dnssec-keytool.pl
changeset 51 d4e31a2d4b5c
parent 46 de6761ce0d5b
child 53 291588cb5e84
equal deleted inserted replaced
47:31f29baca131 51:d4e31a2d4b5c
    10     return (keys %all);
    10     return (keys %all);
    11 }
    11 }
    12 
    12 
    13 sub read_conf {
    13 sub read_conf {
    14 
    14 
    15     # liest die Konfiguration ein
    15     # read configuration
    16     my @configs = ("$FindBin::Bin/dnstools.conf", "/etc/dnstools.conf");
    16     my @configs = ("$FindBin::Bin/dnstools.conf", "/etc/dnstools.conf");
    17     our %config;
    17     our %config;
    18 
    18 
    19     for (grep { -f } @configs) {
    19     for (grep { -f } @configs) {
    20         open(CONFIG, $_) or die "Can't open $_: $!\n";
    20         open(CONFIG, $_) or die "Can't open $_: $!\n";
    34     }
    34     }
    35     close(CONFIG);
    35     close(CONFIG);
    36 }
    36 }
    37 
    37 
    38 sub read_argv {
    38 sub read_argv {
    39 
    39     # evaluate argv or print the help
    40     # wertet argv aus oder gibt die hilfe aus
       
    41     my $arg = shift @ARGV;
    40     my $arg = shift @ARGV;
    42     my $zone;
    41     my $zone;
    43     our $do;
    42     our $do;
    44     our @zones;
    43     our @zones;
    45     our $master_dir;
    44     our $master_dir;
    46 
    45 
    47     if (!defined $arg) {
    46     if (!defined $arg) {
    48         print " usage: dnssec-keytool <option> zone\n";
    47         print " usage: dnssec-keytool <option> zone\n";
    49         print "   -z  erstellt einen neuen ZSK\n";
    48         print "   -z  created a new ZSK\n";
    50         print "   -k  erstellt je einen neuen ZSK und KSK\n";
    49         print "   -k  created a new ZSK and KSK\n";
    51         print "   -rm loescht das Schluesselmaterial einer Zone\n";
    50         print "   -rm deletes the key-set of a zone\n";
    52         print "   -c  erstellt bei existierenden ksk konfigurationsdateien\n";
    51         print "   -c  created configuration files for the dnstools\n";
    53         print "       fuer die dnstools, sowie einen neuen zsk\n";
    52         print "       and a new ZSK for an existing KSK\n";
    54         print "\n";
    53         print "\n";
    55 
    54 
    56         exit;
    55         exit;
    57     }
    56     }
    58     elsif ($arg eq "-k")  { $do = "ksk"; }
    57     elsif ($arg eq "-k")  { $do = "ksk"; }
    59     elsif ($arg eq "-rm") { $do = "rm"; }
    58     elsif ($arg eq "-rm") { $do = "rm"; }
    60     elsif ($arg eq "-c")  { $do = "ck"; }
    59     elsif ($arg eq "-c")  { $do = "ck"; }
    61     elsif ($arg eq "-z")  { $do = "zsk"; }
    60     elsif ($arg eq "-z")  { $do = "zsk"; }
    62     else {
    61     else {
    63         print "keine gueltige Option.\n";
    62         print "not a valid option.\n";
    64         exit;
    63         exit;
    65     }
    64     }
    66 
    65 
    67     # prueft die zonen in argv ob es verwaltete zonen sind
    66     # checks the zones in argv if there are managed zones
    68     for (@ARGV) {
    67     for (@ARGV) {
    69         chomp($zone = `idn --quiet "$_"`);
    68         chomp($zone = `idn --quiet "$_"`);
    70         if (-e "$master_dir/$zone/$zone") {
    69         if (-e "$master_dir/$zone/$zone") {
    71             push @zones, $zone;
    70             push @zones, $zone;
    72         }
    71         }
    73     }
    72     }
    74 }
    73 }
    75 
    74 
    76 sub rm_keys {
    75 sub rm_keys {
    77     # loescht alle schluessel wenn -rm uebergeben wurde
    76     # deletes all the keys were handed over -rm in argv
    78     our @zones;
    77     our @zones;
    79     our $master_dir;
    78     our $master_dir;
    80     my $zone;
    79     my $zone;
    81     my @new_zone_content;
    80     my @new_zone_content;
    82     my @old_zone_content;
    81     my @old_zone_content;
   110             chomp($_);
