retronetworking
/
freeswitch
13
0
Fork 0
Code Pull Requests Releases Activity
freeswitch/libs/ldns/examples/ldns-verify-zone.c

714 lines
18 KiB
C
Raw Blame History

/*
* read a zone file from disk and prints it, one RR per line
*
* (c) NLnetLabs 2008
*
* See the file LICENSE for the license
*
* Missing from the checks: empty non-terminals
*/
#include "config.h"
#include <unistd.h>
#include <stdlib.h>
#include <ldns/ldns.h>
#include <errno.h>
#ifdef HAVE_SSL
#include <openssl/err.h>
int verbosity = 3;
/* returns 1 if the list is empty, or if there are only ns rrs in the
* list, 0 otherwise */
static int
only_ns_in_rrsets(ldns_dnssec_rrsets *rrsets) {
ldns_dnssec_rrsets *cur_rrset = rrsets;
while (cur_rrset) {
if (cur_rrset->type != LDNS_RR_TYPE_NS) {
return 0;
}
cur_rrset = cur_rrset->next;
}
return 1;
}
static int
zone_is_nsec3_optout(ldns_rbtree_t *zone_nodes)
{
/* simply find the first NSEC3 RR and check its flags */
/* TODO: maybe create a general function that uses the active
* NSEC3PARAM RR? */
ldns_rbnode_t *cur_node;
ldns_dnssec_name *cur_name;
cur_node = ldns_rbtree_first(zone_nodes);
while (cur_node != LDNS_RBTREE_NULL) {
cur_name = (ldns_dnssec_name *) cur_node->data;
if (cur_name && cur_name->nsec &&
ldns_rr_get_type(cur_name->nsec) == LDNS_RR_TYPE_NSEC3) {
if (ldns_nsec3_optout(cur_name->nsec)) {
return 1;
} else {
return 0;
}
}
cur_node = ldns_rbtree_next(cur_node);
}
return 0;
}
static bool
ldns_rr_list_contains_name(const ldns_rr_list *rr_list,
const ldns_rdf *name)
{
size_t i;
for (i = 0; i < ldns_rr_list_rr_count(rr_list); i++) {
if (ldns_dname_compare(name,
ldns_rr_owner(ldns_rr_list_rr(rr_list, i))) == 0) {
return true;
}
}
return false;
}
static void
print_type(ldns_rr_type type)
{
const ldns_rr_descriptor *descriptor;
descriptor = ldns_rr_descript(type);
if (descriptor && descriptor->_name) {
fprintf(stdout, "%s", descriptor->_name);
} else {
fprintf(stdout, "TYPE%u",
type);
}
}
static ldns_dnssec_zone *
create_dnssec_zone(ldns_zone *orig_zone)
{
size_t i;
ldns_dnssec_zone *dnssec_zone;
ldns_rr *cur_rr;
ldns_status status;
/* when reading NSEC3s, there is a chance that we encounter nsecs
for empty nonterminals, whose nonterminals we cannot derive yet
because the needed information is to be read later. in that case
we keep a list of those nsec3's and retry to add them later */
ldns_rr_list *failed_nsec3s = ldns_rr_list_new();
dnssec_zone = ldns_dnssec_zone_new();
if (ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(orig_zone)) !=
LDNS_STATUS_OK) {
if (verbosity > 0) {
fprintf(stderr,
"Error adding SOA to dnssec zone, skipping record\n");
}
}
for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(orig_zone)); i++) {
cur_rr = ldns_rr_list_rr(ldns_zone_rrs(orig_zone), i);
status = ldns_dnssec_zone_add_rr(dnssec_zone, cur_rr);
if (status != LDNS_STATUS_OK) {
if (status == LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND) {
ldns_rr_list_push_rr(failed_nsec3s, cur_rr);
} else {
if (verbosity > 0) {
fprintf(stderr, "Error adding RR to dnssec zone");
fprintf(stderr, ", skipping record:\n");
ldns_rr_print(stderr, cur_rr);
}
}
}
}
if (ldns_rr_list_rr_count(failed_nsec3s) > 0) {
(void) ldns_dnssec_zone_add_empty_nonterminals(dnssec_zone);
for (i = 0; i < ldns_rr_list_rr_count(failed_nsec3s); i++) {
cur_rr = ldns_rr_list_rr(failed_nsec3s, i);
status = ldns_dnssec_zone_add_rr(dnssec_zone, cur_rr);
}
}
ldns_rr_list_free(failed_nsec3s);
return dnssec_zone;
}
static ldns_status
