1 /* 2 * unbound-anchor.c - update the root anchor if necessary. 3 * 4 * Copyright (c) 2010, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 25 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 26 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE 27 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 28 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 29 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 30 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 31 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 33 * POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file checks to see that the current 5011 keys work to prime the 40 * current root anchor. If not a certificate is used to update the anchor. 41 * 42 * This is a concept solution for distribution of the DNSSEC root 43 * trust anchor. It is a small tool, called "unbound-anchor", that 44 * runs before the main validator starts. I.e. in the init script: 45 * unbound-anchor; unbound. Thus it is meant to run at system boot time. 46 * 47 * Management-Abstract: 48 * * first run: fill root.key file with hardcoded DS record. 49 * * mostly: use RFC5011 tracking, quick . DNSKEY UDP query. 50 * * failover: use builtin certificate, do https and update. 51 * Special considerations: 52 * * 30-days RFC5011 timer saves a lot of https traffic. 53 * * DNSKEY probe must be NOERROR, saves a lot of https traffic. 54 * * fail if clock before sign date of the root, if cert expired. 55 * * if the root goes back to unsigned, deals with it. 56 * 57 * It has hardcoded the root DS anchors and the ICANN CA root certificate. 58 * It allows with options to override those. It also takes root-hints (it 59 * has to do a DNS resolve), and also has hardcoded defaults for those. 60 * 61 * Once it starts, just before the validator starts, it quickly checks if 62 * the root anchor file needs to be updated. First it tries to use 63 * RFC5011-tracking of the root key. If that fails (and for 30-days since 64 * last successful probe), then it attempts to update using the 65 * certificate. So most of the time, the RFC5011 tracking will work fine, 66 * and within a couple milliseconds, the main daemon can start. It will 67 * have only probed the . DNSKEY, not done expensive https transfers on the 68 * root infrastructure. 69 * 70 * If there is no root key in the root.key file, it bootstraps the 71 * RFC5011-tracking with its builtin DS anchors; if that fails it 72 * bootstraps the RFC5011-tracking using the certificate. (again to avoid 73 * https, and it is also faster). 74 * 75 * It uses the XML file by converting it to DS records and writing that to the 76 * key file. Unbound can detect that the 'special comments' are gone, and 77 * the file contains a list of normal DNSKEY/DS records, and uses that to 78 * bootstrap 5011 (the KSK is made VALID). 79 * 80 * The certificate update is done by fetching root-anchors.xml and 81 * root-anchors.p7s via SSL. The HTTPS certificate can be logged but is 82 * not validated (https for channel security; the security comes from the 83 * certificate). The 'data.iana.org' domain name A and AAAA are resolved 84 * without DNSSEC. It tries a random IP until the transfer succeeds. It 85 * then checks the p7s signature. 86 * 87 * On any failure, it leaves the root key file untouched. The main 88 * validator has to cope with it, it cannot fix things (So a failure does 89 * not go 'without DNSSEC', no downgrade). If it used its builtin stuff or 90 * did the https, it exits with an exit code, so that this can trigger the 91 * init script to log the event and potentially alert the operator that can 92 * do a manual check. 93 * 94 * The date is also checked. Before 2010-07-15 is a failure (root not 95 * signed yet; avoids attacks on system clock). The 96 * last-successful-RFC5011-probe (if available) has to be more than 30 days 97 * in the past (otherwise, RFC5011 should have worked). This keeps 98 * unneccesary https traffic down. If the main certificate is expired, it 99 * fails. 100 * 101 * The dates on the keys in the xml are checked (uses the libexpat xml 102 * parser), only the valid ones are used to re-enstate RFC5011 tracking. 103 * If 0 keys are valid, the zone has gone to insecure (a special marker is 104 * written in the keyfile that tells the main validator daemon the zone is 105 * insecure). 106 * 107 * Only the root ICANN CA is shipped, not the intermediate ones. The 108 * intermediate CAs are included in the p7s file that was downloaded. (the 109 * root cert is valid to 2028 and the intermediate to 2014, today). 110 * 111 * Obviously, the tool also has options so the operator can provide a new 112 * keyfile, a new certificate and new URLs, and fresh root hints. By 113 * default it logs nothing on failure and success; it 'just works'. 114 * 115 */ 116 117 #include "config.h" 118 #include "libunbound/unbound.h" 119 #include <ldns/rr.h> 120 #include <expat.h> 121 #ifndef HAVE_EXPAT_H 122 #error "need libexpat to parse root-anchors.xml file." 123 #endif 124 #ifdef HAVE_GETOPT_H 125 #include <getopt.h> 126 #endif 127 #ifdef HAVE_OPENSSL_SSL_H 128 #include <openssl/ssl.h> 129 #endif 130 #ifdef HAVE_OPENSSL_ERR_H 131 #include <openssl/err.h> 132 #endif 133 #ifdef HAVE_OPENSSL_RAND_H 134 #include <openssl/rand.h> 135 #endif 136 #include <openssl/x509.h> 137 #include <openssl/x509v3.h> 138 #include <openssl/pem.h> 139 140 /** name of server in URL to fetch HTTPS from */ 141 #define URLNAME "data.iana.org" 142 /** path on HTTPS server to xml file */ 143 #define XMLNAME "root-anchors/root-anchors.xml" 144 /** path on HTTPS server to p7s file */ 145 #define P7SNAME "root-anchors/root-anchors.p7s" 146 /** name of the signer of the certificate */ 147 #define P7SIGNER "dnssec@iana.org" 148 /** port number for https access */ 149 #define HTTPS_PORT 443 150 151 #ifdef USE_WINSOCK 152 /* sneakily reuse the the wsa_strerror function, on windows */ 153 char* wsa_strerror(int err); 154 #endif 155 156 /** verbosity for this application */ 157 static int verb = 0; 158 159 /** list of IP addresses */ 160 struct ip_list { 161 /** next in list */ 162 struct ip_list* next; 163 /** length of addr */ 164 socklen_t len; 165 /** address ready to connect to */ 166 struct sockaddr_storage addr; 167 /** has the address been used */ 168 int used; 169 }; 170 171 /** Give unbound-anchor usage, and exit (1). */ 172 static void 173 usage() 174 { 175 printf("Usage: unbound-anchor [opts]\n"); 176 printf(" Setup or update root anchor. " 177 "Most options have defaults.\n"); 178 printf(" Run this program before you start the validator.\n"); 179 printf("\n"); 180 printf(" The anchor and cert have default builtin content\n"); 181 printf(" if the file does not exist or is empty.\n"); 182 printf("\n"); 183 printf("-a file root key file, default %s\n", ROOT_ANCHOR_FILE); 184 printf(" The key is input and output for this tool.\n"); 185 printf("-c file cert file, default %s\n", ROOT_CERT_FILE); 186 printf("-l list builtin key and cert on stdout\n"); 187 printf("-u name server in https url, default %s\n", URLNAME); 188 printf("-x path pathname to xml in url, default %s\n", XMLNAME); 189 printf("-s path pathname to p7s in url, default %s\n", P7SNAME); 190 printf("-n name signer's subject emailAddress, default %s\n", P7SIGNER); 191 printf("-4 work using IPv4 only\n"); 192 printf("-6 work using IPv6 only\n"); 193 printf("-f resolv.conf use given resolv.conf to resolve -u name\n"); 194 printf("-r root.hints use given root.hints to resolve -u name\n" 195 " builtin root hints are used by default\n"); 196 printf("-v more verbose\n"); 197 printf("-C conf debug, read config\n"); 198 printf("-P port use port for https connect, default 443\n"); 199 printf("-F debug, force update with cert\n"); 200 printf("-h show this usage help\n"); 201 printf("Version %s\n", PACKAGE_VERSION); 202 printf("BSD licensed, see LICENSE in source package for details.