1 /*
2 * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 1999-2003 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /*
19 * $Id$
20 */
21
22 /*! \file */
23
24 #include <config.h>
25
26 #include <stdlib.h>
27
28 #include <isc/buffer.h>
29 #include <isc/dir.h>
30 #include <isc/mem.h>
31 #include <isc/serial.h>
32 #include <isc/string.h>
33 #include <isc/util.h>
34
35 #include <dns/db.h>
36 #include <dns/diff.h>
37 #include <dns/dnssec.h>
38 #include <dns/fixedname.h>
39 #include <dns/keyvalues.h>
40 #include <dns/log.h>
41 #include <dns/message.h>
42 #include <dns/rdata.h>
43 #include <dns/rdatalist.h>
44 #include <dns/rdataset.h>
45 #include <dns/rdatastruct.h>
46 #include <dns/result.h>
47 #include <dns/stats.h>
48 #include <dns/tsig.h> /* for DNS_TSIG_FUDGE */
49
50 #include <dst/result.h>
51
52 LIBDNS_EXTERNAL_DATA isc_stats_t *dns_dnssec_stats;
53
54 #define is_response(msg) (msg->flags & DNS_MESSAGEFLAG_QR)
55
56 #define RETERR(x) do { \
57 result = (x); \
58 if (result != ISC_R_SUCCESS) \
59 goto failure; \
60 } while (0)
61
62
63 #define TYPE_SIGN 0
64 #define TYPE_VERIFY 1
65
66 static isc_result_t
67 digest_callback(void *arg, isc_region_t *data);
68
69 static int
70 rdata_compare_wrapper(const void *rdata1, const void *rdata2);
71
72 static isc_result_t
73 rdataset_to_sortedarray(dns_rdataset_t *set, isc_mem_t *mctx,
74 dns_rdata_t **rdata, int *nrdata);
75
76 static isc_result_t
digest_callback(void * arg,isc_region_t * data)77 digest_callback(void *arg, isc_region_t *data) {
78 dst_context_t *ctx = arg;
79
80 return (dst_context_adddata(ctx, data));
81 }
82
83 static inline void
inc_stat(isc_statscounter_t counter)84 inc_stat(isc_statscounter_t counter) {
85 if (dns_dnssec_stats != NULL)
86 isc_stats_increment(dns_dnssec_stats, counter);
87 }
88
89 /*
90 * Make qsort happy.
91 */
92 static int
rdata_compare_wrapper(const void * rdata1,const void * rdata2)93 rdata_compare_wrapper(const void *rdata1, const void *rdata2) {
94 return (dns_rdata_compare((const dns_rdata_t *)rdata1,
95 (const dns_rdata_t *)rdata2));
96 }
97
98 /*
99 * Sort the rdataset into an array.
100 */
101 static isc_result_t
rdataset_to_sortedarray(dns_rdataset_t * set,isc_mem_t * mctx,dns_rdata_t ** rdata,int * nrdata)102 rdataset_to_sortedarray(dns_rdataset_t *set, isc_mem_t *mctx,
103 dns_rdata_t **rdata, int *nrdata)
104 {
105 isc_result_t ret;
106 int i = 0, n;
107 dns_rdata_t *data;
108 dns_rdataset_t rdataset;
109
110 n = dns_rdataset_count(set);
111
112 data = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
113 if (data == NULL)
114 return (ISC_R_NOMEMORY);
115
116 dns_rdataset_init(&rdataset);
117 dns_rdataset_clone(set, &rdataset);
118 ret = dns_rdataset_first(&rdataset);
119 if (ret != ISC_R_SUCCESS) {
120 dns_rdataset_disassociate(&rdataset);
121 isc_mem_put(mctx, data, n * sizeof(dns_rdata_t));
122 return (ret);
123 }
124
125 /*
126 * Put them in the array.
127 */
128 do {
129 dns_rdata_init(&data[i]);
130 dns_rdataset_current(&rdataset, &data[i++]);
131 } while (dns_rdataset_next(&rdataset) == ISC_R_SUCCESS);
132
133 /*
134 * Sort the array.
135 */
136 qsort(data, n, sizeof(dns_rdata_t), rdata_compare_wrapper);
137 *rdata = data;
138 *nrdata = n;
139 dns_rdataset_disassociate(&rdataset);
140 return (ISC_R_SUCCESS);
141 }
142
143 isc_result_t
dns_dnssec_keyfromrdata(dns_name_t * name,dns_rdata_t * rdata,isc_mem_t * mctx,dst_key_t ** key)144 dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
145 dst_key_t **key)
146 {
147 isc_buffer_t b;
148 isc_region_t r;
149
150 INSIST(name != NULL);
151 INSIST(rdata != NULL);
152 INSIST(mctx != NULL);
153 INSIST(key != NULL);
154 INSIST(*key == NULL);
155 REQUIRE(rdata->type == dns_rdatatype_key ||
156 rdata->type == dns_rdatatype_dnskey);
157
158 dns_rdata_toregion(rdata, &r);
159 isc_buffer_init(&b, r.base, r.length);
160 isc_buffer_add(&b, r.length);
161 return (dst_key_fromdns(name, rdata->rdclass, &b, mctx, key));
162 }
163
164 static isc_result_t
digest_sig(dst_context_t * ctx,isc_boolean_t downcase,dns_rdata_t * sigrdata,dns_rdata_rrsig_t * rrsig)165 digest_sig(dst_context_t *ctx, isc_boolean_t downcase, dns_rdata_t *sigrdata,
166 dns_rdata_rrsig_t *rrsig)
167 {
168 isc_region_t r;
169 isc_result_t ret;
170 dns_fixedname_t fname;
171
172 dns_rdata_toregion(sigrdata, &r);
173 INSIST(r.length >= 19);
174
175 r.length = 18;
176 ret = dst_context_adddata(ctx, &r);
177 if (ret != ISC_R_SUCCESS)
178 return (ret);
179 if (downcase) {
180 dns_fixedname_init(&fname);
181
182 RUNTIME_CHECK(dns_name_downcase(&rrsig->signer,
183 dns_fixedname_name(&fname),
184 NULL) == ISC_R_SUCCESS);
185 dns_name_toregion(dns_fixedname_name(&fname), &r);
186 } else
187 dns_name_toregion(&rrsig->signer, &r);
188
189 return (dst_context_adddata(ctx, &r));
190 }
191
192 isc_result_t
dns_dnssec_sign(dns_name_t * name,dns_rdataset_t * set,dst_key_t * key,isc_stdtime_t * inception,isc_stdtime_t * expire,isc_mem_t * mctx,isc_buffer_t * buffer,dns_rdata_t * sigrdata)193 dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
194 isc_stdtime_t *inception, isc_stdtime_t *expire,
195 isc_mem_t *mctx, isc_buffer_t *buffer, dns_rdata_t *sigrdata)
196 {
197 dns_rdata_rrsig_t sig;
198 dns_rdata_t tmpsigrdata;
199 dns_rdata_t *rdatas;
200 int nrdatas, i;
201 isc_buffer_t sigbuf, envbuf;
202 isc_region_t r;
203 dst_context_t *ctx = NULL;
204 isc_result_t ret;
205 isc_buffer_t *databuf = NULL;
206 char data[256 + 8];
207 isc_uint32_t flags;
208 unsigned int sigsize;
209 dns_fixedname_t fnewname;
210 dns_fixedname_t fsigner;
211
212 REQUIRE(name != NULL);
213 REQUIRE(dns_name_countlabels(name) <= 255);
214 REQUIRE(set != NULL);
215 REQUIRE(key != NULL);
216 REQUIRE(inception != NULL);
217 REQUIRE(expire != NULL);
218 REQUIRE(mctx != NULL);
219 REQUIRE(sigrdata != NULL);
220
221 if (*inception >= *expire)
222 return (DNS_R_INVALIDTIME);
223
224 /*
225 * Is the key allowed to sign data?
226 */
227 flags = dst_key_flags(key);
228 if (flags & DNS_KEYTYPE_NOAUTH)
229 return (DNS_R_KEYUNAUTHORIZED);
230 if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
231 return (DNS_R_KEYUNAUTHORIZED);
232
233 sig.mctx = mctx;
234 sig.common.rdclass = set->rdclass;
235 sig.common.rdtype = dns_rdatatype_rrsig;
236 ISC_LINK_INIT(&sig.common, link);
237
238 /*
239 * Downcase signer.
240 */
241 dns_name_init(&sig.signer, NULL);
242 dns_fixedname_init(&fsigner);
243 RUNTIME_CHECK(dns_name_downcase(dst_key_name(key),
244 dns_fixedname_name(&fsigner), NULL) == ISC_R_SUCCESS);
245 dns_name_clone(dns_fixedname_name(&fsigner), &sig.signer);
246
247 sig.covered = set->type;
248 sig.algorithm = dst_key_alg(key);
249 sig.labels = dns_name_countlabels(name) - 1;
250 if (dns_name_iswildcard(name))
251 sig.labels--;
252 sig.originalttl = set->ttl;
253 sig.timesigned = *inception;
254 sig.timeexpire = *expire;
255 sig.keyid = dst_key_id(key);
256 ret = dst_key_sigsize(key, &sigsize);
257 if (ret != ISC_R_SUCCESS)
258 return (ret);
259 sig.siglen = sigsize;
260 /*
261 * The actual contents of sig.signature are not important yet, since
262 * they're not used in digest_sig().
