Update repub branch u/fanf2/patch to rebasing branch u/fanf2/rebasing revision v9_15_...
[ipreg/bind9.git] / bin / dnssec / dnssec-revoke.c
CommitLineData
cfb1587e 1/*
843d3896 2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
cfb1587e 3 *
0c27b3fe
MA
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
843d3896
OS
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
cfb1587e
EH
10 */
11
cfb1587e
EH
12/*! \file */
13
cb6a185c 14#include <inttypes.h>
994e6569 15#include <stdbool.h>
cfb1587e
EH
16#include <stdlib.h>
17#include <unistd.h>
cfb1587e
EH
18
19#include <isc/buffer.h>
20#include <isc/commandline.h>
747abb49 21#include <isc/file.h>
cfb1587e
EH
22#include <isc/hash.h>
23#include <isc/mem.h>
24#include <isc/print.h>
25#include <isc/string.h>
26#include <isc/util.h>
27
28#include <dns/keyvalues.h>
29#include <dns/result.h>
30
31#include <dst/dst.h>
32
c3b8130f 33#if USE_PKCS11
acbb301e
EH
34#include <pk11/result.h>
35#endif
36
cfb1587e
EH
37#include "dnssectool.h"
38
39const char *program = "dnssec-revoke";
cfb1587e
EH
40
41static isc_mem_t *mctx = NULL;
42
debd489a
FD
43ISC_PLATFORM_NORETURN_PRE static void
44usage(void) ISC_PLATFORM_NORETURN_POST;
45
cfb1587e
EH
46static void
47usage(void) {
48 fprintf(stderr, "Usage:\n");
49 fprintf(stderr, " %s [options] keyfile\n\n", program);
50 fprintf(stderr, "Version: %s\n", VERSION);
c3b8130f 51#if USE_PKCS11
ba751492
EH
52 fprintf(stderr, " -E engine: specify PKCS#11 provider "
53 "(default: %s)\n", PK11_LIB_LOCATION);
8b78c993 54#else
9de98fbb 55 fprintf(stderr, " -E engine: specify OpenSSL engine\n");
8b78c993 56#endif
f7b2bd30
TF
57 fprintf(stderr, " -f: force overwrite\n");
58 fprintf(stderr, " -h: help\n");
553ead32 59 fprintf(stderr, " -K directory: use directory for key files\n");
f7b2bd30 60 fprintf(stderr, " -r: remove old keyfiles after "
cfb1587e 61 "creating revoked version\n");
f7b2bd30
TF
62 fprintf(stderr, " -v level: set level of verbosity\n");
63 fprintf(stderr, " -V: print version information\n");
cfb1587e
EH
64 fprintf(stderr, "Output:\n");
65 fprintf(stderr, " K<name>+<alg>+<new id>.key, "
66 "K<name>+<alg>+<new id>.private\n");
67
68 exit (-1);
69}
70
71int
72main(int argc, char **argv) {
73 isc_result_t result;
8b78c993 74 const char *engine = NULL;
5b1c7ef3
MA
75 char const *filename = NULL;
76 char *dir = NULL;
cfb1587e 77 char newname[1024], oldname[1024];
77b8f88f 78 char keystr[DST_KEY_FORMATSIZE];
cfb1587e
EH
79 char *endp;
80 int ch;
cfb1587e 81 dst_key_t *key = NULL;
cb6a185c 82 uint32_t flags;
cfb1587e 83 isc_buffer_t buf;
994e6569
OS
84 bool force = false;
85 bool removefile = false;
86 bool id = false;
cfb1587e
EH
87
88 if (argc == 1)
89 usage();
90
91 result = isc_mem_create(0, 0, &mctx);
92 if (result != ISC_R_SUCCESS)
93 fatal("Out of memory");
94
7ee8a7e6 95#if HAVE_PKCS11
acbb301e
EH
96 pk11_result_register();
97#endif
cfb1587e
EH
98 dns_result_register();
99
994e6569 100 isc_commandline_errprint = false;
cfb1587e 101
42782931 102 while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
cfb1587e 103 switch (ch) {
8b78c993
FD
104 case 'E':
105 engine = isc_commandline_argument;
106 break;
cfb1587e 107 case 'f':
994e6569 108 force = true;
cfb1587e 109 break;
553ead32 110 case 'K':
8d0a1ede
EH
111 /*
112 * We don't have to copy it here, but do it to
113 * simplify cleanup later
114 */
115 dir = isc_mem_strdup(mctx, isc_commandline_argument);
116 if (dir == NULL) {
117 fatal("Failed to allocate memory for "
118 "directory");
119 }
553ead32 120 break;
cfb1587e 121 case 'r':
994e6569 122 removefile = true;
cfb1587e 123 break;
1946c596 124 case 'R':
994e6569 125 id = true;
1946c596 126 break;
cfb1587e
EH
127 case 'v':
128 verbose = strtol(isc_commandline_argument, &endp, 0);
129 if (*endp != '\0')
130 fatal("-v must be followed by a number");
131 break;
132 case '?':
133 if (isc_commandline_option != '?')
