From 0c91911b4d1e872b87eaf6431ed47fe24d18dd43 Mon Sep 17 00:00:00 2001

From: Mark Andrews <marka@isc.org>

Date: Wed, 4 Sep 2013 13:53:02 +1000

Subject: [PATCH] 3642.   [func]          Allow externally generated DNSKEY to

 be imported                         into the DNSKEY management framework.  A

 new tool                         dnssec-importkey is used to this. [RT

 #34698]

---

 CHANGES                                |   4 +

 bin/dnssec/.gitignore                  |   1 +

 bin/dnssec/Makefile.in                 |   8 +-

 bin/dnssec/dnssec-importkey.8          | 112 +++++++++

 bin/dnssec/dnssec-importkey.c          | 399 +++++++++++++++++++++++++++++++++

 bin/dnssec/dnssec-importkey.docbook    | 185 +++++++++++++++

 bin/dnssec/dnssec-importkey.html       | 112 +++++++++

 bin/dnssec/dnssec-settime.c            |   4 +-

 bin/tests/system/conf.sh.in            |   1 +

 bin/tests/system/inline/clean.sh       |   3 +

 bin/tests/system/inline/ns1/root.db.in |   3 +

 bin/tests/system/inline/ns3/named.conf |   8 +

 bin/tests/system/inline/ns3/sign.sh    |  29 +++

 bin/tests/system/inline/setup.sh       |   1 +

 bin/tests/system/inline/tests.sh       |  17 +-

 lib/dns/dnssec.c                       |  96 ++++----

 lib/dns/dst_api.c                      |  10 +

 lib/dns/dst_internal.h                 |   1 +

 lib/dns/dst_parse.c                    |  63 ++++--

 lib/dns/dst_result.c                   |   2 +-

 lib/dns/include/dns/master.h           |   1 +

 lib/dns/include/dst/dst.h              |   6 +

 lib/dns/master.c                       |   4 +-

 lib/dns/openssldsa_link.c              |  19 ++

 lib/dns/opensslecdsa_link.c            |  53 +++--

 lib/dns/opensslgost_link.c             |  27 ++-

 lib/dns/opensslrsa_link.c              |  18 +-

 lib/dns/zone.c                         |   4 +

 28 files changed, 1108 insertions(+), 83 deletions(-)

 create mode 100644 bin/dnssec/dnssec-importkey.8

 create mode 100644 bin/dnssec/dnssec-importkey.c

 create mode 100644 bin/dnssec/dnssec-importkey.docbook

 create mode 100644 bin/dnssec/dnssec-importkey.html

diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in

index 4f8bceb..ecb0fae 100644

--- a/bin/dnssec/Makefile.in

+++ b/bin/dnssec/Makefile.in

@@ -45,13 +45,13 @@ NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@

 TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \

 		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \

 		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \

-		dnssec-verify@EXEEXT@

+		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@

 OBJS =		dnssectool.@O@

 SRCS =		dnssec-dsfromkey.c dnssec-keyfromlabel.c dnssec-keygen.c \

 		dnssec-revoke.c dnssec-settime.c dnssec-signzone.c \

-		dnssec-verify.c dnssectool.c

+		dnssec-verify.c dnssec-importkey.c dnssectool.c 

 MANPAGES =	dnssec-dsfromkey.8 dnssec-keyfromlabel.8 dnssec-keygen.8 \

 		dnssec-revoke.8 dnssec-settime.8 dnssec-signzone.8 \

@@ -102,6 +102,10 @@ dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}

 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \

 	dnssec-settime.@O@ ${OBJS} ${LIBS}

+dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}

+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \

+	dnssec-importkey.@O@ ${OBJS} ${LIBS}

+

 doc man:: ${MANOBJS}

 docclean manclean maintainer-clean::

diff --git a/bin/dnssec/dnssec-importkey.8 b/bin/dnssec/dnssec-importkey.8

new file mode 100644

index 0000000..33a3ef4

--- /dev/null

+++ b/bin/dnssec/dnssec-importkey.8

@@ -0,0 +1,112 @@

+.\" Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC")

+.\" 

+.\" Permission to use, copy, modify, and/or distribute this software for any

+.\" purpose with or without fee is hereby granted, provided that the above

+.\" copyright notice and this permission notice appear in all copies.

