1 #! /usr/bin/perl

     2 

     3 use warnings;

     4 use strict;

     5 use FindBin;

     6 

     7 sub del_double {

     8     my %all;

     9     grep { $all{$_} = 0 } @_;

    10     return (keys %all);

    11 }

    12 

    13 sub read_conf {

    14 

    15     # liest die Konfiguration ein

    16     my @configs = ("$FindBin::Bin/dnstools.conf", "/etc/dnstools.conf");

    17     our %config;

    18 

    19     for (grep { -f } @configs) {

    20         open(CONFIG, $_) or die "Can't open $_: $!\n";

    21     }

    22     unless (seek(CONFIG, 0, 0)) {

    23         die "Can't open config (searched: @configs)\n";

    24     }

    25     while (<CONFIG>) {

    26         chomp;

    27         s/#.*//;

    28         s/\t//g;

    29         s/\s//g;

    30 

    31         next unless length;

    32         my ($cname, $ccont) = split(/\s*=\s*/, $_, 2);

    33         $config{$cname} = $ccont;

    34     }

    35     close(CONFIG);

    36 }

    37 

    38 sub read_argv {

    39 

    40     # wertet argv aus oder gibt die hilfe aus

    41     my $arg = shift @ARGV;

    42     my $zone;

    43     our $do;

    44     our @zones;

    45     our $master_dir;

    46 

    47     if (!defined $arg) {

    48         print " usage: dnssec-keytool <option> zone\n";

    49         print "   -z  erstellt einen neuen ZSK\n";

    50         print "   -k  erstellt je einen neuen ZSK und KSK\n";

    51         print "   -rm loescht das Schluesselmaterial einer Zone\n";

    52         print "   -c  erstellt bei existierenden ksk konfigurationsdateien\n";

    53         print "       fuer die dnstools, sowie einen neuen zsk\n";

    54         print "\n";

    55 

    56         exit;

    57     }

    58     elsif ($arg eq "-k")  { $do = "ksk"; }

    59     elsif ($arg eq "-rm") { $do = "rm"; }

    60     elsif ($arg eq "-c")  { $do = "ck"; }

    61     elsif ($arg eq "-z")  { $do = "zsk"; }

    62     else {

    63         print "keine gueltige Option.\n";

    64         exit;

    65     }

    66 

    67     # prueft die zonen in argv ob es verwaltete zonen sind

    68     for (@ARGV) {

    69         chomp($zone = `idn --quiet "$_"`);

    70         if (-e "$master_dir/$zone/$zone") {

    71             push @zones, $zone;

    72         }

    73     }

    74 }

    75 

    76 sub rm_keys {

    77     # loescht alle schluessel wenn -rm uebergeben wurde

    78     our @zones;

    79     our $master_dir;

    80     my $zone;

    81     my @new_zone_content;

    82     my @old_zone_content;

    83 

    84     for (@zones) {

    85         $zone = $_;

    86 

    87         my $zpf = "$master_dir/$zone";

    88         my $ep  = 0;

    89 

    90         if (-e "$zpf/$zone.signed") {

    91             unlink "$zpf/$zone.signed" and $ep = 1;

    92         }

    93         if (-e "$zpf/.keycounter") {

    94             unlink "$zpf/.keycounter" and $ep = 1;

    95         }

    96         if (-e "$zpf/.index.ksk") {

    97             unlink "$zpf/.index.ksk" and $ep = 1;

    98         }

    99         if (-e "$zpf/.index.zsk") {

   100             unlink "$zpf/.index.zsk" and $ep = 1;

   101         }

   102         if (-e "$zpf/dsset-$zone.") {

   103             unlink "$zpf/dsset-$zone." and $ep = 1;

   104         }

   105         if (-e "$zpf/keyset-$zone.") {

   106             unlink "$zpf/keyset-$zone." and $ep = 1;

   107         }

   108 

   109         for (glob("$zpf/K$zone*")) { 

   110             chomp($_);

   111             unlink ("$_");

   112         }

   113 

   114         if ($ep == 1) {

   115             print " * $zone: schluesselmaterial entfernt\n";

   116         }

   117 

   118         open(ZONE, "$zpf/$zone")

   119           or die "$zpf/$zone: $!\n";

   120         @old_zone_content = <ZONE>;