263 */
264 sig.signature = isc_mem_get(mctx, sig.siglen);
265 if (sig.signature == NULL)
266 return (ISC_R_NOMEMORY);
267
268 ret = isc_buffer_allocate(mctx, &databuf, sigsize + 256 + 18);
269 if (ret != ISC_R_SUCCESS)
270 goto cleanup_signature;
271
272 dns_rdata_init(&tmpsigrdata);
273 ret = dns_rdata_fromstruct(&tmpsigrdata, sig.common.rdclass,
274 sig.common.rdtype, &sig, databuf);
275 if (ret != ISC_R_SUCCESS)
276 goto cleanup_databuf;
277
278 ret = dst_context_create2(key, mctx, DNS_LOGCATEGORY_DNSSEC, &ctx);
279 if (ret != ISC_R_SUCCESS)
280 goto cleanup_databuf;
281
282 /*
283 * Digest the SIG rdata.
284 */
285 ret = digest_sig(ctx, ISC_FALSE, &tmpsigrdata, &sig);
286 if (ret != ISC_R_SUCCESS)
287 goto cleanup_context;
288
289 dns_fixedname_init(&fnewname);
290 RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
291 NULL) == ISC_R_SUCCESS);
292 dns_name_toregion(dns_fixedname_name(&fnewname), &r);
293
294 /*
295 * Create an envelope for each rdata: <name|type|class|ttl>.
296 */
297 isc_buffer_init(&envbuf, data, sizeof(data));
298 memmove(data, r.base, r.length);
299 isc_buffer_add(&envbuf, r.length);
300 isc_buffer_putuint16(&envbuf, set->type);
301 isc_buffer_putuint16(&envbuf, set->rdclass);
302 isc_buffer_putuint32(&envbuf, set->ttl);
303
304 ret = rdataset_to_sortedarray(set, mctx, &rdatas, &nrdatas);
305 if (ret != ISC_R_SUCCESS)
306 goto cleanup_context;
307 isc_buffer_usedregion(&envbuf, &r);
308
309 for (i = 0; i < nrdatas; i++) {
310 isc_uint16_t len;
311 isc_buffer_t lenbuf;
312 isc_region_t lenr;
313
314 /*
315 * Skip duplicates.
316 */
317 if (i > 0 && dns_rdata_compare(&rdatas[i], &rdatas[i-1]) == 0)
318 continue;
319
320 /*
321 * Digest the envelope.
322 */
323 ret = dst_context_adddata(ctx, &r);
324 if (ret != ISC_R_SUCCESS)
325 goto cleanup_array;
326
327 /*
328 * Digest the length of the rdata.
329 */
330 isc_buffer_init(&lenbuf, &len, sizeof(len));
331 INSIST(rdatas[i].length < 65536);
332 isc_buffer_putuint16(&lenbuf, (isc_uint16_t)rdatas[i].length);
333 isc_buffer_usedregion(&lenbuf, &lenr);
334 ret = dst_context_adddata(ctx, &lenr);
335 if (ret != ISC_R_SUCCESS)
336 goto cleanup_array;
337
338 /*
339 * Digest the rdata.
340 */
341 ret = dns_rdata_digest(&rdatas[i], digest_callback, ctx);
342 if (ret != ISC_R_SUCCESS)
343 goto cleanup_array;
344 }
345
346 isc_buffer_init(&sigbuf, sig.signature, sig.siglen);
347 ret = dst_context_sign(ctx, &sigbuf);
348 if (ret != ISC_R_SUCCESS)
349 goto cleanup_array;
350 isc_buffer_usedregion(&sigbuf, &r);
351 if (r.length != sig.siglen) {
352 ret = ISC_R_NOSPACE;
353 goto cleanup_array;
354 }
355
356 ret = dns_rdata_fromstruct(sigrdata, sig.common.rdclass,
357 sig.common.rdtype, &sig, buffer);
358
359 cleanup_array:
360 isc_mem_put(mctx, rdatas, nrdatas * sizeof(dns_rdata_t));
361 cleanup_context:
362 dst_context_destroy(&ctx);
363 cleanup_databuf:
364 isc_buffer_free(&databuf);
365 cleanup_signature:
366 isc_mem_put(mctx, sig.signature, sig.siglen);
367
368 return (ret);
369 }
370
371 isc_result_t
dns_dnssec_verify2(dns_name_t * name,dns_rdataset_t * set,dst_key_t * key,isc_boolean_t ignoretime,isc_mem_t * mctx,dns_rdata_t * sigrdata,dns_name_t * wild)372 dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
373 isc_boolean_t ignoretime, isc_mem_t *mctx,
374 dns_rdata_t *sigrdata, dns_name_t *wild)
375 {
376 return (dns_dnssec_verify3(name, set, key, ignoretime, 0, mctx,
377 sigrdata, wild));
378 }
379
380 isc_result_t
dns_dnssec_verify3(dns_name_t * name,dns_rdataset_t * set,dst_key_t * key,isc_boolean_t ignoretime,unsigned int maxbits,isc_mem_t * mctx,dns_rdata_t * sigrdata,dns_name_t * wild)381 dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
382 isc_boolean_t ignoretime, unsigned int maxbits,
383 isc_mem_t *mctx, dns_rdata_t *sigrdata, dns_name_t *wild)
384 {
385 dns_rdata_rrsig_t sig;
386 dns_fixedname_t fnewname;
387 isc_region_t r;
388 isc_buffer_t envbuf;
389 dns_rdata_t *rdatas;
390 int nrdatas, i;
391 isc_stdtime_t now;
392 isc_result_t ret;
393 unsigned char data[300];
394 dst_context_t *ctx = NULL;
395 int labels = 0;
396 isc_uint32_t flags;
397 isc_boolean_t downcase = ISC_FALSE;
398
399 REQUIRE(name != NULL);
400 REQUIRE(set != NULL);
401 REQUIRE(key != NULL);
402 REQUIRE(mctx != NULL);
403 REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_rrsig);
404
405 ret = dns_rdata_tostruct(sigrdata, &sig, NULL);
406 if (ret != ISC_R_SUCCESS)
407 return (ret);
408
409 if (set->type != sig.covered)
410 return (DNS_R_SIGINVALID);
411
412 if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
413 inc_stat(dns_dnssecstats_fail);
414 return (DNS_R_SIGINVALID);
415 }
416
417 if (!ignoretime) {
418 isc_stdtime_get(&now);
419
420 /*
421 * Is SIG temporally valid?
422 */
423 if (isc_serial_lt((isc_uint32_t)now, sig.timesigned)) {
424 inc_stat(dns_dnssecstats_fail);
425 return (DNS_R_SIGFUTURE);
426 } else if (isc_serial_lt(sig.timeexpire, (isc_uint32_t)now)) {
427 inc_stat(dns_dnssecstats_fail);
428 return (DNS_R_SIGEXPIRED);
429 }
430 }
431
432 /*
433 * NS, SOA and DNSSKEY records are signed by their owner.
434 * DS records are signed by the parent.
435 */
436 switch (set->type) {
437 case dns_rdatatype_ns:
438 case dns_rdatatype_soa:
439 case dns_rdatatype_dnskey:
440 if (!dns_name_equal(name, &sig.signer)) {
441 inc_stat(dns_dnssecstats_fail);
442 return (DNS_R_SIGINVALID);
443 }
444 break;
445 case dns_rdatatype_ds:
446 if (dns_name_equal(name, &sig.signer)) {
447 inc_stat(dns_dnssecstats_fail);
448 return (DNS_R_SIGINVALID);
449 }
450 /* FALLTHROUGH */
451 default:
452 if (!dns_name_issubdomain(name, &sig.signer)) {
453 inc_stat(dns_dnssecstats_fail);
454 return (DNS_R_SIGINVALID);
455 }
456 break;
457 }
458
459 /*
460 * Is the key allowed to sign data?
461 */
462 flags = dst_key_flags(key);
463 if (flags & DNS_KEYTYPE_NOAUTH) {
464 inc_stat(dns_dnssecstats_fail);
465 return (DNS_R_KEYUNAUTHORIZED);
466 }
467 if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
468 inc_stat(dns_dnssecstats_fail);
469 return (DNS_R_KEYUNAUTHORIZED);
470 }
471
472 again:
473 ret = dst_context_create2(key, mctx, DNS_LOGCATEGORY_DNSSEC, &ctx);
474 if (ret != ISC_R_SUCCESS)
475 goto cleanup_struct;
476
477 /*
478 * Digest the SIG rdata (not including the signature).
479 */
480 ret = digest_sig(ctx, downcase, sigrdata, &sig);
481 if (ret != ISC_R_SUCCESS)
482 goto cleanup_context;
483
484 /*
485 * If the name is an expanded wildcard, use the wildcard name.
486 */
487 dns_fixedname_init(&fnewname);
488 labels = dns_name_countlabels(name) - 1;
489 RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
490 NULL) == ISC_R_SUCCESS);
491 if (labels - sig.labels > 0)
492 dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
493 NULL, dns_fixedname_name(&fnewname));
494
495 dns_name_toregion(dns_fixedname_name(&fnewname), &r);
496
497 /*
498 * Create an envelope for each rdata: <name|type|class|ttl>.
