if (newnode != NULL)

dns_db_detachnode(newdb, &newnode);

if (newdb != NULL)

dns_db_detach(&newdb);

}

static isc_boolean_t

haschildkey(dns_db_t *db, dns_name_t *name) {

unsigned char filename[256];

isc_buffer_t b;

dns_db_t *newdb = NULL;

dns_dbnode_t *newnode = NULL;

dns_rdataset_t set, sigset;

dns_rdata_t sigrdata;

isc_result_t result;

isc_boolean_t found = ISC_FALSE;

dns_rdata_sig_t sig;

signer_key_t *key;

dns_rdataset_init(&set);

dns_rdataset_init(&sigset);

isc_buffer_init(&b, filename, sizeof(filename));

isc_buffer_putstr(&b, "signedkey-");

result = dns_name_totext(name, ISC_FALSE, &b);

check_result(result, "dns_name_totext()");

if (isc_buffer_availablelength(&b) == 0)

fatal("name '%s' is too long", nametostr(name));

isc_buffer_putmem(&b, "", 1);

result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,

dns_db_class(db), 0, NULL, &newdb);

check_result(result, "dns_db_create()");

result = dns_db_load(newdb, (char *)filename);

if (result != ISC_R_SUCCESS)

goto failure;

result = dns_db_findnode(newdb, name, ISC_FALSE, &newnode);

if (result != ISC_R_SUCCESS)

goto failure;

result = dns_db_findrdataset(newdb, newnode, NULL, dns_rdatatype_key,

0, 0, &set, &sigset);

if (result != ISC_R_SUCCESS)

goto failure;

if (!dns_rdataset_isassociated(&set) ||

!dns_rdataset_isassociated(&sigset))

goto failure;

result = dns_rdataset_first(&sigset);

check_result(result, "dns_rdataset_first()");

dns_rdata_init(&sigrdata);

for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(&sigset)) {

dns_rdataset_current(&sigset, &sigrdata);

result = dns_rdata_tostruct(&sigrdata, &sig, mctx);

if (result != ISC_R_SUCCESS)

goto failure;

key = keythatsigned(&sig);

dns_rdata_freestruct(&sig);

if (key == NULL)

goto failure;

result = dns_dnssec_verify(name, &set, key->key,

ISC_FALSE, mctx, &sigrdata);

if (result == ISC_R_SUCCESS) {

found = ISC_TRUE;

break;

}

}

failure:

if (dns_rdataset_isassociated(&set))

dns_rdataset_disassociate(&set);

if (dns_rdataset_isassociated(&sigset))

dns_rdataset_disassociate(&sigset);

if (newnode != NULL)

dns_db_detachnode(newdb, &newnode);

if (newdb != NULL)

dns_db_detach(&newdb);

return (found);

}

static void

signname(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,

dns_name_t *name)

{

isc_result_t result;

dns_rdata_t rdata;

dns_rdataset_t rdataset;

dns_rdatasetiter_t *rdsiter;

isc_boolean_t isdelegation = ISC_FALSE;

isc_boolean_t childkey = ISC_FALSE;

static int warnwild = 0;

isc_boolean_t atorigin;

if (dns_name_iswildcard(name)) {

if (warnwild++ == 0) {

fprintf(stderr, "%s: warning: BIND 9 doesn't properly "

"handle wildcards in secure zones:\n",

program);

fprintf(stderr, "\t- wildcard nonexistence proof is "

"not generated by the server\n");

fprintf(stderr, "\t- wildcard nonexistence proof is "

"not required by the resolver\n");

}

fprintf(stderr, "%s: warning: wildcard name seen: %s\n",

program, nametostr(name));

}

atorigin = dns_name_equal(name, dns_db_origin(db));

if (!atorigin) {

dns_rdataset_t nsset;

dns_rdataset_init(&nsset);

result = dns_db_findrdataset(db, node, version,

dns_rdatatype_ns, 0, 0, &nsset,

NULL);

/* Is this a delegation point? */

if (result == ISC_R_SUCCESS) {

isdelegation = ISC_TRUE;

dns_rdataset_disassociate(&nsset);

}

}

dns_rdataset_init(&rdataset);

rdsiter = NULL;

result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &rdataset);

