static inline isc_result_t
totext_openpgpkey(ARGS_TOTEXT) {
isc_region_t sr;
REQUIRE(rdata->type == dns_rdatatype_openpgpkey);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/*
* Keyring
*/
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( ", target));
if ((tctx->flags & DNS_STYLEFLAG_NOCRYPTO) == 0) {
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
} else
RETERR(str_totext("[omitted]", target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_in_dhcid(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof(" ; 64000 255 64000")];
size_t n;
REQUIRE(rdata->type == 49);
REQUIRE(rdata->rdclass == 1);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( " /*)*/, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
RETERR(str_totext(/* ( */ " )", target));
if (rdata->length > 2) {
n = snprintf(buf, sizeof(buf), " ; %u %u %u",
sr.base[0] * 256 + sr.base[1],
sr.base[2], rdata->length - 3);
INSIST(n < sizeof(buf));
RETERR(str_totext(buf, target));
}
}
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_cert(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("64000 ")];
unsigned int n;
REQUIRE(rdata->type == 37);
REQUIRE(rdata->length != 0);
UNUSED(tctx);
dns_rdata_toregion(rdata, &sr);
/*
* Type.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
RETERR(dns_cert_totext((dns_cert_t)n, target));
RETERR(str_totext(" ", target));
/*
* Key tag.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%u ", n);
RETERR(str_totext(buf, target));
/*
* Algorithm.
*/
RETERR(dns_secalg_totext(sr.base[0], target));
isc_region_consume(&sr, 1);
/*
* Cert.
*/
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_key(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("64000")];
unsigned int flags;
unsigned char algorithm;
REQUIRE(rdata->type == 25);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/* flags */
flags = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/* protocol */
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/* algorithm */
algorithm = sr.base[0];
sprintf(buf, "%u", algorithm);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
/* No Key? */
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
/* key */
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
isc_region_t tmpr;
RETERR(str_totext(" ; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
RETERR(str_totext(buf, target));
}
return (ISC_R_SUCCESS);
}
static isc_result_t
gssapi_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {
OM_uint32 major, minor;
gss_buffer_desc gssbuffer;
size_t len;
char *buf;
isc_buffer_t b;
isc_region_t r;
isc_result_t result;
major = gss_export_sec_context(&minor, &key->keydata.gssctx,
&gssbuffer);
if (major != GSS_S_COMPLETE) {
fprintf(stderr, "gss_export_sec_context -> %d, %d\n",
major, minor);
return (ISC_R_FAILURE);
}
if (gssbuffer.length == 0U)
return (ISC_R_FAILURE);
len = ((gssbuffer.length + 2)/3) * 4;
buf = isc_mem_get(mctx, len);
if (buf == NULL) {
gss_release_buffer(&minor, &gssbuffer);
return (ISC_R_NOMEMORY);
}
isc_buffer_init(&b, buf, (unsigned int)len);
GBUFFER_TO_REGION(gssbuffer, r);
result = isc_base64_totext(&r, 0, "", &b);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
gss_release_buffer(&minor, &gssbuffer);
*buffer = buf;
*length = (int)len;
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_opt(ARGS_TOTEXT) {
isc_region_t r;
isc_region_t or;
isc_uint16_t option;
isc_uint16_t length;
char buf[sizeof("64000 64000")];
/*
* OPT records do not have a text format.
*/
REQUIRE(rdata->type == 41);
dns_rdata_toregion(rdata, &r);
while (r.length > 0) {
option = uint16_fromregion(&r);
isc_region_consume(&r, 2);
length = uint16_fromregion(&r);
isc_region_consume(&r, 2);
sprintf(buf, "%u %u", option, length);
RETERR(str_totext(buf, target));
INSIST(r.length >= length);
if (length > 0) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
or = r;
or.length = length;
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&or, 60, "", target));
else
RETERR(isc_base64_totext(&or, tctx->width - 2,
tctx->linebreak,
target));
isc_region_consume(&r, length);
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
}
if (r.length > 0)
RETERR(str_totext(" ", target));
}
return (ISC_R_SUCCESS);
}
isc_result_t
isccc_base64_encode(isccc_region_t *source, int wordlength,
const char *wordbreak, isccc_region_t *target)
{
isc_region_t sr;
isc_buffer_t tb;
isc_result_t result;
sr.base = source->rstart;
sr.length = source->rend - source->rstart;
isc_buffer_init(&tb, target->rstart, target->rend - target->rstart);
result = isc_base64_totext(&sr, wordlength, wordbreak, &tb);
if (result != ISC_R_SUCCESS)
return (result);
source->rstart = source->rend;
target->rstart = isc_buffer_used(&tb);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_ipseckey(ARGS_TOTEXT) {
isc_region_t region;
dns_name_t name;
char buf[sizeof("255 ")];
unsigned short num;
unsigned short gateway;
REQUIRE(rdata->type == 45);
REQUIRE(rdata->length >= 3);
dns_name_init(&name, NULL);
if (rdata->data[1] > 3U)
return (ISC_R_NOTIMPLEMENTED);
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( ", target));
/*
* Precedence.