   121         close(ZONE);

   122 

   123         for (@old_zone_content) {

   124             unless (m#\$INCLUDE.*\"K$zone.*\.key\"#) {

   125                 push @new_zone_content, $_;

   126             }

   127         }

   128 

   129         open(ZONE, ">$zpf/$zone") or die "$zpf/$zone: $!\n";

   130         print ZONE @new_zone_content;

   131         close(ZONE);

   132     }

   133 }

   134 

   135 sub creat_ksk {

   136     our @zones;

   137     our $master_dir;

   138     my @index;

   139     my $zone;

   140     my $keyname;

   141     my $zpf;

   142 

   143     for (@zones) {

   144         $zone = $_;

   145         $zpf  = "$master_dir/$zone";

   146 

   147         chdir "$zpf" or die "$zpf: $!\n";

   148         $keyname = `dnssec-keygen -a RSASHA1 -b 2048 -f KSK -n ZONE $zone`;

   149 

   150         unless (-f ".index.ksk") { @index = (); }

   151         else {

   152             open(INDEX, ".index.ksk") or die "$zpf/.index.ksk: $!\n";

   153             @index = <INDEX>;

   154             close(INDEX);

   155         }

   156 

   157         push @index, $keyname;

   158         if (@index > 2) { shift(@index); }

   159 

   160         open(INDEX, ">.index.ksk") or die "$zpf/.index.ksk: $!\n";

   161         print INDEX @index;

   162         close(INDEX);

   163 

   164         chomp($keyname);

   165         print " * $zone: neuer KSK $keyname\n";

   166 

   167         print "!! DER KSK muss veroeffentlicht werden !! \n";

   168 

   169     }

   170 }

   171 

   172 sub creat_zsk {

   173     our @zones;

   174     our $master_dir;

   175     my @index;

   176     my $zone;

   177     my $keyname;

   178     my $zpf;

   179 

   180     for (@zones) {

   181         $zone = $_;

   182         $zpf  = "$master_dir/$zone";

   183 

   184         chdir "$zpf" or die "$zpf: $!\n";

   185         $keyname = `dnssec-keygen -a RSASHA1 -b 512 -n ZONE $zone`;

   186 

   187         unless (-f ".index.zsk") { @index = (); }

   188         else {

   189             open(INDEX, ".index.zsk") or die "$zpf/.index.zsk: $!\n";

   190             @index = <INDEX>;

   191             close(INDEX);

   192         }

   193 

   194         push @index, $keyname;

   195         if (@index > 2) { shift(@index); }

   196 

   197         open(INDEX, ">.index.zsk") or die "$zpf/.index.zsk: $!\n";

   198         print INDEX @index;

   199         close(INDEX);

   200 

   201         chomp($keyname);

   202         print " * $zone: neuer ZSK $keyname\n";

   203 

   204         open(KC, ">.keycounter") or die "$zpf/keycounter: $!\n";

   205         print KC "0";

   206         close(KC);

   207 

   208     }

   209 }

   210 

   211 sub ck_zone {

   212     our @zones;

   213     our $master_dir;

   214     my $zone;

   215 

   216     for (@zones) {

   217         $zone = $_;

   218         my $zpf = "$master_dir/$zone";

   219         my $keyfile;

   220         my @content;

   221         my @keylist;

   222 

   223         for (<$zpf/*>) {

   224             if (m#(K$zone.*\.key)#) {

   225                 $keyfile = $1;

   226                 open(KEYFILE, "<$zpf/$keyfile");

   227                 @content = <KEYFILE>;

   228                 close(KEYFILE);

   229                 for (@content) {

   230                     if (m#DNSKEY.257#) {

   231                         push @keylist, $keyfile;

   232                     }

   233                 }

   234             }

   235         }

   236 

   237         open(INDEX, ">.index.ksk") or die "$zpf/.index.ksk: $!\n";

   238         for (@keylist) {

   239             s#\.key##;

   240             print INDEX "$_\n";

   241         }

   242         close(INDEX);

   243 

   244         print " * $zone: neue .index.ksk erzeugt\n";

   245 

   246         if (-f "$zpf/.index.zsk") {

   247             unlink("$zpf/.index.zsk") or die "$zpf/.index.zsk: $!\n";

   248         }

   249     }

   250 }

   251 

   252 sub post_creat {

   253     our @zones;

