ldns  1.7.0
ldns-signzone.c
Go to the documentation of this file.
1 /*
2  * ldns-signzone signs a zone file
3  *
4  * (c) NLnet Labs, 2005 - 2008
5  * See the file LICENSE for the license
6  */
7 
8 #include <stdio.h>
9 
10 #include "config.h"
11 
12 #ifdef HAVE_SSL
13 
14 #include <stdlib.h>
15 #include <unistd.h>
16 
17 #include <errno.h>
18 
19 #include <time.h>
20 
21 #include <ldns/ldns.h>
22 #include <ldns/keys.h>
23 
24 #include <openssl/conf.h>
25 #ifndef OPENSSL_NO_ENGINE
26 #include <openssl/engine.h>
27 #endif
28 #include <openssl/err.h>
29 
30 #define MAX_FILENAME_LEN 250
31 
32 char *prog;
33 int verbosity = 1;
34 
35 static void
36 usage(FILE *fp, const char *prog) {
37  fprintf(fp, "%s [OPTIONS] zonefile key [key [key]]\n", prog);
38  fprintf(fp, " signs the zone with the given key(s)\n");
39  fprintf(fp, " -b\t\tuse layout in signed zone and print comments DNSSEC records\n");
40  fprintf(fp, " -d\t\tused keys are not added to the zone\n");
41  fprintf(fp, " -e <date>\texpiration date\n");
42  fprintf(fp, " -f <file>\toutput zone to file (default <name>.signed)\n");
43  fprintf(fp, " -i <date>\tinception date\n");
44  fprintf(fp, " -o <domain>\torigin for the zone\n");
45  fprintf(fp, " -u\t\tset SOA serial to the number of seconds since 1-1-1970\n");
46  fprintf(fp, " -v\t\tprint version and exit\n");
47  fprintf(fp, " -A\t\tsign DNSKEY with all keys instead of minimal\n");
48  fprintf(fp, " -U\t\tSign with every unique algorithm in the provided keys\n");
49 #ifndef OPENSSL_NO_ENGINE
50  fprintf(fp, " -E <name>\tuse <name> as the crypto engine for signing\n");
51  fprintf(fp, " \tThis can have a lot of extra options, see the manual page for more info\n");
52  fprintf(fp, " -k <algorithm>,<key>\tuse `key' with `algorithm' from engine as ZSK\n");
53  fprintf(fp, " -K <algorithm>,<key>\tuse `key' with `algorithm' from engine as KSK\n");
54 #endif
55  fprintf(fp, " -n\t\tuse NSEC3 instead of NSEC.\n");
56  fprintf(fp, "\t\tIf you use NSEC3, you can specify the following extra options:\n");
57  fprintf(fp, "\t\t-a [algorithm] hashing algorithm\n");
58  fprintf(fp, "\t\t-t [number] number of hash iterations\n");
59  fprintf(fp, "\t\t-s [string] salt\n");
60  fprintf(fp, "\t\t-p set the opt-out flag on all nsec3 rrs\n");
61  fprintf(fp, "\n");
62  fprintf(fp, " keys must be specified by their base name (usually K<name>+<alg>+<id>),\n");
63  fprintf(fp, " i.e. WITHOUT the .private extension.\n");
64  fprintf(fp, " If the public part of the key is not present in the zone, the DNSKEY RR\n");
65  fprintf(fp, " will be read from the file called <base name>.key. If that does not exist,\n");
66  fprintf(fp, " a default DNSKEY will be generated from the private key and added to the zone.\n");
67  fprintf(fp, " A date can be a timestamp (seconds since the epoch), or of\n the form <YYYYMMdd[hhmmss]>\n");
68 #ifndef OPENSSL_NO_ENGINE
69  fprintf(fp, " For -k or -K, the algorithm can be specified as an integer or a symbolic name:" );
70 
71 #define __LIST(x) fprintf ( fp, " %3d: %-15s", LDNS_SIGN_ ## x, # x )
72 
73  fprintf ( fp, "\n " );
74  __LIST ( RSAMD5 );
75  __LIST ( DSA );
76  __LIST ( RSASHA1 );
77  fprintf ( fp, "\n " );
78  __LIST ( DSA_NSEC3 );
79  __LIST ( RSASHA1_NSEC3 );
80  __LIST ( RSASHA256 );
81  fprintf ( fp, "\n " );
82  __LIST ( RSASHA512 );
83  __LIST ( ECC_GOST );
84  __LIST ( ECDSAP256SHA256 );
85  fprintf ( fp, "\n " );
86  __LIST ( ECDSAP384SHA384 );
87 
88 #ifdef USE_ED25519
89  __LIST ( ED25519 );
90 #endif
91 
92 #ifdef USE_ED448
93  __LIST ( ED448 );
94 #endif
95  fprintf ( fp, "\n" );
96 
97 #undef __LIST
98 #endif
99 }
100 
101 static void check_tm(struct tm tm)
102 {
103  if (tm.tm_year < 70) {
104  fprintf(stderr, "You cannot specify dates before 1970\n");
105  exit(EXIT_FAILURE);
106  }
107  if (tm.tm_mon < 0 || tm.tm_mon > 11) {
108  fprintf(stderr, "The month must be in the range 1 to 12\n");
109  exit(EXIT_FAILURE);
110  }
111  if (tm.tm_mday < 1 || tm.tm_mday > 31) {
112  fprintf(stderr, "The day must be in the range 1 to 31\n");
113  exit(EXIT_FAILURE);
114  }
115 
116  if (tm.tm_hour < 0 || tm.tm_hour > 23) {
117  fprintf(stderr, "The hour must be in the range 0-23\n");
118  exit(EXIT_FAILURE);
119  }