+.\" 

+.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

+.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

+.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

+.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

+.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

+.\" PERFORMANCE OF THIS SOFTWARE.

+.\"

+.\" $Id$

+.\"

+.hy 0

+.ad l

+'\" t

+.\"     Title: dnssec-importkey

+.\"    Author: [see the "AUTHOR" section]

+.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>

+.\"      Date: August 30, 2013

+.\"    Manual: BIND9

+.\"    Source: BIND9

+.\"  Language: English

+.\"

+.TH "DNSSEC\-IMPORTKEY" "8" "August 30, 2013" "BIND9" "BIND9"

+.\" -----------------------------------------------------------------

+.\" * Define some portability stuff

+.\" -----------------------------------------------------------------

+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+.\" http://bugs.debian.org/507673

+.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html

+.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+.ie \n(.g .ds Aq \(aq

+.el       .ds Aq '

+.\" -----------------------------------------------------------------

+.\" * set default formatting

+.\" -----------------------------------------------------------------

+.\" disable hyphenation

+.nh

+.\" disable justification (adjust text to left margin only)

+.ad l

+.\" -----------------------------------------------------------------

+.\" * MAIN CONTENT STARTS HERE *

+.\" -----------------------------------------------------------------

+.SH "NAME"

+dnssec-importkey \- Import DNSKEY records from external systems so they can be managed\&.

+.SH "SYNOPSIS"

+.HP 17

+\fBdnssec\-importkey\fR [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fBkeyname\fR]

+.SH "DESCRIPTION"

+.PP

+\fBdnssec\-importkey\fR

+read a DNSKEY record and generated a \&.key/\&.private key pair\&. Publication (\fB\-P\fR) and deletions (\fB\-D\fR) times can be set for the key\&.

+.SH "OPTIONS"

+.PP

+\-f \fIfilename\fR

+.RS 4

+Filename to read the key from\&.

+.RE

+.PP

+\-K \fIdirectory\fR

+.RS 4

+Sets the directory in which the key files are to reside\&.

+.RE

+.PP

+\-L \fIttl\fR

+.RS 4

+Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. importkey the default TTL to

+0

+or

+none

+removes it\&.

+.RE

+.PP

+\-h

+.RS 4

+Emit usage message and exit\&.

+.RE

+.PP

+\-v \fIlevel\fR

+.RS 4

+Sets the debugging level\&.

+.RE

+.SH "TIMING OPTIONS"

+.PP

+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To unset a date, use \*(Aqnone\*(Aq\&.

+.PP

+\-P \fIdate/offset\fR

+.RS 4

+Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&.

+.RE

+.PP

+\-D \fIdate/offset\fR

+.RS 4

+Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.)

+.RE

+.SH "SEE ALSO"

+.PP

+\fBdnssec-keygen\fR(8),

+\fBdnssec-signzone\fR(8),

+BIND 9 Administrator Reference Manual,

+RFC 5011\&.

+.SH "AUTHOR"

+.PP

+Internet Systems Consortium

+.SH "COPYRIGHT"

+.br

+Copyright \(co 2013 Internet Systems Consortium, Inc. ("ISC")

+.br

diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c

new file mode 100644

index 0000000..3491828

--- /dev/null

+++ b/bin/dnssec/dnssec-importkey.c

@@ -0,0 +1,399 @@

+/*

+ * Copyright (C) 2008-2012  Internet Systems Consortium, Inc. ("ISC")

+ *

+ * Permission to use, copy, modify, and/or distribute this software for any

+ * purpose with or without fee is hereby granted, provided that the above

+ * copyright notice and this permission notice appear in all copies.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

+ * PERFORMANCE OF THIS SOFTWARE.

