Update repub branch u/fanf2/patch to rebasing branch u/fanf2/rebasing revision v9_13_...
[ipreg/bind9.git] / bin / dnssec / dnssec-verify.c
CommitLineData
ad127d83 1/*
843d3896 2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
ad127d83 3 *
0c27b3fe
MA
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
843d3896
OS
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
ad127d83
MA
10 */
11
ad127d83
MA
12/*! \file */
13
994e6569 14#include <stdbool.h>
ad127d83
MA
15#include <stdlib.h>
16#include <time.h>
17
18#include <isc/app.h>
19#include <isc/base32.h>
20#include <isc/commandline.h>
ad127d83
MA
21#include <isc/event.h>
22#include <isc/file.h>
23#include <isc/hash.h>
24#include <isc/hex.h>
25#include <isc/mem.h>
26#include <isc/mutex.h>
27#include <isc/os.h>
28#include <isc/print.h>
29#include <isc/random.h>
30#include <isc/rwlock.h>
31#include <isc/serial.h>
32#include <isc/stdio.h>
ad127d83
MA
33#include <isc/string.h>
34#include <isc/time.h>
35#include <isc/util.h>
36
37#include <dns/db.h>
38#include <dns/dbiterator.h>
39#include <dns/diff.h>
40#include <dns/dnssec.h>
41#include <dns/ds.h>
42#include <dns/fixedname.h>
43#include <dns/keyvalues.h>
44#include <dns/log.h>
45#include <dns/master.h>
46#include <dns/masterdump.h>
47#include <dns/nsec.h>
48#include <dns/nsec3.h>
49#include <dns/rdata.h>
50#include <dns/rdatalist.h>
51#include <dns/rdataset.h>
52#include <dns/rdataclass.h>
53#include <dns/rdatasetiter.h>
54#include <dns/rdatastruct.h>
55#include <dns/rdatatype.h>
56#include <dns/result.h>
57#include <dns/soa.h>
58#include <dns/time.h>
3a14450d 59#include <dns/zoneverify.h>
ad127d83
MA
60
61#include <dst/dst.h>
62
c3b8130f 63#if USE_PKCS11
acbb301e
EH
64#include <pk11/result.h>
65#endif
66
ad127d83
MA
67#include "dnssectool.h"
68
69const char *program = "dnssec-verify";
70int verbose;
71
72static isc_stdtime_t now;
73static isc_mem_t *mctx = NULL;
ad127d83
MA
74static dns_masterformat_t inputformat = dns_masterformat_text;
75static dns_db_t *gdb; /* The database */
76static dns_dbversion_t *gversion; /* The database version */
77static dns_rdataclass_t gclass; /* The class */
78static dns_name_t *gorigin; /* The database origin */
994e6569
OS
79static bool ignore_kskflag = false;
80static bool keyset_kskonly = false;
ad127d83
MA
81
82/*%
83 * Load the zone file from disk
84 */
85static void
86loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
87 isc_buffer_t b;
88 int len;
89 dns_fixedname_t fname;
90 dns_name_t *name;
91 isc_result_t result;
92
93 len = strlen(origin);
94 isc_buffer_init(&b, origin, len);
95 isc_buffer_add(&b, len);
96
4df4a8e7 97 name = dns_fixedname_initname(&fname);
ad127d83
MA
98 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
99 if (result != ISC_R_SUCCESS)
100 fatal("failed converting name '%s' to dns format: %s",
101 origin, isc_result_totext(result));
102
103 result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
104 rdclass, 0, NULL, db);
105 check_result(result, "dns_db_create()");
106
275a6a3b 107 result = dns_db_load(*db, file, inputformat, 0);
877c264e
MK
108 switch (result) {
109 case DNS_R_SEENINCLUDE:
110 case ISC_R_SUCCESS:
111 break;
112 case DNS_R_NOTZONETOP:
113 /*
114 * Comparing pointers (vs. using strcmp()) is intentional: we
115 * want to check whether -o was supplied on the command line,
116 * not whether origin and file contain the same string.
117 */
118 if (origin == file) {
119 fatal("failed loading zone '%s' from file '%s': "
120 "use -o to specify a different zone origin",
121 origin, file);
122 }
123 /* FALLTHROUGH */
124 default:
ad127d83
MA
125 fatal("failed loading zone from '%s': %s",
126 file, isc_result_totext(result));
877c264e 127 }
ad127d83
MA
128}
129
130ISC_PLATFORM_NORETURN_PRE static void
131usage(void) ISC_PLATFORM_NORETURN_POST;
132
133static void
134usage(void) {
135 fprintf(stderr, "Usage:\n");
136 fprintf(stderr, "\t%s [options] zonefile [keys]\n", program);
137
138 fprintf(stderr, "\n");
139
140 fprintf(stderr, "Version: %s\n", VERSION);
141
142 fprintf(stderr, "Options: (default value in parenthesis) \n");
143 fprintf(stderr, "\t-v debuglevel (0)\n");
42782931 144 fprintf(stderr, "\t-V:\tprint version information\n");
ad127d83
MA
145 fprintf(stderr, "\t-o origin:\n");
146 fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
147 fprintf(stderr, "\t-I format:\n");
148 fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
149 fprintf(stderr, "\t-c class (IN)\n");
150 fprintf(stderr, "\t-E engine:\n");
c3b8130f 151#if USE_PKCS11
ba751492
EH
152 fprintf(stderr, "\t\tpath to PKCS#11 provider library "
153 "(default is %s)\n", PK11_LIB_LOCATION);
ad127d83
MA
154#else
155 fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
156#endif
157 fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
158 "not ZSKs\n");
159 fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
160 exit(0);
161}
162
163int
164main(int argc, char *argv[]) {
165 char *origin = NULL, *file = NULL;
166 char *inputformatstr = NULL;
167 isc_result_t result;
168 isc_log_t *log = NULL;
ad127d83 169 const char *engine = NULL;
ad127d83
MA
170 char *classname = NULL;
171 dns_rdataclass_t rdclass;
b454c031
EH
172 char *endp;
173 int ch;
ad127d83
MA
174
175#define CMDLINE_FLAGS \
42782931 176 "hm:o:I:c:E:v:Vxz"
ad127d83
MA
177
178 /*
179 * Process memory debugging argument first.