120 
121  if (tm.tm_min < 0 || tm.tm_min > 59) {
122  fprintf(stderr, "The minute must be in the range 0-59\n");
123  exit(EXIT_FAILURE);
124  }
125 
126  if (tm.tm_sec < 0 || tm.tm_sec > 59) {
127  fprintf(stderr, "The second must be in the range 0-59\n");
128  exit(EXIT_FAILURE);
129  }
130 
131 }
132 
133 /*
134  * if the ttls are different, make them equal
135  * if one of the ttls equals LDNS_DEFAULT_TTL, that one is changed
136  * otherwise, rr2 will get the ttl of rr1
137  *
138  * prints a warning if a non-default TTL is changed
139  */
140 static void
141 equalize_ttls(ldns_rr *rr1, ldns_rr *rr2, uint32_t default_ttl)
142 {
143  uint32_t ttl1, ttl2;
144 
145  ttl1 = ldns_rr_ttl(rr1);
146  ttl2 = ldns_rr_ttl(rr2);
147 
148  if (ttl1 != ttl2) {
149  if (ttl1 == default_ttl) {
150  ldns_rr_set_ttl(rr1, ttl2);
151  } else if (ttl2 == default_ttl) {
152  ldns_rr_set_ttl(rr2, ttl1);
153  } else {
154  ldns_rr_set_ttl(rr2, ttl1);
155  fprintf(stderr,
156  "warning: changing non-default TTL %u to %u\n",
157  (unsigned int) ttl2, (unsigned int) ttl1);
158  }
159  }
160 }
161 
162 static void
163 equalize_ttls_rr_list(ldns_rr_list *rr_list, ldns_rr *rr, uint32_t default_ttl)
164 {
165  size_t i;
166  ldns_rr *cur_rr;
167 
168  for (i = 0; i < ldns_rr_list_rr_count(rr_list); i++) {
169  cur_rr = ldns_rr_list_rr(rr_list, i);
170  if (ldns_rr_compare_no_rdata(cur_rr, rr) == 0) {
171  equalize_ttls(cur_rr, rr, default_ttl);
172  }
173  }
174 }
175 
176 static ldns_rr *
177 find_key_in_zone(ldns_rr *pubkey_gen, ldns_zone *zone) {
178  size_t key_i;
179  ldns_rr *pubkey;
180 
181  for (key_i = 0;
182  key_i < ldns_rr_list_rr_count(ldns_zone_rrs(zone));
183  key_i++) {
184  pubkey = ldns_rr_list_rr(ldns_zone_rrs(zone), key_i);
185  if (ldns_rr_get_type(pubkey) == LDNS_RR_TYPE_DNSKEY &&
186  (ldns_calc_keytag(pubkey)
187  ==
188  ldns_calc_keytag(pubkey_gen) ||
189  /* KSK has gen-keytag + 1 */
190  ldns_calc_keytag(pubkey)
191  ==
192  ldns_calc_keytag(pubkey_gen) + 1)
193  ) {
194  if (verbosity >= 2) {
195  fprintf(stderr, "Found it in the zone!\n");
196  }
197  return pubkey;
198  }
199  }
200  return NULL;
201 }
202 
203 static ldns_rr *
204 find_key_in_file(const char *keyfile_name_base, ldns_key* ATTR_UNUSED(key),
205  uint32_t zone_ttl)
206 {
207  char *keyfile_name;
208  FILE *keyfile;
209  int line_nr;
210  uint32_t default_ttl = zone_ttl;
211 
212  ldns_rr *pubkey = NULL;
213  keyfile_name = LDNS_XMALLOC(char,
214  strlen(keyfile_name_base) + 5);
215  snprintf(keyfile_name,
216  strlen(keyfile_name_base) + 5,
217  "%s.key",
218  keyfile_name_base);
219  if (verbosity >= 2) {
220  fprintf(stderr, "Trying to read %s\n", keyfile_name);
221  }
222  keyfile = fopen(keyfile_name, "r");
223  line_nr = 0;
224  if (keyfile) {
225  if (ldns_rr_new_frm_fp_l(&pubkey,
226  keyfile,
227  &default_ttl,
228  NULL,
229  NULL,
230  &line_nr) ==
231  LDNS_STATUS_OK) {
232  if (verbosity >= 2) {
233  printf("Key found in file: %s\n", keyfile_name);
234  }
235  }
236  fclose(keyfile);
237  }
238  LDNS_FREE(keyfile_name);
239  return pubkey;
240 }
241 
242 /* this function tries to find the specified keys either in the zone that
243  * has been read, or in a <basename>.key file. If the key is not found,
244  * a public key is generated, and it is assumed the key is a ZSK
245  *
246  * if add_keys is true; the DNSKEYs are added to the zone prior to signing
247  * if it is false, they are not added.
248  * Even if keys are not added, the function is still needed, to check
249  * whether keys of which we only have key data are KSKs or ZSKS
250  */
251 static void
252 find_or_create_pubkey(const char *keyfile_name_base, ldns_key *key, ldns_zone *orig_zone, bool add_keys, uint32_t default_ttl) {
253  ldns_rr *pubkey_gen, *pubkey;
254  int key_in_zone;
255 
256  if (default_ttl == LDNS_DEFAULT_TTL) {
257  default_ttl = ldns_rr_ttl(ldns_zone_soa(orig_zone));
258  }
259 
260  if (!ldns_key_pubkey_owner(key)) {
262  }
263 
264  /* find the public key in the zone, or in a
265  * separate file
266  * we 'generate' one anyway,
267  * then match that to any present in the zone,
268  * if it matches, we drop our own. If not,
269  * we try to see if there is a .key file present.