verify_dnssec_rrset(ldns_rdf *zone_name,
ldns_rdf *name,
ldns_dnssec_rrsets *rrset,
ldns_rr_list *keys,
ldns_rr_list *glue_rrs)
{
ldns_rr_list *rrset_rrs;
ldns_dnssec_rrs *cur_rr, *cur_sig;
ldns_status status;
ldns_rr_list *good_keys;
ldns_status result = LDNS_STATUS_OK;
if (!rrset->rrs) return LDNS_STATUS_OK;
rrset_rrs = ldns_rr_list_new();
cur_rr = rrset->rrs;
while(cur_rr && cur_rr->rr) {
ldns_rr_list_push_rr(rrset_rrs, cur_rr->rr);
cur_rr = cur_rr->next;
}
cur_sig = rrset->signatures;
if (cur_sig) {
while (cur_sig) {
good_keys = ldns_rr_list_new();
status = ldns_verify_rrsig_keylist(rrset_rrs,
cur_sig->rr,
keys,
good_keys);
if (status != LDNS_STATUS_OK) {
if (verbosity > 0) {
printf("Error: %s",
ldns_get_errorstr_by_id(status));
printf(" for ");
ldns_rdf_print(stdout,
ldns_rr_owner(rrset->rrs->rr));
printf("\t");
print_type(rrset->type);
printf("\n");
if (result == LDNS_STATUS_OK) {
result = status;
}
if (status == LDNS_STATUS_SSL_ERR) {
ERR_load_crypto_strings();
ERR_print_errors_fp(stdout);
}
if (verbosity >= 4) {
printf("RRSet:\n");
ldns_dnssec_rrs_print(stdout, rrset->rrs);
printf("Signature:\n");
ldns_rr_print(stdout, cur_sig->rr);
printf("\n");
}
}
}
ldns_rr_list_free(good_keys);
cur_sig = cur_sig->next;
}
} else {
/* delegations are unsigned */
if (rrset->type != LDNS_RR_TYPE_NS ||
ldns_dname_compare(name, zone_name) == 0) {
if (verbosity > 0) {
printf("Error: no signatures for ");
ldns_rdf_print(stdout, ldns_rr_owner(rrset->rrs->rr));
printf("\t");
print_type(rrset->type);
printf("\n");
}
}
}
ldns_rr_list_free(rrset_rrs);
return result;
}
static ldns_status
verify_single_rr(ldns_rr *rr,
ldns_dnssec_rrs *signature_rrs,
ldns_rr_list *keys)
{
ldns_rr_list *rrset_rrs;
ldns_rr_list *good_keys;
ldns_dnssec_rrs *cur_sig;
ldns_status status;
ldns_status result = LDNS_STATUS_OK;
rrset_rrs = ldns_rr_list_new();
ldns_rr_list_push_rr(rrset_rrs, rr);
cur_sig = signature_rrs;
while (cur_sig) {
good_keys = ldns_rr_list_new();
status = ldns_verify_rrsig_keylist(rrset_rrs,
cur_sig->rr,
keys,
good_keys);
if (status != LDNS_STATUS_OK) {
if (verbosity >= 1) {
printf("Error: %s ", ldns_get_errorstr_by_id(status));
if (result == LDNS_STATUS_OK) {
result = status;
}
printf("for ");
ldns_rdf_print(stdout, ldns_rr_owner(rr));
printf("\t");
print_type(ldns_rr_get_type(rr));
printf("\n");
if (status == LDNS_STATUS_SSL_ERR) {
ERR_load_crypto_strings();
ERR_print_errors_fp(stdout);
}
if (verbosity >= 4) {
printf("RRSet:\n");
ldns_rr_list_print(stdout, rrset_rrs);
printf("Signature:\n");
ldns_rr_print(stdout, cur_sig->rr);
printf("\n");
}
}
result = status;
}
ldns_rr_list_free(good_keys);
cur_sig = cur_sig->next;
}
ldns_rr_list_free(rrset_rrs);
return result;
}
static ldns_status
verify_next_hashed_name(ldns_rbtree_t *zone_nodes,
ldns_dnssec_name *name)
{
ldns_rbnode_t *next_node;
ldns_dnssec_name *next_name;
ldns_dnssec_name *cur_next_name = NULL;
ldns_dnssec_name *cur_first_name = NULL;
int cmp;
char *next_owner_str;
ldns_rdf *next_owner_dname;
if (!name->hashed_name) {
name->hashed_name = ldns_nsec3_hash_name_frm_nsec3(name->nsec,
name->name);
}
next_node = ldns_rbtree_first(zone_nodes);
while (next_node != LDNS_RBTREE_NULL) {
next_name = (ldns_dnssec_name *)next_node->data;
/* skip over names that have no NSEC3 records (whether it
* actually should or should not should have been checked
* already */
if (!next_name->nsec) {
next_node = ldns_rbtree_next(next_node);
continue;
}
if (!next_name->hashed_name) {
next_name->hashed_name = ldns_nsec3_hash_name_frm_nsec3(