/* If this is a SIG set, skip it. */

if (rdataset.type == dns_rdatatype_sig)

goto skip;

/*

if (rdataset.type == dns_rdatatype_key && atorigin) {

importparentsig(db, version, node, name, &rdataset);

goto skip;

}

/*

if (isdelegation) {

switch (rdataset.type) {

case dns_rdatatype_nxt:

childkey = haschildkey(db, name);

break;

#ifndef USE_ZONESTATUS

case dns_rdatatype_key:

if (hasnullkey(&rdataset))

break;

goto skip;

#endif

default:

goto skip;

}

}

/*

if (rdataset.type == dns_rdatatype_nxt) {

unsigned char *nxt_bits;

dns_name_t nxtname;

isc_region_t r, r2;

unsigned char keydata[4];

dst_key_t *dstkey;

isc_buffer_t b;

result = dns_rdataset_first(&rdataset);

check_result(result, "dns_rdataset_first()");

dns_rdataset_current(&rdataset, &rdata);

dns_rdata_toregion(&rdata, &r);

dns_name_init(&nxtname, NULL);

dns_name_fromregion(&nxtname, &r);

dns_name_toregion(&nxtname, &r2);

nxt_bits = r.base + r2.length;

set_bit(nxt_bits, dns_rdatatype_sig, 1);

#ifdef USE_ZONESTATUS

if (isdelegation && childkey) {

set_bit(nxt_bits, dns_rdatatype_key, 1);

vbprintf(2, "found a child key for %s, "

"setting KEY bit in NXT\n",

nametostr(name));

}

#else

if (isdelegation && !childkey) {

dns_rdataset_t keyset;

dns_rdatalist_t keyrdatalist;

dns_rdata_t keyrdata;

dns_rdataset_init(&keyset);

result = dns_db_findrdataset(db, node, version,

dns_rdatatype_key,

0, 0, &keyset,

NULL);

if (result == ISC_R_SUCCESS &&

hasnullkey(&keyset))

goto alreadyhavenullkey;

if (result == ISC_R_NOTFOUND)

result = ISC_R_SUCCESS;

if (result != ISC_R_SUCCESS)

fatal("failure looking for null key "

"at '%s': %s", nametostr(name),

isc_result_totext(result));

if (dns_rdataset_isassociated(&keyset))

dns_rdataset_disassociate(&keyset);

vbprintf(2, "no child key for %s, "

"adding null key\n",

nametostr(name));

dns_rdatalist_init(&keyrdatalist);

dstkey = NULL;

result = dst_key_generate(name, DNS_KEYALG_DSA,

0, 0,

DNS_KEYTYPE_NOKEY |

DNS_KEYOWNER_ZONE,

DNS_KEYPROTO_DNSSEC,

mctx, &dstkey);

if (result != ISC_R_SUCCESS)

fatal("failed to generate null key");

isc_buffer_init(&b, keydata, sizeof keydata);

result = dst_key_todns(dstkey, &b);

dst_key_free(&dstkey);

isc_buffer_usedregion(&b, &r);

dns_rdata_fromregion(&keyrdata,

rdataset.rdclass,

dns_rdatatype_key, &r);

ISC_LIST_APPEND(keyrdatalist.rdata, &keyrdata,

link);

keyrdatalist.rdclass = rdataset.rdclass;

keyrdatalist.type = dns_rdatatype_key;

keyrdatalist.covers = 0;

keyrdatalist.ttl = rdataset.ttl;

result = dns_rdatalist_tordataset(&keyrdatalist,

&keyset);

check_result(result,

"dns_rdatalist_tordataset");

dns_db_addrdataset(db, node, version, 0,

&keyset, DNS_DBADD_MERGE,

NULL);

set_bit(nxt_bits, dns_rdatatype_key, 1);

signset(db, version, node, name, &keyset);

alreadyhavenullkey:

dns_rdataset_disassociate(&keyset);

} else if (isdelegation) {

vbprintf(2, "child key for %s found\n",

nametostr(name));

}

#endif

}

signset(db, version, node, name, &rdataset);

skip:

dns_rdataset_disassociate(&rdataset);

result = dns_rdatasetiter_next(rdsiter);

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration for name '%s' failed: %s",

nametostr(name), isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter);