180 */
181 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
182 switch (ch) {
183 case 'm':
184 if (strcasecmp(isc_commandline_argument, "record") == 0)
185 isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
186 if (strcasecmp(isc_commandline_argument, "trace") == 0)
187 isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
188 if (strcasecmp(isc_commandline_argument, "usage") == 0)
189 isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
190 if (strcasecmp(isc_commandline_argument, "size") == 0)
191 isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
192 if (strcasecmp(isc_commandline_argument, "mctx") == 0)
193 isc_mem_debugging |= ISC_MEM_DEBUGCTX;
194 break;
195 default:
196 break;
197 }
198 }
994e6569 199 isc_commandline_reset = true;
ad127d83
MA
200 check_result(isc_app_start(), "isc_app_start");
201
202 result = isc_mem_create(0, 0, &mctx);
203 if (result != ISC_R_SUCCESS)
204 fatal("out of memory");
205
c3b8130f 206#if USE_PKCS11
acbb301e
EH
207 pk11_result_register();
208#endif
ad127d83
MA
209 dns_result_register();
210
994e6569 211 isc_commandline_errprint = false;
ad127d83
MA
212
213 while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
214 switch (ch) {
215 case 'c':
216 classname = isc_commandline_argument;
217 break;
218
219 case 'E':
220 engine = isc_commandline_argument;
221 break;
222
ad127d83
MA
223 case 'I':
224 inputformatstr = isc_commandline_argument;
225 break;
226
227 case 'm':
228 break;
229
230 case 'o':
231 origin = isc_commandline_argument;
232 break;
233
234 case 'v':
235 endp = NULL;
236 verbose = strtol(isc_commandline_argument, &endp, 0);
237 if (*endp != '\0')
238 fatal("verbose level must be numeric");
239 break;
240
241 case 'x':
994e6569 242 keyset_kskonly = true;
ad127d83
MA
243 break;
244
245 case 'z':
994e6569 246 ignore_kskflag = true;
ad127d83
MA
247 break;
248
249 case '?':
250 if (isc_commandline_option != '?')
251 fprintf(stderr, "%s: invalid argument -%c\n",
252 program, isc_commandline_option);
42782931
MS
253 /* FALLTHROUGH */
254
255 case 'h':
256 /* Does not return. */
ad127d83 257 usage();
42782931
MS
258
259 case 'V':
260 /* Does not return. */
261 version(program);
ad127d83
MA
262
263 default:
264 fprintf(stderr, "%s: unhandled option -%c\n",
265 program, isc_commandline_option);
266 exit(1);
267 }
268 }
269
3a4f820d 270 result = dst_lib_init(mctx, engine);
ad127d83
MA
271 if (result != ISC_R_SUCCESS)
272 fatal("could not initialize dst: %s",
273 isc_result_totext(result));
274
275 isc_stdtime_get(&now);
276
277 rdclass = strtoclass(classname);
278
11463c0a 279 setup_logging(mctx, &log);
ad127d83
MA
280
281 argc -= isc_commandline_index;
282 argv += isc_commandline_index;
283
284 if (argc < 1)
285 usage();
286
287 file = argv[0];
288
289 argc -= 1;
290 argv += 1;
291
611dc887
MA
292 POST(argc);
293 POST(argv);
294
ad127d83
MA
295 if (origin == NULL)
296 origin = file;
297
298 if (inputformatstr != NULL) {
299 if (strcasecmp(inputformatstr, "text") == 0)
300 inputformat = dns_masterformat_text;
301 else if (strcasecmp(inputformatstr, "raw") == 0)
302 inputformat = dns_masterformat_raw;
303 else
304 fatal("unknown file format: %s\n", inputformatstr);
305 }
306
307 gdb = NULL;
308 fprintf(stderr, "Loading zone '%s' from file '%s'\n", origin, file);
309 loadzone(file, origin, rdclass, &gdb);
310 gorigin = dns_db_origin(gdb);
311 gclass = dns_db_class(gdb);
312
313 gversion = NULL;
314 result = dns_db_newversion(gdb, &gversion);
315 check_result(result, "dns_db_newversion()");
316
fc3dd703
MK
317 result = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin, NULL,
318 mctx, ignore_kskflag, keyset_kskonly);
ad127d83 319
994e6569 320 dns_db_closeversion(gdb, &gversion, false);
ad127d83
MA
321 dns_db_detach(&gdb);
322
323 cleanup_logging(&log);
324 dst_lib_destroy();
ad127d83
MA
325 dns_name_destroy();
326 if (verbose > 10)
327 isc_mem_stats(mctx, stdout);
328 isc_mem_destroy(&mctx);
329
330 (void) isc_app_finish();
331
24bca1c4 332 return (result == ISC_R_SUCCESS ? 0 : 1);
ad127d83 333}