Merge branch 'kzonesign_verify' into 'master'

kzonesign: implemented zone verify

See merge request !1199

doc/man/kzonesign.1in

@@ -58,8 +58,11 @@ Write the output zone file to the specified directory instead of the configured
 Allow key roll\-overs and NSEC3 re\-salt. In order to finish possible KSK submission,
 set the KSK\(aqs \fBactive\fP timestamp to now (\fB+0\fP) using keymgr\&.
 .TP
+\fB\-v\fP, \fB\-\-verify\fP
+Instead of (re\-)signing the zone, just verify that the zone is correctly signed.
+.TP
 \fB\-t\fP, \fB\-\-time\fP \fItimestamp\fP
-Sign the zone (and roll the keys if necessary) as if it was at the time
+Sign/verify the zone (and roll the keys if necessary) as if it was at the time
 specified by timestamp.
 .TP
 \fB\-h\fP, \fB\-\-help\fP

doc/man_kzonesign.rst

@@ -35,8 +35,11 @@ Options
   Allow key roll-overs and NSEC3 re-salt. In order to finish possible KSK submission,
   set the KSK's **active** timestamp to now (**+0**) using :doc:`keymgr<man_keymgr>`.
 
+**-v**, **--verify**
+  Instead of (re-)signing the zone, just verify that the zone is correctly signed.
+
 **-t**, **--time** *timestamp*
-  Sign the zone (and roll the keys if necessary) as if it was at the time
+  Sign/verify the zone (and roll the keys if necessary) as if it was at the time
   specified by timestamp.
 
 **-h**, **--help**

src/knot/dnssec/zone-events.c

@@ -397,10 +397,13 @@ knot_time_t knot_dnssec_failover_delay(const kdnssec_ctx_t *ctx)
 	}
 }
 
-int knot_dnssec_validate_zone(zone_update_t *update, conf_t *conf, bool incremental)
+int knot_dnssec_validate_zone(zone_update_t *update, conf_t *conf, knot_time_t now, bool incremental)
 {
 	kdnssec_ctx_t ctx = { 0 };
 	int ret = kdnssec_validation_ctx(conf, &ctx, update->new_cont);
+	if (now != 0) {
+		ctx.now = now;
+	}
 	if (ret == KNOT_EOK) {
 		ret = knot_zone_check_nsec_chain(update, &ctx, incremental);
 	}

src/knot/dnssec/zone-events.h

@@ -126,8 +126,9 @@ knot_time_t knot_dnssec_failover_delay(const kdnssec_ctx_t *ctx);
  *
  * \param update         Zone update with contents.
  * \param conf           Knot configuration.
+ * \param now            If not zero: adjust "now" to this timestamp.
  * \param incremental    Try to validate incrementally.
  *
  * \return KNOT_E*
  */
-int knot_dnssec_validate_zone(zone_update_t *update, conf_t *conf, bool incremental);
+int knot_dnssec_validate_zone(zone_update_t *update, conf_t *conf, knot_time_t now, bool incremental);

src/knot/updates/zone-update.c

@@ -921,7 +921,7 @@ int zone_update_commit(conf_t *conf, zone_update_t *update)
 		bool incr_valid = update->flags & UPDATE_INCREMENTAL;
 		const char *msg_valid = incr_valid ? "incremental " : "";
 
-		ret = knot_dnssec_validate_zone(update, conf, incr_valid);
+		ret = knot_dnssec_validate_zone(update, conf, 0, incr_valid);
 		if (ret != KNOT_EOK) {
 			log_zone_error(update->zone->name, "DNSSEC, %svalidation failed (%s)",
 			               msg_valid, knot_strerror(ret));

src/utils/common/msg.h

@@ -39,3 +39,4 @@ int msg_debug(const char *fmt, ...);
 