}

static inline isc_boolean_t

active_node(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {

dns_rdatasetiter_t *rdsiter;

isc_boolean_t active = ISC_FALSE;

isc_result_t result;

dns_rdataset_t rdataset;

dns_rdataset_init(&rdataset);

rdsiter = NULL;

result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);

check_result(result, "dns_db_allrdatasets()");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &rdataset);

if (rdataset.type != dns_rdatatype_nxt)

active = ISC_TRUE;

dns_rdataset_disassociate(&rdataset);

if (!active)

result = dns_rdatasetiter_next(rdsiter);

else

result = ISC_R_NOMORE;

}

if (result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

dns_rdatasetiter_destroy(&rdsiter);

if (!active) {

/*

result = dns_db_deleterdataset(db, node, version,

dns_rdatatype_nxt, 0);

if (result == DNS_R_UNCHANGED)

result = ISC_R_SUCCESS;

check_result(result, "dns_db_deleterdataset");

}

return (active);

}

static inline isc_result_t

next_active(dns_db_t *db, dns_dbversion_t *version, dns_dbiterator_t *dbiter,

dns_name_t *name, dns_dbnode_t **nodep)

{

isc_result_t result;

isc_boolean_t active;

do {

active = ISC_FALSE;

result = dns_dbiterator_current(dbiter, nodep, name);

if (result == ISC_R_SUCCESS) {

active = active_node(db, version, *nodep);

if (!active) {

dns_db_detachnode(db, nodep);

result = dns_dbiterator_next(dbiter);

}

}

} while (result == ISC_R_SUCCESS && !active);

return (result);

}

static inline isc_result_t

next_nonglue(dns_db_t *db, dns_dbversion_t *version, dns_dbiterator_t *dbiter,

dns_name_t *name, dns_dbnode_t **nodep, dns_name_t *origin,

dns_name_t *lastcut)

{

isc_result_t result;

do {

result = next_active(db, version, dbiter, name, nodep);

if (result == ISC_R_SUCCESS) {

if (dns_name_issubdomain(name, origin) &&

(lastcut == NULL ||

!dns_name_issubdomain(name, lastcut)))

return (ISC_R_SUCCESS);

dns_db_detachnode(db, nodep);

result = dns_dbiterator_next(dbiter);

}

} while (result == ISC_R_SUCCESS);

return (result);

}

static dns_ttl_t

minimumttl(dns_db_t *db, dns_dbversion_t *version) {

dns_rdataset_t soaset;

dns_name_t *origin;

dns_fixedname_t fname;

dns_name_t *name;

dns_rdata_t soarr;

dns_rdata_soa_t soa;

isc_result_t result;

dns_ttl_t ttl;

origin = dns_db_origin(db);

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_rdataset_init(&soaset);

result = dns_db_find(db, origin, version, dns_rdatatype_soa,

0, 0, NULL, name, &soaset, NULL);

if (result != ISC_R_SUCCESS)

fatal("failed to find '%s SOA' in the zone: %s",

nametostr(name), isc_result_totext(result));

result = dns_rdataset_first(&soaset);

check_result(result, "dns_rdataset_first()");

dns_rdataset_current(&soaset, &soarr);

result = dns_rdata_tostruct(&soarr, &soa, mctx);

check_result(result, "dns_rdataset_tostruct()");

ttl = soa.minimum;

dns_rdata_freestruct(&soa);

dns_rdataset_disassociate(&soaset);

return (ttl);

}

static void

signzone(dns_db_t *db, dns_dbversion_t *version) {

isc_result_t result, nxtresult;

dns_dbnode_t *node, *nextnode, *curnode;

dns_fixedname_t fname, fnextname, fcurname;

dns_name_t *name, *nextname, *target, *curname, *lastcut;

dns_dbiterator_t *dbiter;

dns_name_t *origin;

zonettl = minimumttl(db, version);

dns_fixedname_init(&fname);

name = dns_fixedname_name(&fname);

dns_fixedname_init(&fnextname);

nextname = dns_fixedname_name(&fnextname);

dns_fixedname_init(&fcurname);

curname = dns_fixedname_name(&fcurname);

origin = dns_db_origin(db);

lastcut = NULL;

dbiter = NULL;