   254     our $master_dir;

   255 

   256     for (@zones) {

   257         my $zone = $_;

   258         `touch $master_dir/$zone/$zone`;

   259 

   260         &kill_useless_keys($zone);

   261         &key_to_zonefile($zone);

   262     }

   263 

   264 }

   265 

   266 sub kill_useless_keys {

   267 

   268     # die funktion loescht alle schluessel die nicht in der index.zsk

   269     # der uebergebenen zone stehen

   270     our $master_dir;

   271     my $zone    = $_[0];

   272     my @keylist = ();

   273     my $zpf     = "$master_dir/$zone";

   274 

   275     open(INDEX, "<$zpf/.index.zsk") or die "$zpf/.index.zsk: $!\n";

   276     @keylist = <INDEX>;

   277     close(INDEX);

   278     open(INDEX, "<$zpf/.index.ksk") or die "$zpf/.index.ksk: $!\n";

   279     push @keylist, <INDEX>;

   280 

   281     # kuerzt die schluessel-bezeichnung aus der indexdatei auf die id um sie

   282     # besser vergleichen zu koennen.

   283     for (@keylist) {

   284         chomp;

   285         s#K.*\+.*\+(.*)#$1#;

   286     }

   287 

   288     # prueft alle schluesseldateien (ksk, zsk), ob sie in der jeweiligen

   289     # indexdatei beschrieben sind. wenn nicht werden sie geloescht.

   290     for ( glob("$master_dir/$zone/K*") {

   291         chomp;

   292         my $file     = $_;

   293         my $rm_count = 1;

   294         my $keyname;

   295         for (@keylist) {

   296             if ($file =~ /$_/) { $rm_count = 0; }

   297         }

   298         if ($rm_count == 1) {

   299             unlink "$file";

   300             if ($file =~ /$zpf\/(.*\.key)/) {

   301                 print " * $zone: Schluessel $1 entfernt \n";

   302             }

   303         }

   304     }

   305 }

   306 

   307 sub key_to_zonefile {

   308 

   309     # die funktion fugt alle schluessel in eine zonedatei

   310     our $master_dir;

   311     my $zone = $_[0];

   312     my $zpf  = "$master_dir/$zone";

   313     my @old_content;

   314     my @new_content = ();

   315 

   316     open(ZONEFILE, "<$zpf/$zone");

   317     @old_content = <ZONEFILE>;

   318     close(ZONEFILE);

   319 

   320     for (@old_content) {

   321         unless (m#INCLUDE.*key#) { push @new_content, $_; }

   322     }

   323 

   324     for (<$zpf/*>) {

   325         if (m#(.*\/)(K.*\.key)#) {

   326             push @new_content, "\$INCLUDE \"$2\"\n";

   327         }

   328     }

   329     open(ZONEFILE, ">$zpf/$zone") or die "$zpf/$zone: $!\n";

   330     print ZONEFILE @new_content;

   331     close(ZONEFILE);

   332 }

   333 

   334 &read_conf;

   335 

   336 our %config;

   337 our $do;       # arbeitsschritte aus argv

   338 our @zones;    # liste der zonen in argv

   339 our $master_dir      = $config{master_dir};

   340 our $bind_dir        = $config{bind_dir};

   341 our $conf_dir        = $config{zone_conf_dir};

   342 our $sign_alert_time = $config{sign_alert_time};

   343 our $indexzone       = $config{indexzone};

   344 our $key_counter_end = $config{key_counter_end};

   345 our $ablauf_zeit     = $config{abl_zeit};

   346 

   347 &read_argv;

   348 

   349 unless (@zones) { exit; }    # beendet das programm, wurden keine

   350                              # gueltigen zonen uebergeben

   351 

   352 if ($do eq "rm") { &rm_keys; exit; }

   353 if ($do eq "ck") { &ck_zone; }

   354 if ($do eq "ksk") { &creat_ksk; }

   355 

   356 &creat_zsk;

   357 &post_creat;

   358 

   359 __END__

   360 

   361 =pod

   362 

   363 =head1 TITLE

   364 

   365 dnssec-keytool

   366 

   367 =head1 SYNTAX

   368 

   369 dnssec-keytool <option> zone

   370 

   371 =head1 BESCHREIBUNG