499 */
500 isc_buffer_init(&envbuf, data, sizeof(data));
501 if (labels - sig.labels > 0) {
502 isc_buffer_putuint8(&envbuf, 1);
503 isc_buffer_putuint8(&envbuf, '*');
504 memmove(data + 2, r.base, r.length);
505 }
506 else
507 memmove(data, r.base, r.length);
508 isc_buffer_add(&envbuf, r.length);
509 isc_buffer_putuint16(&envbuf, set->type);
510 isc_buffer_putuint16(&envbuf, set->rdclass);
511 isc_buffer_putuint32(&envbuf, sig.originalttl);
512
513 ret = rdataset_to_sortedarray(set, mctx, &rdatas, &nrdatas);
514 if (ret != ISC_R_SUCCESS)
515 goto cleanup_context;
516
517 isc_buffer_usedregion(&envbuf, &r);
518
519 for (i = 0; i < nrdatas; i++) {
520 isc_uint16_t len;
521 isc_buffer_t lenbuf;
522 isc_region_t lenr;
523
524 /*
525 * Skip duplicates.
526 */
527 if (i > 0 && dns_rdata_compare(&rdatas[i], &rdatas[i-1]) == 0)
528 continue;
529
530 /*
531 * Digest the envelope.
532 */
533 ret = dst_context_adddata(ctx, &r);
534 if (ret != ISC_R_SUCCESS)
535 goto cleanup_array;
536
537 /*
538 * Digest the rdata length.
539 */
540 isc_buffer_init(&lenbuf, &len, sizeof(len));
541 INSIST(rdatas[i].length < 65536);
542 isc_buffer_putuint16(&lenbuf, (isc_uint16_t)rdatas[i].length);
543 isc_buffer_usedregion(&lenbuf, &lenr);
544
545 /*
546 * Digest the rdata.
547 */
548 ret = dst_context_adddata(ctx, &lenr);
549 if (ret != ISC_R_SUCCESS)
550 goto cleanup_array;
551 ret = dns_rdata_digest(&rdatas[i], digest_callback, ctx);
552 if (ret != ISC_R_SUCCESS)
553 goto cleanup_array;
554 }
555
556 r.base = sig.signature;
557 r.length = sig.siglen;
558 ret = dst_context_verify2(ctx, maxbits, &r);
559 if (ret == ISC_R_SUCCESS && downcase) {
560 char namebuf[DNS_NAME_FORMATSIZE];
561 dns_name_format(&sig.signer, namebuf, sizeof(namebuf));
562 isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
563 DNS_LOGMODULE_DNSSEC, ISC_LOG_DEBUG(1),
564 "successfully validated after lower casing "
565 "signer '%s'", namebuf);
566 inc_stat(dns_dnssecstats_downcase);
567 } else if (ret == ISC_R_SUCCESS)
568 inc_stat(dns_dnssecstats_asis);
569
570 cleanup_array:
571 isc_mem_put(mctx, rdatas, nrdatas * sizeof(dns_rdata_t));
572 cleanup_context:
573 dst_context_destroy(&ctx);
574 if (ret == DST_R_VERIFYFAILURE && !downcase) {
575 downcase = ISC_TRUE;
576 goto again;
577 }
578 cleanup_struct:
579 dns_rdata_freestruct(&sig);
580
581 if (ret == DST_R_VERIFYFAILURE)
582 ret = DNS_R_SIGINVALID;
583
584 if (ret != ISC_R_SUCCESS)
585 inc_stat(dns_dnssecstats_fail);
586
587 if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) {
588 if (wild != NULL)
589 RUNTIME_CHECK(dns_name_concatenate(dns_wildcardname,
590 dns_fixedname_name(&fnewname),
591 wild, NULL) == ISC_R_SUCCESS);
592 inc_stat(dns_dnssecstats_wildcard);
593 ret = DNS_R_FROMWILDCARD;
594 }
595 return (ret);
596 }
597
598 isc_result_t
dns_dnssec_verify(dns_name_t * name,dns_rdataset_t * set,dst_key_t * key,isc_boolean_t ignoretime,isc_mem_t * mctx,dns_rdata_t * sigrdata)599 dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
600 isc_boolean_t ignoretime, isc_mem_t *mctx,
601 dns_rdata_t *sigrdata)
602 {
603 isc_result_t result;
604
605 result = dns_dnssec_verify2(name, set, key, ignoretime, mctx,
606 sigrdata, NULL);
607 if (result == DNS_R_FROMWILDCARD)
608 result = ISC_R_SUCCESS;
609 return (result);
610 }
611
612 isc_boolean_t
dns_dnssec_keyactive(dst_key_t * key,isc_stdtime_t now)613 dns_dnssec_keyactive(dst_key_t *key, isc_stdtime_t now) {
614 isc_result_t result;
615 isc_stdtime_t publish, active, revoke, inactive, delete;
616 isc_boolean_t pubset = ISC_FALSE, actset = ISC_FALSE;
617 isc_boolean_t revset = ISC_FALSE, inactset = ISC_FALSE;
618 isc_boolean_t delset = ISC_FALSE;
619 int major, minor;
620
621 /* Is this an old-style key? */
622 result = dst_key_getprivateformat(key, &major, &minor);
623 RUNTIME_CHECK(result == ISC_R_SUCCESS);
624
625 /*
626 * Smart signing started with key format 1.3; prior to that, all
627 * keys are assumed active
628 */
629 if (major == 1 && minor <= 2)
630 return (ISC_TRUE);
631
632 result = dst_key_gettime(key, DST_TIME_PUBLISH, &publish);
633 if (result == ISC_R_SUCCESS)
634 pubset = ISC_TRUE;
635
636 result = dst_key_gettime(key, DST_TIME_ACTIVATE, &active);
637 if (result == ISC_R_SUCCESS)
638 actset = ISC_TRUE;
639
640 result = dst_key_gettime(key, DST_TIME_REVOKE, &revoke);
641 if (result == ISC_R_SUCCESS)
642 revset = ISC_TRUE;
643
644 result = dst_key_gettime(key, DST_TIME_INACTIVE, &inactive);
645 if (result == ISC_R_SUCCESS)
646 inactset = ISC_TRUE;
647
648 result = dst_key_gettime(key, DST_TIME_DELETE, &delete);
649 if (result == ISC_R_SUCCESS)
650 delset = ISC_TRUE;
651
652 if ((inactset && inactive <= now) || (delset && delete <= now))
653 return (ISC_FALSE);
654
655 if (revset && revoke <= now && pubset && publish <= now)
656 return (ISC_TRUE);
657
658 if (actset && active <= now)
659 return (ISC_TRUE);
660
661 return (ISC_FALSE);
662 }
663
664 #define is_zone_key(key) ((dst_key_flags(key) & DNS_KEYFLAG_OWNERMASK) \
665 == DNS_KEYOWNER_ZONE)
666
667 isc_result_t
dns_dnssec_findzonekeys2(dns_db_t * db,dns_dbversion_t * ver,dns_dbnode_t * node,dns_name_t * name,const char * directory,isc_mem_t * mctx,unsigned int maxkeys,dst_key_t ** keys,unsigned int * nkeys)668 dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
669 dns_dbnode_t *node, dns_name_t *name,
670 const char *directory, isc_mem_t *mctx,
671 unsigned int maxkeys, dst_key_t **keys,
672 unsigned int *nkeys)
673 {
674 dns_rdataset_t rdataset;
675 dns_rdata_t rdata = DNS_RDATA_INIT;
676 isc_result_t result;
677 dst_key_t *pubkey = NULL;
678 unsigned int count = 0;
679 isc_stdtime_t now;
680
681 REQUIRE(nkeys != NULL);
682 REQUIRE(keys != NULL);
683
684 isc_stdtime_get(&now);
685
686 *nkeys = 0;
687 memset(keys, 0, sizeof(*keys) * maxkeys);
688 dns_rdataset_init(&rdataset);
689 RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0,
690 &rdataset, NULL));
691 RETERR(dns_rdataset_first(&rdataset));
692 while (result == ISC_R_SUCCESS && count < maxkeys) {
693 pubkey = NULL;
694 dns_rdataset_current(&rdataset, &rdata);
695 RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey));
696 dst_key_setttl(pubkey, rdataset.ttl);
697
698 if (!is_zone_key(pubkey) ||
699 (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
700 goto next;
701 /* Corrupted .key file? */
702 if (!dns_name_equal(name, dst_key_name(pubkey)))
703 goto next;
704 keys[count] = NULL;
705 result = dst_key_fromfile(dst_key_name(pubkey),
706 dst_key_id(pubkey),
707 dst_key_alg(pubkey),
708 DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
709 directory,
710 mctx, &keys[count]);
711
712 /*
713 * If the key was revoked and the private file
714 * doesn't exist, maybe it was revoked internally
715 * by named. Try loading the unrevoked version.