*/
dns_rdata_toregion(rdata, ®ion);
num = uint8_fromregion(®ion);
isc_region_consume(®ion, 1);
sprintf(buf, "%u ", num);
RETERR(str_totext(buf, target));
/*
* Gateway type.
*/
gateway = uint8_fromregion(®ion);
isc_region_consume(®ion, 1);
sprintf(buf, "%u ", gateway);
RETERR(str_totext(buf, target));
/*
* Algorithm.
*/
num = uint8_fromregion(®ion);
isc_region_consume(®ion, 1);
sprintf(buf, "%u ", num);
RETERR(str_totext(buf, target));
/*
* Gateway.
*/
switch (gateway) {
case 0:
RETERR(str_totext(".", target));
break;
case 1:
RETERR(inet_totext(AF_INET, ®ion, target));
isc_region_consume(®ion, 4);
break;
case 2:
RETERR(inet_totext(AF_INET6, ®ion, target));
isc_region_consume(®ion, 16);
break;
case 3:
dns_name_fromregion(&name, ®ion);
RETERR(dns_name_totext(&name, ISC_FALSE, target));
isc_region_consume(®ion, name_length(&name));
break;
}
/*
* Key.
*/
if (region.length > 0U) {
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(®ion, 60, "", target));
else
RETERR(isc_base64_totext(®ion, tctx->width - 2,
tctx->linebreak, target));
}
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_sig(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("4294967295")];
dns_rdatatype_t covered;
unsigned long ttl;
unsigned long when;
unsigned long exp;
unsigned long foot;
dns_name_t name;
dns_name_t prefix;
isc_boolean_t sub;
REQUIRE(rdata->type == dns_rdatatype_sig);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/*
* Type covered.
*/
covered = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
/*
* XXXAG We should have something like dns_rdatatype_isknown()
* that does the right thing with type 0.
*/
if (dns_rdatatype_isknown(covered) && covered != 0) {
RETERR(dns_rdatatype_totext(covered, target));
} else {
sprintf(buf, "%u", covered);
RETERR(str_totext(buf, target));
}
RETERR(str_totext(" ", target));
/*
* Algorithm.
*/
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/*
* Labels.
*/
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/*
* Ttl.
*/
ttl = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
sprintf(buf, "%lu", ttl);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/*
* Sig exp.
*/
exp = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(exp, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
/*
* Time signed.
*/
when = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(when, target));
RETERR(str_totext(" ", target));
/*
* Footprint.
*/
foot = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%lu", foot);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/*
* Signer.
*/
dns_name_init(&name, NULL);
dns_name_init(&prefix, NULL);
dns_name_fromregion(&name, &sr);
isc_region_consume(&sr, name_length(&name));
sub = name_prefix(&name, tctx->origin, &prefix);
RETERR(dns_name_totext(&prefix, sub, target));
/*
* Sig.
*/
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
}
int
dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
const char *directory)
{
FILE *fp;
int ret, i;
isc_result_t iret;
char filename[ISC_DIR_NAMEMAX];
char buffer[MAXFIELDSIZE * 2];
isc_buffer_t b;
isc_fsaccess_t access;
REQUIRE(priv != NULL);
if (check_data(priv, dst_key_alg(key)) < 0)
return (DST_R_INVALIDPRIVATEKEY);
isc_buffer_init(&b, filename, sizeof(filename));
ret = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &b);
if (ret != ISC_R_SUCCESS)
return (ret);
if ((fp = fopen(filename, "w")) == NULL)
return (DST_R_WRITEERROR);
access = 0;
isc_fsaccess_add(ISC_FSACCESS_OWNER,
ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
&access);
(void)isc_fsaccess_set(filename, access);
/* XXXDCL return value should be checked for full filesystem */
fprintf(fp, "%s v%d.%d\n", PRIVATE_KEY_STR, MAJOR_VERSION,
MINOR_VERSION);
fprintf(fp, "%s %d ", ALGORITHM_STR, dst_key_alg(key));
/* XXXVIX this switch statement is too sparse to gen a jump table. */
switch (dst_key_alg(key)) {
case DST_ALG_RSAMD5:
fprintf(fp, "(RSA)\n");
break;