\n"); 203 printf("Report bugs to %s\n", PACKAGE_BUGREPORT); 204 exit(1); 205 } 206 207 /** return the built in root update certificate */ 208 static const char* 209 get_builtin_cert(void) 210 { 211 return 212 /* The ICANN CA fetched at 24 Sep 2010. Valid to 2028 */ 213 "-----BEGIN CERTIFICATE-----\n" 214 "MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO\n" 215 "TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV\n" 216 "BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX\n" 217 "DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O\n" 218 "IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB\n" 219 "MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb\n" 220 "cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S\n" 221 "G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg\n" 222 "ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2\n" 223 "paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7\n" 224 "MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29\n" 225 "iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B\n" 226 "Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3\n" 227 "DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH\n" 228 "6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD\n" 229 "2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h\n" 230 "15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF\n" 231 "0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg\n" 232 "j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk\n" 233 "-----END CERTIFICATE-----\n" 234 ; 235 } 236 237 /** return the built in root DS trust anchor */ 238 static const char* 239 get_builtin_ds(void) 240 { 241 return 242 ". IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5\n"; 243 } 244 245 /** print hex data */ 246 static void 247 print_data(char* msg, char* data, int len) 248 { 249 int i; 250 printf("%s: ", msg); 251 for(i=0; i<len; i++) { 252 printf(" %2.2x", (unsigned char)data[i]); 253 } 254 printf("\n"); 255 } 256 257 /** print ub context creation error and exit */ 258 static void 259 ub_ctx_error_exit(struct ub_ctx* ctx, const char* str, const char* str2) 260 { 261 ub_ctx_delete(ctx); 262 if(str && str2 && verb) printf("%s: %s\n", str, str2); 263 if(verb) printf("error: could not create unbound resolver context\n"); 264 exit(0); 265 } 266 267 /** 268 * Create a new unbound context with the commandline settings applied 269 */ 270 static struct ub_ctx* 271 create_unbound_context(char* res_conf, char* root_hints, char* debugconf, 272 int ip4only, int ip6only) 273 { 274 int r; 275 struct ub_ctx* ctx = ub_ctx_create(); 276 if(!ctx) { 277 if(verb) printf("out of memory\n"); 278 exit(0); 279 } 280 /* do not waste time and network traffic to fetch extra nameservers */ 281 r = ub_ctx_set_option(ctx, "target-fetch-policy:", "0 0 0 0 0"); 282 if(r && verb) printf("ctx targetfetchpolicy: %s\n", ub_strerror(r)); 283 /* read config file first, so its settings can be overridden */ 284 if(debugconf) { 285 r = ub_ctx_config(ctx, debugconf); 286 if(r) ub_ctx_error_exit(ctx, debugconf, ub_strerror(r)); 287 } 288 if(res_conf) { 289 r = ub_ctx_resolvconf(ctx, res_conf); 290 if(r) ub_ctx_error_exit(ctx, res_conf, ub_strerror(r)); 291 } 292 if(root_hints) { 293 r = ub_ctx_set_option(ctx, "root-hints:", root_hints); 294 if(r) ub_ctx_error_exit(ctx, root_hints, ub_strerror(r)); 295 } 296 if(ip4only) { 297 r = ub_ctx_set_option(ctx, "do-ip6:", "no"); 298 if(r) ub_ctx_error_exit(ctx, "ip4only", ub_strerror(r)); 299 } 300 if(ip6only) { 301 r = ub_ctx_set_option(ctx, "do-ip4:", "no"); 302 if(r) ub_ctx_error_exit(ctx, "ip6only", ub_strerror(r)); 303 } 304 return ctx; 305 } 306 307 /** printout certificate in detail */ 308 static void 309 verb_cert(char* msg, X509* x) 310 { 311 if(verb == 0 || verb == 1) return; 312 if(verb == 2) { 313 if(msg) printf("%s\n", msg); 314 X509_print_ex_fp(stdout, x, 0, (unsigned long)-1 315 ^(X509_FLAG_NO_SUBJECT 316 |X509_FLAG_NO_ISSUER|X509_FLAG_NO_VALIDITY)); 317 return; 318 } 319 if(msg) printf("%s\n", msg); 320 X509_print_fp(stdout, x); 321 } 322 323 /** printout certificates in detail */ 324 static void 325 verb_certs(char* msg, STACK_OF(X509)* sk) 326 { 327 int i, num = sk_X509_num(sk); 328 if(verb == 0 || verb == 1) return; 329 for(i=0; i<num; i++) { 330 printf("%s (%d/%d)\n", msg, i, num); 331 verb_cert(NULL, sk_X509_value(sk, i)); 332 } 333 } 334 335 /** read certificates from a PEM bio */ 336 static STACK_OF(X509)* 337 read_cert_bio(BIO* bio) 338 { 339 STACK_OF(X509) *sk = sk_X509_new_null(); 340 if(!sk) { 341 if(verb) printf("out of memory\n"); 342 exit(0); 343 } 344 while(!BIO_eof(bio)) { 345 X509* x = PEM_read_bio_X509(bio, NULL, 0, NULL); 346 if(x == NULL) { 347 if(verb) { 348 printf("failed to read X509\n"); 349 ERR_print_errors_fp(stdout); 350 } 351 continue; 352 } 353 if(!sk_X509_push(sk, x)) { 354 if(verb) printf("out of memory\n"); 355 exit(0); 356 } 357 } 358 return sk; 359 } 360 361 /* read the certificate file */ 362 static STACK_OF(X509)* 363 read_cert_file(char* file) 364 { 365 STACK_OF(X509)* sk; 366 FILE* in; 367 int content = 0; 368 char buf[128]; 369 if(file == NULL || strcmp(file, "") == 0) { 370 return NULL; 371 } 372 sk = sk_X509_new_null(); 373 if(!sk) { 374 if(verb) printf("out of memory\n"); 375 exit(0); 376 } 377 in = fopen(file, "r"); 378 if(!in) { 379 if(verb) printf("%s: %s\n", file, strerror(errno)); 380 #ifndef S_SPLINT_S 381 sk_X509_pop_free(sk, X509_free); 382 #endif 383 return NULL; 384 } 385 while(!feof(in)) { 386 X509* x = PEM_read_X509(in, NULL, 0, NULL); 387 if(x == NULL) { 388 if(verb) { 389 printf("failed to read X509 file\n"); 390 ERR_print_errors_fp(stdout); 391 } 392 continue; 393 } 394 if(!sk_X509_push(sk, x)) { 395 if(verb) printf("out of memory\n"); 396 fclose(in); 397 exit(0); 398 } 399 content = 1; 400 /* read away newline after --END CERT-- */ 401 if(!fgets(buf, (int)sizeof(buf), in)) 402 break; 403 } 404 fclose(in); 405 if(!content) { 406 if(verb) printf("%s is empty\n", file); 407 #ifndef S_SPLINT_S 408 sk_X509_pop_free(sk, X509_free); 409 #endif 410 return NULL; 411 } 412 return sk; 413 } 414 415 /** read certificates from the builtin certificate */ 416 static STACK_OF(X509)* 417 read_builtin_cert(void) 418 { 419 const char* builtin_cert = get_builtin_cert(); 420 STACK_OF(X509)* sk; 421 BIO *bio = BIO_new_mem_buf((void*)builtin_cert, 422 (int)strlen(builtin_cert)); 423 if(!bio) { 424 if(verb) printf("out of memory\n"); 425 exit(0); 426 } 427 sk = read_cert_bio(bio); 428 if(!sk) { 429 if(verb) printf("internal error, out of memory\n"); 430 exit(0); 431 } 432 BIO_free(bio); 433 return sk; 434 } 435 436 /** read update cert file or use builtin */ 437 static STACK_OF(X509)* 438 read_cert_or_builtin(char* file) 439 { 440 STACK_OF(X509) *sk = read_cert_file(file); 441 if(!sk) { 442 if(verb) printf("using builtin certificate\n"); 443 sk = read_builtin_cert(); 444 } 445 if(verb) printf("have %d trusted certificates\n", sk_X509_num(sk)); 446 verb_certs("trusted certificates", sk); 447 return sk; 448 } 449 450 static void 451 do_list_builtin(void) 452 { 453 const char* builtin_cert = get_builtin_cert(); 454 const char* builtin_ds = get_builtin_ds(); 455 printf("%s\n", builtin_ds); 456 printf("%s\n", builtin_cert); 457 exit(0); 458 } 459 460 /** printout IP address with message */ 461 static void 462 verb_addr(char* msg, struct ip_list* ip) 463 { 464 if(verb) { 465 char out[100]; 466 void* a = &((struct sockaddr_in*)&ip->addr)->sin_addr; 467 if(ip->len != (socklen_t)sizeof(struct sockaddr_in)) 468 a = &((struct sockaddr_in6*)&ip->addr)->sin6_addr; 469 470 if(inet_ntop((int)((struct sockaddr_in*)&ip->addr)->sin_family, 471 a, out, (socklen_t)sizeof(out))==0) 472 printf("%s (inet_ntop error)\n", msg); 473 else printf("%s %s\n", msg, out); 474 } 475 } 476 477 /** free ip_list */ 478 static void 479 ip_list_free(struct ip_list* p) 480 { 481 struct ip_list* np; 482 while(p) { 483 np = p->next; 484 free(p); 485 p = np; 486 } 487 } 488 489 /** create ip_list entry for a RR record */ 490 static struct ip_list* 491 RR_to_ip(int tp, char* data, int len, int port) 492 { 493 struct ip_list* ip = (struct ip_list*)calloc(1, sizeof(*ip)); 494 uint16_t p = (uint16_t)port; 495 if(tp == LDNS_RR_TYPE_A) { 496 struct sockaddr_in* sa = (struct sockaddr_in*)&ip->addr; 497 ip->len = (socklen_t)sizeof(*sa); 498 sa->sin_family = AF_INET; 499 sa->sin_port = (in_port_t)htons(p); 500 if(len != (int)sizeof(sa->sin_addr)) { 501 if(verb) printf("skipped badly formatted A\n"); 502 free(ip); 503 return NULL; 504 } 505 memmove(&sa->sin_addr, data, sizeof(sa->sin_addr)); 506 507 } else if(tp == LDNS_RR_TYPE_AAAA) { 508 struct sockaddr_in6* sa = (struct sockaddr_in6*)&ip->addr; 509 ip->len = (socklen_t)sizeof(*sa); 510 sa->sin6_family = AF_INET6; 511 sa->sin6_port = (in_port_t)htons(p); 512 if(len != (int)sizeof(sa->sin6_addr)) { 513 if(verb) printf("skipped badly formatted AAAA\n"); 514 free(ip); 515 return NULL; 516 } 517 memmove(&sa->sin6_addr, data, sizeof(sa->sin6_addr)); 518 } else { 519 if(verb) printf("internal error: bad type in RRtoip\n"); 520 free(ip); 521 return NULL; 522 } 523 verb_addr("resolved server address", ip); 524 return ip; 525 } 526 527 /** Resolve name, type, class and add addresses to iplist */ 528 static void 529 resolve_host_ip(struct ub_ctx* ctx, char* host, int port, int tp, int cl, 530 struct ip_list** head) 531 { 532 struct ub_result* res = NULL; 533 int r; 534 int i; 535 536 r = ub_resolve(ctx, host, tp, cl, &res); 537 if(r) { 538 if(verb) printf("error: resolve %s %s: %s\n", host, 539 (tp==LDNS_RR_TYPE_A)?"A":"AAAA", ub_strerror(r)); 540 return; 541 } 542 if(!res) { 543 if(verb) printf("out of memory\n"); 544 ub_ctx_delete(ctx); 545 exit(0); 546 } 547 if(!res->havedata || res->rcode || !res->data) { 548 if(verb) printf("resolve %s %s: no result\n", host, 549 (tp==LDNS_RR_TYPE_A)?"A":"AAAA"); 550 return; 551 } 552 for(i = 0; res->data[i]; i++) { 553 struct ip_list* ip = RR_to_ip(tp, res->data[i], res->len[i], 554 port); 555 if(!ip) continue; 556 ip->next = *head; 557 *head = ip; 558 } 559 ub_resolve_free(res); 560 } 561 562 /** parse a text IP address into a sockaddr */ 563 static struct ip_list* 564 parse_ip_addr(char* str, int port) 565 { 566 socklen_t len = 0; 567 struct sockaddr_storage* addr = NULL; 568 struct sockaddr_in6 a6; 569 struct sockaddr_in a; 570 struct ip_list* ip; 571 uint16_t p = (uint16_t)port; 572 memset(&a6, 0, sizeof(a6)); 573 memset(&a, 0, sizeof(a)); 574 575 if(inet_pton(AF_INET6, str, &a6.sin6_addr) > 0) { 576 /* it is an IPv6 */ 577 a6.sin6_family = AF_INET6; 578 a6.sin6_port = (in_port_t)htons(p); 579 addr = (struct sockaddr_storage*)&a6; 580 len = (socklen_t)sizeof(struct sockaddr_in6); 581 } 582 if(inet_pton(AF_INET, str, &a.sin_addr) > 0) { 583 /* it is an IPv4 */ 584 a.sin_family = AF_INET; 585 a.sin_port = (in_port_t)htons(p); 586 addr = (struct sockaddr_storage*)&a; 587 len = (socklen_t)sizeof(struct sockaddr_in); 588 } 589 if(!len) return NULL; 590 ip = (struct ip_list*)calloc(1, sizeof(*ip)); 591 if(!ip) { 592 if(verb) printf("out of memory\n"); 593 exit(0); 594 } 595 ip->len = len; 596 memmove(&ip->addr, addr, len); 597 if(verb) printf("server address is %s\n", str); 598 return ip; 599 } 600 601 /** 602 * Resolve a domain name (even though the resolver is down and there is 603 * no trust anchor). Without DNSSEC validation. 604 * @param host: the name to resolve. 605 * If this name is an IP4 or IP6 address this address is returned. 606 * @param port: the port number used for the returned IP structs. 607 * @param res_conf: resolv.conf (if any). 608 * @param root_hints: root hints (if any). 609 * @param debugconf: unbound.conf for debugging options. 610 * @param ip4only: use only ip4 for resolve and only lookup A 611 * @param ip6only: use only ip6 for resolve and only lookup AAAA 612 * default is to lookup A and AAAA using ip4 and ip6. 613 * @return list of IP addresses. 614 */ 615 static struct ip_list* 616 resolve_name(char* host, int port, char* res_conf, char* root_hints, 617 char* debugconf, int ip4only, int ip6only) 618 { 619 struct ub_ctx* ctx; 620 struct ip_list* list = NULL; 621 /* first see if name is an IP address itself */ 622 if( (list=parse_ip_addr(host, port)) ) { 623 return list; 624 } 625 626 /* create resolver context */ 627 ctx = create_unbound_context(res_conf, root_hints, debugconf, 628 ip4only, ip6only); 629 630 /* try resolution of A */ 631 if(!ip6only) { 632 resolve_host_ip(ctx, host, port, LDNS_RR_TYPE_A, 633 LDNS_RR_CLASS_IN, &list); 634 } 635 636 /* try resolution of AAAA */ 637 if(!ip4only) { 638 resolve_host_ip(ctx, host, port, LDNS_RR_TYPE_AAAA, 639 LDNS_RR_CLASS_IN, &list); 640 } 641 642 ub_ctx_delete(ctx); 643 if(!list) { 644 if(verb) printf("%s has no IP addresses I can use\n", host); 645 exit(0); 646 } 647 return list; 648 } 649 650 /** clear used flags */ 651 static void 652 wipe_ip_usage(struct ip_list* p) 653 { 654 while(p) { 655 p->used = 0; 656 p = p->next; 657 } 658 } 659 660 /** cound unused IPs */ 661 static int 662 count_unused(struct ip_list* p) 663 { 664 int num = 0; 665 while(p) { 666 if(!p->used) num++; 667 p = p->next; 668 } 669 return num; 670 } 671 672 /** pick random unused element from IP list */ 673 static struct ip_list* 674 pick_random_ip(struct ip_list* list) 675 { 676 struct ip_list* p = list; 677 int num = count_unused(list); 678 int sel; 679 if(num == 0) return NULL; 680 /* not perfect, but random enough */ 681 sel = (int)ldns_get_random() % num; 682 /* skip over unused elements that we did not select */ 683 while(sel > 0 && p) { 684 if(!p->used) sel--; 685 p = p->next; 686 } 687 /* find the next unused element */ 688 while(p && p->used) 689 p = p->next; 690 if(!p) return NULL; /* robustness */ 691 return p; 692 } 693 694 /** close the fd */ 695 static void 696 fd_close(int fd) 697 { 698 #ifndef USE_WINSOCK 699 close(fd); 700 #else 701 closesocket(fd); 702 #endif 703 } 704 705 /** printout socket errno */ 706 static void 707 print_sock_err(const char* msg) 708 { 709 #ifndef USE_WINSOCK 710 if(verb) printf("%s: %s\n", msg, strerror(errno)); 711 #else 712 if(verb) printf("%s: %s\n", msg, wsa_strerror(WSAGetLastError())); 713 #endif 714 } 715 716 /** connect to IP address */ 717 static int 718 connect_to_ip(struct ip_list* ip) 719 { 720 int fd; 721 verb_addr("connect to", ip); 722 fd = socket(ip->len==(socklen_t)sizeof(struct sockaddr_in)? 723 AF_INET:AF_INET6, SOCK_STREAM, 0); 724 if(fd == -1) { 725 print_sock_err("socket"); 726 return -1; 727 } 728 if(connect(fd, (struct sockaddr*)&ip->addr, ip->len) < 0) { 729 print_sock_err("connect"); 730 fd_close(fd); 731 return -1; 732 } 733 return fd; 734 } 735 736 /** create SSL context */ 737 static SSL_CTX* 738 setup_sslctx(void) 739 { 740 SSL_CTX* sslctx = SSL_CTX_new(SSLv23_client_method()); 741 if(!sslctx) { 742 if(verb) printf("SSL_CTX_new error\n"); 743 return NULL; 744 } 745 return sslctx; 746 } 747 748 /** initiate TLS on a connection */ 749 static SSL* 750 TLS_initiate(SSL_CTX* sslctx, int fd) 751 { 752 X509* x; 753 int r; 754 SSL* ssl = SSL_new(sslctx); 755 if(!ssl) { 756 if(verb) printf("SSL_new error\n"); 757 return NULL; 758 } 759 SSL_set_connect_state(ssl); 760 (void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY); 761 if(!SSL_set_fd(ssl, fd)) { 762 if(verb) printf("SSL_set_fd error\n"); 763 SSL_free(ssl); 764 return NULL; 765 } 766 while(1) { 767 ERR_clear_error(); 768 if( (r=SSL_do_handshake(ssl)) == 1) 769 break; 770 r = SSL_get_error(ssl, r); 771 if(r != SSL_ERROR_WANT_READ && r != SSL_ERROR_WANT_WRITE) { 772 if(verb) printf("SSL handshake failed\n"); 773 SSL_free(ssl); 774 return NULL; 775 } 776 /* wants to be called again */ 777 } 778 x = SSL_get_peer_certificate(ssl); 779 if(!x) { 780 if(verb) printf("Server presented no peer certificate\n"); 781 SSL_free(ssl); 782 return NULL; 783 } 784 verb_cert("server SSL certificate", x); 785 X509_free(x); 786 return ssl; 787 } 788 789 /** perform neat TLS shutdown */ 790 static void 791 TLS_shutdown(int fd, SSL* ssl, SSL_CTX* sslctx) 792 { 793 /* shutdown the SSL connection nicely */ 794 if(SSL_shutdown(ssl) == 0) { 795 SSL_shutdown(ssl); 796 } 797 SSL_free(ssl); 798 SSL_CTX_free(sslctx); 799 fd_close(fd); 800 } 801 802 /** write a line over SSL */ 803 static int 804 write_ssl_line(SSL* ssl, char* str, char* sec) 805 { 806 char buf[1024]; 807 size_t l; 808 if(sec) { 809 snprintf(buf, sizeof(buf), str, sec); 810 } else { 811 snprintf(buf, sizeof(buf), "%s", str); 812 } 813 l = strlen(buf); 814 if(l+2 >= sizeof(buf)) { 815 if(verb) printf("line too long\n"); 816 return 0; 817 } 818 if(verb >= 2) printf("SSL_write: %s\n", buf); 819 buf[l] = '\r'; 820 buf[l+1] = '\n'; 821 buf[l+2] = 0; 822 /* add \r\n */ 823 if(SSL_write(ssl, buf, (int)strlen(buf)) <= 0) { 824 if(verb) printf("could not SSL_write %s", str); 825 return 0; 826 } 827 return 1; 828 } 829 830 /** process header line, check rcode and keeping track of size */ 831 static int 832 process_one_header(char* buf, size_t* clen, int* chunked) 833 { 834 if(verb>=2) printf("header: '%s'\n", buf); 835 if(strncasecmp(buf, "HTTP/1.1 ", 9) == 0) { 836 /* check returncode */ 837 if(buf[9] != '2') { 838 if(verb) printf("bad status %s\n", buf+9); 839 return 0; 840 } 841 } else if(strncasecmp(buf, "Content-Length: ", 16) == 0) { 842 if(!