716 */
717 if (result == ISC_R_FILENOTFOUND) {
718 isc_uint32_t flags;
719 flags = dst_key_flags(pubkey);
720 if ((flags & DNS_KEYFLAG_REVOKE) != 0) {
721 dst_key_setflags(pubkey,
722 flags & ~DNS_KEYFLAG_REVOKE);
723 result = dst_key_fromfile(dst_key_name(pubkey),
724 dst_key_id(pubkey),
725 dst_key_alg(pubkey),
726 DST_TYPE_PUBLIC|
727 DST_TYPE_PRIVATE,
728 directory,
729 mctx, &keys[count]);
730 if (result == ISC_R_SUCCESS &&
731 dst_key_pubcompare(pubkey, keys[count],
732 ISC_FALSE)) {
733 dst_key_setflags(keys[count], flags);
734 }
735 dst_key_setflags(pubkey, flags);
736 }
737 }
738
739 if (result != ISC_R_SUCCESS) {
740 char keybuf[DNS_NAME_FORMATSIZE];
741 char algbuf[DNS_SECALG_FORMATSIZE];
742 dns_name_format(dst_key_name(pubkey), keybuf,
743 sizeof(keybuf));
744 dns_secalg_format(dst_key_alg(pubkey), algbuf,
745 sizeof(algbuf));
746 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
747 DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
748 "dns_dnssec_findzonekeys2: error "
749 "reading private key file %s/%s/%d: %s",
750 keybuf, algbuf, dst_key_id(pubkey),
751 isc_result_totext(result));
752 }
753
754 if (result == ISC_R_FILENOTFOUND || result == ISC_R_NOPERM) {
755 keys[count] = pubkey;
756 pubkey = NULL;
757 count++;
758 goto next;
759 }
760
761 if (result != ISC_R_SUCCESS)
762 goto failure;
763
764 /*
765 * If a key is marked inactive, skip it
766 */
767 if (!dns_dnssec_keyactive(keys[count], now)) {
768 dst_key_setinactive(pubkey, ISC_TRUE);
769 dst_key_free(&keys[count]);
770 keys[count] = pubkey;
771 pubkey = NULL;
772 count++;
773 goto next;
774 }
775
776 /*
777 * Whatever the key's default TTL may have
778 * been, the rdataset TTL takes priority.
779 */
780 dst_key_setttl(keys[count], rdataset.ttl);
781
782 if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) {
783 /* We should never get here. */
784 dst_key_free(&keys[count]);
785 goto next;
786 }
787 count++;
788 next:
789 if (pubkey != NULL)
790 dst_key_free(&pubkey);
791 dns_rdata_reset(&rdata);
792 result = dns_rdataset_next(&rdataset);
793 }
794 if (result != ISC_R_NOMORE)
795 goto failure;
796 if (count == 0)
797 result = ISC_R_NOTFOUND;
798 else
799 result = ISC_R_SUCCESS;
800
801 failure:
802 if (dns_rdataset_isassociated(&rdataset))
803 dns_rdataset_disassociate(&rdataset);
804 if (pubkey != NULL)
805 dst_key_free(&pubkey);
806 if (result != ISC_R_SUCCESS)
807 while (count > 0)
808 dst_key_free(&keys[--count]);
809 *nkeys = count;
810 return (result);
811 }
812
813 isc_result_t
dns_dnssec_findzonekeys(dns_db_t * db,dns_dbversion_t * ver,dns_dbnode_t * node,dns_name_t * name,isc_mem_t * mctx,unsigned int maxkeys,dst_key_t ** keys,unsigned int * nkeys)814 dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver,
815 dns_dbnode_t *node, dns_name_t *name, isc_mem_t *mctx,
816 unsigned int maxkeys, dst_key_t **keys,
817 unsigned int *nkeys)
818 {
819 return (dns_dnssec_findzonekeys2(db, ver, node, name, NULL, mctx,
820 maxkeys, keys, nkeys));
821 }
822
823 isc_result_t
dns_dnssec_signmessage(dns_message_t * msg,dst_key_t * key)824 dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
825 dns_rdata_sig_t sig; /* SIG(0) */
826 unsigned char data[512];
827 unsigned char header[DNS_MESSAGE_HEADERLEN];
828 isc_buffer_t headerbuf, databuf, sigbuf;
829 unsigned int sigsize;
830 isc_buffer_t *dynbuf = NULL;
831 dns_rdata_t *rdata;
832 dns_rdatalist_t *datalist;
833 dns_rdataset_t *dataset;
834 isc_region_t r;
835 isc_stdtime_t now;
836 dst_context_t *ctx = NULL;
837 isc_mem_t *mctx;
838 isc_result_t result;
839 isc_boolean_t signeedsfree = ISC_TRUE;
840
841 REQUIRE(msg != NULL);
842 REQUIRE(key != NULL);
843
844 if (is_response(msg))
845 REQUIRE(msg->query.base != NULL);
846
847 mctx = msg->mctx;
848
849 memset(&sig, 0, sizeof(sig));
850
851 sig.mctx = mctx;
852 sig.common.rdclass = dns_rdataclass_any;
853 sig.common.rdtype = dns_rdatatype_sig; /* SIG(0) */
854 ISC_LINK_INIT(&sig.common, link);
855
856 sig.covered = 0;
857 sig.algorithm = dst_key_alg(key);
858 sig.labels = 0; /* the root name */
859 sig.originalttl = 0;
860
861 isc_stdtime_get(&now);
862 sig.timesigned = now - DNS_TSIG_FUDGE;
863 sig.timeexpire = now + DNS_TSIG_FUDGE;
864
865 sig.keyid = dst_key_id(key);
866
867 dns_name_init(&sig.signer, NULL);
868 dns_name_clone(dst_key_name(key), &sig.signer);
869
870 sig.siglen = 0;
871 sig.signature = NULL;
872
873 isc_buffer_init(&databuf, data, sizeof(data));
874
875 RETERR(dst_context_create2(key, mctx, DNS_LOGCATEGORY_DNSSEC, &ctx));
876
877 /*
878 * Digest the fields of the SIG - we can cheat and use
879 * dns_rdata_fromstruct. Since siglen is 0, the digested data
880 * is identical to dns format.
881 */
882 RETERR(dns_rdata_fromstruct(NULL, dns_rdataclass_any,
883 dns_rdatatype_sig /* SIG(0) */,
884 &sig, &databuf));
885 isc_buffer_usedregion(&databuf, &r);
886 RETERR(dst_context_adddata(ctx, &r));
887
888 /*
889 * If this is a response, digest the query.
890 */
891 if (is_response(msg))
892 RETERR(dst_context_adddata(ctx, &msg->query));
893
894 /*
895 * Digest the header.
896 */
897 isc_buffer_init(&headerbuf, header, sizeof(header));
898 dns_message_renderheader(msg, &headerbuf);
899 isc_buffer_usedregion(&headerbuf, &r);
900 RETERR(dst_context_adddata(ctx, &r));
901
902 /*
903 * Digest the remainder of the message.
904 */
905 isc_buffer_usedregion(msg->buffer, &r);
906 isc_region_consume(&r, DNS_MESSAGE_HEADERLEN);
907 RETERR(dst_context_adddata(ctx, &r));
908
909 RETERR(dst_key_sigsize(key, &sigsize));
910 sig.siglen = sigsize;
911 sig.signature = (unsigned char *) isc_mem_get(mctx, sig.siglen);
912 if (sig.signature == NULL) {
913 result = ISC_R_NOMEMORY;
914 goto failure;
915 }
916
917 isc_buffer_init(&sigbuf, sig.signature, sig.siglen);
918 RETERR(dst_context_sign(ctx, &sigbuf));
919 dst_context_destroy(&ctx);
920
921 rdata = NULL;
922 RETERR(dns_message_gettemprdata(msg, &rdata));
923 RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
924 RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
925 dns_rdatatype_sig /* SIG(0) */,
926 &sig, dynbuf));
927
928 isc_mem_put(mctx, sig.signature, sig.siglen);
929 signeedsfree = ISC_FALSE;
930
931 dns_message_takebuffer(msg, &dynbuf);
932
933 datalist = NULL;
934 RETERR(dns_message_gettemprdatalist(msg, &datalist));
935 datalist->rdclass = dns_rdataclass_any;
936 datalist->type = dns_rdatatype_sig; /* SIG(0) */
937 ISC_LIST_APPEND(datalist->rdata, rdata, link);
938 dataset = NULL;
939 RETERR(dns_message_gettemprdataset(msg, &dataset));
940 dns_rdataset_init(dataset);
941 RUNTIME_CHECK(dns_rdatalist_tordataset(datalist, dataset) == ISC_R_SUCCESS);
942 msg->sig0 = dataset;
943
944 return (ISC_R_SUCCESS);
945
946 failure:
947 if (dynbuf != NULL)
948 isc_buffer_free(&dynbuf);
949 if (signeedsfree)
950 isc_mem_put(mctx, sig.signature, sig.siglen);
951 if (ctx != NULL)
952 dst_context_destroy(&ctx);
953
954 return (result);
955 }
956
957 isc_result_t
dns_dnssec_verifymessage(isc_buffer_t * source,dns_message_t * msg,dst_key_t * key)958 dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
959 dst_key_t *key)
960 {
961 dns_rdata_sig_t sig; /* SIG(0) */
962 unsigned char header[DNS_MESSAGE_HEADERLEN];
963 dns_rdata_t rdata = DNS_RDATA_INIT;
964 isc_region_t r, source_r, sig_r, header_r;
965 isc_stdtime_t now;
966 dst_context_t *ctx = NULL;
967 isc_mem_t *mctx;
968 isc_result_t result;
969 isc_uint16_t addcount, addcount_n;
970 isc_boolean_t signeedsfree = ISC_FALSE;
971
972 REQUIRE(source != NULL);
973 REQUIRE(msg != NULL);
974 REQUIRE(key != NULL);
975
976 mctx = msg->mctx;
977
978 msg->verify_attempted = 1;
979
980 if (is_response(msg)) {
981 if (msg->query.base == NULL)
982 return (DNS_R_UNEXPECTEDTSIG);
983 }
984
985 isc_buffer_usedregion(source, &source_r);
986
987 RETERR(dns_rdataset_first(msg->sig0));
988 dns_rdataset_current(msg->sig0, &rdata);
989
990 RETERR(dns_rdata_tostruct(&rdata, &sig, NULL));
991 signeedsfree = ISC_TRUE;
992
993 if (sig.labels != 0) {
994 result = DNS_R_SIGINVALID;
995 goto failure;
996 }
997
998 if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
999 result = DNS_R_SIGINVALID;
1000 msg->sig0status = dns_tsigerror_badtime;
1001 goto failure;
1002 }
1003
1004 isc_stdtime_get(&now);
1005 if (isc_serial_lt((isc_uint32_t)now, sig.timesigned)) {
1006 result = DNS_R_SIGFUTURE;
1007 msg->sig0status = dns_tsigerror_badtime;
1008 goto failure;
1009 }
1010 else if (isc_serial_lt(sig.timeexpire, (isc_uint32_t)now)) {
1011 result = DNS_R_SIGEXPIRED;
1012 msg->sig0status = dns_tsigerror_badtime;
1013 goto failure;
1014 }
1015
1016 if (!dns_name_equal(dst_key_name(key), &sig.signer)) {
1017 result = DNS_R_SIGINVALID;
1018 msg->sig0status = dns_tsigerror_badkey;
1019 goto failure;
1020 }
1021
1022 RETERR(dst_context_create2(key, mctx, DNS_LOGCATEGORY_DNSSEC, &ctx));
1023
1024 /*
1025 * Digest the SIG(0) record, except for the signature.