case DST_ALG_DH:
fprintf(fp, "(DH)\n");
break;
case DST_ALG_DSA:
fprintf(fp, "(DSA)\n");
break;
case DST_ALG_RSASHA1:
fprintf(fp, "(RSASHA1)\n");
break;
case DST_ALG_HMACMD5:
fprintf(fp, "(HMAC_MD5)\n");
break;
default:
fprintf(fp, "(?)\n");
break;
}
for (i = 0; i < priv->nelements; i++) {
isc_buffer_t b;
isc_region_t r;
const char *s;
s = find_tag(priv->elements[i].tag);
r.base = priv->elements[i].data;
r.length = priv->elements[i].length;
isc_buffer_init(&b, buffer, sizeof(buffer));
iret = isc_base64_totext(&r, sizeof(buffer), "", &b);
if (iret != ISC_R_SUCCESS) {
fclose(fp);
return (DST_R_INVALIDPRIVATEKEY);
}
isc_buffer_usedregion(&b, &r);
fprintf(fp, "%s ", s);
fwrite(r.base, 1, r.length, fp);
fprintf(fp, "\n");
}
fclose(fp);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_hip(ARGS_TOTEXT) {
isc_region_t region;
dns_name_t name;
unsigned int length, key_len, hit_len;
unsigned char algorithm;
char buf[sizeof("225 ")];
REQUIRE(rdata->type == dns_rdatatype_hip);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, ®ion);
hit_len = uint8_fromregion(®ion);
isc_region_consume(®ion, 1);
algorithm = uint8_fromregion(®ion);
isc_region_consume(®ion, 1);
key_len = uint16_fromregion(®ion);
isc_region_consume(®ion, 2);
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( ", target));
/*
* Algorithm
*/
sprintf(buf, "%u ", algorithm);
RETERR(str_totext(buf, target));
/*
* HIT.
*/
INSIST(hit_len < region.length);
length = region.length;
region.length = hit_len;
RETERR(isc_hex_totext(®ion, 1, "", target));
region.length = length - hit_len;
RETERR(str_totext(tctx->linebreak, target));
/*
* Public KEY.
*/
INSIST(key_len <= region.length);
length = region.length;
region.length = key_len;
RETERR(isc_base64_totext(®ion, 1, "", target));
region.length = length - key_len;
RETERR(str_totext(tctx->linebreak, target));
/*
* Rendezvous Servers.
*/
dns_name_init(&name, NULL);
while (region.length > 0) {
dns_name_fromregion(&name, ®ion);
RETERR(dns_name_totext(&name, ISC_FALSE, target));
isc_region_consume(®ion, name.length);
if (region.length > 0)
RETERR(str_totext(tctx->linebreak, target));
}
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
}
isc_result_t
dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
const char *directory)
{
FILE *fp;
isc_result_t result;
char filename[ISC_DIR_NAMEMAX];
char buffer[MAXFIELDSIZE * 2];
isc_fsaccess_t access;
isc_stdtime_t when;
isc_uint32_t value;
isc_buffer_t b;
isc_region_t r;
int major, minor;
mode_t mode;
int i, ret;
REQUIRE(priv != NULL);
ret = check_data(priv, dst_key_alg(key), ISC_FALSE, key->external);
if (ret < 0)
return (DST_R_INVALIDPRIVATEKEY);
else if (ret != ISC_R_SUCCESS)
return (ret);
isc_buffer_init(&b, filename, sizeof(filename));
result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &b);
if (result != ISC_R_SUCCESS)
return (result);
result = isc_file_mode(filename, &mode);
if (result == ISC_R_SUCCESS && mode != 0600) {
/* File exists; warn that we are changing its permissions */
isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
"Permissions on the file %s "
"have changed from 0%o to 0600 as "
"a result of this operation.",
filename, (unsigned int)mode);
}
if ((fp = fopen(filename, "w")) == NULL)
return (DST_R_WRITEERROR);
access = 0;
isc_fsaccess_add(ISC_FSACCESS_OWNER,
ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
&access);
(void)isc_fsaccess_set(filename, access);
dst_key_getprivateformat(key, &major, &minor);
if (major == 0 && minor == 0) {
major = DST_MAJOR_VERSION;
minor = DST_MINOR_VERSION;
}
/* XXXDCL return value should be checked for full filesystem */
fprintf(fp, "%s v%d.%d\n", PRIVATE_KEY_STR, major, minor);
fprintf(fp, "%s %d ", ALGORITHM_STR, dst_key_alg(key));
/* XXXVIX this switch statement is too sparse to gen a jump table. */
switch (dst_key_alg(key)) {
case DST_ALG_RSAMD5:
fprintf(fp, "(RSA)\n");
break;
case DST_ALG_DH:
fprintf(fp, "(DH)\n");
break;