+ */

+

+/*! \file */

+

+#include <config.h>

+

+#include <stdlib.h>

+

+#include <isc/buffer.h>

+#include <isc/commandline.h>

+#include <isc/entropy.h>

+#include <isc/hash.h>

+#include <isc/mem.h>

+#include <isc/print.h>

+#include <isc/string.h>

+#include <isc/util.h>

+

+#include <dns/callbacks.h>

+#include <dns/db.h>

+#include <dns/dbiterator.h>

+#include <dns/ds.h>

+#include <dns/fixedname.h>

+#include <dns/keyvalues.h>

+#include <dns/log.h>

+#include <dns/master.h>

+#include <dns/name.h>

+#include <dns/rdata.h>

+#include <dns/rdataclass.h>

+#include <dns/rdataset.h>

+#include <dns/rdatasetiter.h>

+#include <dns/rdatatype.h>

+#include <dns/result.h>

+

+#include <dst/dst.h>

+

+#include "dnssectool.h"

+

+#ifndef PATH_MAX

+#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */

+#endif

+

+const char *program = "dnssec-importkey";

+int verbose;

+

+static dns_rdataclass_t rdclass;

+static dns_fixedname_t	fixed;

+static dns_name_t	*name = NULL;

+static isc_mem_t	*mctx = NULL;

+static isc_boolean_t	setpub = ISC_FALSE, setdel = ISC_FALSE;

+static isc_stdtime_t	pub = 0, del = 0;

+

+static isc_result_t

+initname(char *setname) {

+	isc_result_t result;

+	isc_buffer_t buf;

+

+	dns_fixedname_init(&fixed);

+	name = dns_fixedname_name(&fixed);

+

+	isc_buffer_init(&buf, setname, strlen(setname));

+	isc_buffer_add(&buf, strlen(setname));

+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);

+	return (result);

+}

+

+static void

+db_load_from_stream(dns_db_t *db, FILE *fp) {

+	isc_result_t result;

+	dns_rdatacallbacks_t callbacks;

+

+	dns_rdatacallbacks_init(&callbacks);

+	result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private);

+	if (result != ISC_R_SUCCESS)

+		fatal("dns_db_beginload failed: %s", isc_result_totext(result));

+

+	result = dns_master_loadstream(fp, name, name, rdclass, 0,

+				       &callbacks, mctx);

+	if (result != ISC_R_SUCCESS)

+		fatal("can't load from input: %s", isc_result_totext(result));

+

+	result = dns_db_endload(db, &callbacks.add_private);

+	if (result != ISC_R_SUCCESS)

+		fatal("dns_db_endload failed: %s", isc_result_totext(result));

+}

+

+static isc_result_t

+loadset(const char *filename, dns_rdataset_t *rdataset) {

+	isc_result_t	 result;

+	dns_db_t	 *db = NULL;

+	dns_dbnode_t	 *node = NULL;

+	char setname[DNS_NAME_FORMATSIZE];

+

+	dns_name_format(name, setname, sizeof(setname));

+

+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,

+			       rdclass, 0, NULL, &db);

+	if (result != ISC_R_SUCCESS)

+		fatal("can't create database");

+

+	if (strcmp(filename, "-") == 0) {

+		db_load_from_stream(db, stdin);

+		filename = "input";

+	} else {

+		result = dns_db_load3(db, filename, dns_masterformat_text,

+				      DNS_MASTER_NOTTL);

+		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)

+			fatal("can't load %s: %s", filename,

+			      isc_result_totext(result));

+	}

+

+	result = dns_db_findnode(db, name, ISC_FALSE, &node);

+	if (result != ISC_R_SUCCESS)

+		fatal("can't find %s node in %s", setname, filename);

+

+	result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_dnskey,

+				     0, 0, rdataset, NULL);

+

+	if (result == ISC_R_NOTFOUND)

+		fatal("no DNSKEY RR for %s in %s", setname, filename);

+	else if (result != ISC_R_SUCCESS)

+		fatal("dns_db_findrdataset");

+

+	if (node != NULL)

+		dns_db_detachnode(db, &node);

+	if (db != NULL)

+		dns_db_detach(&db);

+	return (result);