   109             chomp($_);
   111             unlink ("$_");
   110             unlink ("$_");
   112         }
   111         }
   113 
   112 
   114         if ($ep == 1) {
   113         if ($ep == 1) {
   115             print " * $zone: schluesselmaterial entfernt\n";
   114             print " * $zone: removed key-set\n";
   116         }
   115         }
   117 
   116 
   118         open(ZONE, "$zpf/$zone")
   117         open(ZONE, "$zpf/$zone")
   119           or die "$zpf/$zone: $!\n";
   118           or die "$zpf/$zone: $!\n";
   120         @old_zone_content = <ZONE>;
   119         @old_zone_content = <ZONE>;
   160         open(INDEX, ">.index.ksk") or die "$zpf/.index.ksk: $!\n";
   159         open(INDEX, ">.index.ksk") or die "$zpf/.index.ksk: $!\n";
   161         print INDEX @index;
   160         print INDEX @index;
   162         close(INDEX);
   161         close(INDEX);
   163 
   162 
   164         chomp($keyname);
   163         chomp($keyname);
   165         print " * $zone: neuer KSK $keyname\n";
   164         print " * $zone: new KSK $keyname\n";
   166 
   165 
   167         print "!! DER KSK muss veroeffentlicht werden !! \n";
   166         print "!! THE KSK must be published !! \n";
   168 
   167 
   169     }
   168     }
   170 }
   169 }
   171 
   170 
   172 sub creat_zsk {
   171 sub creat_zsk {
   197         open(INDEX, ">.index.zsk") or die "$zpf/.index.zsk: $!\n";
   196         open(INDEX, ">.index.zsk") or die "$zpf/.index.zsk: $!\n";
   198         print INDEX @index;
   197         print INDEX @index;
   199         close(INDEX);
   198         close(INDEX);
   200 
   199 
   201         chomp($keyname);
   200         chomp($keyname);
   202         print " * $zone: neuer ZSK $keyname\n";
   201         print " * $zone: new ZSK $keyname\n";
   203 
   202 
   204         open(KC, ">.keycounter") or die "$zpf/keycounter: $!\n";
   203         open(KC, ">.keycounter") or die "$zpf/keycounter: $!\n";
   205         print KC "0";
   204         print KC "0";
   206         close(KC);
   205         close(KC);
   207 
   206 
   239             s#\.key##;
   238             s#\.key##;
   240             print INDEX "$_\n";
   239             print INDEX "$_\n";
   241         }
   240         }
   242         close(INDEX);
   241         close(INDEX);
   243 
   242 
   244         print " * $zone: neue .index.ksk erzeugt\n";
   243         print " * $zone: new .index.ksk created\n";
   245 
   244 
   246         if (-f "$zpf/.index.zsk") {
   245         if (-f "$zpf/.index.zsk") {
   247             unlink("$zpf/.index.zsk") or die "$zpf/.index.zsk: $!\n";
   246             unlink("$zpf/.index.zsk") or die "$zpf/.index.zsk: $!\n";
   248         }
   247         }
   249     }
   248     }
   263 
   262 
   264 }
   263 }
   265 
   264 
   266 sub kill_useless_keys {
   265 sub kill_useless_keys {
   267 
   266 
   268     # die funktion loescht alle schluessel die nicht in der index.zsk
   267     # the function deletes all keys that are not available in the zone
   269     # der uebergebenen zone stehen
   268     # of index.zsk
   270     our $master_dir;
   269     our $master_dir;
   271     my $zone    = $_[0];
   270     my $zone    = $_[0];
   272     my @keylist = ();
   271     my @keylist = ();
   273     my $zpf     = "$master_dir/$zone";
   272     my $zpf     = "$master_dir/$zone";
   274 
   273 
   276     @keylist = <INDEX>;
   275     @keylist = <INDEX>;
   277     close(INDEX);
   276     close(INDEX);
   278     open(INDEX, "<$zpf/.index.ksk") or die "$zpf/.index.ksk: $!\n";
   277     open(INDEX, "<$zpf/.index.ksk") or die "$zpf/.index.ksk: $!\n";
   279     push @keylist, <INDEX>;
   278     push @keylist, <INDEX>;
   280 
   279 
   281     # kuerzt die schluessel-bezeichnung aus der indexdatei auf die id um sie
   280     # shortened the key name from the index file on the id in order to
   282     # besser vergleichen zu koennen.
