52 fprintf(stderr,
"%s (%s) version %s\n",
53 progname, PACKAGE_NAME, PACKAGE_VERSION);
60 "usage: %s [-c config] [-vVfh] [command [options]]\n",
63 fprintf(stderr,
" -h Print this usage information.\n");
64 fprintf(stderr,
" -v Increase verbosity.\n");
65 fprintf(stderr,
" -V Print version and exit.\n");
66 fprintf(stderr,
" -f Force, Assume yes on all questions.\n");
67 fprintf(stderr,
" -c <cfg> Use alternative conf.xml.\n");
69 fprintf(stderr,
"commands\n");
71 fprintf(stderr,
" login\n");
72 fprintf(stderr,
" logout\n");
73 fprintf(stderr,
" list [repository]\n");
74 fprintf(stderr,
" generate <repository> rsa|dsa|gost|ecdsa [keysize]\n");
75 fprintf(stderr,
" remove <id>\n");
76 fprintf(stderr,
" purge <repository>\n");
77 fprintf(stderr,
" dnskey <id> <name> <type> <algo>\n");
78 fprintf(stderr,
" test <repository>\n");
79 fprintf(stderr,
" info\n");
81 fprintf(stderr,
" debug\n");
88 printf(
"The tokens are now logged in.\n");
97 printf(
"Failed to erase the credentials.\n");
102 printf(
"The credentials has been erased.\n");
107#pragma GCC diagnostic push
108#pragma GCC diagnostic ignored "-Wformat-nonliteral"
110cmd_list (
int argc,
char *argv[])
113 char *repository = NULL;
115 size_t key_count = 0;
116 size_t key_count_valid = 0;
119 const char *key_info_format =
"%-20s %-32s %-10s\n";
124 repository = argv[0];
134 fprintf(stdout,
"\nListing keys in repository: %s\n", repository);
137 fprintf(stdout,
"\nListing keys in all repositories.\n");
141 fprintf(stdout,
"%u %s found.\n\n", (
unsigned int) key_count,
142 (key_count > 1 || key_count == 0 ?
"keys" :
"key"));
149 fprintf(stdout, key_info_format,
"Repository",
"ID",
"Type");
150 fprintf(stdout, key_info_format,
"----------",
"--",
"----");
152 for (i = 0; i < key_count; i++) {
156 char const * key_id = NULL;
169 snprintf(key_type,
sizeof(key_type),
"%s/%lu",
171 key_id = key_info->
id;
173 snprintf(key_type,
sizeof(key_type),
"UNKNOWN");
177 printf(key_info_format, key->
modulename, key_id, key_type);
183 if (key_count != key_count_valid) {
185 invalid_keys = key_count - key_count_valid;
187 fprintf(stderr,
"Warning: %u %s not usable by OpenDNSSEC was found.\n",
188 (
unsigned int) invalid_keys, invalid_keys > 1 ?
"keys" :
"key");
193#pragma GCC diagnostic pop
196cmd_generate (
int argc,
char *argv[])
198 const char *repository = NULL;
200 unsigned int keysize = 1024;
204 if (argc < 2 || argc > 3) {
209 repository = argv[0];
219 keysize = atoi(argv[2]);
223 printf(
"Generating %d bit RSA key in repository: %s\n",
224 keysize, repository);
227 }
else if (!strcasecmp(
algorithm,
"dsa")) {
228 printf(
"Generating %d bit DSA key in repository: %s\n",
229 keysize, repository);
232 }
else if (!strcasecmp(
algorithm,
"gost")) {
233 printf(
"Generating 512 bit GOST key in repository: %s\n",
237 }
else if (!strcasecmp(
algorithm,
"ecdsa")) {
238 if (keysize == 256) {
239 printf(
"Generating a P-256 ECDSA key in repository: %s\n",
243 }
else if (keysize == 384) {
244 printf(
"Generating a P-384 ECDSA key in repository: %s\n",
249 printf(
"Invalid ECDSA key size: %d\n", keysize);
250 printf(
"Expecting 256 or 384.\n");
254 printf(
"Unknown algorithm: %s\n",
algorithm);
262 printf(
"Key generation successful: %s\n",
263 key_info ? key_info->
id :
"NULL");
268 printf(
"Key generation failed.\n");
276cmd_remove (
int argc,
char *argv[])
293 printf(
"Key not found: %s\n",
id);
300 printf(
"Key remove successful.\n");
302 printf(
"Key remove failed.\n");
311cmd_purge (
int argc,
char *argv[],
int force)
314 int final_result = 0;
318 char *repository = NULL;
321 size_t key_count = 0;
329 repository = argv[0];
339 printf(
"Purging all keys from repository: %s\n", repository);
342 printf(
"%u %s found.\n\n", (
unsigned int) key_count,
343 (key_count > 1 || key_count == 0 ?