*chunked) 843 *clen = (size_t)atoi(buf+16); 844 } else if(strncasecmp(buf, "Transfer-Encoding: chunked", 19+7) == 0) { 845 *clen = 0; 846 *chunked = 1; 847 } 848 return 1; 849 } 850 851 /** 852 * Read one line from SSL 853 * zero terminates. 854 * skips "\r\n" (but not copied to buf). 855 * @param ssl: the SSL connection to read from (blocking). 856 * @param buf: buffer to return line in. 857 * @param len: size of the buffer. 858 * @return 0 on error, 1 on success. 859 */ 860 static int 861 read_ssl_line(SSL* ssl, char* buf, size_t len) 862 { 863 size_t n = 0; 864 int r; 865 int endnl = 0; 866 while(1) { 867 if(n >= len) { 868 if(verb) printf("line too long\n"); 869 return 0; 870 } 871 if((r = SSL_read(ssl, buf+n, 1)) <= 0) { 872 if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) { 873 /* EOF */ 874 break; 875 } 876 if(verb) printf("could not SSL_read\n"); 877 return 0; 878 } 879 if(endnl && buf[n] == '\n') { 880 break; 881 } else if(endnl) { 882 /* bad data */ 883 if(verb) printf("error: stray linefeeds\n"); 884 return 0; 885 } else if(buf[n] == '\r') { 886 /* skip \r, and also \n on the wire */ 887 endnl = 1; 888 continue; 889 } else if(buf[n] == '\n') { 890 /* skip the \n, we are done */ 891 break; 892 } else n++; 893 } 894 buf[n] = 0; 895 return 1; 896 } 897 898 /** read http headers and process them */ 899 static size_t 900 read_http_headers(SSL* ssl, size_t* clen) 901 { 902 char buf[1024]; 903 int chunked = 0; 904 *clen = 0; 905 while(read_ssl_line(ssl, buf, sizeof(buf))) { 906 if(buf[0] == 0) 907 return 1; 908 if(!process_one_header(buf, clen, &chunked)) 909 return 0; 910 } 911 return 0; 912 } 913 914 /** read a data chunk */ 915 static char* 916 read_data_chunk(SSL* ssl, size_t len) 917 { 918 size_t got = 0; 919 int r; 920 char* data = malloc(len+1); 921 if(!data) { 922 if(verb) printf("out of memory\n"); 923 return NULL; 924 } 925 while(got < len) { 926 if((r = SSL_read(ssl, data+got, (int)(len-got))) <= 0) { 927 if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) { 928 /* EOF */ 929 if(verb) printf("could not SSL_read: unexpected EOF\n"); 930 free(data); 931 return NULL; 932 } 933 if(verb) printf("could not SSL_read\n"); 934 free(data); 935 return NULL; 936 } 937 if(verb >= 2) printf("at %d/%d\n", (int)got, (int)len); 938 got += r; 939 } 940 if(verb>=2) printf("read %d data\n", (int)len); 941 data[len] = 0; 942 return data; 943 } 944 945 /** parse chunk header */ 946 static int 947 parse_chunk_header(char* buf, size_t* result) 948 { 949 char* e = NULL; 950 size_t v = (size_t)strtol(buf, &e, 16); 951 if(e == buf) 952 return 0; 953 *result = v; 954 return 1; 955 } 956 957 /** read chunked data from connection */ 958 static BIO* 959 do_chunked_read(SSL* ssl) 960 { 961 char buf[1024]; 962 size_t len; 963 char* body; 964 BIO* mem = BIO_new(BIO_s_mem()); 965 if(verb>=3) printf("do_chunked_read\n"); 966 if(!mem) { 967 if(verb) printf("out of memory\n"); 968 return NULL; 969 } 970 while(read_ssl_line(ssl, buf, sizeof(buf))) { 971 /* read the chunked start line */ 972 if(verb>=2) printf("chunk header: %s\n", buf); 973 if(!parse_chunk_header(buf, &len)) { 974 BIO_free(mem); 975 if(verb>=3) printf("could not parse chunk header\n"); 976 return NULL; 977 } 978 if(verb>=2) printf("chunk len: %d\n", (int)len); 979 /* are we done? */ 980 if(len == 0) { 981 char z = 0; 982 /* skip end-of-chunk-trailer lines, 983 * until the empty line after that */ 984 do { 985 if(!read_ssl_line(ssl, buf, sizeof(buf))) { 986 BIO_free(mem); 987 return NULL; 988 } 989 } while (strlen(buf) > 0); 990 /* end of chunks, zero terminate it */ 991 if(BIO_write(mem, &z, 1) <= 0) { 992 if(verb) printf("out of memory\n"); 993 BIO_free(mem); 994 return NULL; 995 } 996 return mem; 997 } 998 /* read the chunked body */ 999 body = read_data_chunk(ssl, len); 1000 if(!body) { 1001 BIO_free(mem); 1002 return NULL; 1003 } 1004 if(BIO_write(mem, body, (int)len) <= 0) { 1005 if(verb) printf("out of memory\n"); 1006 free(body); 1007 BIO_free(mem); 1008 return NULL; 1009 } 1010 free(body); 1011 /* skip empty line after data chunk */ 1012 if(!read_ssl_line(ssl, buf, sizeof(buf))) { 1013 BIO_free(mem); 1014 return NULL; 1015 } 1016 } 1017 BIO_free(mem); 1018 return NULL; 1019 } 1020 1021 /** start HTTP1.1 transaction on SSL */ 1022 static int 1023 write_http_get(SSL* ssl, char* pathname, char* urlname) 1024 { 1025 if(write_ssl_line(ssl, "GET /%s HTTP/1.1", pathname) && 1026 write_ssl_line(ssl, "Host: %s", urlname) && 1027 write_ssl_line(ssl, "User-Agent: unbound-anchor/%s", 1028 PACKAGE_VERSION) && 1029 /* We do not really do multiple queries per connection, 1030 * but this header setting is also not needed. 1031 * write_ssl_line(ssl, "Connection: close", NULL) &&*/ 1032 write_ssl_line(ssl, "", NULL)) { 1033 return 1; 1034 } 1035 return 0; 1036 } 1037 1038 /** read chunked data and zero terminate; len is without zero */ 1039 static char* 1040 read_chunked_zero_terminate(SSL* ssl, size_t* len) 1041 { 1042 /* do the chunked version */ 1043 BIO* tmp = do_chunked_read(ssl); 1044 char* data, *d = NULL; 1045 size_t l; 1046 if(!tmp) { 1047 if(verb) printf("could not read from https\n"); 1048 return NULL; 1049 } 1050 l = (size_t)BIO_get_mem_data(tmp, &d); 1051 if(verb>=2) printf("chunked data is %d\n", (int)l); 1052 if(l == 0 || d == NULL) { 1053 if(verb) printf("out of memory\n"); 1054 return NULL; 1055 } 1056 *len = l-1; 1057 data = (char*)malloc(l); 1058 if(data == NULL) { 1059 if(verb) printf("out of memory\n"); 1060 return NULL; 1061 } 1062 memcpy(data, d, l); 1063 BIO_free(tmp); 1064 return data; 1065 } 1066 1067 /** read HTTP result from SSL */ 1068 static BIO* 1069 read_http_result(SSL* ssl) 1070 { 1071 size_t len = 0; 1072 char* data; 1073 BIO* m; 1074 if(!read_http_headers(ssl, &len)) { 1075 return NULL; 1076 } 1077 if(len == 0) { 1078 data = read_chunked_zero_terminate(ssl, &len); 1079 } else { 1080 data = read_data_chunk(ssl, len); 1081 } 1082 if(!data) return NULL; 1083 if(verb >= 4) print_data("read data", data, (int)len); 1084 m = BIO_new_mem_buf(data, (int)len); 1085 if(!m) { 1086 if(verb) printf("out of memory\n"); 1087 exit(0); 1088 } 1089 return m; 1090 } 1091 1092 /** https to an IP addr, return BIO with pathname or NULL */ 1093 static BIO* 1094 https_to_ip(struct ip_list* ip, char* pathname, char* urlname) 1095 { 1096 int fd; 1097 SSL* ssl; 1098 BIO* bio; 1099 SSL_CTX* sslctx = setup_sslctx(); 1100 if(!sslctx) { 1101 return NULL; 1102 } 1103 fd = connect_to_ip(ip); 1104 if(fd == -1) { 1105 SSL_CTX_free(sslctx); 1106 return NULL; 1107 } 1108 ssl = TLS_initiate(sslctx, fd); 1109 if(!ssl) { 1110 SSL_CTX_free(sslctx); 1111 fd_close(fd); 1112 return NULL; 1113 } 1114 if(!write_http_get(ssl, pathname, urlname)) { 1115 if(verb) printf("could not write to server\n"); 1116 SSL_free(ssl); 1117 SSL_CTX_free(sslctx); 1118 fd_close(fd); 1119 return NULL; 1120 } 1121 bio = read_http_result(ssl); 1122 TLS_shutdown(fd, ssl, sslctx); 1123 return bio; 1124 } 1125 1126 /** 1127 * Do a HTTPS, HTTP1.1 over TLS, to fetch a file 1128 * @param ip_list: list of IP addresses to use to fetch from. 1129 * @param pathname: pathname of file on server to GET. 1130 * @param urlname: name to pass as the virtual host for this request. 