270  * If not, we use our own generated one, with
271  * some default values
272  *
273  * Even if -d (do-not-add-keys) is specified,
274  * we still need to do this, because we need
275  * to have any key flags that are set this way
276  */
277  pubkey_gen = ldns_key2rr(key);
278  ldns_rr_set_ttl(pubkey_gen, default_ttl);
279 
280  if (verbosity >= 2) {
281  fprintf(stderr,
282  "Looking for key with keytag %u or %u\n",
283  (unsigned int) ldns_calc_keytag(pubkey_gen),
284  (unsigned int) ldns_calc_keytag(pubkey_gen)+1
285  );
286  }
287 
288  pubkey = find_key_in_zone(pubkey_gen, orig_zone);
289  key_in_zone = 1;
290  if (!pubkey) {
291  key_in_zone = 0;
292  /* it was not in the zone, try to read a .key file */
293  pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
294  if (!pubkey && !(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
295  /* maybe it is a ksk? */
296  ldns_key_set_keytag(key, ldns_key_keytag(key) + 1);
297  pubkey = find_key_in_file(keyfile_name_base, key, default_ttl);
298  if (!pubkey) {
299  /* ok, no file, set back to ZSK */
300  ldns_key_set_keytag(key, ldns_key_keytag(key) - 1);
301  }
302  }
303  if(pubkey && ldns_dname_compare(ldns_rr_owner(pubkey), ldns_rr_owner(ldns_zone_soa(orig_zone))) != 0) {
304  fprintf(stderr, "Error %s.key has wrong name: %s\n",
305  keyfile_name_base, ldns_rdf2str(ldns_rr_owner(pubkey)));
306  exit(EXIT_FAILURE); /* leak rdf2str, but we exit */
307  }
308  }
309 
310  if (!pubkey) {
311  /* okay, no public key found,
312  just use our generated one */
313  pubkey = pubkey_gen;
314  if (verbosity >= 2) {
315  fprintf(stderr, "Not in zone, no .key file, generating ZSK DNSKEY from private key data\n");
316  }
317  } else {
318  ldns_rr_free(pubkey_gen);
319  }
322 
323  if (add_keys && !key_in_zone) {
324  equalize_ttls_rr_list(ldns_zone_rrs(orig_zone), pubkey, default_ttl);
325  ldns_zone_push_rr(orig_zone, pubkey);
326  }
327 }
328 
329 #ifndef OPENSSL_NO_ENGINE
330 /*
331  * For keys coming from the engine (-k or -K), parse algoritm specification.
332  */
333 static enum ldns_enum_signing_algorithm
334 parse_algspec ( const char * const p )
335 {
336  if ( p == NULL )
337  return 0;
338 
339  if ( isdigit ( (const unsigned char)*p ) ) {
340  const char *nptr = NULL;
341  const long id = strtol ( p, (char **) &nptr, 10 );
342  return id > 0 && nptr != NULL && *nptr == ',' ? id : 0;
343  }
344 
345 #define __MATCH(x) \
346  if ( !memcmp ( # x, p, sizeof ( # x ) - 1 ) \
347  && p [ sizeof ( # x ) - 1 ] == ',' ) { \
348  return LDNS_SIGN_ ## x; \
349  }
350 
351  __MATCH ( RSAMD5 );
352  __MATCH ( RSASHA1 );
353  __MATCH ( DSA );
354  __MATCH ( RSASHA1_NSEC3 );
355  __MATCH ( RSASHA256 );
356  __MATCH ( RSASHA512 );
357  __MATCH ( DSA_NSEC3 );
358  __MATCH ( ECC_GOST );
359  __MATCH ( ECDSAP256SHA256 );
360  __MATCH ( ECDSAP384SHA384 );
361 
362 #ifdef USE_ED25519
363  __MATCH ( ED25519 );
364 #endif
365 
366 #ifdef USE_ED448
367  __MATCH ( ED448 );
368 #endif
369 
370 #undef __MATCH
371 
372  return 0;
373 }
374 
375 /*
376  * For keys coming from the engine (-k or -K), parse key specification
377  * in the form of <algorithm>,<key-id>. No whitespace is allowed
378  * between <algorithm> and the comma, and between the comma and
379  * <key-id>. <key-id> format is specific to the engine at hand, i.e.
380  * it can be the old OpenSC syntax or a PKCS #11 URI as defined in RFC 7512
381  * and (partially) supported by OpenSC (as of 20180312).
382  */
383 static const char *
384 parse_keyspec ( const char * const p,
385  enum ldns_enum_signing_algorithm * const algorithm,
386  const char ** const id )
387 {
388  const char * const comma = strchr ( p, ',' );
389 
390  if ( comma == NULL || !(*algorithm = parse_algspec ( p )) )
391  return NULL;
392  return comma [ 1 ] ? *id = comma + 1 : NULL;
393 }
394 
395 /*
396  * Load a key from the engine.
397  */
398 static ldns_key *
399 load_key ( const char * const p, ENGINE * const e )
400 {
401  enum ldns_enum_signing_algorithm alg = 0;
402  const char *id = NULL;
403  ldns_status status = LDNS_STATUS_ERR;
404  ldns_key *key = NULL;
405 
406  /* Parse key specification. */
407  if ( parse_keyspec ( p, &alg, &id ) == NULL ) {
408  fprintf ( stderr,
409  "Failed to parse key specification `%s'.\n",
410  p );
411  usage ( stderr, prog );
412  exit ( EXIT_FAILURE );
413  }
414 
415  /* Validate that the algorithm can be used for signing. */
416  switch ( alg ) {
417  case LDNS_SIGN_RSAMD5:
418  case LDNS_SIGN_RSASHA1:
420  case LDNS_SIGN_RSASHA256:
421  case LDNS_SIGN_RSASHA512:
422  case LDNS_SIGN_DSA:
423  case LDNS_SIGN_DSA_NSEC3:
424  case LDNS_SIGN_ECC_GOST:
425 #ifdef USE_ECDSA
428 #endif
429  break;
430  default:
431  fprintf ( stderr,
432  "Algorithm %d cannot be used for signing.\n",
433  alg );
434  usage ( stderr, prog );
435  exit ( EXIT_FAILURE );
436  }
437 
438  printf ( "Engine key id: %s, algo %d\n", id, alg );
439 
440  /* Attempt to load the key from the engine. */
441  status = ldns_key_new_frm_engine (
442  &key, e, (char *) id, (ldns_algorithm)alg );
443  if ( status != LDNS_STATUS_OK ) {
444  ERR_print_errors_fp ( stderr );
445  exit ( EXIT_FAILURE );
446  }
447 
448  return key;
449 }
450 
451 /*
452  * For keys coming from the engine (-k or -K), set key parameters
453  * and determine whether the key is listed in the zone file.