result = dns_db_createiterator(db, ISC_FALSE, &dbiter);

check_result(result, "dns_db_createiterator()");

result = dns_dbiterator_first(dbiter);

node = NULL;

dns_name_clone(origin, name);

result = next_nonglue(db, version, dbiter, name, &node, origin,

lastcut);

while (result == ISC_R_SUCCESS) {

nextnode = NULL;

curnode = NULL;

dns_dbiterator_current(dbiter, &curnode, curname);

if (!dns_name_equal(name, dns_db_origin(db))) {

dns_rdatasetiter_t *rdsiter = NULL;

dns_rdataset_t set;

dns_rdataset_init(&set);

result = dns_db_allrdatasets(db, curnode, version,

0, &rdsiter);

check_result(result, "dns_db_allrdatasets");

result = dns_rdatasetiter_first(rdsiter);

while (result == ISC_R_SUCCESS) {

dns_rdatasetiter_current(rdsiter, &set);

if (set.type == dns_rdatatype_ns) {

dns_rdataset_disassociate(&set);

break;

}

dns_rdataset_disassociate(&set);

result = dns_rdatasetiter_next(rdsiter);

}

if (result != ISC_R_SUCCESS && result != ISC_R_NOMORE)

fatal("rdataset iteration failed: %s",

isc_result_totext(result));

if (result == ISC_R_SUCCESS) {

if (lastcut != NULL)

dns_name_free(lastcut, mctx);

else {

lastcut = isc_mem_get(mctx,

sizeof(dns_name_t));

if (lastcut == NULL)

fatal("out of memory");

}

dns_name_init(lastcut, NULL);

result = dns_name_dup(curname, mctx, lastcut);

check_result(result, "dns_name_dup()");

}

dns_rdatasetiter_destroy(&rdsiter);

}

result = dns_dbiterator_next(dbiter);

if (result == ISC_R_SUCCESS)

result = next_nonglue(db, version, dbiter, nextname,

&nextnode, origin, lastcut);

if (result == ISC_R_SUCCESS)

target = nextname;

else if (result == ISC_R_NOMORE)

target = origin;

else {

target = NULL; /* Make compiler happy. */

fatal("iterating through the database failed: %s",

isc_result_totext(result));

}

nxtresult = dns_buildnxt(db, version, node, target, zonettl);

check_result(nxtresult, "dns_buildnxt()");

signname(db, version, node, curname);

dns_db_detachnode(db, &node);

dns_db_detachnode(db, &curnode);

node = nextnode;

}

if (result != ISC_R_NOMORE)

fatal("iterating through the database failed: %s",

isc_result_totext(result));

if (lastcut != NULL) {

dns_name_free(lastcut, mctx);

isc_mem_put(mctx, lastcut, sizeof(dns_name_t));

}

dns_dbiterator_destroy(&dbiter);

}

static void

loadzone(char *file, char *origin, dns_db_t **db) {

isc_buffer_t b, b2;

unsigned char namedata[1024];

int len;

dns_name_t name;

isc_result_t result;

len = strlen(origin);

isc_buffer_init(&b, origin, len);

isc_buffer_add(&b, len);

isc_buffer_init(&b2, namedata, sizeof(namedata));

dns_name_init(&name, NULL);

result = dns_name_fromtext(&name, &b, dns_rootname, ISC_FALSE, &b2);

if (result != ISC_R_SUCCESS)

fatal("failed converting name '%s' to dns format: %s",

origin, isc_result_totext(result));

result = dns_db_create(mctx, "rbt", &name, dns_dbtype_zone,

dns_rdataclass_in, 0, NULL, db);

check_result(result, "dns_db_create()");

result = dns_db_load(*db, file);

if (result != ISC_R_SUCCESS)

fatal("failed loading zone from '%s': %s",

file, isc_result_totext(result));