1131 * @return a memory BIO with the file in it. 1132 */ 1133 static BIO* 1134 https(struct ip_list* ip_list, char* pathname, char* urlname) 1135 { 1136 struct ip_list* ip; 1137 BIO* bio = NULL; 1138 /* try random address first, and work through the list */ 1139 wipe_ip_usage(ip_list); 1140 while( (ip = pick_random_ip(ip_list)) ) { 1141 ip->used = 1; 1142 bio = https_to_ip(ip, pathname, urlname); 1143 if(bio) break; 1144 } 1145 if(!bio) { 1146 if(verb) printf("could not fetch %s\n", pathname); 1147 exit(0); 1148 } else { 1149 if(verb) printf("fetched %s (%d bytes)\n", 1150 pathname, (int)BIO_ctrl_pending(bio)); 1151 } 1152 return bio; 1153 } 1154 1155 /** free up a downloaded file BIO */ 1156 static void 1157 free_file_bio(BIO* bio) 1158 { 1159 char* pp = NULL; 1160 (void)BIO_reset(bio); 1161 (void)BIO_get_mem_data(bio, &pp); 1162 free(pp); 1163 BIO_free(bio); 1164 } 1165 1166 /** XML parse private data during the parse */ 1167 struct xml_data { 1168 /** the parser, reference */ 1169 XML_Parser parser; 1170 /** the current tag; malloced; or NULL outside of tags */ 1171 char* tag; 1172 /** current date to use during the parse */ 1173 time_t date; 1174 /** number of keys usefully read in */ 1175 int num_keys; 1176 /** the compiled anchors as DS records */ 1177 BIO* ds; 1178 1179 /** do we want to use this anchor? */ 1180 int use_key; 1181 /** the current anchor: Zone */ 1182 BIO* czone; 1183 /** the current anchor: KeyTag */ 1184 BIO* ctag; 1185 /** the current anchor: Algorithm */ 1186 BIO* calgo; 1187 /** the current anchor: DigestType */ 1188 BIO* cdigtype; 1189 /** the current anchor: Digest*/ 1190 BIO* cdigest; 1191 }; 1192 1193 /** The BIO for the tag */ 1194 static BIO* 1195 xml_selectbio(struct xml_data* data, const char* tag) 1196 { 1197 BIO* b = NULL; 1198 if(strcasecmp(tag, "KeyTag") == 0) 1199 b = data->ctag; 1200 else if(strcasecmp(tag, "Algorithm") == 0) 1201 b = data->calgo; 1202 else if(strcasecmp(tag, "DigestType") == 0) 1203 b = data->cdigtype; 1204 else if(strcasecmp(tag, "Digest") == 0) 1205 b = data->cdigest; 1206 return b; 1207 } 1208 1209 /** 1210 * XML handle character data, the data inside an element. 1211 * @param userData: xml_data structure 1212 * @param s: the character data. May not all be in one callback. 1213 * NOT zero terminated. 1214 * @param len: length of this part of the data. 1215 */ 1216 void 1217 xml_charhandle(void *userData, const XML_Char *s, int len) 1218 { 1219 struct xml_data* data = (struct xml_data*)userData; 1220 BIO* b = NULL; 1221 /* skip characters outside of elements */ 1222 if(!data->tag) 1223 return; 1224 if(verb>=4) { 1225 int i; 1226 printf("%s%s charhandle: '", 1227 data->use_key?"use ":"", 1228 data->tag?data->tag:"none"); 1229 for(i=0; i<len; i++) 1230 printf("%c", s[i]); 1231 printf("'\n"); 1232 } 1233 if(strcasecmp(data->tag, "Zone") == 0) { 1234 if(BIO_write(data->czone, s, len) <= 0) { 1235 if(verb) printf("out of memory in BIO_write\n"); 1236 exit(0); 1237 } 1238 return; 1239 } 1240 /* only store if key is used */ 1241 if(!data->use_key) 1242 return; 1243 b = xml_selectbio(data, data->tag); 1244 if(b) { 1245 if(BIO_write(b, s, len) <= 0) { 1246 if(verb) printf("out of memory in BIO_write\n"); 1247 exit(0); 1248 } 1249 } 1250 } 1251 1252 /** 1253 * XML fetch value of particular attribute(by name) or NULL if not present. 1254 * @param atts: attribute array (from xml_startelem). 1255 * @param name: name of attribute to look for. 1256 * @return the value or NULL. (ptr into atts). 1257 */ 1258 static const XML_Char* 1259 find_att(const XML_Char **atts, XML_Char* name) 1260 { 1261 int i; 1262 for(i=0; atts[i]; i+=2) { 1263 if(strcasecmp(atts[i], name) == 0) 1264 return atts[i+1]; 1265 } 1266 return NULL; 1267 } 1268 1269 /** 1270 * XML convert DateTime element to time_t. 1271 * [-]CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] 1272 * (with optional .ssssss fractional seconds) 1273 * @param str: the string 1274 * @return a time_t representation or 0 on failure. 1275 */ 1276 static time_t 1277 xml_convertdate(const char* str) 1278 { 1279 time_t t = 0; 1280 struct tm tm; 1281 const char* s; 1282 /* for this application, ignore minus in front; 1283 * only positive dates are expected */ 1284 s = str; 1285 if(s[0] == '-') s++; 1286 memset(&tm, 0, sizeof(tm)); 1287 /* parse initial content of the string (lots of whitespace allowed) */ 1288 s = strptime(s, "%t%Y%t-%t%m%t-%t%d%tT%t%H%t:%t%M%t:%t%S%t", &tm); 1289 if(!s) { 1290 if(verb) printf("xml_convertdate parse failure %s\n", str); 1291 return 0; 1292 } 1293 /* parse remainder of date string */ 1294 if(*s == '.') { 1295 /* optional '.' and fractional seconds */ 1296 int frac = 0, n = 0; 1297 if(sscanf(s+1, "%d%n", &frac, &n) < 1) { 1298 if(verb) printf("xml_convertdate f failure %s\n", str); 1299 return 0; 1300 } 1301 /* fraction is not used, time_t has second accuracy */ 1302 s++; 1303 s+=n; 1304 } 1305 if(*s == 'Z' || *s == 'z') { 1306 /* nothing to do for this */ 1307 s++; 1308 } else if(*s == '+' || *s == '-') { 1309 /* optional timezone spec: Z or +hh:mm or -hh:mm */ 1310 int hr = 0, mn = 0, n = 0; 1311 if(sscanf(s+1, "%d:%d%n", &hr, &mn, &n) < 2) { 1312 if(verb) printf("xml_convertdate tz failure %s\n", str); 1313 return 0; 1314 } 1315 if(*s == '+') { 1316 tm.tm_hour += hr; 1317 tm.tm_min += mn; 1318 } else { 1319 tm.tm_hour -= hr; 1320 tm.tm_min -= mn; 1321 } 1322 s++; 1323 s += n; 1324 } 1325 if(*s != 0) { 1326 /* not ended properly */ 1327 /* but ignore, (lenient) */ 1328 } 1329 1330 t = mktime(&tm); 1331 if(t == (time_t)-1) { 1332 if(verb) printf("xml_convertdate mktime failure\n"); 1333 return 0; 1334 } 1335 return t; 1336 } 1337 1338 /** 1339 * XML handle the KeyDigest start tag, check validity periods. 1340 */ 1341 static void 1342 handle_keydigest(struct xml_data* data, const XML_Char **atts) 1343 { 1344 data->use_key = 0; 1345 if(find_att(atts, "validFrom")) { 1346 time_t from = xml_convertdate(find_att(atts, "validFrom")); 1347 if(from == 0) { 1348 if(verb) printf("error: xml cannot be parsed\n"); 1349 exit(0); 1350 } 1351 if(data->date < from) 1352 return; 1353 } 1354 if(find_att(atts, "validUntil")) { 1355 time_t until = xml_convertdate(find_att(atts, "validUntil")); 1356 if(until == 0) { 1357 if(verb) printf("error: xml cannot be parsed\n"); 1358 exit(0); 1359 } 1360 if(data->date > until) 1361 return; 1362 } 1363 /* yes we want to use this key */ 1364 data->use_key = 1; 1365 (void)BIO_reset(data->ctag); 1366 (void)BIO_reset(data->calgo); 1367 (void)BIO_reset(data->cdigtype); 1368 (void)BIO_reset(data->cdigest); 1369 } 1370 1371 /** See if XML element equals the zone name */ 1372 static int 1373 xml_is_zone_name(BIO* zone, char* name) 1374 { 1375 char buf[1024]; 1376 char* z = NULL; 1377 long zlen; 1378 (void)BIO_seek(zone, 0); 1379 zlen = BIO_get_mem_data(zone, &z); 1380 if(!zlen || !z) return 0; 1381 /* zero terminate */ 1382 if(zlen >= (long)sizeof(buf)) return 0; 1383 memmove(buf, z, (size_t)zlen); 1384 buf[zlen] = 0; 1385 /* compare */ 1386 return (strncasecmp(buf, name, strlen(name)) == 0); 1387 } 1388 1389 /** 1390 * XML start of element. This callback is called whenever an XML tag starts. 1391 * XML_Char is UTF8. 1392 * @param userData: the xml_data structure. 1393 * @param name: the tag that starts. 1394 * @param atts: array of strings, pairs of attr = value, ends with NULL. 1395 * i.e. att[0]="att[1]" att[2]="att[3]" att[4]isNull 1396 */ 1397 static void 1398 xml_startelem(void *userData, const XML_Char *name, const XML_Char **atts) 1399 { 1400 struct xml_data* data = (struct xml_data*)userData; 1401 BIO* b; 1402 if(verb>=4) printf("xml tag start '%s'\n", name); 1403 free(data->tag); 1404 data->tag = strdup(name); 1405 if(!data->tag) { 1406 if(verb) printf("out of memory\n"); 1407 exit(0); 1408 } 1409 if(verb>=4) { 1410 int i; 1411 for(i=0; atts[i]; i+=2) { 1412 printf(" %s='%s'\n", atts[i], atts[i+1]); 1413 } 1414 } 1415 /* handle attributes to particular types */ 1416 if(strcasecmp(name, "KeyDigest") == 0) { 1417 handle_keydigest(data, atts); 1418 return; 1419 } else if(strcasecmp(name, "Zone") == 0) { 1420 (void)BIO_reset(data->czone); 1421 return; 1422 } 1423 1424 /* for other types we prepare to pick up the data */ 1425 if(!data->use_key) 1426 return; 1427 b = xml_selectbio(data, data->tag); 1428 if(b) { 1429 /* empty it */ 1430 (void)BIO_reset(b); 1431 } 1432 } 1433 1434 /** Append str to bio */ 1435 static void 1436 xml_append_str(BIO* b, const char* s) 1437 { 1438 if(BIO_write(b, s, (int)strlen(s)) <= 0) { 1439 if(verb) printf("out of memory in BIO_write\n"); 1440 exit(0); 1441 } 1442 } 1443 1444 /** Append bio to bio */ 1445 static void 1446 xml_append_bio(BIO* b, BIO* a) 1447 { 1448 char* z = NULL; 1449 long i, len; 1450 (void)BIO_seek(a, 0); 1451 len = BIO_get_mem_data(a, &z); 1452 if(!len || !z) { 1453 if(verb) printf("out of memory in BIO_write\n"); 1454 exit(0); 1455 } 1456 /* remove newlines in the data here */ 1457 for(i=0; i<len; i++) { 1458 if(z[i] == '\r' || z[i] == '\n') 1459 z[i] = ' '; 1460 } 1461 /* write to BIO */ 1462 if(BIO_write(b, z, len) <= 0) { 1463 if(verb) printf("out of memory in BIO_write\n"); 1464 exit(0); 1465 } 1466 } 1467 1468 /** write the parsed xml-DS to the DS list */ 1469 static void 1470 xml_append_ds(struct xml_data* data) 1471 { 1472 /* write DS to accumulated DS */ 1473 xml_append_str(data->ds, ". IN DS "); 1474 xml_append_bio(data->ds, data->ctag); 1475 xml_append_str(data->ds, " "); 1476 xml_append_bio(data->ds, data->calgo); 1477 xml_append_str(data->ds, " "); 1478 xml_append_bio(data->ds, data->cdigtype); 1479 xml_append_str(data->ds, " "); 1480 xml_append_bio(data->ds, data->cdigest); 1481 xml_append_str(data->ds, "\n"); 1482 data->num_keys++; 1483 } 1484 1485 /** 1486 * XML end of element. This callback is called whenever an XML tag ends. 1487 * XML_Char is UTF8. 