454  */
455 static void
456 post_process_engine_key ( ldns_key_list * const keys,
457  ldns_key * const key,
458  ldns_zone * const zone,
459  const bool add_keys,
460  const uint32_t ttl,
461  const uint32_t inception,
462  const uint32_t expiration )
463 {
464  if ( key == NULL ) return;
465 
466  if ( expiration ) ldns_key_set_expiration ( key, expiration );
467 
468  if ( inception ) ldns_key_set_inception ( key, inception );
469 
470  ldns_key_list_push_key ( keys, key );
471  find_or_create_pubkey ( "", key, zone, add_keys, ttl );
472 }
473 
474 /*
475  * Initialize OpenSSL, for versions 1.1 and newer.
476  */
477 static ENGINE *
478 init_openssl_engine ( const char * const id )
479 {
480  ENGINE *e = NULL;
481 
482 #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
483  ERR_load_crypto_strings();
484 #endif
485 #if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL) || !defined(HAVE_OPENSSL_INIT_CRYPTO)
486  OpenSSL_add_all_algorithms();
487 #else
488  if ( !OPENSSL_init_crypto ( OPENSSL_INIT_LOAD_CONFIG, NULL ) ) {
489  fprintf ( stderr, "OPENSSL_init_crypto(3) failed.\n" );
490  ERR_print_errors_fp ( stderr );
491  exit ( EXIT_FAILURE );
492  }
493 #endif
494 
495  if ( (e = ENGINE_by_id ( id )) == NULL ) {
496  fprintf ( stderr, "ENGINE_by_id(3) failed.\n" );
497  ERR_print_errors_fp ( stderr );
498  exit ( EXIT_FAILURE );
499  }
500 
501  if ( !ENGINE_set_default_DSA ( e ) ) {
502  fprintf ( stderr, "ENGINE_set_default_DSA(3) failed.\n" );
503  ERR_print_errors_fp ( stderr );
504  exit ( EXIT_FAILURE );
505  }
506 
507  if ( !ENGINE_set_default_RSA ( e ) ) {
508  fprintf ( stderr, "ENGINE_set_default_RSA(3) failed.\n" );
509  ERR_print_errors_fp ( stderr );
510  exit ( EXIT_FAILURE );
511  }
512 
513  return e;
514 }
515 
516 /*
517  * De-initialize OpenSSL, for versions 1.1 and newer.
518  *
519  * All of that is not strictly necessary because the process exits
520  * anyway, however, when an engine is used, this is the only hope
521  * of letting the engine's driver know that the program terminates
522  * (for the fear that the driver's reference counting may go awry, etc.)
523  * Still, there is no guarantee that this function helps...
524  */
525 static void
526 shutdown_openssl ( ENGINE * const e )
527 {
528  if ( e != NULL ) {
529  ENGINE_free ( e );
530  ENGINE_cleanup ();
531  }
532 
533  CONF_modules_unload ( 1 );
534  EVP_cleanup ();
535  CRYPTO_cleanup_all_ex_data ();
536  ERR_free_strings ();
537 }
538 #endif
539 
540 int
541 main(int argc, char *argv[])
542 {
543  const char *zonefile_name;
544  FILE *zonefile = NULL;
545  int line_nr = 0;
546  int c;
547  int argi;
548 #ifndef OPENSSL_NO_ENGINE
549  ENGINE *engine = NULL;
550 #endif
551  ldns_zone *orig_zone;
552  ldns_rr_list *orig_rrs = NULL;
553  ldns_rr *orig_soa = NULL;
554  ldns_dnssec_zone *signed_zone;
555 
556  char *keyfile_name_base;
557  char *keyfile_name = NULL;
558  FILE *keyfile = NULL;
559  ldns_key *key = NULL;
560 #ifndef OPENSSL_NO_ENGINE
561  ldns_key *eng_ksk = NULL; /* KSK specified with -K */
562  ldns_key *eng_zsk = NULL; /* ZSK specified with -k */
563 #endif
564  ldns_key_list *keys;
565  ldns_status s;
566  size_t i;
567  ldns_rr_list *added_rrs;
568 
569  char *outputfile_name = NULL;
570  FILE *outputfile;
571 
572  bool use_nsec3 = false;
573  int signflags = 0;
574  bool unixtime_serial = false;
575 
576  /* Add the given keys to the zone if they are not yet present */
577  bool add_keys = true;
578  uint8_t nsec3_algorithm = 1;
579  uint8_t nsec3_flags = 0;
580  size_t nsec3_iterations_cmd = 1;
581  uint16_t nsec3_iterations = 1;
582  uint8_t nsec3_salt_length = 0;
583  uint8_t *nsec3_salt = NULL;
584 
585  /* we need to know the origin before reading ksk's,
586  * so keep an array of filenames until we know it
587  */
588  struct tm tm;
589  uint32_t inception;
590  uint32_t expiration;
591  ldns_rdf *origin = NULL;
592  uint32_t ttl = LDNS_DEFAULT_TTL;
594 
595  ldns_status result;
596 
598  ldns_output_format* fmt = ldns_output_format_init(&fmt_st);
599 
600  prog = strdup(argv[0]);
601  inception = 0;
602  expiration = 0;
603 
604  keys = ldns_key_list_new();
605 
606  while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:uvAUE:K:")) != -1) {
607  switch (c) {
608  case 'a':
609  nsec3_algorithm = (uint8_t) atoi(optarg);
610  if (nsec3_algorithm != 1) {
611  fprintf(stderr, "Bad NSEC3 algorithm, only RSASHA1 allowed\n");
612  exit(EXIT_FAILURE);
613  }
614  break;
615  case 'b':
616  ldns_output_format_set(fmt, LDNS_COMMENT_FLAGS
620  break;
621  case 'd':
622  add_keys = false;
623  break;
624  case 'e':
625  /* try to parse YYYYMMDD first,
626  * if that doesn't work, it
627  * should be a timestamp (seconds since epoch)
628  */
629  memset(&tm, 0, sizeof(tm));
630 
631  if (strlen(optarg) == 8 &&
632  sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
633  ) {
634  tm.tm_year -= 1900;
635  tm.tm_mon--;
636  check_tm(tm);
637  expiration =
638  (uint32_t) ldns_mktime_from_utc(&tm);
639  } else if (strlen(optarg) == 14 &&
640  sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
641  ) {
642  tm.tm_year -= 1900;
643  tm.tm_mon--;
644  check_tm(tm);
645  expiration =
646  (uint32_t) ldns_mktime_from_utc(&tm);
647  } else {