134 fprintf(stderr, "%s: invalid argument -%c\n",
135 program, isc_commandline_option);
cdacec1d 136 /* FALLTHROUGH */
cfb1587e 137 case 'h':
42782931 138 /* Does not return. */
cfb1587e
EH
139 usage();
140
42782931
MS
141 case 'V':
142 /* Does not return. */
143 version(program);
144
cfb1587e
EH
145 default:
146 fprintf(stderr, "%s: unhandled option -%c\n",
147 program, isc_commandline_option);
148 exit(1);
149 }
150 }
151
152 if (argc < isc_commandline_index + 1 ||
153 argv[isc_commandline_index] == NULL)
154 fatal("The key file name was not specified");
155 if (argc > isc_commandline_index + 1)
156 fatal("Extraneous arguments");
157
747abb49
EH
158 if (dir != NULL) {
159 filename = argv[isc_commandline_index];
160 } else {
e3b59e4a
EH
161 result = isc_file_splitpath(mctx, argv[isc_commandline_index],
162 &dir, &filename);
163 if (result != ISC_R_SUCCESS)
164 fatal("cannot process filename %s: %s",
165 argv[isc_commandline_index],
166 isc_result_totext(result));
707d9fbd
MA
167 if (strcmp(dir, ".") == 0) {
168 isc_mem_free(mctx, dir);
169 dir = NULL;
170 }
4a979d35 171 }
aeff7de8 172
3a4f820d 173 result = dst_lib_init(mctx, engine);
cfb1587e 174 if (result != ISC_R_SUCCESS)
8b78c993
FD
175 fatal("Could not initialize dst: %s",
176 isc_result_totext(result));
cfb1587e 177
553ead32 178 result = dst_key_fromnamedfile(filename, dir,
cfb1587e
EH
179 DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
180 mctx, &key);
181 if (result != ISC_R_SUCCESS)
182 fatal("Invalid keyfile name %s: %s",
183 filename, isc_result_totext(result));
184
1946c596
MA
185 if (id) {
186 fprintf(stdout, "%u\n", dst_key_rid(key));
187 goto cleanup;
188 }
c0214996 189 dst_key_format(key, keystr, sizeof(keystr));
cfb1587e 190
c0214996 191 if (verbose > 2)
cfb1587e 192 fprintf(stderr, "%s: %s\n", program, keystr);
c0214996
EH
193
194 if (force)
195 set_keyversion(key);
196 else
197 check_keyversion(key, keystr);
198
cfb1587e
EH
199
200 flags = dst_key_flags(key);
201 if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
d7201de0 202 isc_stdtime_t now;
eab9975b 203
53c22b8e
EH
204 if ((flags & DNS_KEYFLAG_KSK) == 0)
205 fprintf(stderr, "%s: warning: Key is not flagged "
206 "as a KSK. Revoking a ZSK is "
207 "legal, but undefined.\n",
208 program);
209
d7201de0 210 isc_stdtime_get(&now);
eab9975b
EH
211 dst_key_settime(key, DST_TIME_REVOKE, now);
212
cfb1587e
EH
213 dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);
214
215 isc_buffer_init(&buf, newname, sizeof(newname));
216 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
217
218 if (access(newname, F_OK) == 0 && !force) {
219 fatal("Key file %s already exists; "
220 "use -f to force overwrite", newname);
221 }
222
223 result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
224 dir);
225 if (result != ISC_R_SUCCESS) {
77b8f88f 226 dst_key_format(key, keystr, sizeof(keystr));
cfb1587e
EH
227 fatal("Failed to write key %s: %s", keystr,
228 isc_result_totext(result));
229 }
230
cfb1587e 231 isc_buffer_clear(&buf);
707d9fbd 232 dst_key_buildfilename(key, 0, dir, &buf);
cfb1587e
EH
233 printf("%s\n", newname);
234
235 /*
236 * Remove old key file, if told to (and if
237 * it isn't the same as the new file)
238 */
e69dc0db 239 if (removefile) {
cfb1587e
EH
240 isc_buffer_init(&buf, oldname, sizeof(oldname));
241 dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
242 dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
243 if (strcmp(oldname, newname) == 0)
244 goto cleanup;
e58154a6 245 (void)unlink(oldname);
cfb1587e
EH
246 isc_buffer_clear(&buf);
247 dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
e58154a6 248 (void)unlink(oldname);
cfb1587e
EH
249 }
250 } else {
77b8f88f 251 dst_key_format(key, keystr, sizeof(keystr));
cfb1587e
EH
252 fatal("Key %s is already revoked", keystr);
253 }
254
255cleanup:
256 dst_key_free(&key);
586e65ea 257 dst_lib_destroy();
cfb1587e
EH
258 if (verbose > 10)
259 isc_mem_stats(mctx, stdout);
707d9fbd
MA
260 if (dir != NULL)
261 isc_mem_free(mctx, dir);
cfb1587e
EH
262 isc_mem_destroy(&mctx);
263
264 return (0);
265}