1488 * @param userData: the xml_data structure 1489 * @param name: the tag that ends. 1490 */ 1491 static void 1492 xml_endelem(void *userData, const XML_Char *name) 1493 { 1494 struct xml_data* data = (struct xml_data*)userData; 1495 if(verb>=4) printf("xml tag end '%s'\n", name); 1496 free(data->tag); 1497 data->tag = NULL; 1498 if(strcasecmp(name, "KeyDigest") == 0) { 1499 if(data->use_key) 1500 xml_append_ds(data); 1501 data->use_key = 0; 1502 } else if(strcasecmp(name, "Zone") == 0) { 1503 if(!xml_is_zone_name(data->czone, ".")) { 1504 if(verb) printf("xml not for the right zone\n"); 1505 exit(0); 1506 } 1507 } 1508 } 1509 1510 /* Stop the parser when an entity declaration is encountered. For safety. */ 1511 static void 1512 xml_entitydeclhandler(void *userData, 1513 const XML_Char *ATTR_UNUSED(entityName), 1514 int ATTR_UNUSED(is_parameter_entity), 1515 const XML_Char *ATTR_UNUSED(value), int ATTR_UNUSED(value_length), 1516 const XML_Char *ATTR_UNUSED(base), 1517 const XML_Char *ATTR_UNUSED(systemId), 1518 const XML_Char *ATTR_UNUSED(publicId), 1519 const XML_Char *ATTR_UNUSED(notationName)) 1520 { 1521 (void)XML_StopParser((XML_Parser)userData, XML_FALSE); 1522 } 1523 1524 /** 1525 * XML parser setup of the callbacks for the tags 1526 */ 1527 static void 1528 xml_parse_setup(XML_Parser parser, struct xml_data* data, time_t now) 1529 { 1530 char buf[1024]; 1531 memset(data, 0, sizeof(*data)); 1532 XML_SetUserData(parser, data); 1533 data->parser = parser; 1534 data->date = now; 1535 data->ds = BIO_new(BIO_s_mem()); 1536 data->ctag = BIO_new(BIO_s_mem()); 1537 data->czone = BIO_new(BIO_s_mem()); 1538 data->calgo = BIO_new(BIO_s_mem()); 1539 data->cdigtype = BIO_new(BIO_s_mem()); 1540 data->cdigest = BIO_new(BIO_s_mem()); 1541 if(!data->ds || !data->ctag || !data->calgo || !data->czone || 1542 !data->cdigtype || !data->cdigest) { 1543 if(verb) printf("out of memory\n"); 1544 exit(0); 1545 } 1546 snprintf(buf, sizeof(buf), "; created by unbound-anchor on %s", 1547 ctime(&now)); 1548 if(BIO_write(data->ds, buf, (int)strlen(buf)) <= 0) { 1549 if(verb) printf("out of memory\n"); 1550 exit(0); 1551 } 1552 XML_SetEntityDeclHandler(parser, xml_entitydeclhandler); 1553 XML_SetElementHandler(parser, xml_startelem, xml_endelem); 1554 XML_SetCharacterDataHandler(parser, xml_charhandle); 1555 } 1556 1557 /** 1558 * Perform XML parsing of the root-anchors file 1559 * Its format description can be read here 1560 * https://data.iana.org/root-anchors/draft-icann-dnssec-trust-anchor.txt 1561 * It uses libexpat. 1562 * @param xml: BIO with xml data. 1563 * @param now: the current time for checking DS validity periods. 1564 * @return memoryBIO with the DS data in zone format. 1565 * or NULL if the zone is insecure. 1566 * (It exit()s on error) 1567 */ 1568 static BIO* 1569 xml_parse(BIO* xml, time_t now) 1570 { 1571 char* pp; 1572 int len; 1573 XML_Parser parser; 1574 struct xml_data data; 1575 1576 parser = XML_ParserCreate(NULL); 1577 if(!parser) { 1578 if(verb) printf("could not XML_ParserCreate\n"); 1579 exit(0); 1580 } 1581 1582 /* setup callbacks */ 1583 xml_parse_setup(parser, &data, now); 1584 1585 /* parse it */ 1586 (void)BIO_reset(xml); 1587 len = (int)BIO_get_mem_data(xml, &pp); 1588 if(!len || !pp) { 1589 if(verb) printf("out of memory\n"); 1590 exit(0); 1591 } 1592 if(!XML_Parse(parser, pp, len, 1 /*isfinal*/ )) { 1593 const char *e = XML_ErrorString(XML_GetErrorCode(parser)); 1594 if(verb) printf("XML_Parse failure %s\n", e?e:""); 1595 exit(0); 1596 } 1597 1598 /* parsed */ 1599 if(verb) printf("XML was parsed successfully, %d keys\n", 1600 data.num_keys); 1601 free(data.tag); 1602 XML_ParserFree(parser); 1603 1604 if(verb >= 4) { 1605 char* pp = NULL; 1606 int len; 1607 (void)BIO_seek(data.ds, 0); 1608 len = BIO_get_mem_data(data.ds, &pp); 1609 printf("got DS bio %d: '", len); 1610 if(!fwrite(pp, (size_t)len, 1, stdout)) 1611 /* compilers do not allow us to ignore fwrite .. */ 1612 fprintf(stderr, "error writing to stdout\n"); 1613 printf("'\n"); 1614 } 1615 BIO_free(data.czone); 1616 BIO_free(data.ctag); 1617 BIO_free(data.calgo); 1618 BIO_free(data.cdigtype); 1619 BIO_free(data.cdigest); 1620 1621 if(data.num_keys == 0) { 1622 /* the root zone seems to have gone insecure */ 1623 BIO_free(data.ds); 1624 return NULL; 1625 } else { 1626 return data.ds; 1627 } 1628 } 1629 1630 /* get key usage out of its extension, returns 0 if no key_usage extension */ 1631 static unsigned long 1632 get_usage_of_ex(X509* cert) 1633 { 1634 unsigned long val = 0; 1635 ASN1_BIT_STRING* s; 1636 if((s=X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL))) { 1637 if(s->length > 0) { 1638 val = s->data[0]; 1639 if(s->length > 1) 1640 val |= s->data[1] << 8; 1641 } 1642 ASN1_BIT_STRING_free(s); 1643 } 1644 return val; 1645 } 1646 1647 /** get valid signers from the list of signers in the signature */ 1648 static STACK_OF(X509)* 1649 get_valid_signers(PKCS7* p7, char* p7signer) 1650 { 1651 int i; 1652 STACK_OF(X509)* validsigners = sk_X509_new_null(); 1653 STACK_OF(X509)* signers = PKCS7_get0_signers(p7, NULL, 0); 1654 unsigned long usage = 0; 1655 if(!validsigners) { 1656 if(verb) printf("out of memory\n"); 1657 sk_X509_free(signers); 1658 return NULL; 1659 } 1660 if(!signers) { 1661 if(verb) printf("no signers in pkcs7 signature\n"); 1662 sk_X509_free(validsigners); 1663 return NULL; 1664 } 1665 for(i=0; i<sk_X509_num(signers); i++) { 1666 X509_NAME* nm = X509_get_subject_name( 1667 sk_X509_value(signers, i)); 1668 char buf[1024]; 1669 if(!nm) { 1670 if(verb) printf("signer %d: cert has no subject name\n", i); 1671 continue; 1672 } 1673 if(verb && nm) { 1674 char* nmline = X509_NAME_oneline(nm, buf, 1675 (int)sizeof(buf)); 1676 printf("signer %d: Subject: %s\n", i, 1677 nmline?nmline:"no subject"); 1678 if(verb >= 3 && X509_NAME_get_text_by_NID(nm, 1679 NID_commonName, buf, (int)sizeof(buf))) 1680 printf("commonName: %s\n", buf); 1681 if(verb >= 3 && X509_NAME_get_text_by_NID(nm, 1682 NID_pkcs9_emailAddress, buf, (int)sizeof(buf))) 1683 printf("emailAddress: %s\n", buf); 1684 } 1685 if(verb) { 1686 int ku_loc = X509_get_ext_by_NID( 1687 sk_X509_value(signers, i), NID_key_usage, -1); 1688 if(verb >= 3 && ku_loc >= 0) { 1689 X509_EXTENSION *ex = X509_get_ext( 1690 sk_X509_value(signers, i), ku_loc); 1691 if(ex) { 1692 printf("keyUsage: "); 1693 X509V3_EXT_print_fp(stdout, ex, 0, 0); 1694 printf("\n"); 1695 } 1696 } 1697 } 1698 if(!p7signer || strcmp(p7signer, "")==0) { 1699 /* there is no name to check, return all records */ 1700 if(verb) printf("did not check commonName of signer\n"); 1701 } else { 1702 if(!X509_NAME_get_text_by_NID(nm, 1703 NID_pkcs9_emailAddress, 1704 buf, (int)sizeof(buf))) { 1705 if(verb) printf("removed cert with no name\n"); 1706 continue; /* no name, no use */ 1707 } 1708 if(strcmp(buf, p7signer) != 0) { 1709 if(verb) printf("removed cert with wrong name\n"); 1710 continue; /* wrong name, skip it */ 1711 } 1712 } 1713 1714 /* check that the key usage allows digital signatures 1715 * (the p7s) */ 1716 usage = get_usage_of_ex(sk_X509_value(signers, i)); 1717 if(!