648  expiration = (uint32_t) atol(optarg);
649  }
650  break;
651  case 'f':
652  outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN);
653  strncpy(outputfile_name, optarg, MAX_FILENAME_LEN);
654  break;
655  case 'i':
656  memset(&tm, 0, sizeof(tm));
657 
658  if (strlen(optarg) == 8 &&
659  sscanf(optarg, "%4d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday)
660  ) {
661  tm.tm_year -= 1900;
662  tm.tm_mon--;
663  check_tm(tm);
664  inception =
665  (uint32_t) ldns_mktime_from_utc(&tm);
666  } else if (strlen(optarg) == 14 &&
667  sscanf(optarg, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec)
668  ) {
669  tm.tm_year -= 1900;
670  tm.tm_mon--;
671  check_tm(tm);
672  inception =
673  (uint32_t) ldns_mktime_from_utc(&tm);
674  } else {
675  inception = (uint32_t) atol(optarg);
676  }
677  break;
678  case 'n':
679  use_nsec3 = true;
680  break;
681  case 'o':
682  if (ldns_str2rdf_dname(&origin, optarg) != LDNS_STATUS_OK) {
683  fprintf(stderr, "Bad origin, not a correct domain name\n");
684  usage(stderr, prog);
685  exit(EXIT_FAILURE);
686  }
687  break;
688  case 'p':
689  nsec3_flags = nsec3_flags | LDNS_NSEC3_VARS_OPTOUT_MASK;
690  break;
691  case 'u':
692  unixtime_serial = true;
693  break;
694  case 'v':
695  printf("zone signer version %s (ldns version %s)\n", LDNS_VERSION, ldns_version());
696  exit(EXIT_SUCCESS);
697  break;
698  case 'A':
699  signflags |= LDNS_SIGN_DNSKEY_WITH_ZSK;
700  break;
701  case 'E':
702 #ifndef OPENSSL_NO_ENGINE
703  engine = init_openssl_engine ( optarg );
704  break;
705 #else
706  /* fallthrough */
707 #endif
708  case 'k':
709 #ifndef OPENSSL_NO_ENGINE
710  eng_zsk = load_key ( optarg, engine );
711  break;
712 #else
713  /* fallthrough */
714 #endif
715  case 'K':
716 #ifndef OPENSSL_NO_ENGINE
717  eng_ksk = load_key ( optarg, engine );
718  /* I apologize for that, there is no API. */
719  eng_ksk -> _extra.dnssec.flags |= LDNS_KEY_SEP_KEY;
720 #else
721  fprintf(stderr, "%s compiled without engine support\n"
722  , prog);
723  exit(EXIT_FAILURE);
724 #endif
725  break;
726  case 'U':
727  signflags |= LDNS_SIGN_WITH_ALL_ALGORITHMS;
728  break;
729  case 's':
730  if (strlen(optarg) % 2 != 0) {
731  fprintf(stderr, "Salt value is not valid hex data, not a multiple of 2 characters\n");
732  exit(EXIT_FAILURE);
733  }
734  nsec3_salt_length = (uint8_t) strlen(optarg) / 2;
735  nsec3_salt = LDNS_XMALLOC(uint8_t, nsec3_salt_length);
736  for (c = 0; c < (int) strlen(optarg); c += 2) {
737  if (isxdigit((int) optarg[c]) && isxdigit((int) optarg[c+1])) {
738  nsec3_salt[c/2] = (uint8_t) ldns_hexdigit_to_int(optarg[c]) * 16 +
739  ldns_hexdigit_to_int(optarg[c+1]);
740  } else {
741  fprintf(stderr, "Salt value is not valid hex data.\n");
742  exit(EXIT_FAILURE);
743  }
744  }
745 
746  break;
747  case 't':
748  nsec3_iterations_cmd = (size_t) atol(optarg);
749  if (nsec3_iterations_cmd > LDNS_NSEC3_MAX_ITERATIONS) {
750  fprintf(stderr, "Iterations count can not exceed %u, quitting\n", LDNS_NSEC3_MAX_ITERATIONS);
751  exit(EXIT_FAILURE);
752  }
753  nsec3_iterations = (uint16_t) nsec3_iterations_cmd;
754  break;
755  default:
756  usage(stderr, prog);
757  exit(EXIT_SUCCESS);
758  }
759  }
760 
761  argc -= optind;
762  argv += optind;
763 
764  if (argc < 1) {
765  printf("Error: not enough arguments\n");
766  usage(stdout, prog);
767  exit(EXIT_FAILURE);
768  } else {
769  zonefile_name = argv[0];
770  }
771 
772  /* read zonefile first to find origin if not specified */
773 
774  if (strncmp(zonefile_name, "-", 2) == 0) {
775  s = ldns_zone_new_frm_fp_l(&orig_zone,
776  stdin,
777  origin,
778  ttl,
779  class,
780  &line_nr);
781  if (s != LDNS_STATUS_OK) {
782  fprintf(stderr, "Zone not read, error: %s at stdin line %d\n",
784  line_nr);
785  exit(EXIT_FAILURE);
786  } else {
787  orig_soa = ldns_zone_soa(orig_zone);
788  if (!orig_soa) {
789  fprintf(stderr,
790  "Error reading zonefile: missing SOA record\n");
791  exit(EXIT_FAILURE);
792  }
793  orig_rrs = ldns_zone_rrs(orig_zone);
794  if (!orig_rrs) {
795  fprintf(stderr,
796  "Error reading zonefile: no resource records\n");
797  exit(EXIT_FAILURE);
798  }
799  }
800  } else {
801  zonefile = fopen(zonefile_name, "r");
802 
803  if (!zonefile) {
804  fprintf(stderr,
805  "Error: unable to read %s (%s)\n",
806  zonefile_name,
807  strerror(errno));
808  exit(EXIT_FAILURE);
809  } else {
810  s = ldns_zone_new_frm_fp_l(&orig_zone,
811  zonefile,
812  origin,
813  ttl,
814  class,
815  &line_nr);
816  if (s != LDNS_STATUS_OK) {
817  fprintf(stderr, "Zone not read, error: %s at %s line %d\n",
819  zonefile_name, line_nr);
820  exit(EXIT_FAILURE);
821  } else {
822  orig_soa = ldns_zone_soa(orig_zone);
823  if (!orig_soa) {
824  fprintf(stderr,
825  "Error reading zonefile: missing SOA record\n");
826  exit(EXIT_FAILURE);
827  }
828  orig_rrs = ldns_zone_rrs(orig_zone);
829  if (!orig_rrs) {
830  fprintf(stderr,
831  "Error reading zonefile: no resource records\n");
832  exit(EXIT_FAILURE);
833  }
834  }
835  fclose(zonefile);
836  }
837  }
838 
839  /* read the ZSKs */
840  argi = 1;
841  while (argi < argc) {
842  keyfile_name_base = argv[argi];
843  keyfile_name = LDNS_XMALLOC(char, strlen(keyfile_name_base) + 9);
844  snprintf(keyfile_name,
845  strlen(keyfile_name_base) + 9,