   281     # be able to compare
   283     for (@keylist) {
   282     for (@keylist) {
   284         chomp;
   283         chomp;
   285         s#K.*\+.*\+(.*)#$1#;
   284         s#K.*\+.*\+(.*)#$1#;
   286     }
   285     }
   287 
   286 
   288     # prueft alle schluesseldateien (ksk, zsk), ob sie in der jeweiligen
   287     # reviewed every key file (KSK, ZSK), whether they are described in
   289     # indexdatei beschrieben sind. wenn nicht werden sie geloescht.
   288     # the respective index file. if not they will be deleted.
   290     for ( glob("$master_dir/$zone/K*") {
   289     for ( glob("$master_dir/$zone/K*") {
   291         chomp;
   290         chomp;
   292         my $file     = $_;
   291         my $file     = $_;
   293         my $rm_count = 1;
   292         my $rm_count = 1;
   294         my $keyname;
   293         my $keyname;
   304     }
   303     }
   305 }
   304 }
   306 
   305 
   307 sub key_to_zonefile {
   306 sub key_to_zonefile {
   308 
   307 
   309     # die funktion fugt alle schluessel in eine zonedatei
   308     # the function added all keys to the indexfile
   310     our $master_dir;
   309     our $master_dir;
   311     my $zone = $_[0];
   310     my $zone = $_[0];
   312     my $zpf  = "$master_dir/$zone";
   311     my $zpf  = "$master_dir/$zone";
   313     my @old_content;
   312     my @old_content;
   314     my @new_content = ();
   313     my @new_content = ();
   332 }
   331 }
   333 
   332 
   334 &read_conf;
   333 &read_conf;
   335 
   334 
   336 our %config;
   335 our %config;
   337 our $do;       # arbeitsschritte aus argv
   336 our $do;       # statements from argv
   338 our @zones;    # liste der zonen in argv
   337 our @zones;    # list of zones from argv
   339 our $master_dir      = $config{master_dir};
   338 our $master_dir      = $config{master_dir};
   340 our $bind_dir        = $config{bind_dir};
   339 our $bind_dir        = $config{bind_dir};
   341 our $conf_dir        = $config{zone_conf_dir};
   340 our $conf_dir        = $config{zone_conf_dir};
   342 our $sign_alert_time = $config{sign_alert_time};
   341 our $sign_alert_time = $config{sign_alert_time};
   343 our $indexzone       = $config{indexzone};
   342 our $indexzone       = $config{indexzone};
   344 our $key_counter_end = $config{key_counter_end};
   343 our $key_counter_end = $config{key_counter_end};
   345 our $ablauf_zeit     = $config{abl_zeit};
   344 our $ablauf_zeit     = $config{abl_zeit};
   346 
   345 
   347 &read_argv;
   346 &read_argv;
   348 
   347 
   349 unless (@zones) { exit; }    # beendet das programm, wurden keine
   348 # completed the program, if not a valid zones was handed over
   350                              # gueltigen zonen uebergeben
   349 unless (@zones) { exit; }
   351 
   350 
   352 if ($do eq "rm") { &rm_keys; exit; }
   351 if ($do eq "rm") { &rm_keys; exit; }
   353 if ($do eq "ck") { &ck_zone; }
   352 if ($do eq "ck") { &ck_zone; }
   354 if ($do eq "ksk") { &creat_ksk; }
   353 if ($do eq "ksk") { &creat_ksk; }
   355 
   354 
   358 
   357 
   359 __END__
   358 __END__
   360 
   359 
   361 =pod
   360 =pod
   362 
   361 
   363 =head1 TITLE
   362 =head1 NAME
   364 
   363 
   365 dnssec-keytool
   364 dnssec-keytool
   366 
   365 
   367 =head1 SYNTAX
   366 =head1 SYNOPSIS
   368 
   367 
   369 dnssec-keytool <option> zone
   368 dnssec-keytool <option> zone
   370 
   369 
   371 =head1 BESCHREIBUNG
   370 =head1 DESCRIPTION