(usage & KU_DIGITAL_SIGNATURE)) { 1718 if(verb) printf("removed cert with no key usage Digital Signature allowed\n"); 1719 continue; 1720 } 1721 1722 /* we like this cert, add it to our list of valid 1723 * signers certificates */ 1724 sk_X509_push(validsigners, sk_X509_value(signers, i)); 1725 } 1726 sk_X509_free(signers); 1727 return validsigners; 1728 } 1729 1730 /** verify a PKCS7 signature, false on failure */ 1731 static int 1732 verify_p7sig(BIO* data, BIO* p7s, STACK_OF(X509)* trust, char* p7signer) 1733 { 1734 PKCS7* p7; 1735 X509_STORE *store = X509_STORE_new(); 1736 STACK_OF(X509)* validsigners; 1737 int secure = 0; 1738 int i; 1739 #ifdef X509_V_FLAG_CHECK_SS_SIGNATURE 1740 X509_VERIFY_PARAM* param = X509_VERIFY_PARAM_new(); 1741 if(!param) { 1742 if(verb) printf("out of memory\n"); 1743 X509_STORE_free(store); 1744 return 0; 1745 } 1746 /* do the selfcheck on the root certificate; it checks that the 1747 * input is valid */ 1748 X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CHECK_SS_SIGNATURE); 1749 if(store) X509_STORE_set1_param(store, param); 1750 #endif 1751 if(!store) { 1752 if(verb) printf("out of memory\n"); 1753 #ifdef X509_V_FLAG_CHECK_SS_SIGNATURE 1754 X509_VERIFY_PARAM_free(param); 1755 #endif 1756 return 0; 1757 } 1758 #ifdef X509_V_FLAG_CHECK_SS_SIGNATURE 1759 X509_VERIFY_PARAM_free(param); 1760 #endif 1761 1762 (void)BIO_reset(p7s); 1763 (void)BIO_reset(data); 1764 1765 /* convert p7s to p7 (the signature) */ 1766 p7 = d2i_PKCS7_bio(p7s, NULL); 1767 if(!p7) { 1768 if(verb) printf("could not parse p7s signature file\n"); 1769 X509_STORE_free(store); 1770 return 0; 1771 } 1772 if(verb >= 2) printf("parsed the PKCS7 signature\n"); 1773 1774 /* convert trust to trusted certificate store */ 1775 for(i=0; i<sk_X509_num(trust); i++) { 1776 if(!X509_STORE_add_cert(store, sk_X509_value(trust, i))) { 1777 if(verb) printf("failed X509_STORE_add_cert\n"); 1778 X509_STORE_free(store); 1779 PKCS7_free(p7); 1780 return 0; 1781 } 1782 } 1783 if(verb >= 2) printf("setup the X509_STORE\n"); 1784 1785 /* check what is in the Subject name of the certificates, 1786 * and build a stack that contains only the right certificates */ 1787 validsigners = get_valid_signers(p7, p7signer); 1788 if(!validsigners) { 1789 X509_STORE_free(store); 1790 PKCS7_free(p7); 1791 return 0; 1792 } 1793 if(PKCS7_verify(p7, validsigners, store, data, NULL, PKCS7_NOINTERN) == 1) { 1794 secure = 1; 1795 if(verb) printf("the PKCS7 signature verified\n"); 1796 } else { 1797 if(verb) { 1798 ERR_print_errors_fp(stdout); 1799 } 1800 } 1801 1802 sk_X509_free(validsigners); 1803 X509_STORE_free(store); 1804 PKCS7_free(p7); 1805 return secure; 1806 } 1807 1808 /** write unsigned root anchor file, a 5011 revoked tp */ 1809 static void 1810 write_unsigned_root(char* root_anchor_file) 1811 { 1812 FILE* out; 1813 time_t now = time(NULL); 1814 out = fopen(root_anchor_file, "w"); 1815 if(!out) { 1816 if(verb) printf("%s: %s\n", root_anchor_file, strerror(errno)); 1817 return; 1818 } 1819 if(fprintf(out, "; autotrust trust anchor file\n" 1820 ";;REVOKED\n" 1821 ";;id: . 1\n" 1822 "; This file was written by unbound-anchor on %s" 1823 "; It indicates that the root does not use DNSSEC\n" 1824 "; to restart DNSSEC overwrite this file with a\n" 1825 "; valid trustanchor or (empty-it and run unbound-anchor)\n" 1826 , ctime(&now)) < 0) { 1827 if(verb) printf("failed to write 'unsigned' to %s\n", 1828 root_anchor_file); 1829 if(verb && errno != 0) printf("%s\n", strerror(errno)); 1830 } 1831 fclose(out); 1832 } 1833 1834 /** write root anchor file */ 1835 static void 1836 write_root_anchor(char* root_anchor_file, BIO* ds) 1837 { 1838 char* pp = NULL; 1839 int len; 1840 FILE* out; 1841 (void)BIO_seek(ds, 0); 1842 len = BIO_get_mem_data(ds, &pp); 1843 if(!len || !pp) { 1844 if(verb) printf("out of memory\n"); 1845 return; 1846 } 1847 out = fopen(root_anchor_file, "w"); 1848 if(!out) { 1849 if(verb) printf("%s: %s\n", root_anchor_file, strerror(errno)); 1850 return; 1851 } 1852 if(fwrite(pp, (size_t)len, 1, out) != 1) { 1853 if(verb) printf("failed to write all data to %s\n", 1854 root_anchor_file); 1855 if(verb && errno != 0) printf("%s\n", strerror(errno)); 1856 } 1857 fclose(out); 1858 } 1859 1860 /** Perform the verification and update of the trustanchor file */ 1861 static void 1862 verify_and_update_anchor(char* root_anchor_file, BIO* xml, BIO* p7s, 1863 STACK_OF(X509)* cert, char* p7signer) 1864 { 1865 BIO* ds; 1866 1867 /* verify xml file */ 1868 if(!verify_p7sig(xml, p7s, cert, p7signer)) { 1869 printf("the PKCS7 signature failed\n"); 1870 exit(0); 1871 } 1872 1873 /* parse the xml file into DS records */ 1874 ds = xml_parse(xml, time(NULL)); 1875 if(!ds) { 1876 /* the root zone is unsigned now */ 1877 write_unsigned_root(root_anchor_file); 1878 } else { 1879 /* reinstate 5011 tracking */ 1880 write_root_anchor(root_anchor_file, ds); 1881 } 1882 BIO_free(ds); 1883 } 1884 1885 #ifdef USE_WINSOCK 1886 static void do_wsa_cleanup(void) { WSACleanup(); } 1887 #endif 1888 1889 /** perform actual certupdate work */ 1890 static int 1891 do_certupdate(char* root_anchor_file, char* root_cert_file, 1892 char* urlname, char* xmlname, char* p7sname, char* p7signer, 1893 char* res_conf, char* root_hints, char* debugconf, 1894 int ip4only, int ip6only, int port, struct ub_result* dnskey) 1895 { 1896 STACK_OF(X509)* cert; 1897 BIO *xml, *p7s; 1898 struct ip_list* ip_list = NULL; 1899 1900 /* read pem file or provide builtin */ 1901 cert = read_cert_or_builtin(root_cert_file); 1902 1903 /* lookup A, AAAA for the urlname (or parse urlname if IP address) */ 1904 ip_list = resolve_name(urlname, port, res_conf, root_hints, debugconf, 1905 ip4only, ip6only); 1906 1907 #ifdef USE_WINSOCK 1908 if(1) { /* libunbound finished, startup WSA for the https connection */ 1909 WSADATA wsa_data; 1910 int r; 1911 if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0) { 1912 if(verb) printf("WSAStartup failed: %s\n", 1913 wsa_strerror(r)); 1914 exit(0); 1915 } 1916 atexit(&do_wsa_cleanup); 1917 } 1918 #endif 1919 1920 /* fetch the necessary files over HTTPS */ 1921 xml = https(ip_list, xmlname, urlname); 1922 p7s = https(ip_list, p7sname, urlname); 1923 1924 /* verify and update the root anchor */ 1925 verify_and_update_anchor(root_anchor_file, xml, p7s, cert, p7signer); 1926 if(verb) printf("success: the anchor has been updated " 1927 "using the cert\n"); 1928 1929 free_file_bio(xml); 1930 free_file_bio(p7s); 1931 #ifndef S_SPLINT_S 1932 sk_X509_pop_free(cert, X509_free); 1933 #endif 1934 ub_resolve_free(dnskey); 1935 ip_list_free(ip_list); 1936 return 1; 1937 } 1938 1939 /** 1940 * Try to read the root RFC5011 autotrust anchor file, 1941 * @param file: filename. 1942 * @return: 1943 * 0 if does not exist or empty 1944 * 1 if trust-point-revoked-5011 1945 * 2 if it is OK. 1946 */ 1947 static int 1948 try_read_anchor(char* file) 1949 { 1950 int empty = 1; 1951 char line[10240]; 1952 char* p; 1953 FILE* in = fopen(file, "r"); 1954 if(!in) { 1955 /* only if the file does not exist, can we fix it */ 1956 if(errno != ENOENT) { 1957 if(verb) printf("%s: %s\n", file, strerror(errno)); 1958 if(verb) printf("error: cannot access the file\n"); 1959 exit(0); 1960 } 1961 if(verb) printf("%s does not exist\n", file); 1962 return 0; 1963 } 1964 while(fgets(line, (int)sizeof(line), in)) { 1965 line[sizeof(line)-1] = 0; 1966 if(strncmp(line, ";;REVOKED", 9) == 0) { 1967 fclose(in); 1968 if(verb) printf("%s : the trust point is revoked\n" 1969 "and the zone is considered unsigned.\n" 1970 "if you wish to re-enable, delete the file\n", 1971 file); 1972 return 1; 1973 } 1974 p=line; 1975 while(*p == ' ' || *p == '\t') 1976 p++; 1977 if(p[0]==0 || p[0]=='\n' || p[0]==';') continue; 1978 /* this line is a line of content */ 1979 empty = 0; 1980 } 1981 fclose(in); 1982 if(empty) { 1983 if(verb) printf("%s is empty\n", file); 1984 return 0; 1985 } 1986 if(verb) printf("%s has content\n", file); 1987 return 2; 1988 } 1989 1990 /** Write the builtin root anchor to a file */ 1991 static void 1992 write_builtin_anchor(char* file) 1993 { 1994 const char* builtin_root_anchor = get_builtin_ds(); 1995 FILE* out = fopen(file, "w"); 1996 if(!out) { 1997 if(verb) printf("%s: %s\n", file, strerror(errno)); 1998 if(verb) printf(" could not write builtin anchor\n"); 1999 return; 2000 } 2001 if(!fwrite(builtin_root_anchor, strlen(builtin_root_anchor), 1, out)) { 2002 if(verb) printf("%s: %s\n", file, strerror(errno)); 2003 if(verb) printf(" could not complete write builtin anchor\n"); 2004 } 2005 fclose(out); 2006 } 2007 2008 /** 2009 * Check the root anchor file. 2010 * If does not exist, provide builtin and write file. 2011 * If empty, provide builtin and write file. 2012 * If trust-point-revoked-5011 file: make the program exit. 2013 * @param root_anchor_file: filename of the root anchor. 2014 * @param used_builtin: set to 1 if the builtin is written. 2015 * @return 0 if trustpoint is insecure, 1 on success. Exit on failure. 