unbound-host shows security info.

git-svn-id: file:///svn/unbound/trunk@811 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 792a57a8eb87a9239df303f261c23ef6518b8996..07fcf62415f237c91cc17b735a5f35f3965610d9 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,8 @@
        - library resolution works in foreground mode, unbound-host app
          receives data.
        - unbound-host prints rdata using ldns.
+       - unbound-host accepts trust anchors, and prints validation
+         information when you give -v.
 
 5 December 2007: Wouter
        - locking in context_new() inside the function.

diff --git a/libunbound/ubsyms.def b/libunbound/ubsyms.def
index d984cdf4deb500c8777d0d111825fc52edaa4857..966c2bc28eda37ce8a183de9bccf842e8be2dc45 100644 (file)
--- a/libunbound/ubsyms.def
+++ b/libunbound/ubsyms.def
@@ -2,6 +2,7 @@ ub_val_ctx_create
 ub_val_ctx_delete
 ub_val_ctx_config
 ub_val_ctx_add_ta
+ub_val_ctx_add_ta_file
 ub_val_ctx_trustedkeys
 ub_val_ctx_async
 ub_val_ctx_poll

diff --git a/libunbound/unbound.c b/libunbound/unbound.c
index 3bb3d55a4756854c4c04d418ccc2034a521e5f5b..ea02141bf56ea0ff5455e334313b34d267c8dc16 100644 (file)
--- a/libunbound/unbound.c
+++ b/libunbound/unbound.c
@@ -183,6 +183,25 @@ ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta)
        return UB_NOERROR;
 }
 
+int 
+ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname)
+{
+       char* dup = strdup(fname);
+       if(!dup) return UB_NOMEM;
+       lock_basic_lock(&ctx->cfglock);
+       if(ctx->finalized) {
+               lock_basic_unlock(&ctx->cfglock);
+               return UB_AFTERFINAL;
+       }
+       if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_file_list, dup)) {
+               lock_basic_unlock(&ctx->cfglock);
+               free(dup);
+               return UB_NOMEM;
+       }
+       lock_basic_unlock(&ctx->cfglock);
+       return UB_NOERROR;
+}
+
 int 
 ub_val_ctx_trustedkeys(struct ub_val_ctx* ctx, char* fname)
 {

diff --git a/libunbound/unbound.h b/libunbound/unbound.h
index 8efab283ee586670a04aeb6024f96443dfae8d14..7f2538c91a0452fb1793b304aadc24c36c082079 100644 (file)
--- a/libunbound/unbound.h
+++ b/libunbound/unbound.h
@@ -218,7 +218,18 @@ int ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta);
 
 /**
  * Add trust anchors to the given context.
- * The trust anchor the name of a bind-style config file with trusted-keys{}.
+ * Pass name of a file with DS and DNSKEY records (like from dig or drill).
+ * @param ctx: context.
+ *     At this time it is only possible to add trusted keys before the
+ *     first resolve is done.
+ * @param fname: filename of file with keyfile with trust anchors.
+ * @return 0 if OK, else error.
+ */
+int ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname);
+
+/**
+ * Add trust anchors to the given context.
+ * Pass the name of a bind-style config file with trusted-keys{}.
  * @param ctx: context.
  *     At this time it is only possible to add trusted keys before the
  *     first resolve is done.

diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index 00e9e37a8106118d5fc6ff3f0cdc6bccc354eafe..9d6594a987fd204ca1f3deee8fed6bfe2fd06ab4 100644 (file)
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -52,13 +52,19 @@ static void
 usage()
 {
        printf("Usage:  unbound-host [-c class] [-t type] hostname\n");
+       printf("                     [-y key] [-f keyfile] [-F named.conf]\n");
        printf("  Queries the DNS for information.\n");
        printf("  The hostname is looked up for IP4, IP6 and mail.\n");
        printf("  If an ip-address is given a reverse lookup is done.\n");
-       printf("-t type         what type to look for.\n");
-       printf("-c class        what class to look for, if not class IN.\n");
-       printf("-v              be more verbose.\n");
-       printf("-h              show this usage help.\n");
+       printf("  Use the -v option to see DNSSEC security information.\n");
+       printf("    -t type             what type to look for.\n");
+       printf("    -c class            what class to look for, if not class IN.\n");
+       printf("    -y 'keystring'      specify trust anchor, DS or DNSKEY, like\n");
+       printf("                        -y 'example.com DS 31560 5 1 1CFED8478...'\n");
+       printf("    -f keyfile          read trust anchors from file, with lines as -y.\n");
+       printf("    -F keyfile          read named.conf-style trust anchors.\n");
+       printf("    -v                  be more verbose, shows nodata and security.\n");
+       printf("    -h                  show this usage help.\n");
        printf("Version %s\n", PACKAGE_VERSION);
        printf("BSD licensed, see LICENSE in source package for details.\n");
        printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
@@ -256,7 +262,8 @@ pretty_rdata(char* q, char* cstr, char* tstr, int t, const char* sec,
                printf(" domain name pointer");
        else    printf(" has %s record", tstr);
        print_rd(t, data, len);
-       printf(" %s", sec);
+       if(verb > 0)
+               printf(" %s", sec);
        printf("\n");
 }
 