name->nsec, next_name->name);
}
/* we keep track of what 'so far' is the next hashed name;
* it must of course be 'larger' than the current name
* if we find one that is larger, but smaller than what we
* previously thought was the next one, that one is the next
*/
cmp = ldns_dname_compare(name->hashed_name,
next_name->hashed_name);
if (cmp < 0) {
if (!cur_next_name) {
cur_next_name = next_name;
} else {
cmp = ldns_dname_compare(next_name->hashed_name,
cur_next_name->hashed_name);
if (cmp < 0) {
cur_next_name = next_name;
}
}
}
/* in case the hashed name of the nsec we are checking is the
* last one, we need the first hashed name of the zone */
if (!cur_first_name) {
cur_first_name = next_name;
} else {
cmp = ldns_dname_compare(next_name->hashed_name,
cur_first_name->hashed_name);
if (cmp < 0) {
cur_first_name = next_name;
}
}
next_node = ldns_rbtree_next(next_node);
}
if (!cur_next_name) {
cur_next_name = cur_first_name;
}
next_owner_str = ldns_rdf2str(ldns_nsec3_next_owner(name->nsec));
next_owner_dname = ldns_dname_new_frm_str(next_owner_str);
cmp = ldns_dname_compare(next_owner_dname,
cur_next_name->hashed_name);
ldns_rdf_deep_free(next_owner_dname);
LDNS_FREE(next_owner_str);
if (cmp != 0) {
printf("Error: The NSEC3 record for ");
ldns_rdf_print(stdout, name->name);
printf(" points to the wrong next hashed owner name\n");
printf("(should point to ");
ldns_rdf_print(stdout, cur_next_name->name);
printf("(whose hashed name is ");
ldns_rdf_print(stdout, cur_next_name->hashed_name);
printf(")\n");
return LDNS_STATUS_ERR;
} else {
return LDNS_STATUS_OK;
}
}
static ldns_rbnode_t *
next_nonglue_node(ldns_rbnode_t *node, ldns_rr_list *glue_rrs)
{
ldns_rbnode_t *cur_node = ldns_rbtree_next(node);
ldns_dnssec_name *cur_name;
while (cur_node != LDNS_RBTREE_NULL) {
cur_name = (ldns_dnssec_name *) cur_node->data;
if (cur_name && cur_name->name) {
if (!ldns_rr_list_contains_name(glue_rrs, cur_name->name)) {
return cur_node;
}
}
cur_node = ldns_rbtree_next(cur_node);
}
return LDNS_RBTREE_NULL;
}
static ldns_status
verify_nsec(ldns_rbtree_t *zone_nodes,
ldns_rbnode_t *cur_node,
ldns_rr_list *keys,
ldns_rr_list *glue_rrs
)
{
ldns_rbnode_t *next_node;
ldns_dnssec_name *name, *next_name;
ldns_status status, result;
result = LDNS_STATUS_OK;
name = (ldns_dnssec_name *) cur_node->data;
if (name->nsec) {
if (name->nsec_signatures) {
status = verify_single_rr(name->nsec,
name->nsec_signatures,
keys);
if (result == LDNS_STATUS_OK) {
result = status;
}
} else {
if (verbosity >= 1) {
printf("Error: the NSEC(3) record of ");
ldns_rdf_print(stdout, name->name);
printf(" has no signatures\n");
}
if (result == LDNS_STATUS_OK) {
result = LDNS_STATUS_ERR;
}
}
/* check whether the NSEC record points to the right name */
switch (ldns_rr_get_type(name->nsec)) {
case LDNS_RR_TYPE_NSEC:
/* simply try next name */
next_node = next_nonglue_node(cur_node, glue_rrs);
if (next_node == LDNS_RBTREE_NULL) {
next_node = ldns_rbtree_first(zone_nodes);
}
next_name = (ldns_dnssec_name *)next_node->data;
if (ldns_dname_compare(next_name->name,
ldns_rr_rdf(name->nsec, 0))
!= 0) {
printf("Error: the NSEC record for ");
ldns_rdf_print(stdout, name->name);
printf(" points to the wrong next owner name\n");
if (result == LDNS_STATUS_OK) {
result = LDNS_STATUS_ERR;
}
}
break;
case LDNS_RR_TYPE_NSEC3:
/* find the hashed next name in the tree */
/* this is expensive, do we need to add support
* for this in the structs? (ie. pointer to next
* hashed name?)