"keys" :
"key"));
349 if (key_count == 0) {
355 printf(
"Are you sure you want to remove ALL keys from repository %s ? (YES/NO) ", repository);
356 fresult = fgets(confirm,
sizeof(confirm) - 1, stdin);
357 if (fresult == NULL || strncasecmp(confirm,
"yes", 3) != 0) {
358 printf(
"\npurge cancelled.\n");
363 printf(
"\nStarting purge...\n");
365 for (i = 0; i < key_count; i++) {
373 printf(
"Key remove successful: %s\n",
374 key_info ? key_info->
id :
"NULL");
376 printf(
"Key remove failed: %s\n",
377 key_info ? key_info->
id :
"NULL");
385 printf(
"Purge done.\n");
391cmd_dnskey (
int argc,
char *argv[])
407 id = strdup(argv[0]);
408 name = strdup(argv[1]);
409 type = atoi(argv[2]);
410 algo = atoi(argv[3]);
415 printf(
"Key not found: %s\n",
id);
421 if (type != LDNS_KEY_ZONE_KEY && type != LDNS_KEY_ZONE_KEY + LDNS_KEY_SEP_KEY) {
422 printf(
"Invalid key type: %i\n", type);
423 printf(
"Please use: %i or %i\n", LDNS_KEY_ZONE_KEY, LDNS_KEY_ZONE_KEY + LDNS_KEY_SEP_KEY);
432 case LDNS_SIGN_RSAMD5:
433 case LDNS_SIGN_RSASHA1:
434 case LDNS_SIGN_RSASHA1_NSEC3:
435 case LDNS_SIGN_RSASHA256:
436 case LDNS_SIGN_RSASHA512:
438 printf(
"Not an RSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
447 case LDNS_SIGN_DSA_NSEC3:
449 printf(
"Not a DSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
457 case LDNS_SIGN_ECC_GOST:
459 printf(
"Not a GOST key, the key is of algorithm %s.\n", key_info->
algorithm_name);
467 case LDNS_SIGN_ECDSAP256SHA256:
469 printf(
"Not an ECDSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
476 if (key_info->
keysize != 256) {
477 printf(
"The key is a ECDSA/%lu, expecting ECDSA/256 for this algorithm.\n", key_info->
keysize);
485 case LDNS_SIGN_ECDSAP384SHA384:
487 printf(
"Not an ECDSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
494 if (key_info->
keysize != 384) {
495 printf(
"The key is a ECDSA/%lu, expecting ECDSA/384 for this algorithm.\n", key_info->
keysize);
503#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
504 case LDNS_SIGN_ED25519:
506 printf(
"Not an EDDSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
513 if (key_info->
keysize != 255) {
514 printf(
"The key is EDDSA/%lu, expecting EDDSA/255 for this algorithm.\n", key_info->
keysize);
522 case LDNS_SIGN_ED448:
524 printf(
"Not an EDDSA key, the key is of algorithm %s.\n", key_info->
algorithm_name);
531 if (key_info->
keysize != 448) {
532 printf(
"The key is EDDSA/%lu, expecting EDDSA/448 for this algorithm.\n", key_info->
keysize);
542 printf(
"Invalid algorithm: %i\n", algo);
553 sign_params->
flags = type;
554 sign_params->
owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, name);
556 sign_params->
keytag = ldns_calc_keytag(dnskey_rr);
558 ldns_rr_print(stdout, dnskey_rr);