+}

+

+static void

+loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,

+	dns_rdata_t *rdata)

+{

+	isc_result_t  result;

+	dst_key_t     *key = NULL;

+	isc_buffer_t  keyb;

+	isc_region_t  r;

+

+	dns_rdata_init(rdata);

+

+	isc_buffer_init(&keyb, key_buf, key_buf_size);

+

+	result = dst_key_fromnamedfile(filename, NULL, DST_TYPE_PUBLIC,

+				       mctx, &key);

+	if (result != ISC_R_SUCCESS)

+		fatal("invalid keyfile name %s: %s",

+		      filename, isc_result_totext(result));

+

+	if (verbose > 2) {

+		char keystr[DST_KEY_FORMATSIZE];

+

+		dst_key_format(key, keystr, sizeof(keystr));

+		fprintf(stderr, "%s: %s\n", program, keystr);

+	}

+

+	result = dst_key_todns(key, &keyb);

+	if (result != ISC_R_SUCCESS)

+		fatal("can't decode key");

+

+	isc_buffer_usedregion(&keyb, &r);

+	dns_rdata_fromregion(rdata, dst_key_class(key),

+			     dns_rdatatype_dnskey, &r);

+

+	rdclass = dst_key_class(key);

+

+	dns_fixedname_init(&fixed);

+	name = dns_fixedname_name(&fixed);

+	result = dns_name_copy(dst_key_name(key), name, NULL);

+	if (result != ISC_R_SUCCESS)

+		fatal("can't copy name");

+

+	dst_key_free(&key);

+}

+

+static void

+emit(const char *dir, dns_rdata_t *rdata) {

+	isc_result_t result;

+	char keystr[DST_KEY_FORMATSIZE];

+	char newname[1024];

+	isc_buffer_t buf;

+	dst_key_t *key = NULL;

+

+	isc_buffer_init(&buf, rdata->data, rdata->length);

+	isc_buffer_add(&buf, rdata->length);

+	result = dst_key_fromdns(name, rdclass, &buf, mctx, &key);

+	if (result != ISC_R_SUCCESS) {

+		fatal("dst_key_fromdns: %s", isc_result_totext(result));

+	}

+

+	dst_key_setexternal(key, ISC_TRUE);

+	if (setpub)

+		dst_key_settime(key, DST_TIME_PUBLISH, pub);

+	if (setdel)

+		dst_key_settime(key, DST_TIME_DELETE, del);

+

+	isc_buffer_init(&buf, newname, sizeof(newname));

+	result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf;;

+	if (result != ISC_R_SUCCESS) {

+		fatal("Failed to build public key filename: %s",

+		      isc_result_totext(result));

+	}

+

+	result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,

+				dir);

+	if (result != ISC_R_SUCCESS) {

+		dst_key_format(key, keystr, sizeof(keystr));

+		fatal("Failed to write key %s: %s", keystr,

+		      isc_result_totext(result));

+	}

+

+	printf("%s\n", newname);

+

+	isc_buffer_clear(&buf;;

+	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf;;

+	if (result != ISC_R_SUCCESS) {

+		fatal("Failed to build private key filename: %s",

+		      isc_result_totext(result));

+	}

+	printf("%s\n", newname);

+	dst_key_free(&key);

+}

+

+ISC_PLATFORM_NORETURN_PRE static void

+usage(void) ISC_PLATFORM_NORETURN_POST;

+

+static void

+usage(void) {

+	fprintf(stderr, "Usage:\n");

+	fprintf(stderr,	"    %s options [-K dir] file\n\n", program);

+	fprintf(stderr, "Version: %s\n", VERSION);

+	fprintf(stderr, "Options:\n");

+	fprintf(stderr, "    -v <verbose level>\n");

+	fprintf(stderr, "    -K <directory>: directory in which to store "

+			"the keyset files\n");

+	fprintf(stderr, "    -f file: read keyset from zone file\n");

+

+	exit (-1);

+}

+

+int

+main(int argc, char **argv) {

+	char		*classname = NULL;

+	char		*filename = NULL, *dir = NULL, *namestr;