*/
status = verify_next_hashed_name(zone_nodes, name);
if (result == LDNS_STATUS_OK) {
result = status;
}
break;
default:
break;
}
} else {
/* todo; do this once and cache result? */
if (zone_is_nsec3_optout(zone_nodes) &&
only_ns_in_rrsets(name->rrsets)) {
/* ok, no problem, but we need to remember to check
* whether the chain does not actually point to this
* name later */
} else {
if (verbosity >= 1) {
printf("Error: there is no NSEC(3) for ");
ldns_rdf_print(stdout, name->name);
printf("\n");
}
if (result == LDNS_STATUS_OK) {
result = LDNS_STATUS_ERR;
}
}
}
return result;
}
static int
ldns_dnssec_name_has_only_a(ldns_dnssec_name *cur_name)
{
ldns_dnssec_rrsets *cur_rrset;
cur_rrset = cur_name->rrsets;
while (cur_rrset) {
if (cur_rrset->type != LDNS_RR_TYPE_A &&
cur_rrset->type != LDNS_RR_TYPE_AAAA) {
return 0;
} else {
cur_rrset = cur_rrset->next;
}
}
return 1;
}
static ldns_status
verify_dnssec_name(ldns_rdf *zone_name,
ldns_dnssec_zone *zone,
ldns_rbtree_t *zone_nodes,
ldns_rbnode_t *cur_node,
ldns_rr_list *keys,
ldns_rr_list *glue_rrs)
{
ldns_status result = LDNS_STATUS_OK;
ldns_status status;
ldns_dnssec_rrsets *cur_rrset;
ldns_dnssec_name *name;
/* for NSEC chain checks */
name = (ldns_dnssec_name *) cur_node->data;
if (verbosity >= 3) {
printf("Checking: ");
ldns_rdf_print(stdout, name->name);
printf("\n");
}
if (ldns_rr_list_contains_name(glue_rrs, name->name) &&
ldns_dnssec_name_has_only_a(name)
) {
/* glue */
cur_rrset = name->rrsets;
while (cur_rrset) {
if (cur_rrset->signatures) {
if (verbosity >= 1) {
printf("Error: ");
ldns_rdf_print(stdout, name->name);
printf("\t");
print_type(cur_rrset->type);
printf(" has signature(s), but is glue\n");
}
result = LDNS_STATUS_ERR;
}
cur_rrset = cur_rrset->next;
}
if (name->nsec) {
if (verbosity >= 1) {
printf("Error: ");
ldns_rdf_print(stdout, name->name);
printf("\thas an NSEC(3), but is glue\n");
}
result = LDNS_STATUS_ERR;
}
} else {
/* not glue, do real verify */
cur_rrset = name->rrsets;
while(cur_rrset) {
if (cur_rrset->type != LDNS_RR_TYPE_A ||
!ldns_dnssec_zone_find_rrset(zone, name->name, LDNS_RR_TYPE_NS)) {
status = verify_dnssec_rrset(zone_name, name->name, cur_rrset, keys, glue_rrs);
if (status != LDNS_STATUS_OK && result == LDNS_STATUS_OK) {
result = status;
}
}
cur_rrset = cur_rrset->next;
}
status = verify_nsec(zone_nodes, cur_node, keys, glue_rrs);
if (result == LDNS_STATUS_OK) {
result = status;
}
}
return result;
}
static ldns_status
verify_dnssec_zone(ldns_dnssec_zone *dnssec_zone,
ldns_rdf *zone_name,
ldns_rr_list *glue_rrs)
{
ldns_rr_list *keys;
ldns_rbnode_t *cur_node;
ldns_dnssec_rrsets *cur_key_rrset;
ldns_dnssec_rrs *cur_key;
ldns_dnssec_name *cur_name;
ldns_status status;
ldns_status result = LDNS_STATUS_OK;
keys = ldns_rr_list_new();
cur_key_rrset = ldns_dnssec_zone_find_rrset(dnssec_zone,
zone_name,
LDNS_RR_TYPE_DNSKEY);
if (!cur_key_rrset || !cur_key_rrset->rrs) {
if (verbosity >= 1) {
printf("No DNSKEY records at zone apex\n");