@@ -284,9 +291,21 @@ pretty_output(char* q, int t, int c, int sec, int haved,
                printf("%s is an alias for %s\n", result->qname, 
                        result->canonname);
        if(!haved) {
-               if(verb > 0)
-                       printf("%s %s %s: no data. %s\n",
-                               q, cstr, tstr, secstatus);
+               if(verb > 0) {
+                       printf("%s", q);
+                       if(strcmp(cstr, "IN") != 0)
+                               printf(" in class %s", cstr);
+                       if(t == LDNS_RR_TYPE_A)
+                               printf(" has no address");
+                       else if(t == LDNS_RR_TYPE_AAAA)
+                               printf(" has no IPv6 address");
+                       else if(t == LDNS_RR_TYPE_PTR)
+                               printf(" has no domain name ptr");
+                       else if(t == LDNS_RR_TYPE_MX)
+                               printf(" has no mail handler record");
+                       else    printf(" has no %s record", tstr);
+                       printf(" %s\n", secstatus);
+               }
                /* else: emptiness to indicate no data */
                return;
        }
@@ -321,7 +340,7 @@ dnslook(struct ub_val_ctx* ctx, char* q, int t, int c, int docname)
 
 /** perform host lookup */
 static void
-lookup(const char* nm, const char* qt, const char* qc)
+lookup(struct ub_val_ctx* ctx, const char* nm, const char* qt, const char* qc)
 {
        /* massage input into a query name, type and class */
        int multi = 0;   /* no type, so do A, AAAA, MX */
@@ -331,16 +350,6 @@ lookup(const char* nm, const char* qt, const char* qc)
        int c = massage_class(qc);
 
        /* perform the query */
-       struct ub_val_ctx* ctx = NULL;
-       
-       if(verb>0)
-               printf("lookup %s %d %d reverse=%d multi=%d\n", 
-                       realq, t, c, reverse, multi);
-       ctx = ub_val_ctx_create();
-       if(!ctx) {
-               fprintf(stderr, "error: out of memory\n");
-               exit(1);
-       }
        if(multi) {
                if(!dnslook(ctx, realq, LDNS_RR_TYPE_A, c, 1)) {
                        /* domain exists, lookup more */
@@ -365,8 +374,16 @@ int main(int argc, char* argv[])
        int c;
        char* qclass = NULL;
        char* qtype = NULL;
+       struct ub_val_ctx* ctx = NULL;
+       
+       ctx = ub_val_ctx_create();
+       if(!ctx) {
+               fprintf(stderr, "error: out of memory\n");
+               exit(1);
+       }
+
        /* parse the options */
-       while( (c=getopt(argc, argv, "c:ht:v")) != -1) {
+       while( (c=getopt(argc, argv, "F:c:f:ht:vy:")) != -1) {
                switch(c) {
                case 'c':
                        qclass = optarg;
@@ -377,6 +394,15 @@ int main(int argc, char* argv[])
                case 'v':
                        verb++;
                        break;
+               case 'y':
+                       ub_val_ctx_add_ta(ctx, optarg);
+                       break;
+               case 'f':
+                       ub_val_ctx_add_ta_file(ctx, optarg);
+                       break;
+               case 'F':
+                       ub_val_ctx_trustedkeys(ctx, optarg);
+                       break;
                case '?':
                case 'h':
                default:
@@ -388,6 +414,6 @@ int main(int argc, char* argv[])
        if(argc != 1)
                usage();
 
-       lookup(argv[0], qtype, qclass);
+       lookup(ctx, argv[0], qtype, qclass);
        return 0;
 }