561 ldns_rr_free(dnskey_rr);
572 char *repository = NULL;
575 repository = strdup(argv[0]);
579 printf(
"Testing repository: %s\n\n", repository);
581 if (repository) free(repository);
617 while ((ch = getopt(argc, argv,
"c:vVhf")) != -1) {
650 if (!strcasecmp(argv[0],
"logout")) {
651 if (config) free(config);
659 fprintf(stderr,
"%s\n", error);
666 openlog(
"hsmutil", LOG_PID, LOG_USER);
668 if (!strcasecmp(argv[0],
"login")) {
671 result = cmd_login();
672 }
else if (!strcasecmp(argv[0],
"list")) {
675 result = cmd_list(argc, argv);
676 }
else if (!strcasecmp(argv[0],
"generate")) {
679 result = cmd_generate(argc, argv);
680 }
else if (!strcasecmp(argv[0],
"remove")) {
683 result = cmd_remove(argc, argv);
684 }
else if (!strcasecmp(argv[0],
"purge")) {
687 result = cmd_purge(argc, argv, force);
688 }
else if (!strcasecmp(argv[0],
"dnskey")) {
691 result = cmd_dnskey(argc, argv);
692 }
else if (!strcasecmp(argv[0],
"test")) {
695 result = cmd_test(argc, argv,
ctx);
696 }
else if (!strcasecmp(argv[0],
"info")) {
699 result = cmd_info(
ctx);
700 }
else if (!strcasecmp(argv[0],
"debug")) {
703 result = cmd_debug(
ctx);
711 if (config) free(config);
int hsm_test(const char *repository, hsm_ctx_t *ctx)
int main(int argc, char *argv[])
hsm_repository_t * parse_conf_repositories(const char *cfgfile)
void libhsm_key_list_free(libhsm_key_t **key_list, size_t count)
char * hsm_get_error(hsm_ctx_t *gctx)
void hsm_print_error(hsm_ctx_t *gctx)
libhsm_key_t * hsm_find_key_by_id(hsm_ctx_t *ctx, const char *id)
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
libhsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
libhsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
void hsm_print_key(hsm_ctx_t *ctx, libhsm_key_t *key)
hsm_sign_params_t * hsm_sign_params_new()
void hsm_print_ctx(hsm_ctx_t *ctx)
void libhsm_key_info_free(libhsm_key_info_t *key_info)
libhsm_key_t ** hsm_list_keys_repository(hsm_ctx_t *ctx, size_t *count, const char *repository)
int hsm_open2(hsm_repository_t *rlist, char *(pin_callback)(unsigned int, const char *, unsigned int))
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
libhsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
libhsm_key_t * hsm_generate_ecdsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
int hsm_remove_key(hsm_ctx_t *ctx, libhsm_key_t *key)
void hsm_print_tokeninfo(hsm_ctx_t *ctx)
libhsm_key_info_t * hsm_get_key_info(hsm_ctx_t *ctx, const libhsm_key_t *key)
void hsm_destroy_context(hsm_ctx_t *ctx)
libhsm_key_t ** hsm_list_keys(hsm_ctx_t *ctx, size_t *count)
void libhsm_key_free(libhsm_key_t *key)
void hsm_sign_params_free(hsm_sign_params_t *params)
hsm_ctx_t * hsm_create_context()
char * hsm_prompt_pin(unsigned int id, const char *repository, unsigned int mode)