case DST_ALG_DSA:
fprintf(fp, "(DSA)\n");
break;
case DST_ALG_RSASHA1:
fprintf(fp, "(RSASHA1)\n");
break;
case DST_ALG_NSEC3RSASHA1:
fprintf(fp, "(NSEC3RSASHA1)\n");
break;
case DST_ALG_NSEC3DSA:
fprintf(fp, "(NSEC3DSA)\n");
break;
case DST_ALG_RSASHA256:
fprintf(fp, "(RSASHA256)\n");
break;
case DST_ALG_RSASHA512:
fprintf(fp, "(RSASHA512)\n");
break;
case DST_ALG_ECCGOST:
fprintf(fp, "(ECC-GOST)\n");
break;
case DST_ALG_ECDSA256:
fprintf(fp, "(ECDSAP256SHA256)\n");
break;
case DST_ALG_ECDSA384:
fprintf(fp, "(ECDSAP384SHA384)\n");
break;
case DST_ALG_HMACMD5:
fprintf(fp, "(HMAC_MD5)\n");
break;
case DST_ALG_HMACSHA1:
fprintf(fp, "(HMAC_SHA1)\n");
break;
case DST_ALG_HMACSHA224:
fprintf(fp, "(HMAC_SHA224)\n");
break;
case DST_ALG_HMACSHA256:
fprintf(fp, "(HMAC_SHA256)\n");
break;
case DST_ALG_HMACSHA384:
fprintf(fp, "(HMAC_SHA384)\n");
break;
case DST_ALG_HMACSHA512:
fprintf(fp, "(HMAC_SHA512)\n");
break;
default:
fprintf(fp, "(?)\n");
break;
}
for (i = 0; i < priv->nelements; i++) {
const char *s;
s = find_tag(priv->elements[i].tag);
r.base = priv->elements[i].data;
r.length = priv->elements[i].length;
isc_buffer_init(&b, buffer, sizeof(buffer));
result = isc_base64_totext(&r, sizeof(buffer), "", &b);
if (result != ISC_R_SUCCESS) {
fclose(fp);
return (DST_R_INVALIDPRIVATEKEY);
}
isc_buffer_usedregion(&b, &r);
fprintf(fp, "%s %.*s\n", s, (int)r.length, r.base);
}
if (key->external)
fprintf(fp, "External:\n");
/* Add the metadata tags */
if (major > 1 || (major == 1 && minor >= 3)) {
for (i = 0; i < NUMERIC_NTAGS; i++) {
result = dst_key_getnum(key, i, &value);
if (result != ISC_R_SUCCESS)
continue;
fprintf(fp, "%s %u\n", numerictags[i], value);
}
for (i = 0; i < TIMING_NTAGS; i++) {
result = dst_key_gettime(key, i, &when);
if (result != ISC_R_SUCCESS)
continue;
isc_buffer_init(&b, buffer, sizeof(buffer));
result = dns_time32_totext(when, &b);
if (result != ISC_R_SUCCESS) {
fclose(fp);
return (DST_R_INVALIDPRIVATEKEY);
}
isc_buffer_usedregion(&b, &r);
fprintf(fp, "%s %.*s\n", timetags[i], (int)r.length,
r.base);
}
}
fflush(fp);
result = ferror(fp) ? DST_R_WRITEERROR : ISC_R_SUCCESS;
fclose(fp);
return (result);
}
/*%
* Generate a key of size 'keysize' using entropy source 'randomfile',
* and place it in 'key_txtbuffer'
*/
void
generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
int keysize, isc_buffer_t *key_txtbuffer) {
isc_result_t result = ISC_R_SUCCESS;
isc_entropysource_t *entropy_source = NULL;
int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
int entropy_flags = 0;
isc_entropy_t *ectx = NULL;
isc_buffer_t key_rawbuffer;
isc_region_t key_rawregion;
char key_rawsecret[64];
dst_key_t *key = NULL;
switch (alg) {
case DST_ALG_HMACMD5:
case DST_ALG_HMACSHA1:
case DST_ALG_HMACSHA224:
case DST_ALG_HMACSHA256:
if (keysize < 1 || keysize > 512)
fatal("keysize %d out of range (must be 1-512)\n",
keysize);
break;
case DST_ALG_HMACSHA384:
case DST_ALG_HMACSHA512:
if (keysize < 1 || keysize > 1024)
fatal("keysize %d out of range (must be 1-1024)\n",
keysize);
break;
default:
fatal("unsupported algorithm %d\n", alg);
}
DO("create entropy context", isc_entropy_create(mctx, &ectx));
if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
randomfile = NULL;
open_keyboard = ISC_ENTROPY_KEYBOARDYES;
}
DO("start entropy source", isc_entropy_usebestsource(ectx,
&entropy_source,
randomfile,
open_keyboard));
entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));
DO("generate key", dst_key_generate(dns_rootname, alg,
keysize, 0, 0,
DNS_KEYPROTO_ANY,
dns_rdataclass_in, mctx, &key));
isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
DO("dump key to buffer", dst_key_tobuffer(key, &key_rawbuffer));
isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);
DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
key_txtbuffer));
/*
* Shut down the entropy source now so the "stop typing" message
* does not muck with the output.