+	char		*endp;

+	int		ch;

+	isc_result_t	result;

+	isc_log_t	*log = NULL;

+	isc_entropy_t	*ectx = NULL;

+	dns_rdataset_t	rdataset;

+	dns_rdata_t	rdata;

+	isc_stdtime_t   now;

+

+	dns_rdata_init(&rdata);

+	isc_stdtime_get(&now;;

+

+	if (argc == 1)

+		usage();

+

+	result = isc_mem_create(0, 0, &mctx);

+	if (result != ISC_R_SUCCESS)

+		fatal("out of memory");

+

+	dns_result_register();

+

+	isc_commandline_errprint = ISC_FALSE;

+

+	while ((ch = isc_commandline_parse(argc, argv, "D:f:hK:P:v:")) != -1) {

+		switch (ch) {

+                case 'D':

+                        if (setdel)

+                                fatal("-D specified more than once");

+

+			setdel = ISC_TRUE;

+			del = strtotime(isc_commandline_argument, now, now);

+			break;

+		case 'K':

+			dir = isc_commandline_argument;

+			if (strlen(dir) == 0U)

+				fatal("directory must be non-empty string");

+			break;

+                case 'P':

+                        if (setpub)

+                                fatal("-P specified more than once");

+

+			setpub = ISC_TRUE;

+			pub = strtotime(isc_commandline_argument, now, now);

+                        break;

+		case 'f':

+			filename = isc_commandline_argument;

+			break;

+		case 'v':

+			verbose = strtol(isc_commandline_argument, &endp, 0);

+			if (*endp != '\0')

+				fatal("-v must be followed by a number");

+			break;

+		case '?':

+			if (isc_commandline_option != '?')

+				fprintf(stderr, "%s: invalid argument -%c\n",

+					program, isc_commandline_option);

+			/* FALLTHROUGH */

+		case 'h':

+			usage();

+

+		default:

+			fprintf(stderr, "%s: unhandled option -%c\n",

+				program, isc_commandline_option);

+			exit(1);

+		}

+	}

+

+	rdclass = strtoclass(classname);

+

+	if (argc < isc_commandline_index + 1 && filename == NULL)

+		fatal("the key file name was not specified");

+	if (argc > isc_commandline_index + 1)

+		fatal("extraneous arguments");

+

+	if (ectx == NULL)

+		setup_entropy(mctx, NULL, &ectx);

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not initialize hash");

+	result = dst_lib_init(mctx, ectx,

+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not initialize dst: %s",

+		      isc_result_totext(result));

+	isc_entropy_stopcallbacksources(ectx);

+

+	setup_logging(verbose, mctx, &log;;

+

+	dns_rdataset_init(&rdataset);

+

+	if (filename != NULL) {

+		if (argc < isc_commandline_index + 1 && filename != NULL) {

+			/* using zone name as the zone file name */

+			namestr = filename;

+		} else

+			namestr = argv[isc_commandline_index];

+

+		result = initname(namestr);

+		if (result != ISC_R_SUCCESS)

+			fatal("could not initialize name %s", namestr);

+

+		result = loadset(filename, &rdataset);

+

+		if (result != ISC_R_SUCCESS)

+			fatal("could not load DNSKEY set: %s\n",

+			      isc_result_totext(result));

+

+		for (result = dns_rdataset_first(&rdataset);

+		     result == ISC_R_SUCCESS;

+		     result = dns_rdataset_next(&rdataset)) {

+

+			dns_rdata_init(&rdata);

+			dns_rdataset_current(&rdataset, &rdata);

+			emit(dir, &rdata);

+		}

+	} else {

+		unsigned char key_buf[DST_KEY_MAXSIZE];

+

+		loadkey(argv[isc_commandline_index], key_buf,

+			DST_KEY_MAXSIZE, &rdata);

+

+		emit(dir, &rdata);

+	}

+

+	if (dns_rdataset_isassociated(&rdataset))

+		dns_rdataset_disassociate(&rdataset);

+	cleanup_logging(&log;;

+	dst_lib_destroy();