 #define ERR2(msg, ...)	{ fprintf(stderr, "Error: "   msg, ##__VA_ARGS__); fflush(stderr); }
 #define WARN2(msg, ...)	{ fprintf(stderr, "Warning: " msg, ##__VA_ARGS__); fflush(stderr); }
+#define INFO2(msg, ...)	{ fprintf(stdout,             msg, ##__VA_ARGS__); fflush(stdout); }

src/utils/kzonesign/main.c

@@ -20,6 +20,7 @@
 #include "knot/dnssec/zone-events.h"
 #include "knot/updates/zone-update.h"
 #include "knot/server/server.h"
+#include "knot/zone/adjust.h"
 #include "knot/zone/zone-load.h"
 #include "knot/zone/zonefile.h"
 #include "utils/common/msg.h"
@@ -40,6 +41,7 @@ static void print_help(void)
 	       "                           (default %s)\n"
 	       " -o, --outdir <dir_name>  Output directory.\n"
 	       " -r, --rollover           Allow key rollovers and NSEC3 re-salt.\n"
+	       " -v, --verify             Only verify if zone is signed correctly.\n"
 	       " -t, --time <timestamp>   Current time specification.\n"
 	       "                           (default current UNIX time)\n"
 	       " -h, --help               Print the program help.\n"
@@ -54,6 +56,7 @@ typedef struct {
 	const char *outdir;
 	zone_sign_roll_flags_t rollover;
 	int64_t timestamp;
+	bool verify;
 } sign_params_t;
 
 static int zonesign(sign_params_t *params)
@@ -98,6 +101,30 @@ static int zonesign(sign_params_t *params)
 		goto fail;
 	}
 
+	if (params->verify) {
+		val = conf_zone_get(conf(), C_ADJUST_THR, params->zone_name);
+		ret = zone_adjust_full(up.new_cont, conf_int(&val));
+		if (ret != KNOT_EOK) {
+			ERR2("failed to adjust the zone (%s)\n", knot_strerror(ret));
+			zone_update_clear(&up);
+			goto fail;
+		}
+
+		ret = knot_dnssec_validate_zone(&up, conf(), params->timestamp, false);
+		if (ret != KNOT_EOK) {
+			ERR2("DNSSEC validation failed (%s)\n", knot_strerror(ret));
+			char name_str[KNOT_DNAME_TXT_MAXLEN], type_str[16];
+			if (knot_dname_to_str(name_str, up.validation_hint.node, sizeof(name_str)) != NULL &&
+			    knot_rrtype_to_string(up.validation_hint.rrtype, type_str, sizeof(type_str)) >= 0) {
+				ERR2("affected node: '%s' type '%s'\n", name_str, type_str);
+			}
+		} else {
+			INFO2("DNSSEC validation successful\n");
+		}
+		zone_update_clear(&up);
+		goto fail;
+	}
+
 	kasp_db_ensure_init(&fake_server.kaspdb, conf());
 	zone_struct->server = &fake_server;
 
@@ -166,6 +193,7 @@ int main(int argc, char *argv[])
 		{ "confdb",    required_argument, NULL, 'C' },
 		{ "outdir",    required_argument, NULL, 'o' },
 		{ "rollover",  no_argument,       NULL, 'r' },
+		{ "verify" ,   no_argument,       NULL, 'v' },
 		{ "time",      required_argument, NULL, 't' },
 		{ "help",      no_argument,       NULL, 'h' },
 		{ "version",   no_argument,       NULL, 'V' },
@@ -175,7 +203,7 @@ int main(int argc, char *argv[])
 	tzset();
 
 	int opt = 0;
-	while ((opt = getopt_long(argc, argv, "c:C:o:rt:hV", opts, NULL)) != -1) {
+	while ((opt = getopt_long(argc, argv, "c:C:o:rvt:hV", opts, NULL)) != -1) {
 		switch (opt) {
 		case 'c':
 			if (util_conf_init_file(optarg) != KNOT_EOK) {
@@ -193,6 +221,9 @@ int main(int argc, char *argv[])
 		case 'r':
 			params.rollover = KEY_ROLL_ALLOW_ALL;
 			break;
+		case 'v':
+			params.verify = true;
+			break;
 		case 't':
 			; uint32_t num = 0;
 			if (str_to_u32(optarg, &num) != KNOT_EOK || num == 0) {