*/
if (entropy_source != NULL)
isc_entropy_destroysource(&entropy_source);
if (key != NULL)
dst_key_free(&key);
isc_entropy_detach(&ectx);
dst_lib_destroy();
}
static inline isc_result_t
totext_dnskey(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("64000")];
unsigned int flags;
unsigned char algorithm;
char algbuf[DNS_NAME_FORMATSIZE];
const char *keyinfo;
REQUIRE(rdata->type == 48);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/* flags */
flags = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
if ((flags & DNS_KEYFLAG_KSK) != 0) {
if (flags & DNS_KEYFLAG_REVOKE)
keyinfo = "revoked KSK";
else
keyinfo = "KSK";
} else
keyinfo = "ZSK";
/* protocol */
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/* algorithm */
algorithm = sr.base[0];
sprintf(buf, "%u", algorithm);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
/* No Key? */
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
algorithm == DNS_KEYALG_PRIVATEDNS) {
dns_name_t name;
dns_name_init(&name, NULL);
dns_name_fromregion(&name, &sr);
dns_name_format(&name, algbuf, sizeof(algbuf));
} else {
dns_secalg_format((dns_secalg_t) algorithm, algbuf,
sizeof(algbuf));
}
/* key */
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 0, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
RETERR(str_totext(" ; ", target));
RETERR(str_totext(keyinfo, target));
RETERR(str_totext("; alg = ", target));
RETERR(str_totext(algbuf, target));
RETERR(str_totext("; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
RETERR(str_totext(buf, target));
}
return (ISC_R_SUCCESS);
}
int
main(int argc, char **argv) {
isc_boolean_t show_final_mem = ISC_FALSE;
isc_buffer_t key_rawbuffer;
isc_buffer_t key_txtbuffer;
isc_region_t key_rawregion;
isc_mem_t *mctx = NULL;
isc_entropy_t *ectx = NULL;
isc_entropysource_t *entropy_source = NULL;
isc_result_t result = ISC_R_SUCCESS;
dst_key_t *key = NULL;
const char *keyname = NULL;
const char *randomfile = NULL;
const char *serveraddr = NULL;
char key_rawsecret[64];
char key_txtsecret[256];
char *p;
int ch;
int port;
int keysize;
int entropy_flags = 0;
int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
struct in_addr addr4_dummy;
struct in6_addr addr6_dummy;
char *chrootdir = NULL;
char *user = NULL;
isc_boolean_t keyonly = ISC_FALSE;
int len;
keydef = keyfile = RNDC_KEYFILE;
result = isc_file_progname(*argv, program, sizeof(program));
if (result != ISC_R_SUCCESS)
memcpy(program, "rndc-confgen", 13);
progname = program;
keyname = DEFAULT_KEYNAME;
keysize = DEFAULT_KEYLENGTH;
serveraddr = DEFAULT_SERVER;
port = DEFAULT_PORT;
while ((ch = isc_commandline_parse(argc, argv,
"ab:c:hk:Mmp:r:s:t:u:Vy")) != -1) {
switch (ch) {
case 'a':
keyonly = ISC_TRUE;
break;
case 'b':
keysize = strtol(isc_commandline_argument, &p, 10);
if (*p != '\0' || keysize < 0)
fatal("-b requires a non-negative number");
if (keysize < 1 || keysize > 512)
fatal("-b must be in the range 1 through 512");
break;
case 'c':
keyfile = isc_commandline_argument;
break;
case 'h':
usage(0);
case 'k':
case 'y': /* Compatible with rndc -y. */
keyname = isc_commandline_argument;
break;
case 'M':
isc_mem_debugging = ISC_MEM_DEBUGTRACE;
break;
case 'm':
show_final_mem = ISC_TRUE;
break;
case 'p':
port = strtol(isc_commandline_argument, &p, 10);
if (*p != '\0' || port < 0 || port > 65535)
fatal("port '%s' out of range",
isc_commandline_argument);
break;
case 'r':
randomfile = isc_commandline_argument;
break;
case 's':
serveraddr = isc_commandline_argument;
if (inet_pton(AF_INET, serveraddr, &addr4_dummy) != 1 &&
inet_pton(AF_INET6, serveraddr, &addr6_dummy) != 1)
fatal("-s should be an IPv4 or IPv6 address");
break;
case 't':
chrootdir = isc_commandline_argument;
break;
case 'u':
user = isc_commandline_argument;
break;
case 'V':
verbose = ISC_TRUE;
break;
case '?':
usage(1);
break;
default:
fatal("unexpected error parsing command arguments: "
"got %c\n", ch);
break;
}
}
argc -= isc_commandline_index;
argv += isc_commandline_index;
if (argc > 0)
usage(1);
DO("create memory context", isc_mem_create(0, 0, &mctx));
DO("create entropy context", isc_entropy_create(mctx, &ectx));
if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
randomfile = NULL;
open_keyboard = ISC_ENTROPY_KEYBOARDYES;
}
DO("start entropy source", isc_entropy_usebestsource(ectx,
&entropy_source,
randomfile,
open_keyboard));
entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));
DO("generate key", dst_key_generate(dns_rootname, DST_ALG_HMACMD5,
keysize, 0, 0,
DNS_KEYPROTO_ANY,
dns_rdataclass_in, mctx, &key));
isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
DO("dump key to buffer", dst_key_tobuffer(key, &key_rawbuffer));
isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);
DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
&key_txtbuffer));
/*
* Shut down the entropy source now so the "stop typing" message
* does not muck with the output.