846  "%s.private",
847  keyfile_name_base);
848  keyfile = fopen(keyfile_name, "r");
849  line_nr = 0;
850  if (!keyfile) {
851  fprintf(stderr,
852  "Error: unable to read %s: %s\n",
853  keyfile_name,
854  strerror(errno));
855  } else {
856  s = ldns_key_new_frm_fp_l(&key, keyfile, &line_nr);
857  fclose(keyfile);
858  if (s == LDNS_STATUS_OK) {
859  /* set times in key? they will end up
860  in the rrsigs
861  */
862  if (expiration != 0) {
863  ldns_key_set_expiration(key, expiration);
864  }
865  if (inception != 0) {
866  ldns_key_set_inception(key, inception);
867  }
868 
869  LDNS_FREE(keyfile_name);
870 
871  ldns_key_list_push_key(keys, key);
872  } else {
873  fprintf(stderr, "Error reading key from %s at line %d: %s\n", argv[argi], line_nr, ldns_get_errorstr_by_id(s));
874  }
875  }
876  /* and, if not unset by -p, find or create the corresponding DNSKEY record */
877  if (key) {
878  find_or_create_pubkey(keyfile_name_base, key,
879  orig_zone, add_keys, ttl);
880  }
881  argi++;
882  }
883 
884 #ifndef OPENSSL_NO_ENGINE
885  /*
886  * The user may have loaded a KSK and a ZSK from the engine.
887  * Since these keys carry no meta-information which is
888  * relevant to DNS (origin, TTL, etc), and because that
889  * information becomes known only after the command line
890  * and the zone file are parsed completely, the program
891  * needs to post-process these keys before they become usable.
892  */
893 
894  /* The engine's KSK. */
895  post_process_engine_key ( keys,
896  eng_ksk,
897  orig_zone,
898  add_keys,
899  ttl,
900  inception,
901  expiration );
902 
903  /* The engine's ZSK. */
904  post_process_engine_key ( keys,
905  eng_zsk,
906  orig_zone,
907  add_keys,
908  ttl,
909  inception,
910  expiration );
911 #endif
912 
913  if (ldns_key_list_key_count(keys) < 1) {
914  fprintf(stderr, "Error: no keys to sign with. Aborting.\n\n");
915  usage(stderr, prog);
916  exit(EXIT_FAILURE);
917  }
918 
919  signed_zone = ldns_dnssec_zone_new();
920  if (unixtime_serial) {
923  }
924  if (ldns_dnssec_zone_add_rr(signed_zone, ldns_zone_soa(orig_zone)) !=
925  LDNS_STATUS_OK) {
926  fprintf(stderr,
927  "Error adding SOA to dnssec zone, skipping record\n");
928  }
929 
930  for (i = 0;
931  i < ldns_rr_list_rr_count(ldns_zone_rrs(orig_zone));
932  i++) {
933  if (ldns_dnssec_zone_add_rr(signed_zone,
934  ldns_rr_list_rr(ldns_zone_rrs(orig_zone),
935  i)) !=
936  LDNS_STATUS_OK) {
937  fprintf(stderr,
938  "Error adding RR to dnssec zone");
939  fprintf(stderr, ", skipping record:\n");
940  ldns_rr_print(stderr,
941  ldns_rr_list_rr(ldns_zone_rrs(orig_zone), i));
942  }
943  }
944 
945  /* list to store newly created rrs, so we can free them later */
946  added_rrs = ldns_rr_list_new();
947 
948  if (use_nsec3) {
949  result = ldns_dnssec_zone_sign_nsec3_flg_mkmap(signed_zone,
950  added_rrs,
951  keys,
953  NULL,
954  nsec3_algorithm,
955  nsec3_flags,
956  nsec3_iterations,
957  nsec3_salt_length,
958  nsec3_salt,
959  signflags,
960  &fmt_st.hashmap);
961  } else {
962  result = ldns_dnssec_zone_sign_flg(signed_zone,
963  added_rrs,
964  keys,
966  NULL,
967  signflags);
968  }
969  if (result != LDNS_STATUS_OK) {
970  fprintf(stderr, "Error signing zone: %s\n",
971  ldns_get_errorstr_by_id(result));
972  }
973 
974  if (!outputfile_name) {
975  outputfile_name = LDNS_XMALLOC(char, MAX_FILENAME_LEN);
976  snprintf(outputfile_name, MAX_FILENAME_LEN, "%s.signed", zonefile_name);
977  }
978 
979  if (signed_zone) {
980  if (strncmp(outputfile_name, "-", 2) == 0) {
981  ldns_dnssec_zone_print(stdout, signed_zone);
982  } else {
983  outputfile = fopen(outputfile_name, "w");
984  if (!outputfile) {
985  fprintf(stderr, "Unable to open %s for writing: %s\n",
986  outputfile_name, strerror(errno));
987  } else {
989  outputfile, fmt, signed_zone);
990  fclose(outputfile);
991  }
992  }
993  } else {
994  fprintf(stderr, "Error signing zone.\n");
995 
996 #ifdef HAVE_SSL
997  if (ERR_peek_error()) {
998  ERR_load_crypto_strings();
999  ERR_print_errors_fp(stderr);
1000  ERR_free_strings();
1001  }
1002 #endif
1003  exit(EXIT_FAILURE);
1004  }
1005 
1006  ldns_key_list_free(keys);
1007  /* since the ldns_rr records are pointed to in both the ldns_zone
1008  * and the ldns_dnssec_zone, we can either deep_free the
1009  * dnssec_zone and 'shallow' free the original zone and added
1010  * records, or the other way around
1011  */
1012  ldns_dnssec_zone_free(signed_zone);
1013  ldns_zone_deep_free(orig_zone);
1014  ldns_rr_list_deep_free(added_rrs);
1015 
1016  LDNS_FREE(outputfile_name);
1017 
1018 #ifndef OPENSSL_NO_ENGINE
1019  shutdown_openssl ( engine );
1020 #else
1021  CRYPTO_cleanup_all_ex_data();
1022 #endif
1023 
1024  free(prog);
1025  exit(EXIT_SUCCESS);
1026 }
1027 
1028 #else /* !HAVE_SSL */
1029 int
1030 main(int argc __attribute__((unused)),
1031  char **argv __attribute__((unused)))
1032 {
1033  fprintf(stderr, "ldns-signzone needs OpenSSL support, which has not been compiled in\n");
1034  return 1;
1035 }
1036 #endif /* HAVE_SSL */
ldns_rr_rdf
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:901
LDNS_COMMENT_NSEC3_CHAIN
#define LDNS_COMMENT_NSEC3_CHAIN
Show the unhashed owner and next owner names for NSEC3 RR's as comment.