1026 */
1027 dns_rdata_toregion(&rdata, &r);
1028 r.length -= sig.siglen;
1029 RETERR(dst_context_adddata(ctx, &r));
1030
1031 /*
1032 * If this is a response, digest the query.
1033 */
1034 if (is_response(msg))
1035 RETERR(dst_context_adddata(ctx, &msg->query));
1036
1037 /*
1038 * Extract the header.
1039 */
1040 memmove(header, source_r.base, DNS_MESSAGE_HEADERLEN);
1041
1042 /*
1043 * Decrement the additional field counter.
1044 */
1045 memmove(&addcount, &header[DNS_MESSAGE_HEADERLEN - 2], 2);
1046 addcount_n = ntohs(addcount);
1047 addcount = htons((isc_uint16_t)(addcount_n - 1));
1048 memmove(&header[DNS_MESSAGE_HEADERLEN - 2], &addcount, 2);
1049
1050 /*
1051 * Digest the modified header.
1052 */
1053 header_r.base = (unsigned char *) header;
1054 header_r.length = DNS_MESSAGE_HEADERLEN;
1055 RETERR(dst_context_adddata(ctx, &header_r));
1056
1057 /*
1058 * Digest all non-SIG(0) records.
1059 */
1060 r.base = source_r.base + DNS_MESSAGE_HEADERLEN;
1061 r.length = msg->sigstart - DNS_MESSAGE_HEADERLEN;
1062 RETERR(dst_context_adddata(ctx, &r));
1063
1064 sig_r.base = sig.signature;
1065 sig_r.length = sig.siglen;
1066 result = dst_context_verify(ctx, &sig_r);
1067 if (result != ISC_R_SUCCESS) {
1068 msg->sig0status = dns_tsigerror_badsig;
1069 goto failure;
1070 }
1071
1072 msg->verified_sig = 1;
1073
1074 dst_context_destroy(&ctx);
1075 dns_rdata_freestruct(&sig);
1076
1077 return (ISC_R_SUCCESS);
1078
1079 failure:
1080 if (signeedsfree)
1081 dns_rdata_freestruct(&sig);
1082 if (ctx != NULL)
1083 dst_context_destroy(&ctx);
1084
1085 return (result);
1086 }
1087
1088 /*%
1089 * Does this key ('rdata') self sign the rrset ('rdataset')?
1090 */
1091 isc_boolean_t
dns_dnssec_selfsigns(dns_rdata_t * rdata,dns_name_t * name,dns_rdataset_t * rdataset,dns_rdataset_t * sigrdataset,isc_boolean_t ignoretime,isc_mem_t * mctx)1092 dns_dnssec_selfsigns(dns_rdata_t *rdata, dns_name_t *name,
1093 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
1094 isc_boolean_t ignoretime, isc_mem_t *mctx)
1095 {
1096 INSIST(rdataset->type == dns_rdatatype_key ||
1097 rdataset->type == dns_rdatatype_dnskey);
1098 if (rdataset->type == dns_rdatatype_key) {
1099 INSIST(sigrdataset->type == dns_rdatatype_sig);
1100 INSIST(sigrdataset->covers == dns_rdatatype_key);
1101 } else {
1102 INSIST(sigrdataset->type == dns_rdatatype_rrsig);
1103 INSIST(sigrdataset->covers == dns_rdatatype_dnskey);
1104 }
1105
1106 return (dns_dnssec_signs(rdata, name, rdataset, sigrdataset,
1107 ignoretime, mctx));
1108
1109 }
1110
1111 isc_boolean_t
dns_dnssec_signs(dns_rdata_t * rdata,dns_name_t * name,dns_rdataset_t * rdataset,dns_rdataset_t * sigrdataset,isc_boolean_t ignoretime,isc_mem_t * mctx)1112 dns_dnssec_signs(dns_rdata_t *rdata, dns_name_t *name,
1113 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
1114 isc_boolean_t ignoretime, isc_mem_t *mctx)
1115 {
1116 dst_key_t *dstkey = NULL;
1117 dns_keytag_t keytag;
1118 dns_rdata_dnskey_t key;
1119 dns_rdata_rrsig_t sig;
1120 dns_rdata_t sigrdata = DNS_RDATA_INIT;
1121 isc_result_t result;
1122
1123 INSIST(sigrdataset->type == dns_rdatatype_rrsig);
1124 if (sigrdataset->covers != rdataset->type)
1125 return (ISC_FALSE);
1126
1127 result = dns_dnssec_keyfromrdata(name, rdata, mctx, &dstkey);
1128 if (result != ISC_R_SUCCESS)
1129 return (ISC_FALSE);
1130 result = dns_rdata_tostruct(rdata, &key, NULL);
1131 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1132
1133 keytag = dst_key_id(dstkey);
1134 for (result = dns_rdataset_first(sigrdataset);
1135 result == ISC_R_SUCCESS;
1136 result = dns_rdataset_next(sigrdataset))
1137 {
1138 dns_rdata_reset(&sigrdata);
1139 dns_rdataset_current(sigrdataset, &sigrdata);
1140 result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
1141 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1142
1143 if (sig.algorithm == key.algorithm &&
1144 sig.keyid == keytag) {
1145 result = dns_dnssec_verify2(name, rdataset, dstkey,
1146 ignoretime, mctx,
1147 &sigrdata, NULL);
1148 if (result == ISC_R_SUCCESS) {
1149 dst_key_free(&dstkey);
1150 return (ISC_TRUE);
1151 }
1152 }
1153 }
1154 dst_key_free(&dstkey);
1155 return (ISC_FALSE);
1156 }
1157
1158 isc_result_t
dns_dnsseckey_create(isc_mem_t * mctx,dst_key_t ** dstkey,dns_dnsseckey_t ** dkp)1159 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
1160 dns_dnsseckey_t **dkp)
1161 {
1162 isc_result_t result;
1163 dns_dnsseckey_t *dk;
1164 int major, minor;
1165
1166 REQUIRE(dkp != NULL && *dkp == NULL);
1167 dk = isc_mem_get(mctx, sizeof(dns_dnsseckey_t));
1168 if (dk == NULL)
1169 return (ISC_R_NOMEMORY);
1170
1171 dk->key = *dstkey;
1172 *dstkey = NULL;
1173 dk->force_publish = ISC_FALSE;
1174 dk->force_sign = ISC_FALSE;
1175 dk->hint_publish = ISC_FALSE;
1176 dk->hint_sign = ISC_FALSE;
1177 dk->hint_remove = ISC_FALSE;
1178 dk->first_sign = ISC_FALSE;
1179 dk->is_active = ISC_FALSE;
1180 dk->prepublish = 0;
1181 dk->source = dns_keysource_unknown;
1182 dk->index = 0;
1183
1184 /* KSK or ZSK? */
1185 dk->ksk = ISC_TF((dst_key_flags(dk->key) & DNS_KEYFLAG_KSK) != 0);
1186
1187 /* Is this an old-style key? */
1188 result = dst_key_getprivateformat(dk->key, &major, &minor);
1189 INSIST(result == ISC_R_SUCCESS);
1190
1191 /* Smart signing started with key format 1.3 */
1192 dk->legacy = ISC_TF(major == 1 && minor <= 2);
1193
1194 ISC_LINK_INIT(dk, link);
1195 *dkp = dk;
1196 return (ISC_R_SUCCESS);
1197 }
1198
1199 void
dns_dnsseckey_destroy(isc_mem_t * mctx,dns_dnsseckey_t ** dkp)1200 dns_dnsseckey_destroy(isc_mem_t *mctx, dns_dnsseckey_t **dkp) {
1201 dns_dnsseckey_t *dk;
1202
1203 REQUIRE(dkp != NULL && *dkp != NULL);
1204 dk = *dkp;
1205 if (dk->key != NULL)
1206 dst_key_free(&dk->key);
1207 isc_mem_put(mctx, dk, sizeof(dns_dnsseckey_t));
1208 *dkp = NULL;
1209 }
1210
1211 static void
get_hints(dns_dnsseckey_t * key,isc_stdtime_t now)1212 get_hints(dns_dnsseckey_t *key, isc_stdtime_t now) {
1213 isc_result_t result;
1214 isc_stdtime_t publish, active, revoke, inactive, delete;
1215 isc_boolean_t pubset = ISC_FALSE, actset = ISC_FALSE;
1216 isc_boolean_t revset = ISC_FALSE, inactset = ISC_FALSE;
1217 isc_boolean_t delset = ISC_FALSE;
1218
1219 REQUIRE(key != NULL && key->key != NULL);
1220
1221 result = dst_key_gettime(key->key, DST_TIME_PUBLISH, &publish);
1222 if (result == ISC_R_SUCCESS)
1223 pubset = ISC_TRUE;
1224
1225 result = dst_key_gettime(key->key, DST_TIME_ACTIVATE, &active);
1226 if (result == ISC_R_SUCCESS)
1227 actset = ISC_TRUE;
1228
1229 result = dst_key_gettime(key->key, DST_TIME_REVOKE, &revoke);
1230 if (result == ISC_R_SUCCESS)
1231 revset = ISC_TRUE;
1232
1233 result = dst_key_gettime(key->key, DST_TIME_INACTIVE, &inactive);
1234 if (result == ISC_R_SUCCESS)
1235 inactset = ISC_TRUE;
1236
1237 result = dst_key_gettime(key->key, DST_TIME_DELETE, &delete);
1238 if (result == ISC_R_SUCCESS)
1239 delset = ISC_TRUE;
1240
1241 /* Metadata says publish (but possibly not activate) */
1242 if (pubset && publish <= now)
1243 key->hint_publish = ISC_TRUE;
1244
1245 /* Metadata says activate (so we must also publish) */
1246 if (actset && active <= now) {
1247 key->hint_sign = ISC_TRUE;
1248
1249 /* Only publish if publish time has already passed. */
1250 if (pubset && publish <= now)
1251 key->hint_publish = ISC_TRUE;
1252 }
1253
1254 /*
1255 * Activation date is set (maybe in the future), but
1256 * publication date isn't. Most likely the user wants to
1257 * publish now and activate later.