*/
if (entropy_source != NULL)
isc_entropy_destroysource(&entropy_source);
if (key != NULL)
dst_key_free(&key);
isc_entropy_detach(&ectx);
dst_lib_destroy();
if (keyonly) {
write_key_file(keyfile, chrootdir == NULL ? user : NULL,
keyname, &key_txtbuffer);
if (chrootdir != NULL) {
char *buf;
len = strlen(chrootdir) + strlen(keyfile) + 2;
buf = isc_mem_get(mctx, len);
if (buf == NULL)
fatal("isc_mem_get(%d) failed\n", len);
snprintf(buf, len, "%s%s%s", chrootdir,
(*keyfile != '/') ? "/" : "", keyfile);
write_key_file(buf, user, keyname, &key_txtbuffer);
isc_mem_put(mctx, buf, len);
}
} else {
printf("\
# Start of rndc.conf\n\
key \"%s\" {\n\
algorithm hmac-md5;\n\
secret \"%.*s\";\n\
};\n\
\n\
options {\n\
default-key \"%s\";\n\
default-server %s;\n\
default-port %d;\n\
};\n\
# End of rndc.conf\n\
\n\
# Use with the following in named.conf, adjusting the allow list as needed:\n\
# key \"%s\" {\n\
# algorithm hmac-md5;\n\
# secret \"%.*s\";\n\
# };\n\
# \n\
# controls {\n\
# inet %s port %d\n\
# allow { %s; } keys { \"%s\"; };\n\
# };\n\
# End of named.conf\n",
keyname,
(int)isc_buffer_usedlength(&key_txtbuffer),
(char *)isc_buffer_base(&key_txtbuffer),
keyname, serveraddr, port,
keyname,
(int)isc_buffer_usedlength(&key_txtbuffer),
(char *)isc_buffer_base(&key_txtbuffer),
serveraddr, port, serveraddr, keyname);
}
if (show_final_mem)
isc_mem_stats(mctx, stderr);
isc_mem_destroy(&mctx);
return (0);
}
static inline isc_result_t
totext_tkey(ARGS_TOTEXT) {
isc_region_t sr, dr;
char buf[sizeof("4294967295 ")];
unsigned long n;
dns_name_t name;
dns_name_t prefix;
isc_boolean_t sub;
REQUIRE(rdata->type == 249);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/*
* Algorithm.
*/
dns_name_init(&name, NULL);
dns_name_init(&prefix, NULL);
dns_name_fromregion(&name, &sr);
sub = name_prefix(&name, tctx->origin, &prefix);
RETERR(dns_name_totext(&prefix, sub, target));
RETERR(str_totext(" ", target));
isc_region_consume(&sr, name_length(&name));
/*
* Inception.
*/
n = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
sprintf(buf, "%lu ", n);
RETERR(str_totext(buf, target));
/*
* Expiration.
*/
n = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
sprintf(buf, "%lu ", n);
RETERR(str_totext(buf, target));
/*
* Mode.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%lu ", n);
RETERR(str_totext(buf, target));
/*
* Error.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
if (dns_tsigrcode_totext((dns_rcode_t)n, target) == ISC_R_SUCCESS)
RETERR(str_totext(" ", target));
else {
sprintf(buf, "%lu ", n);
RETERR(str_totext(buf, target));
}
/*
* Key Size.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%lu", n);
RETERR(str_totext(buf, target));
/*
* Key Data.