Definition: host2str.h:60
prog
char * prog
Definition: ldns-signzone.c:32
ldns_struct_rr_list
List or Set of Resource Records.
Definition: rr.h:335
ldns_rr_class
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:61
LDNS_NSEC3_VARS_OPTOUT_MASK
#define LDNS_NSEC3_VARS_OPTOUT_MASK
Definition: rdata.h:40
ldns_zone_new_frm_fp_l
ldns_status ldns_zone_new_frm_fp_l(ldns_zone **z, FILE *fp, const ldns_rdf *origin, uint32_t ttl, ldns_rr_class c __attribute__((unused)), int *line_nr)
Definition: zone.c:194
ldns_dnssec_zone_new
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:569
ldns_soa_serial_unixtime
uint32_t ldns_soa_serial_unixtime(uint32_t s, void *data)
Function to be used with ldns_rr_soa_increment_func or ldns_rr_soa_increment_func_int to set the soa ...
Definition: rr_functions.c:379
LDNS_COMMENT_LAYOUT
#define LDNS_COMMENT_LAYOUT
Print mark up.
Definition: host2str.h:62
ldns_key2rr
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition: keys.c:1800
ldns_key_set_inception
void ldns_key_set_inception(ldns_key *k, uint32_t i)
Set the key's inception date (seconds after epoch)
Definition: keys.c:1419
ldns_key_set_keytag
void ldns_key_set_keytag(ldns_key *k, uint16_t tag)
Set the key's key tag.
Definition: keys.c:1437
ldns_struct_rr
Resource Record.
Definition: rr.h:307
keys.h
LDNS_FREE
#define LDNS_FREE(ptr)
Definition: util.h:60
ldns_dnssec_zone_add_rr
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:928
ldns_version
const char * ldns_version(void)
Show the internal library version.
Definition: util.c:160
ldns_struct_output_format
Output format specifier.
Definition: host2str.h:86
LDNS_STATUS_OK
@ LDNS_STATUS_OK
Definition: error.h:26
LDNS_STATUS_ERR
@ LDNS_STATUS_ERR
Definition: error.h:37
ldns_zone_push_rr
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:53
LDNS_COMMENT_FLAGS
#define LDNS_COMMENT_FLAGS
Show when a NSEC3 RR has the optout flag set as comment.
Definition: host2str.h:58
ldns_key_list_push_key
bool ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
pushes a key to a keylist
Definition: keys.c:1597
ldns_rr_print
void ldns_rr_print(FILE *output, const ldns_rr *rr)
Prints the data in the resource record to the given file stream (in presentation format)
Definition: host2str.c:2584
LDNS_KEY_SEP_KEY
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
ldns_struct_key_list
Same as rr_list, but now for keys.
Definition: keys.h:176
ldns_rr_set_ttl
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:808
LDNS_RR_CLASS_IN
@ LDNS_RR_CLASS_IN
the Internet
Definition: rr.h:47
__MATCH
#define __MATCH(x)
LDNS_SIGN_ECDSAP256SHA256
@ LDNS_SIGN_ECDSAP256SHA256
Definition: keys.h:99
ldns_struct_key::dnssec
struct ldns_struct_key::@1::@3 dnssec
Some values that influence generated signatures.
ldns_rr_list_deep_free
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:1012
ldns_key_flags
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1550
ldns_dnssec_zone_sign_flg
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1369
ldns_rr_soa_increment_func_int
void ldns_rr_soa_increment_func_int(ldns_rr *soa, ldns_soa_serial_increment_func_t f, int data)
Increment the serial number of the given SOA with the given function using data as an argument for th...
Definition: rr_functions.c:422
ldns_key_list_new
ldns_key_list * ldns_key_list_new(void)
Creates a new empty key list.
Definition: keys.c:65
ldns_zone_rrs
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
ldns_key_set_expiration
void ldns_key_set_expiration(ldns_key *k, uint32_t e)
Set the key's expiration date (seconds after epoch)
Definition: keys.c:1425
ldns_rdf2str
char * ldns_rdf2str(const ldns_rdf *rdf)
Converts the data in the rdata field to presentation format and returns that as a char *.
Definition: host2str.c:2441
ldns_str2rdf_dname
ldns_status ldns_str2rdf_dname(ldns_rdf **d, const char *str)
convert a dname string into wireformat
Definition: str2host.c:311
ldns_rr_free
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
LDNS_SIGN_ECC_GOST
@ LDNS_SIGN_ECC_GOST
Definition: keys.h:98
LDNS_SIGN_RSASHA1
@ LDNS_SIGN_RSASHA1
Definition: keys.h:92
ldns_hexdigit_to_int
int ldns_hexdigit_to_int(char ch)
Returns the int value of the given (hex) digit.