1258 */
1259 if (actset && !pubset)
1260 key->hint_publish = ISC_TRUE;
1261
1262 /*
1263 * If activation date is in the future, make note of how far off
1264 */
1265 if (key->hint_publish && actset && active > now) {
1266 key->prepublish = active - now;
1267 }
1268
1269 /*
1270 * Key has been marked inactive: we can continue publishing,
1271 * but don't sign.
1272 */
1273 if (key->hint_publish && inactset && inactive <= now) {
1274 key->hint_sign = ISC_FALSE;
1275 }
1276
1277 /*
1278 * Metadata says revoke. If the key is published,
1279 * we *have to* sign with it per RFC5011--even if it was
1280 * not active before.
1281 *
1282 * If it hasn't already been done, we should also revoke it now.
1283 */
1284 if (key->hint_publish && (revset && revoke <= now)) {
1285 isc_uint32_t flags;
1286 key->hint_sign = ISC_TRUE;
1287 flags = dst_key_flags(key->key);
1288 if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
1289 flags |= DNS_KEYFLAG_REVOKE;
1290 dst_key_setflags(key->key, flags);
1291 }
1292 }
1293
1294 /*
1295 * Metadata says delete, so don't publish this key or sign with it.
1296 */
1297 if (delset && delete <= now) {
1298 key->hint_publish = ISC_FALSE;
1299 key->hint_sign = ISC_FALSE;
1300 key->hint_remove = ISC_TRUE;
1301 }
1302 }
1303
1304 /*%
1305 * Get a list of DNSSEC keys from the key repository
1306 */
1307 isc_result_t
dns_dnssec_findmatchingkeys(dns_name_t * origin,const char * directory,isc_mem_t * mctx,dns_dnsseckeylist_t * keylist)1308 dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
1309 isc_mem_t *mctx, dns_dnsseckeylist_t *keylist)
1310 {
1311 isc_result_t result = ISC_R_SUCCESS;
1312 isc_boolean_t dir_open = ISC_FALSE;
1313 dns_dnsseckeylist_t list;
1314 isc_dir_t dir;
1315 dns_dnsseckey_t *key = NULL;
1316 dst_key_t *dstkey = NULL;
1317 char namebuf[DNS_NAME_FORMATSIZE];
1318 isc_buffer_t b;
1319 unsigned int len, i;
1320 isc_stdtime_t now;
1321
1322 REQUIRE(keylist != NULL);
1323 ISC_LIST_INIT(list);
1324 isc_dir_init(&dir);
1325
1326 isc_buffer_init(&b, namebuf, sizeof(namebuf) - 1);
1327 RETERR(dns_name_tofilenametext(origin, ISC_FALSE, &b));
1328 len = isc_buffer_usedlength(&b);
1329 namebuf[len] = '\0';
1330
1331 if (directory == NULL)
1332 directory = ".";
1333 RETERR(isc_dir_open(&dir, directory));
1334 dir_open = ISC_TRUE;
1335
1336 isc_stdtime_get(&now);
1337
1338 while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
1339 if (dir.entry.name[0] != 'K' ||
1340 dir.entry.length < len + 1 ||
1341 dir.entry.name[len + 1] != '+' ||
1342 strncasecmp(dir.entry.name + 1, namebuf, len) != 0)
1343 continue;
1344
1345 for (i = len + 1 + 1; i < dir.entry.length ; i++)
1346 if (dir.entry.name[i] < '0' || dir.entry.name[i] > '9')
1347 break;
1348
1349 if (i == len + 1 + 1 || i >= dir.entry.length ||
1350 dir.entry.name[i] != '+')
1351 continue;
1352
1353 for (i++ ; i < dir.entry.length ; i++)
1354 if (dir.entry.name[i] < '0' || dir.entry.name[i] > '9')
1355 break;
1356
1357 if (strcmp(dir.entry.name + i, ".private") != 0)
1358 continue;
1359
1360 dstkey = NULL;
1361 result = dst_key_fromnamedfile(dir.entry.name,
1362 directory,
1363 DST_TYPE_PUBLIC |
1364 DST_TYPE_PRIVATE,
1365 mctx, &dstkey);
1366
1367 if (result != ISC_R_SUCCESS) {
1368 isc_log_write(dns_lctx,
1369 DNS_LOGCATEGORY_GENERAL,
1370 DNS_LOGMODULE_DNSSEC,
1371 ISC_LOG_WARNING,
1372 "dns_dnssec_findmatchingkeys: "
1373 "error reading key file %s: %s",
1374 dir.entry.name,
1375 isc_result_totext(result));
1376 continue;
1377 }
1378
1379 RETERR(dns_dnsseckey_create(mctx, &dstkey, &key));
1380 key->source = dns_keysource_repository;
1381 get_hints(key, now);
1382
1383 if (key->legacy) {
1384 dns_dnsseckey_destroy(mctx, &key);
1385 } else {
1386 ISC_LIST_APPEND(list, key, link);
1387 key = NULL;
1388 }
1389 }
1390
1391 if (!ISC_LIST_EMPTY(list)) {
1392 result = ISC_R_SUCCESS;
1393 ISC_LIST_APPENDLIST(*keylist, list, link);
1394 } else
1395 result = ISC_R_NOTFOUND;
1396
1397 failure:
1398 if (dir_open)
1399 isc_dir_close(&dir);
1400 INSIST(key == NULL);
1401 while ((key = ISC_LIST_HEAD(list)) != NULL) {
1402 ISC_LIST_UNLINK(list, key, link);
1403 INSIST(key->key != NULL);
1404 dst_key_free(&key->key);
1405 dns_dnsseckey_destroy(mctx, &key);
1406 }
1407 if (dstkey != NULL)
1408 dst_key_free(&dstkey);
1409 return (result);
1410 }
1411
1412 /*%
1413 * Add 'newkey' to 'keylist' if it's not already there.
1414 *
1415 * If 'savekeys' is ISC_TRUE, then we need to preserve all
1416 * the keys in the keyset, regardless of whether they have
1417 * metadata indicating they should be deactivated or removed.
1418 */
1419 static isc_result_t
addkey(dns_dnsseckeylist_t * keylist,dst_key_t ** newkey,isc_boolean_t savekeys,isc_mem_t * mctx)1420 addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey,
1421 isc_boolean_t savekeys, isc_mem_t *mctx)
1422 {
1423 dns_dnsseckey_t *key;
1424 isc_result_t result;
1425
1426 /* Skip duplicates */
1427 for (key = ISC_LIST_HEAD(*keylist);
1428 key != NULL;
1429 key = ISC_LIST_NEXT(key, link)) {
1430 if (dst_key_id(key->key) == dst_key_id(*newkey) &&
1431 dst_key_alg(key->key) == dst_key_alg(*newkey) &&
1432 dns_name_equal(dst_key_name(key->key),
1433 dst_key_name(*newkey)))
1434 break;
1435 }
1436
1437 if (key != NULL) {
1438 /*
1439 * Found a match. If the old key was only public and the
1440 * new key is private, replace the old one; otherwise
1441 * leave it. But either way, mark the key as having
1442 * been found in the zone.
1443 */
1444 if (dst_key_isprivate(key->key)) {
1445 dst_key_free(newkey);
1446 } else if (dst_key_isprivate(*newkey)) {
1447 dst_key_free(&key->key);
1448 key->key = *newkey;
1449 }
1450
1451 key->source = dns_keysource_zoneapex;
1452 return (ISC_R_SUCCESS);
1453 }
1454
1455 result = dns_dnsseckey_create(mctx, newkey, &key);
1456 if (result != ISC_R_SUCCESS)
1457 return (result);
1458 if (key->legacy || savekeys) {
1459 key->force_publish = ISC_TRUE;
1460 key->force_sign = dst_key_isprivate(key->key);
1461 }
1462 key->source = dns_keysource_zoneapex;
1463 ISC_LIST_APPEND(*keylist, key, link);
1464 *newkey = NULL;
1465 return (ISC_R_SUCCESS);
1466 }
1467
1468
1469 /*%
1470 * Mark all keys which signed the DNSKEY/SOA RRsets as "active",
1471 * for future reference.