*/
REQUIRE(n <= sr.length);
dr = sr;
dr.length = n;
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
RETERR(isc_base64_totext(&dr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ) ", target));
else
RETERR(str_totext(" ", target));
isc_region_consume(&sr, n);
/*
* Other Size.
*/
n = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%lu", n);
RETERR(str_totext(buf, target));
/*
* Other Data.
*/
REQUIRE(n <= sr.length);
if (n != 0U) {
dr = sr;
dr.length = n;
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
RETERR(isc_base64_totext(&dr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
}
return (ISC_R_SUCCESS);
}
int
main(int argc, char **argv) {
isc_buffer_t buf;
unsigned char key[1024];
char secret[1024];
char base64[(1024*4)/3];
isc_region_t r;
isc_result_t result;
if (argc != 3) {
fprintf(stderr, "Usage:\t%s algorithm secret\n", argv[0]);
fprintf(stderr, "\talgorithm: (MD5 | SHA1 | SHA224 | "
"SHA256 | SHA384 | SHA512)\n");
return (1);
}
isc_buffer_init(&buf, secret, sizeof(secret));
result = isc_base64_decodestring(argv[2], &buf);
if (result != ISC_R_SUCCESS) {
fprintf(stderr, "error: %s\n", isc_result_totext(result));
return (1);
}
isc__buffer_usedregion(&buf, &r);
if (!strcasecmp(argv[1], "md5") ||
!strcasecmp(argv[1], "hmac-md5")) {
if (r.length > HMAC_LEN) {
isc_md5_t md5ctx;
isc_md5_init(&md5ctx);
isc_md5_update(&md5ctx, r.base, r.length);
isc_md5_final(&md5ctx, key);
r.base = key;
r.length = ISC_MD5_DIGESTLENGTH;
}
} else if (!strcasecmp(argv[1], "sha1") ||
!strcasecmp(argv[1], "hmac-sha1")) {
if (r.length > ISC_SHA1_DIGESTLENGTH) {
isc_sha1_t sha1ctx;
isc_sha1_init(&sha1ctx);
isc_sha1_update(&sha1ctx, r.base, r.length);
isc_sha1_final(&sha1ctx, key);
r.base = key;
r.length = ISC_SHA1_DIGESTLENGTH;
}
} else if (!strcasecmp(argv[1], "sha224") ||
!strcasecmp(argv[1], "hmac-sha224")) {
if (r.length > ISC_SHA224_DIGESTLENGTH) {
isc_sha224_t sha224ctx;
isc_sha224_init(&sha224ctx);
isc_sha224_update(&sha224ctx, r.base, r.length);
isc_sha224_final(key, &sha224ctx);
r.base = key;
r.length = ISC_SHA224_DIGESTLENGTH;
}
} else if (!strcasecmp(argv[1], "sha256") ||
!strcasecmp(argv[1], "hmac-sha256")) {
if (r.length > ISC_SHA256_DIGESTLENGTH) {
isc_sha256_t sha256ctx;
isc_sha256_init(&sha256ctx);
isc_sha256_update(&sha256ctx, r.base, r.length);
isc_sha256_final(key, &sha256ctx);
r.base = key;
r.length = ISC_SHA256_DIGESTLENGTH;
}
} else if (!strcasecmp(argv[1], "sha384") ||
!strcasecmp(argv[1], "hmac-sha384")) {
if (r.length > ISC_SHA384_DIGESTLENGTH) {
isc_sha384_t sha384ctx;
isc_sha384_init(&sha384ctx);
isc_sha384_update(&sha384ctx, r.base, r.length);
isc_sha384_final(key, &sha384ctx);
r.base = key;
r.length = ISC_SHA384_DIGESTLENGTH;
}
} else if (!strcasecmp(argv[1], "sha512") ||
!strcasecmp(argv[1], "hmac-sha512")) {
if (r.length > ISC_SHA512_DIGESTLENGTH) {
isc_sha512_t sha512ctx;
isc_sha512_init(&sha512ctx);
isc_sha512_update(&sha512ctx, r.base, r.length);
isc_sha512_final(key, &sha512ctx);
r.base = key;
r.length = ISC_SHA512_DIGESTLENGTH;
}
} else {
fprintf(stderr, "unknown hmac/digest algorithm: %s\n", argv[1]);
return (1);
}
isc_buffer_init(&buf, base64, sizeof(base64));
result = isc_base64_totext(&r, 0, "", &buf);
if (result != ISC_R_SUCCESS) {
fprintf(stderr, "error: %s\n", isc_result_totext(result));
return (1);
}
fprintf(stdout, "%.*s\n", (int)isc_buffer_usedlength(&buf), base64);
return (0);
}
static inline isc_result_t
totext_keydata(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("64000")];
unsigned int flags;
unsigned char algorithm;
unsigned long when;
char algbuf[DNS_NAME_FORMATSIZE];
const char *keyinfo;
REQUIRE(rdata->type == 65533);
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
/* refresh timer */
when = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(when, target));
RETERR(str_totext(" ", target));
/* add hold-down */
when = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(when, target));
RETERR(str_totext(" ", target));
/* remove hold-down */
when = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(when, target));
RETERR(str_totext(" ", target));
/* flags */
flags = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