Definition: util.c:88
MAX_FILENAME_LEN
#define MAX_FILENAME_LEN
Definition: ldns-signzone.c:30
ldns_enum_signing_algorithm
ldns_enum_signing_algorithm
Algorithms used in dns for signing.
Definition: keys.h:89
ldns_struct_dnssec_zone
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_dnssec_zone_free
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:797
ldns_mktime_from_utc
time_t ldns_mktime_from_utc(const struct tm *tm)
Convert TM to seconds since epoch (midnight, January 1st, 1970).
Definition: util.c:194
ldns_key_set_pubkey_owner
void ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
Set the key's pubkey owner.
Definition: keys.c:1431
LDNS_SIGN_RSASHA512
@ LDNS_SIGN_RSASHA512
Definition: keys.h:96
__LIST
#define __LIST(x)
ldns_struct_key
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:126
ldns_struct_output_format_storage
Output format struct with additional data for flags that use them.
Definition: host2str.h:100
ldns_key_list_key_count
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1444
ldns_rdf_clone
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
LDNS_VERSION
#define LDNS_VERSION
Definition: util.h:30
ldns_calc_keytag
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
Definition: dnssec.c:277
ldns_status
enum ldns_enum_status ldns_status
Definition: error.h:134
ATTR_UNUSED
#define ATTR_UNUSED(x)
Definition: common.h:69
LDNS_NSEC3_MAX_ITERATIONS
#define LDNS_NSEC3_MAX_ITERATIONS
Definition: dnssec.h:87
LDNS_XMALLOC
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
LDNS_SIGN_DSA
@ LDNS_SIGN_DSA
Definition: keys.h:93
ldns_zone_soa
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17
verbosity
int verbosity
Definition: ldns-signzone.c:33
ldns_struct_rdf
Resource record data field.
Definition: rdata.h:177
ldns_rdf2native_int16
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rr_ttl
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:923
ldns_key_pubkey_owner
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1574
ldns_key_keytag
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1568
ldns_dnssec_zone_sign_nsec3_flg_mkmap
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1424
ldns_struct_output_format_storage::hashmap
ldns_rbtree_t * hashmap
Definition: host2str.h:102
ldns_algorithm
enum ldns_enum_algorithm ldns_algorithm
Definition: keys.h:72
ldns.h
ldns_struct_zone
DNS Zone.
Definition: zone.h:42
LDNS_DEFAULT_TTL
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
ldns_rr_list_new
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:992
ldns_dnssec_default_replace_signatures
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1733
ldns_get_errorstr_by_id
const char * ldns_get_errorstr_by_id(ldns_status err)
look up a descriptive text by each error.
Definition: error.c:164
LDNS_SIGN_DSA_NSEC3
@ LDNS_SIGN_DSA_NSEC3
Definition: keys.h:97
main
int main(int argc, char *argv[])
Definition: ldns-signzone.c:541
config.h
ldns_dname_compare
int ldns_dname_compare(const ldns_rdf *dname1, const ldns_rdf *dname2)
Compares the two dname rdf's according to the algorithm for ordering in RFC4034 Section 6.
Definition: dname.c:359
ldns_rr_list_rr
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:982
LDNS_RR_TYPE_DNSKEY
@ LDNS_RR_TYPE_DNSKEY
Definition: rr.h:172
ldns_key_new_frm_fp_l
ldns_status ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
Creates a new private key based on the contents of the file pointed by fp.
Definition: keys.c:416
LDNS_SIGN_RSASHA256
@ LDNS_SIGN_RSASHA256
Definition: keys.h:95
LDNS_SIGN_RSAMD5
@ LDNS_SIGN_RSAMD5
Definition: keys.h:91
ldns_key_set_flags
void ldns_key_set_flags(ldns_key *k, uint16_t f)
Set the key's flags.
Definition: keys.c:1339
LDNS_SIGN_WITH_ALL_ALGORITHMS
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition: dnssec_sign.h:16
LDNS_COMMENT_BUBBLEBABBLE
#define LDNS_COMMENT_BUBBLEBABBLE
Provide bubblebabble representation for DS RR's as comment.
Definition: host2str.h:56
ldns_zone_deep_free
void ldns_zone_deep_free(ldns_zone *zone)
Frees the allocated memory for the zone, the soa rr in it, and the rr_list structure in it,...
Definition: zone.c:312
ldns_dnssec_zone_print
void ldns_dnssec_zone_print(FILE *out, const ldns_dnssec_zone *zone)
Prints the complete zone to the given file descriptor.
Definition: dnssec_zone.c:1035
LDNS_SIGN_RSASHA1_NSEC3
@ LDNS_SIGN_RSASHA1_NSEC3
Definition: keys.h:94
ldns_rr_owner
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:911
LDNS_SIGN_DNSKEY_WITH_ZSK
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
ldns_key_list_free
void ldns_key_list_free(ldns_key_list *key_list)
Frees a key list structure.
Definition: keys.c:2070
ldns_key_new_frm_engine
ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
Read the key with the given id from the given engine and store it in the given ldns_key structure.
Definition: keys.c:111
LDNS_SIGN_ECDSAP384SHA384
@ LDNS_SIGN_ECDSAP384SHA384
Definition: keys.h:100
ldns_rr_compare_no_rdata
int ldns_rr_compare_no_rdata(const ldns_rr *rr1, const ldns_rr *rr2)
compares two rrs, up to the rdata.
Definition: rr.c:1550
ldns_rr_new_frm_fp_l
ldns_status ldns_rr_new_frm_fp_l(ldns_rr **newrr, FILE *fp, uint32_t *default_ttl, ldns_rdf **origin, ldns_rdf **prev, int *line_nr)
creates a new rr from a file containing a string.
Definition: rr.c:712
ldns_dnssec_zone_print_fmt
void ldns_dnssec_zone_print_fmt(FILE *out, const ldns_output_format *fmt, const ldns_dnssec_zone *zone)
Prints the complete zone to the given file descriptor.
Definition: dnssec_zone.c:1007
ldns_rr_get_type
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:935
ldns_rr_list_rr_count
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:949