2016 */ 2017 static int 2018 provide_builtin(char* root_anchor_file, int* used_builtin) 2019 { 2020 /* try to read it */ 2021 switch(try_read_anchor(root_anchor_file)) 2022 { 2023 case 0: /* no exist or empty */ 2024 write_builtin_anchor(root_anchor_file); 2025 *used_builtin = 1; 2026 break; 2027 case 1: /* revoked tp */ 2028 return 0; 2029 case 2: /* it is fine */ 2030 default: 2031 break; 2032 } 2033 return 1; 2034 } 2035 2036 /** 2037 * add an autotrust anchor for the root to the context 2038 */ 2039 static void 2040 add_5011_probe_root(struct ub_ctx* ctx, char* root_anchor_file) 2041 { 2042 int r; 2043 r = ub_ctx_set_option(ctx, "auto-trust-anchor-file:", root_anchor_file); 2044 if(r) { 2045 if(verb) printf("add 5011 probe to ctx: %s\n", ub_strerror(r)); 2046 ub_ctx_delete(ctx); 2047 exit(0); 2048 } 2049 } 2050 2051 /** 2052 * Prime the root key and return the result. Exit on error. 2053 * @param ctx: the unbound context to perform the priming with. 2054 * @return: the result of the prime, on error it exit()s. 2055 */ 2056 static struct ub_result* 2057 prime_root_key(struct ub_ctx* ctx) 2058 { 2059 struct ub_result* res = NULL; 2060 int r; 2061 r = ub_resolve(ctx, ".", LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN, &res); 2062 if(r) { 2063 if(verb) printf("resolve DNSKEY: %s\n", ub_strerror(r)); 2064 ub_ctx_delete(ctx); 2065 exit(0); 2066 } 2067 if(!res) { 2068 if(verb) printf("out of memory\n"); 2069 ub_ctx_delete(ctx); 2070 exit(0); 2071 } 2072 return res; 2073 } 2074 2075 /** see if ADDPEND keys exist in autotrust file (if possible) */ 2076 static int 2077 read_if_pending_keys(char* file) 2078 { 2079 FILE* in = fopen(file, "r"); 2080 char line[8192]; 2081 if(!in) { 2082 if(verb>=2) printf("%s: %s\n", file, strerror(errno)); 2083 return 0; 2084 } 2085 while(fgets(line, (int)sizeof(line), in)) { 2086 if(line[0]==';') continue; 2087 if(strstr(line, "[ ADDPEND ]")) { 2088 fclose(in); 2089 if(verb) printf("RFC5011-state has ADDPEND keys\n"); 2090 return 1; 2091 } 2092 } 2093 fclose(in); 2094 return 0; 2095 } 2096 2097 /** read last successful probe time from autotrust file (if possible) */ 2098 static int32_t 2099 read_last_success_time(char* file) 2100 { 2101 FILE* in = fopen(file, "r"); 2102 char line[1024]; 2103 if(!in) { 2104 if(verb) printf("%s: %s\n", file, strerror(errno)); 2105 return 0; 2106 } 2107 while(fgets(line, (int)sizeof(line), in)) { 2108 if(strncmp(line, ";;last_success: ", 16) == 0) { 2109 char* e; 2110 time_t x = (unsigned int)strtol(line+16, &e, 10); 2111 fclose(in); 2112 if(line+16 == e) { 2113 if(verb) printf("failed to parse " 2114 "last_success probe time\n"); 2115 return 0; 2116 } 2117 if(verb) printf("last successful probe: %s", ctime(&x)); 2118 return (int32_t)x; 2119 } 2120 } 2121 fclose(in); 2122 if(verb) printf("no last_success probe time in anchor file\n"); 2123 return 0; 2124 } 2125 2126 /** 2127 * Read autotrust 5011 probe file and see if the date 2128 * compared to the current date allows a certupdate. 2129 * If the last successful probe was recent then 5011 cannot be behind, 2130 * and the failure cannot be solved with a certupdate. 2131 * The debugconf is to validation-override the date for testing. 2132 * @param root_anchor_file: filename of root key 2133 * @return true if certupdate is ok. 2134 */ 2135 static int 2136 probe_date_allows_certupdate(char* root_anchor_file) 2137 { 2138 int has_pending_keys = read_if_pending_keys(root_anchor_file); 2139 int32_t last_success = read_last_success_time(root_anchor_file); 2140 int32_t now = (int32_t)time(NULL); 2141 int32_t leeway = 30 * 24 * 3600; /* 30 days leeway */ 2142 /* if the date is before 2010-07-15:00.00.00 then the root has not 2143 * been signed yet, and thus we refuse to take action. */ 2144 if(time(NULL) < xml_convertdate("2010-07-15T00:00:00")) { 2145 if(verb) printf("the date is before the root was first signed," 2146 " please correct the clock\n"); 2147 return 0; 2148 } 2149 if(last_success == 0) 2150 return 1; /* no probe time */ 2151 if(has_pending_keys) 2152 return 1; /* key in ADDPEND state, a previous probe has 2153 inserted that, and it was present in all recent probes, 2154 but it has not become active. The 30 day timer may not have 2155 expired, but we know(for sure) there is a rollover going on. 2156 If we only managed to pickup the new key on its last day 2157 of announcement (for example) this can happen. */ 2158 if(now - last_success < 0) { 2159 if(verb) printf("the last successful probe is in the future," 2160 " clock was modified\n"); 2161 return 0; 2162 } 2163 if(now - last_success >= leeway) { 2164 if(verb) printf("the last successful probe was more than 30 " 2165 "days ago\n"); 2166 return 1; 2167 } 2168 if(verb) printf("the last successful probe is recent\n"); 2169 return 0; 2170 } 2171 2172 /** perform the unbound-anchor work */ 2173 static int 2174 do_root_update_work(char* root_anchor_file, char* root_cert_file, 2175 char* urlname, char* xmlname, char* p7sname, char* p7signer, 2176 char* res_conf, char* root_hints, char* debugconf, 2177 int ip4only, int ip6only, int force, int port) 2178 { 2179 struct ub_ctx* ctx; 2180 struct ub_result* dnskey; 2181 int used_builtin = 0; 2182 2183 /* see if builtin rootanchor needs to be provided, or if 2184 * rootanchor is 'revoked-trust-point' */ 2185 if(!provide_builtin(root_anchor_file, &used_builtin)) 2186 return 0; 2187 2188 /* make unbound context with 5011-probe for root anchor, 2189 * and probe . DNSKEY */ 2190 ctx = create_unbound_context(res_conf, root_hints, debugconf, 2191 ip4only, ip6only); 2192 add_5011_probe_root(ctx, root_anchor_file); 2193 dnskey = prime_root_key(ctx); 2194 ub_ctx_delete(ctx); 2195 2196 /* if secure: exit */ 2197 if(dnskey->secure && !force) { 2198 if(verb) printf("success: the anchor is ok\n"); 2199 ub_resolve_free(dnskey); 2200 return used_builtin; 2201 } 2202 if(force && verb) printf("debug cert update forced\n"); 2203 2204 /* if not (and NOERROR): check date and do certupdate */ 2205 if((dnskey->rcode == 0 && 2206 probe_date_allows_certupdate(root_anchor_file)) || force) { 2207 if(do_certupdate(root_anchor_file, root_cert_file, urlname, 2208 xmlname, p7sname, p7signer, res_conf, root_hints, 2209 debugconf, ip4only, ip6only, port, dnskey)) 2210 return 1; 2211 return used_builtin; 2212 } 2213 if(verb) printf("fail: the anchor is NOT ok and could not be fixed\n"); 2214 ub_resolve_free(dnskey); 2215 return used_builtin; 2216 } 2217 2218 /** getopt global, in case header files fail to declare it. */ 2219 extern int optind; 2220 /** getopt global, in case header files fail to declare it. */ 2221 extern char* optarg; 2222 2223 /** Main routine for unbound-anchor */ 2224 int main(int argc, char* argv[]) 2225 { 2226 int c; 2227 char* root_anchor_file = ROOT_ANCHOR_FILE; 2228 char* root_cert_file = ROOT_CERT_FILE; 2229 char* urlname = URLNAME; 2230 char* xmlname = XMLNAME; 2231 char* p7sname = P7SNAME; 2232 char* p7signer = P7SIGNER; 2233 char* res_conf = NULL; 2234 char* root_hints = NULL; 2235 char* debugconf = NULL; 2236 int dolist=0, ip4only=0, ip6only=0, force=0, port = HTTPS_PORT; 2237 /* parse the options */ 2238 while( (c=getopt(argc, argv, "46C:FP:a:c:f:hln:r:s:u:vx:")) != -1) { 2239 switch(c) { 2240 case 'l': 2241 dolist = 1; 2242 break; 2243 case '4': 2244 ip4only = 1; 2245 break; 2246 case '6': 2247 ip6only = 1; 2248 break; 2249 case 'a': 2250 root_anchor_file = optarg; 2251 break; 2252 case 'c': 2253 root_cert_file = optarg; 2254 break; 2255 case 'u': 2256 urlname = optarg; 2257 break; 2258 case 'x': 2259 xmlname = optarg; 2260 break; 2261 case 's': 2262 p7sname = optarg; 2263 break; 2264 case 'n': 2265 p7signer = optarg; 2266 break; 2267 case 'f': 2268 res_conf = optarg; 2269 break; 2270 case 'r': 2271 root_hints = optarg; 2272 break; 2273 case 'C': 2274 debugconf = optarg; 2275 break; 2276 case 'F': 2277 force = 1; 2278 break; 2279 case 'P': 2280 port = atoi(optarg); 2281 break; 2282 case 'v': 2283 verb++; 2284 break; 2285 case '?': 2286 case 'h': 2287 default: 2288 usage(); 2289 } 2290 } 2291 argc -= optind; 2292 argv += optind; 2293 if(argc != 0) 2294 usage(); 2295 2296 ERR_load_crypto_strings(); 2297 ERR_load_SSL_strings(); 2298 OpenSSL_add_all_algorithms(); 2299 (void)SSL_library_init(); 2300 2301 if(dolist) do_list_builtin(); 2302 2303 return do_root_update_work(root_anchor_file, root_cert_file, urlname, 2304 xmlname, p7sname, p7signer, res_conf, root_hints, debugconf, 2305 ip4only, ip6only, force, port); 2306 } 2307