1472 */
1473 static isc_result_t
mark_active_keys(dns_dnsseckeylist_t * keylist,dns_rdataset_t * rrsigs)1474 mark_active_keys(dns_dnsseckeylist_t *keylist, dns_rdataset_t *rrsigs) {
1475 isc_result_t result = ISC_R_SUCCESS;
1476 dns_rdata_t rdata = DNS_RDATA_INIT;
1477 dns_rdataset_t sigs;
1478 dns_dnsseckey_t *key;
1479
1480 REQUIRE(rrsigs != NULL && dns_rdataset_isassociated(rrsigs));
1481
1482 dns_rdataset_init(&sigs);
1483 dns_rdataset_clone(rrsigs, &sigs);
1484 for (key = ISC_LIST_HEAD(*keylist);
1485 key != NULL;
1486 key = ISC_LIST_NEXT(key, link)) {
1487 isc_uint16_t keyid, sigid;
1488 dns_secalg_t keyalg, sigalg;
1489 keyid = dst_key_id(key->key);
1490 keyalg = dst_key_alg(key->key);
1491
1492 for (result = dns_rdataset_first(&sigs);
1493 result == ISC_R_SUCCESS;
1494 result = dns_rdataset_next(&sigs)) {
1495 dns_rdata_rrsig_t sig;
1496
1497 dns_rdata_reset(&rdata);
1498 dns_rdataset_current(&sigs, &rdata);
1499 result = dns_rdata_tostruct(&rdata, &sig, NULL);
1500 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1501 sigalg = sig.algorithm;
1502 sigid = sig.keyid;
1503 if (keyid == sigid && keyalg == sigalg) {
1504 key->is_active = ISC_TRUE;
1505 break;
1506 }
1507 }
1508 }
1509
1510 if (result == ISC_R_NOMORE)
1511 result = ISC_R_SUCCESS;
1512
1513 if (dns_rdataset_isassociated(&sigs))
1514 dns_rdataset_disassociate(&sigs);
1515 return (result);
1516 }
1517
1518 /*%
1519 * Add the contents of a DNSKEY rdataset 'keyset' to 'keylist'.
1520 */
1521 isc_result_t
dns_dnssec_keylistfromrdataset(dns_name_t * origin,const char * directory,isc_mem_t * mctx,dns_rdataset_t * keyset,dns_rdataset_t * keysigs,dns_rdataset_t * soasigs,isc_boolean_t savekeys,isc_boolean_t publickey,dns_dnsseckeylist_t * keylist)1522 dns_dnssec_keylistfromrdataset(dns_name_t *origin,
1523 const char *directory, isc_mem_t *mctx,
1524 dns_rdataset_t *keyset, dns_rdataset_t *keysigs,
1525 dns_rdataset_t *soasigs, isc_boolean_t savekeys,
1526 isc_boolean_t publickey,
1527 dns_dnsseckeylist_t *keylist)
1528 {
1529 dns_rdataset_t keys;
1530 dns_rdata_t rdata = DNS_RDATA_INIT;
1531 dst_key_t *pubkey = NULL, *privkey = NULL;
1532 isc_result_t result;
1533
1534 REQUIRE(keyset != NULL && dns_rdataset_isassociated(keyset));
1535
1536 dns_rdataset_init(&keys);
1537
1538 dns_rdataset_clone(keyset, &keys);
1539 for (result = dns_rdataset_first(&keys);
1540 result == ISC_R_SUCCESS;
1541 result = dns_rdataset_next(&keys)) {
1542 dns_rdata_reset(&rdata);
1543 dns_rdataset_current(&keys, &rdata);
1544 RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &pubkey));
1545 dst_key_setttl(pubkey, keys.ttl);
1546
1547 if (!is_zone_key(pubkey) ||
1548 (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
1549 goto skip;
1550
1551 /* Corrupted .key file? */
1552 if (!dns_name_equal(origin, dst_key_name(pubkey)))
1553 goto skip;
1554
1555 if (publickey) {
1556 RETERR(addkey(keylist, &pubkey, savekeys, mctx));
1557 goto skip;
1558 }
1559
1560 result = dst_key_fromfile(dst_key_name(pubkey),
1561 dst_key_id(pubkey),
1562 dst_key_alg(pubkey),
1563 DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
1564 directory, mctx, &privkey);
1565
1566 /*
1567 * If the key was revoked and the private file
1568 * doesn't exist, maybe it was revoked internally
1569 * by named. Try loading the unrevoked version.
1570 */
1571 if (result == ISC_R_FILENOTFOUND) {
1572 isc_uint32_t flags;
1573 flags = dst_key_flags(pubkey);
1574 if ((flags & DNS_KEYFLAG_REVOKE) != 0) {
1575 dst_key_setflags(pubkey,
1576 flags & ~DNS_KEYFLAG_REVOKE);
1577 result = dst_key_fromfile(dst_key_name(pubkey),
1578 dst_key_id(pubkey),
1579 dst_key_alg(pubkey),
1580 DST_TYPE_PUBLIC|
1581 DST_TYPE_PRIVATE,
1582 directory,
1583 mctx, &privkey);
1584 if (result == ISC_R_SUCCESS &&
1585 dst_key_pubcompare(pubkey, privkey,
1586 ISC_FALSE)) {
1587 dst_key_setflags(privkey, flags);
1588 }
1589 dst_key_setflags(pubkey, flags);
1590 }
1591 }
1592
1593 if (result != ISC_R_SUCCESS) {
1594 char keybuf[DNS_NAME_FORMATSIZE];
1595 char algbuf[DNS_SECALG_FORMATSIZE];
1596 dns_name_format(dst_key_name(pubkey), keybuf,
1597 sizeof(keybuf));
1598 dns_secalg_format(dst_key_alg(pubkey), algbuf,
1599 sizeof(algbuf));
1600 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1601 DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
1602 "dns_dnssec_keylistfromrdataset: error "
1603 "reading private key file %s/%s/%d: %s",
1604 keybuf, algbuf, dst_key_id(pubkey),
1605 isc_result_totext(result));
1606 }
1607
1608 if (result == ISC_R_FILENOTFOUND || result == ISC_R_NOPERM) {
1609 RETERR(addkey(keylist, &pubkey, savekeys, mctx));
1610 goto skip;
1611 }
1612 RETERR(result);
1613
1614 /* This should never happen. */
1615 if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0)
1616 goto skip;
1617
1618 /*
1619 * Whatever the key's default TTL may have
1620 * been, the rdataset TTL takes priority.
1621 */
1622 dst_key_setttl(privkey, dst_key_getttl(pubkey));
1623
1624 RETERR(addkey(keylist, &privkey, savekeys, mctx));
1625 skip:
1626 if (pubkey != NULL)
1627 dst_key_free(&pubkey);
1628 if (privkey != NULL)
1629 dst_key_free(&privkey);
1630 }
1631
1632 if (result != ISC_R_NOMORE)
1633 RETERR(result);
1634
1635 if (keysigs != NULL && dns_rdataset_isassociated(keysigs))
1636 RETERR(mark_active_keys(keylist, keysigs));
1637
1638 if (soasigs != NULL && dns_rdataset_isassociated(soasigs))
1639 RETERR(mark_active_keys(keylist, soasigs));
1640
1641 result = ISC_R_SUCCESS;
1642
1643 failure:
1644 if (dns_rdataset_isassociated(&keys))
1645 dns_rdataset_disassociate(&keys);
1646 if (pubkey != NULL)
1647 dst_key_free(&pubkey);
1648 if (privkey != NULL)
1649 dst_key_free(&privkey);
1650 return (result);
1651 }
1652
1653 static isc_result_t
make_dnskey(dst_key_t * key,unsigned char * buf,int bufsize,dns_rdata_t * target)1654 make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
1655 dns_rdata_t *target)
1656 {
1657 isc_result_t result;
1658 isc_buffer_t b;
1659 isc_region_t r;
1660
1661 isc_buffer_init(&b, buf, bufsize);
1662 result = dst_key_todns(key, &b);
1663 if (result != ISC_R_SUCCESS)
1664 return (result);
1665
1666 dns_rdata_reset(target);
1667 isc_buffer_usedregion(&b, &r);
1668 dns_rdata_fromregion(target, dst_key_class(key),
1669 dns_rdatatype_dnskey, &r);
1670 return (ISC_R_SUCCESS);
1671 }
1672
1673 static isc_result_t
publish_key(dns_diff_t * diff,dns_dnsseckey_t * key,dns_name_t * origin,dns_ttl_t ttl,isc_mem_t * mctx,isc_boolean_t allzsk,void (* report)(const char *,...))1674 publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
1675 dns_ttl_t ttl, isc_mem_t *mctx, isc_boolean_t allzsk,
1676 void (*report)(const char *, ...))