if ((flags & DNS_KEYFLAG_KSK) != 0) {
if (flags & DNS_KEYFLAG_REVOKE)
keyinfo = "revoked KSK";
else
keyinfo = "KSK";
} else
keyinfo = "ZSK";
/* protocol */
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/* algorithm */
algorithm = sr.base[0];
sprintf(buf, "%u", algorithm);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
/* No Key? */
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
/* key */
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
RETERR(str_totext(" ; ", target));
RETERR(str_totext(keyinfo, target));
dns_secalg_format((dns_secalg_t) algorithm, algbuf,
sizeof(algbuf));
RETERR(str_totext("; alg = ", target));
RETERR(str_totext(algbuf, target));
RETERR(str_totext("; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
/* Skip over refresh, addhd, and removehd */
isc_region_consume(&tmpr, 12);
sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
RETERR(str_totext(buf, target));
}
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_keydata(ARGS_TOTEXT) {
isc_region_t sr;
char buf[sizeof("64000")];
unsigned int flags;
unsigned char algorithm;
unsigned long refresh, add, remove;
char algbuf[DNS_NAME_FORMATSIZE];
const char *keyinfo;
REQUIRE(rdata->type == 65533);
if ((tctx->flags & DNS_STYLEFLAG_KEYDATA) == 0 || rdata->length < 16)
return (unknown_totext(rdata, tctx, target));
dns_rdata_toregion(rdata, &sr);
/* refresh timer */
refresh = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(refresh, target));
RETERR(str_totext(" ", target));
/* add hold-down */
add = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(add, target));
RETERR(str_totext(" ", target));
/* remove hold-down */
remove = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(remove, target));
RETERR(str_totext(" ", target));
/* flags */
flags = uint16_fromregion(&sr);
isc_region_consume(&sr, 2);
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
if ((flags & DNS_KEYFLAG_KSK) != 0) {
if (flags & DNS_KEYFLAG_REVOKE)
keyinfo = "revoked KSK";
else
keyinfo = "KSK";
} else
keyinfo = "ZSK";
/* protocol */
sprintf(buf, "%u", sr.base[0]);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
/* algorithm */
algorithm = sr.base[0];
sprintf(buf, "%u", algorithm);
isc_region_consume(&sr, 1);
RETERR(str_totext(buf, target));
/* No Key? */
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
/* key */
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
if (tctx->width == 0) /* No splitting */
RETERR(isc_base64_totext(&sr, 60, "", target));
else
RETERR(isc_base64_totext(&sr, tctx->width - 2,
tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
char rbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
char abuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
char dbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
isc_time_t t;
RETERR(str_totext(" ; ", target));
RETERR(str_totext(keyinfo, target));
dns_secalg_format((dns_secalg_t) algorithm, algbuf,
sizeof(algbuf));
RETERR(str_totext("; alg = ", target));
RETERR(str_totext(algbuf, target));
RETERR(str_totext("; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
/* Skip over refresh, addhd, and removehd */
isc_region_consume(&tmpr, 12);
sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
RETERR(str_totext(buf, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
isc_stdtime_t now;
isc_stdtime_get(&now);
RETERR(str_totext(tctx->linebreak, target));
RETERR(str_totext("; next refresh: ", target));
isc_time_set(&t, refresh, 0);
isc_time_formathttptimestamp(&t, rbuf, sizeof(rbuf));
RETERR(str_totext(rbuf, target));
if (add == 0) {
RETERR(str_totext(tctx->linebreak, target));
RETERR(str_totext("; no trust", target));
} else {
RETERR(str_totext(tctx->linebreak, target));
if (add < now) {
RETERR(str_totext("; trusted since: ",
target));
} else {
RETERR(str_totext("; trust pending: ",
target));
}
isc_time_set(&t, add, 0);
isc_time_formathttptimestamp(&t, abuf,
sizeof(abuf));
RETERR(str_totext(abuf, target));
}
if (remove != 0) {
RETERR(str_totext(tctx->linebreak, target));
RETERR(str_totext("; removal pending: ",
target));
isc_time_set(&t, remove, 0);
isc_time_formathttptimestamp(&t, dbuf,
sizeof(dbuf));
RETERR(str_totext(dbuf, target));
}
}
}
return (ISC_R_SUCCESS);
}