}

static void

loadzonekeys(dns_db_t *db) {

dns_name_t *origin;

dns_dbnode_t *node;

dns_dbversion_t *currentversion;

isc_result_t result;

dst_key_t *keys[20];

unsigned int nkeys, i;

origin = dns_db_origin(db);

currentversion = NULL;

dns_db_currentversion(db, &currentversion);

node = NULL;

result = dns_db_findnode(db, origin, ISC_FALSE, &node);

if (result != ISC_R_SUCCESS)

fatal("failed to find the zone's origin: %s",

isc_result_totext(result));

result = dns_dnssec_findzonekeys(db, currentversion, node, origin, mctx,

20, keys, &nkeys);

if (result == ISC_R_NOTFOUND)

result = ISC_R_SUCCESS;

if (result != ISC_R_SUCCESS)

fatal("failed to find the zone keys: %s",

isc_result_totext(result));

for (i = 0; i < nkeys; i++) {

signer_key_t *key;

key = isc_mem_get(mctx, sizeof(signer_key_t));

if (key == NULL)

fatal("out of memory");

key->key = keys[i];

key->isdefault = ISC_FALSE;

ISC_LIST_APPEND(keylist, key, link);

}

dns_db_detachnode(db, &node);

dns_db_closeversion(db, &currentversion, ISC_FALSE);

}

static isc_stdtime_t

strtotime(char *str, isc_int64_t now, isc_int64_t base) {

isc_int64_t val, offset;

isc_result_t result;

char *endp;

if (str[0] == '+') {

offset = strtol(str + 1, &endp, 0);

if (*endp != '\0')

fatal("time value %s is invalid", str);

val = base + offset;

} else if (strncmp(str, "now+", 4) == 0) {

offset = strtol(str + 4, &endp, 0);

if (*endp != '\0')

fatal("time value %s is invalid", str);

val = now + offset;

} else {

result = dns_time64_fromtext(str, &val);

if (result != ISC_R_SUCCESS)

fatal("time %s must be numeric", str);

}

return ((isc_stdtime_t) val);

}

static void

usage(void) {

fprintf(stderr, "Usage:\n");

fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);

fprintf(stderr, "\n");

fprintf(stderr, "Options: (default value in parenthesis) \n");

fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n");

fprintf(stderr, "\t\tSIG start time - absolute|offset (now)\n");

fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");

fprintf(stderr, "\t\tSIG end time - absolute|from start|from now "

"(now + 30 days)\n");

fprintf(stderr, "\t-c ttl:\n");

fprintf(stderr, "\t\tcycle period - regenerate "

"if < cycle from end ( (end-start)/4 )\n");

fprintf(stderr, "\t-v level:\n");

fprintf(stderr, "\t\tverbose level (0)\n");

fprintf(stderr, "\t-o origin:\n");

fprintf(stderr, "\t\tzone origin (name of zonefile)\n");

fprintf(stderr, "\t-f outfile:\n");

fprintf(stderr, "\t\tfile the signed zone is written in "

"(zonefile + .signed)\n");

fprintf(stderr, "\t-a\n");

fprintf(stderr, "\t\tverify generated signatures\n");

fprintf(stderr, "\t-p\n");

fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n");

fprintf(stderr, "\t-r randomdev:\n");

fprintf(stderr, "\t\ta file containing random data\n");

fprintf(stderr, "\n");

fprintf(stderr, "Signing Keys: ");

fprintf(stderr, "(default: all zone keys that have private keys)\n");

fprintf(stderr, "\tkeyfile (Kname+alg+id)\n");

exit(0);

}

main(int argc, char *argv[]) {

int i, ch;

char *startstr = NULL, *endstr = NULL;

char *origin = NULL, *file = NULL, *output = NULL;

char *randomfile = NULL;

char *endp;

dns_db_t *db;

dns_dbversion_t *version;

signer_key_t *key;

isc_result_t result;

isc_log_t *log = NULL;

isc_boolean_t pseudorandom = ISC_FALSE;

unsigned int eflags;

isc_boolean_t free_output = ISC_FALSE;

result = isc_mem_create(0, 0, &mctx);

if (result != ISC_R_SUCCESS)

fatal("out of memory");

dns_result_register();

while ((ch = isc_commandline_parse(argc, argv, "s:e:c:v:o:f:ahpr:"))

!= -1) {

switch (ch) {

case 's':

startstr = isc_commandline_argument;

break;

case 'e':

endstr = isc_commandline_argument;

break;

case 'c':

endp = NULL;

cycle = strtol(isc_commandline_argument, &endp, 0);

if (*endp != '\0' || cycle < 0)

fatal("cycle period must be numeric and "

"positive");

break;