199 lines
4.2 KiB
C
199 lines
4.2 KiB
C
/*
|
|
* ldnssec-utils
|
|
*
|
|
* Written in 2021 by Lucas
|
|
*
|
|
* To the extent possible under law, the author(s) have dedicated all
|
|
* copyright and related and neighboring rights to this software to the
|
|
* public domain worldwide. This software is distributed without any
|
|
* warranty.
|
|
*
|
|
* You should have received a copy of the CC0 Public Domain Dedication
|
|
* along with this software. If not, see
|
|
* <http://creativecommons.org/publicdomain/zero/1.0/>.
|
|
*/
|
|
|
|
#include <err.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
|
|
#include <ldns/ldns.h>
|
|
|
|
#include "util.h"
|
|
|
|
static void
|
|
usage(void)
|
|
{
|
|
const char *p = getprogname();
|
|
|
|
fprintf(stderr, "Usage:\n"
|
|
"\t%s [-b bits] algorithm\n"
|
|
"\t%s [-a algorithm] [-d domain] [-k] -r ds|dnskey\n",
|
|
p, p);
|
|
exit(1);
|
|
}
|
|
|
|
static int
|
|
print_record_main(ldns_hash hash, int ksk, const char *domain, int argc,
|
|
char *argv[])
|
|
{
|
|
ldns_key *key;
|
|
ldns_rr *dnskey_rr, *ds_rr;
|
|
ldns_rdf *rdf_dname;
|
|
ldns_status s;
|
|
const char *type;
|
|
char *str;
|
|
uint16_t flags;
|
|
int line_nr, do_ds;
|
|
|
|
if (argc != 1)
|
|
usage();
|
|
type = argv[0];
|
|
|
|
do_ds = strcasecmp(type, "DS") == 0;
|
|
if (strcasecmp(type, "DNSKEY") != 0 && !do_ds)
|
|
errx(1, "unsupport RR type %s", type);
|
|
|
|
s = ldns_key_new_frm_fp_l(&key, stdin, &line_nr);
|
|
if (s != LDNS_STATUS_OK)
|
|
errx(1, "ldns_key_new_frm_fp_l: (stdin) line %d: %s",
|
|
line_nr, ldns_get_errorstr_by_id(s));
|
|
|
|
s = ldns_str2rdf_dname(&rdf_dname, domain);
|
|
if (s != LDNS_STATUS_OK)
|
|
errx(1, "ldns_str2rdf_dname: %s", ldns_get_errorstr_by_id(s));
|
|
|
|
flags = LDNS_KEY_ZONE_KEY;
|
|
if (ksk)
|
|
flags |= LDNS_KEY_SEP_KEY;
|
|
|
|
ldns_key_set_pubkey_owner(key, rdf_dname);
|
|
ldns_key_set_flags(key, flags);
|
|
|
|
dnskey_rr = ldns_key2rr(key);
|
|
if (dnskey_rr == NULL)
|
|
errx(1, "ldns_key2rr");
|
|
|
|
ds_rr = NULL;
|
|
if (do_ds) {
|
|
ds_rr = ldns_key_rr2ds(dnskey_rr, hash);
|
|
if (ds_rr == NULL)
|
|
errx(1, "ldns_key_rr2ds");
|
|
}
|
|
|
|
str = ldns_rr2str(do_ds ? ds_rr : dnskey_rr);
|
|
if (str == NULL)
|
|
errx(1, "ldns_rr2str");
|
|
fputs(str, stdout);
|
|
|
|
free(str);
|
|
ldns_rr_free(dnskey_rr);
|
|
ldns_rr_free(ds_rr);
|
|
ldns_key_deep_free(key);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int
|
|
keygen_main(uint16_t bits, int argc, char *argv[])
|
|
{
|
|
ldns_key *key;
|
|
ldns_signing_algorithm alg;
|
|
char *str;
|
|
|
|
if (argc != 1)
|
|
usage();
|
|
|
|
alg = ldns_get_signing_algorithm_by_name(argv[0]);
|
|
/*
|
|
* ldns_key_algo_supported can't be used here as it uses
|
|
* ldns_signing_algorithms lookup table, which includes algorithms for
|
|
* TSIG.
|
|
*/
|
|
if (ldns_lookup_by_id(ldns_algorithms, alg) == NULL)
|
|
errx(1, "unsupported algorithm %s", argv[0]);
|
|
|
|
key = ldns_key_new_frm_algorithm(alg, bits);
|
|
if (key == NULL)
|
|
errx(1, "error generating key of type %s", argv[0]);
|
|
|
|
/* ldns_key_print uses stdout to signal errors */
|
|
str = ldns_key2str(key);
|
|
if (str == NULL)
|
|
errx(1, "ldns_key2str");
|
|
fputs(str, stdout);
|
|
|
|
ldns_key_deep_free(key);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
main(int argc, char *argv[])
|
|
{
|
|
const ldns_lookup_table *lt;
|
|
ldns_key *key;
|
|
ldns_signing_algorithm alg;
|
|
ldns_hash hash_alg;
|
|
const char *errstr, *domain;
|
|
long long n;
|
|
int ch, rc;
|
|
int aflag, bflag, dflag, kflag, rflag;
|
|
uint16_t bits;
|
|
|
|
aflag = bflag = dflag = kflag = rflag = 0;
|
|
hash_alg = LDNS_SHA256;
|
|
bits = 0;
|
|
domain = ".";
|
|
while ((ch = getopt(argc, argv, "a:b:d:kr")) != -1) {
|
|
switch (ch) {
|
|
case 'a':
|
|
aflag = 1;
|
|
hash_alg = ldnssec_get_hash_algorithm_by_name(optarg);
|
|
if (!ldns_lookup_by_id(ldnssec_hashes, hash_alg))
|
|
errx(1, "-a: unsupported algorithm: %s",
|
|
optarg);
|
|
break;
|
|
case 'b':
|
|
bflag = 1;
|
|
n = strtonum(optarg, 0, UINT16_MAX, &errstr);
|
|
if (errstr != NULL)
|
|
errx(1, "-b: bits is %s: %s", errstr, optarg);
|
|
bits = n;
|
|
break;
|
|
case 'd':
|
|
dflag = 1;
|
|
domain = optarg;
|
|
break;
|
|
case 'k':
|
|
kflag = 1;
|
|
break;
|
|
case 'r':
|
|
rflag = 1;
|
|
break;
|
|
default:
|
|
usage();
|
|
}
|
|
}
|
|
argc -= optind;
|
|
argv += optind;
|
|
|
|
if (bflag && (aflag || dflag || rflag || kflag))
|
|
errx(1, "-b is mutually exclusive with -d, -k and -r");
|
|
if (aflag && !rflag)
|
|
errx(1, "can't use -a without -r");
|
|
if (dflag && !rflag)
|
|
errx(1, "can't use -d without -r");
|
|
if (kflag && !rflag)
|
|
errx(1, "can't use -k without -r");
|
|
|
|
rc = 1;
|
|
if (rflag)
|
|
rc = print_record_main(hash_alg, kflag, domain, argc, argv);
|
|
else
|
|
rc = keygen_main(bits, argc, argv);
|
|
|
|
return rc;
|
|
}
|