1677 {
1678 isc_result_t result;
1679 dns_difftuple_t *tuple = NULL;
1680 unsigned char buf[DST_KEY_MAXSIZE];
1681 dns_rdata_t dnskey = DNS_RDATA_INIT;
1682 char alg[80];
1683
1684 dns_rdata_reset(&dnskey);
1685 RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
1686
1687 dns_secalg_format(dst_key_alg(key->key), alg, sizeof(alg));
1688 report("Fetching %s %d/%s from key %s.",
1689 key->ksk ? (allzsk ? "KSK/ZSK" : "KSK") : "ZSK",
1690 dst_key_id(key->key), alg,
1691 key->source == dns_keysource_user ? "file" : "repository");
1692
1693 if (key->prepublish && ttl > key->prepublish) {
1694 char keystr[DST_KEY_FORMATSIZE];
1695 isc_stdtime_t now;
1696
1697 dst_key_format(key->key, keystr, sizeof(keystr));
1698 report("Key %s: Delaying activation to match the DNSKEY TTL.\n",
1699 keystr, ttl);
1700
1701 isc_stdtime_get(&now);
1702 dst_key_settime(key->key, DST_TIME_ACTIVATE, now + ttl);
1703 }
1704
1705 /* publish key */
1706 RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_ADD, origin, ttl,
1707 &dnskey, &tuple));
1708 dns_diff_appendminimal(diff, &tuple);
1709 result = ISC_R_SUCCESS;
1710
1711 failure:
1712 return (result);
1713 }
1714
1715 static isc_result_t
remove_key(dns_diff_t * diff,dns_dnsseckey_t * key,dns_name_t * origin,dns_ttl_t ttl,isc_mem_t * mctx,const char * reason,void (* report)(const char *,...))1716 remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
1717 dns_ttl_t ttl, isc_mem_t *mctx, const char *reason,
1718 void (*report)(const char *, ...))
1719 {
1720 isc_result_t result;
1721 dns_difftuple_t *tuple = NULL;
1722 unsigned char buf[DST_KEY_MAXSIZE];
1723 dns_rdata_t dnskey = DNS_RDATA_INIT;
1724 char alg[80];
1725
1726 dns_secalg_format(dst_key_alg(key->key), alg, sizeof(alg));
1727 report("Removing %s key %d/%s from DNSKEY RRset.",
1728 reason, dst_key_id(key->key), alg);
1729
1730 RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
1731 RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_DEL, origin, ttl, &dnskey,
1732 &tuple));
1733 dns_diff_appendminimal(diff, &tuple);
1734 result = ISC_R_SUCCESS;
1735
1736 failure:
1737 return (result);
1738 }
1739
1740 /*
1741 * Update 'keys' with information from 'newkeys'.
1742 *
1743 * If 'removed' is not NULL, any keys that are being removed from
1744 * the zone will be added to the list for post-removal processing.
1745 */
1746 isc_result_t
dns_dnssec_updatekeys(dns_dnsseckeylist_t * keys,dns_dnsseckeylist_t * newkeys,dns_dnsseckeylist_t * removed,dns_name_t * origin,dns_ttl_t hint_ttl,dns_diff_t * diff,isc_boolean_t allzsk,isc_mem_t * mctx,void (* report)(const char *,...))1747 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
1748 dns_dnsseckeylist_t *removed, dns_name_t *origin,
1749 dns_ttl_t hint_ttl, dns_diff_t *diff,
1750 isc_boolean_t allzsk, isc_mem_t *mctx,
1751 void (*report)(const char *, ...))
1752 {
1753 isc_result_t result;
1754 dns_dnsseckey_t *key, *key1, *key2, *next;
1755 isc_boolean_t found_ttl = ISC_FALSE;
1756 dns_ttl_t ttl = hint_ttl;
1757
1758 /*
1759 * First, look through the existing key list to find keys
1760 * supplied from the command line which are not in the zone.
1761 * Update the zone to include them.
1762 *
1763 * Also, if there are keys published in the zone already,
1764 * use their TTL for all subsequent published keys.
1765 */
1766 for (key = ISC_LIST_HEAD(*keys);
1767 key != NULL;
1768 key = ISC_LIST_NEXT(key, link)) {
1769 if (key->source == dns_keysource_user &&
1770 (key->hint_publish || key->force_publish)) {
1771 RETERR(publish_key(diff, key, origin, ttl,
1772 mctx, allzsk, report));
1773 }
1774 if (key->source == dns_keysource_zoneapex) {
1775 ttl = dst_key_getttl(key->key);
1776 found_ttl = ISC_TRUE;
1777 }
1778 }
1779
1780 /*
1781 * If there were no existing keys, use the smallest nonzero
1782 * TTL of the keys found in the repository.
1783 */
1784 if (!found_ttl && !ISC_LIST_EMPTY(*newkeys)) {
1785 dns_ttl_t shortest = 0;
1786
1787 for (key = ISC_LIST_HEAD(*newkeys);
1788 key != NULL;
1789 key = ISC_LIST_NEXT(key, link)) {
1790 dns_ttl_t thisttl = dst_key_getttl(key->key);
1791 if (thisttl != 0 &&
1792 (shortest == 0 || thisttl < shortest))
1793 shortest = thisttl;
1794 }
1795
1796 if (shortest != 0)
1797 ttl = shortest;
1798 }
1799
1800 /*
1801 * Second, scan the list of newly found keys looking for matches
1802 * with known keys, and update accordingly.
1803 */
1804 for (key1 = ISC_LIST_HEAD(*newkeys); key1 != NULL; key1 = next) {
1805 isc_boolean_t key_revoked = ISC_FALSE;
1806
1807 next = ISC_LIST_NEXT(key1, link);
1808
1809 for (key2 = ISC_LIST_HEAD(*keys);
1810 key2 != NULL;
1811 key2 = ISC_LIST_NEXT(key2, link)) {
1812 int f1 = dst_key_flags(key1->key);
1813 int f2 = dst_key_flags(key2->key);
1814 int nr1 = f1 & ~DNS_KEYFLAG_REVOKE;
1815 int nr2 = f2 & ~DNS_KEYFLAG_REVOKE;
1816 if (nr1 == nr2 &&
1817 dst_key_alg(key1->key) == dst_key_alg(key2->key) &&
1818 dst_key_pubcompare(key1->key, key2->key,
1819 ISC_TRUE)) {
1820 int r1, r2;
1821 r1 = dst_key_flags(key1->key) &
1822 DNS_KEYFLAG_REVOKE;
1823 r2 = dst_key_flags(key2->key) &
1824 DNS_KEYFLAG_REVOKE;
1825 key_revoked = ISC_TF(r1 != r2);
1826 break;
1827 }
1828 }
1829
1830 /* No match found in keys; add the new key. */
1831 if (key2 == NULL) {
1832 ISC_LIST_UNLINK(*newkeys, key1, link);
1833 ISC_LIST_APPEND(*keys, key1, link);
1834
1835 if (key1->source != dns_keysource_zoneapex &&
1836 (key1->hint_publish || key1->force_publish)) {
1837 RETERR(publish_key(diff, key1, origin, ttl,
1838 mctx, allzsk, report));
1839 if (key1->hint_sign || key1->force_sign)
1840 key1->first_sign = ISC_TRUE;
1841 }
1842
1843 continue;
1844 }
1845
1846 /* Match found: remove or update it as needed */
1847 if (key1->hint_remove) {
1848 RETERR(remove_key(diff, key2, origin, ttl, mctx,
1849 "expired", report));
1850 ISC_LIST_UNLINK(*keys, key2, link);
1851 if (removed != NULL)
1852 ISC_LIST_APPEND(*removed, key2, link);
1853 else
1854 dns_dnsseckey_destroy(mctx, &key2);
1855 } else if (key_revoked &&
1856 (dst_key_flags(key1->key) & DNS_KEYFLAG_REVOKE) != 0) {
1857
1858 /*
1859 * A previously valid key has been revoked.
1860 * We need to remove the old version and pull
1861 * in the new one.
1862 */
1863 RETERR(remove_key(diff, key2, origin, ttl, mctx,
1864 "revoked", report));
1865 ISC_LIST_UNLINK(*keys, key2, link);
1866 if (removed != NULL)
1867 ISC_LIST_APPEND(*removed, key2, link);
1868 else
1869 dns_dnsseckey_destroy(mctx, &key2);
1870
1871 RETERR(publish_key(diff, key1, origin, ttl,
1872 mctx, allzsk, report));
1873 ISC_LIST_UNLINK(*newkeys, key1, link);
1874 ISC_LIST_APPEND(*keys, key1, link);
1875
1876 /*
1877 * XXX: The revoke flag is only defined for trust
1878 * anchors. Setting the flag on a non-KSK is legal,
1879 * but not defined in any RFC. It seems reasonable
1880 * to treat it the same as a KSK: keep it in the
1881 * zone, sign the DNSKEY set with it, but not
1882 * sign other records with it.
1883 */
1884 key1->ksk = ISC_TRUE;
1885 continue;
1886 } else {
1887 if (!key2->is_active &&
1888 (key1->hint_sign || key1->force_sign))
1889 key2->first_sign = ISC_TRUE;
1890 key2->hint_sign = key1->hint_sign;
1891 key2->hint_publish = key1->hint_publish;
1892 }
1893 }
1894
1895 /* Free any leftover keys in newkeys */
1896 while (!ISC_LIST_EMPTY(*newkeys)) {
1897 key1 = ISC_LIST_HEAD(*newkeys);
1898 ISC_LIST_UNLINK(*newkeys, key1, link);
1899 dns_dnsseckey_destroy(mctx, &key1);
1900 }
1901
1902 result = ISC_R_SUCCESS;
1903
1904 failure:
1905 return (result);
1906 }
1907