}
result = LDNS_STATUS_ERR;
} else {
cur_key = cur_key_rrset->rrs;
while (cur_key) {
if (verbosity >= 4) {
printf("DNSKEY: ");
ldns_rr_print(stdout, cur_key->rr);
}
ldns_rr_list_push_rr(keys, cur_key->rr);
cur_key = cur_key->next;
}
cur_node = ldns_rbtree_first(dnssec_zone->names);
if (cur_node == LDNS_RBTREE_NULL) {
if (verbosity >= 1) {
printf("Empty zone?\n");
}
result = LDNS_STATUS_ERR;
}
while (cur_node != LDNS_RBTREE_NULL) {
cur_name = (ldns_dnssec_name *) cur_node->data;
status = verify_dnssec_name(zone_name,
dnssec_zone,
dnssec_zone->names,
cur_node,
keys,
glue_rrs);
if (status != LDNS_STATUS_OK && result == LDNS_STATUS_OK) {
result = status;
}
cur_node = ldns_rbtree_next(cur_node);
}
}
ldns_rr_list_free(keys);
return result;
}
int
main(int argc, char **argv)
{
char *filename;
FILE *fp;
ldns_zone *z;
int line_nr = 0;
int c;
ldns_status s;
ldns_dnssec_zone *dnssec_zone;
ldns_status result = LDNS_STATUS_ERR;
ldns_rr_list *glue_rrs;
while ((c = getopt(argc, argv, "hvV:")) != -1) {
switch(c) {
case 'h':
printf("Usage: %s [OPTIONS] <zonefile>\n", argv[0]);
printf("\tReads the zonefile and checks for DNSSEC errors.\n");
printf("\nIt checks whether NSEC(3)s are present,");
printf(" and verifies all signatures\n");
printf("It also checks the NSEC(3) chain, but it will error on opted-out delegations\n");
printf("\nOPTIONS:\n");
printf("\t-h show this text\n");
printf("\t-v shows the version and exits\n");
printf("\t-V [0-5]\tset verbosity level (default 3)\n");
printf("\nif no file is given standard input is read\n");
exit(EXIT_SUCCESS);
break;
case 'v':
printf("read zone version %s (ldns version %s)\n",
LDNS_VERSION, ldns_version());
exit(EXIT_SUCCESS);
break;
case 'V':
verbosity = atoi(optarg);
break;
}
}
argc -= optind;
argv += optind;
if (argc == 0) {
fp = stdin;
} else {
filename = argv[0];
fp = fopen(filename, "r");
if (!fp) {
fprintf(stderr,
"Unable to open %s: %s\n",
filename,
strerror(errno));
exit(EXIT_FAILURE);
}
}
s = ldns_zone_new_frm_fp_l(&z, fp, NULL, 0, LDNS_RR_CLASS_IN, &line_nr);
if (s == LDNS_STATUS_OK) {
if (!ldns_zone_soa(z)) {
fprintf(stderr, "; Error: no SOA in the zone\n");
exit(1);
}
glue_rrs = ldns_zone_glue_rr_list(z);
dnssec_zone = create_dnssec_zone(z);
if (verbosity >= 5) {
ldns_dnssec_zone_print(stdout, dnssec_zone);
}
result = verify_dnssec_zone(dnssec_zone,
ldns_rr_owner(ldns_zone_soa(z)),
glue_rrs);
if (result == LDNS_STATUS_OK) {
if (verbosity >= 1) {
printf("Zone is verified and complete\n");
}
} else {
if (verbosity >= 1) {
printf("There were errors in the zone\n");
}
}
ldns_zone_free(z);
ldns_dnssec_zone_deep_free(dnssec_zone);
} else {
fprintf(stderr, "%s at %d\n",
ldns_get_errorstr_by_id(s),
line_nr);
exit(EXIT_FAILURE);
}
fclose(fp);
exit(result);
}
#else
int
main(int argc, char **argv)
{
fprintf(stderr, "ldns-verifyzone needs OpenSSL support, which has not been compiled in\n");
return 1;
}
#endif /* HAVE_SSL */
View Git Blame Copy Permalink