+	isc_hash_destroy();

+	cleanup_entropy(&ectx);

+	dns_name_destroy();

+	if (verbose > 10)

+		isc_mem_stats(mctx, stdout);

+	isc_mem_destroy(&mctx);

+

+	fflush(stdout);

+	if (ferror(stdout)) {

+		fprintf(stderr, "write error\n");

+		return (1);

+	} else

+		return (0);

+}

diff --git a/bin/dnssec/dnssec-importkey.docbook b/bin/dnssec/dnssec-importkey.docbook

new file mode 100644

index 0000000..b8d160c

--- /dev/null

+++ b/bin/dnssec/dnssec-importkey.docbook

@@ -0,0 +1,185 @@

+

+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

+               []>

+

+ - Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")

+ -

+ - Permission to use, copy, modify, and/or distribute this software for any

+ - purpose with or without fee is hereby granted, provided that the above

+ - copyright notice and this permission notice appear in all copies.

+ -

+ - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

+ - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

+ - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

+ - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

+ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

+ - PERFORMANCE OF THIS SOFTWARE.

+-->

+

+

+<refentry id="man.dnssec-importkey">

+  <refentryinfo>

+    <date>August 30, 2013</date>

+  </refentryinfo>

+

+  <refmeta>

+    <refentrytitle><application>dnssec-importkey</application></refentrytitle>

+    <manvolnum>8</manvolnum>

+    <refmiscinfo>BIND9</refmiscinfo>

+  </refmeta>

+

+  <refnamediv>

+    <refname><application>dnssec-importkey</application></refname>

+    <refpurpose>Import DNSKEY records from external systems so they can be managed.</refpurpose>

+  </refnamediv>

+

+  <docinfo>

+    <copyright>

+      <year>2013</year>

+      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

+    </copyright>

+  </docinfo>

+

+  <refsynopsisdiv>

+    <cmdsynopsis>

+      <command>dnssec-importkey</command>

+      <arg><option>-f <replaceable class="parameter">filename</replaceable></option></arg>

+      <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

+      <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

+      <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

+      <arg><option>-h</option></arg>

+      <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

+      <arg><option>keyname</option></arg>

+    </cmdsynopsis>

+  </refsynopsisdiv>

+

+  <refsect1>

+    <title>DESCRIPTION</title>

+    <para><command>dnssec-importkey</command>

+      read a DNSKEY record and generated a .key/.private key pair.

+      Publication (<option>-P</option>) and deletions (<option>-D</option>)

+      times can be set for the key.

+    </para>

+  </refsect1>

+

+  <refsect1>

+    <title>OPTIONS</title>

+

+    <variablelist>

+      <varlistentry>

+	<term>-f <replaceable class="parameter">filename</replaceable></term>

+        <listitem>

+	  <para>

+	    Filename to read the key from.

+	  </para>

+        </listitem>

+      </varlistentry>

+  

+      <varlistentry>

+        <term>-K <replaceable class="parameter">directory</replaceable></term>

+        <listitem>

+          <para>

+            Sets the directory in which the key files are to reside.

+          </para>

+        </listitem>

+      </varlistentry>

+

+      <varlistentry>

+        <term>-L <replaceable class="parameter">ttl</replaceable></term>

+        <listitem>

+          <para>

+            Sets the default TTL to use for this key when it is converted

+            into a DNSKEY RR.  If the key is imported into a zone,

+            this is the TTL that will be used for it, unless there was

+            already a DNSKEY RRset in place, in which case the existing TTL

+            would take precedence.  importkey the default TTL to

+            <literal>0</literal> or <literal>none</literal> removes it.

+          </para>

+        </listitem>

+      </varlistentry>

+

+      <varlistentry>

+	<term>-h</term>

+        <listitem>

+	  <para>

+	    Emit usage message and exit.

+	  </para>

+        </listitem>

+      </varlistentry>

+  

+      <varlistentry>

+        <term>-v <replaceable class="parameter">level</replaceable></term>

+        <listitem>

+          <para>

+            Sets the debugging level.

+          </para>