|
| 1 | +#!/usr/bin/env python3 |
| 2 | + |
| 3 | +# Copyright 2024 OpenARC contributors. |
| 4 | +# See LICENSE. |
| 5 | + |
| 6 | +import argparse |
| 7 | +import os |
| 8 | +import subprocess |
| 9 | +import sys |
| 10 | + |
| 11 | + |
| 12 | +def main(): |
| 13 | + parser = argparse.ArgumentParser() |
| 14 | + # fmt: off |
| 15 | + parser.add_argument( |
| 16 | + '-b', '--bits', |
| 17 | + type=int, |
| 18 | + default=2048, |
| 19 | + help='Size of RSA key to generate.', |
| 20 | + ) |
| 21 | + parser.add_argument( |
| 22 | + '-d', '--domain', |
| 23 | + required=True, |
| 24 | + help='The domain which will use this key for signing.', |
| 25 | + ) |
| 26 | + parser.add_argument( |
| 27 | + '-D', '--directory', |
| 28 | + help='Directory to store the keys in.', |
| 29 | + ) |
| 30 | + parser.add_argument( |
| 31 | + '-f', '--format', |
| 32 | + default='zone', |
| 33 | + choices=['bare', 'testkey', 'text', 'zone'], |
| 34 | + help='output format for the public key', |
| 35 | + ) |
| 36 | + parser.add_argument( |
| 37 | + '--fqdn', |
| 38 | + action='store_true', |
| 39 | + help='Use the fully qualified domain name when outputting a DNS zone entry', |
| 40 | + ) |
| 41 | + parser.add_argument( |
| 42 | + '--hash-algorithms', |
| 43 | + help='Tag the generated DNS record for use with this colon-separated list of algorithms.', |
| 44 | + ) |
| 45 | + parser.add_argument( |
| 46 | + '-n', '--note', |
| 47 | + help='Free-form text to include in the public key.' |
| 48 | + ) |
| 49 | + parser.add_argument( |
| 50 | + '--no-subdomains', |
| 51 | + action='store_true', |
| 52 | + help='Tag the public key to indicate that identities in a signature are required to be from this exact domain, not subdomains.', |
| 53 | + ) |
| 54 | + parser.add_argument( |
| 55 | + '-r', '--restrict', |
| 56 | + action='store_true', |
| 57 | + help='Tag the public key to indicate that it should only be used for email.', |
| 58 | + ) |
| 59 | + parser.add_argument( |
| 60 | + '-s', '--selector', |
| 61 | + required=True, |
| 62 | + help='A name for the key.', |
| 63 | + ) |
| 64 | + parser.add_argument( |
| 65 | + '-t', '--type', |
| 66 | + default='rsa', |
| 67 | + choices=['rsa', 'ed25519'], |
| 68 | + help='Type of key to generate.', |
| 69 | + ) |
| 70 | + parser.add_argument( |
| 71 | + '--testing', |
| 72 | + action='store_true', |
| 73 | + help='Tag the public key to indicate that this domain is testing its deployment of the protocol this key is used for.', |
| 74 | + ) |
| 75 | + # fmt: on |
| 76 | + |
| 77 | + args = parser.parse_args() |
| 78 | + |
| 79 | + fname_base = f'{args.selector}._domainkey.{args.domain}' |
| 80 | + if args.directory: |
| 81 | + if not os.path.exists(args.directory): |
| 82 | + print(f'{args.directory} does not exist', file=sys.stderr) |
| 83 | + sys.exit(1) |
| 84 | + fname_base = os.path.join(args.directory, fname_base) |
| 85 | + |
| 86 | + binargs = [ |
| 87 | + 'openssl', |
| 88 | + 'genpkey', |
| 89 | + '-algorithm', |
| 90 | + args.type, |
| 91 | + '-outform', |
| 92 | + 'PEM', |
| 93 | + '-out', |
| 94 | + f'{fname_base}.key', |
| 95 | + ] |
| 96 | + |
| 97 | + if args.type == 'rsa': |
| 98 | + binargs.extend( |
| 99 | + [ |
| 100 | + '-pkeyopt', |
| 101 | + f'rsa_keygen_bits:{args.bits}', |
| 102 | + ] |
| 103 | + ) |
| 104 | + |
| 105 | + res = subprocess.run(binargs, capture_output=True, text=True) |
| 106 | + if res.returncode != 0: |
| 107 | + print(f'openssl returned error code {res.returncode} while generating the private key: {res.stderr}', file=sys.stderr) |
| 108 | + sys.exit(1) |
| 109 | + |
| 110 | + binargs = [ |
| 111 | + 'openssl', |
| 112 | + 'pkey', |
| 113 | + '-in', |
| 114 | + f'{fname_base}.key', |
| 115 | + '-inform', |
| 116 | + 'PEM', |
| 117 | + '-outform', |
| 118 | + 'PEM', |
| 119 | + '-pubout', |
| 120 | + ] |
| 121 | + |
| 122 | + res = subprocess.run(binargs, capture_output=True, text=True) |
| 123 | + if res.returncode != 0: |
| 124 | + print(f'openssl returned error code {res.returncode} while extracting the public key: {res.stderr}', file=sys.stderr) |
| 125 | + sys.exit(1) |
| 126 | + |
| 127 | + pkey = ''.join(res.stdout.splitlines()[1:-1]) |
| 128 | + if args.type == 'ed25519': |
| 129 | + # This key type is published without the ASN1 prefix. Conveniently, |
| 130 | + # this prefix is 12 bytes so we can strip it off without decoding the |
| 131 | + # base64. |
| 132 | + pkey = pkey[16:] |
| 133 | + |
| 134 | + # Format the DNS record contents |
| 135 | + txt = f'v=DKIM1; k={args.type}' |
| 136 | + |
| 137 | + if args.hash_algorithms: |
| 138 | + txt += f'; h={args.hash_algorithms}' |
| 139 | + |
| 140 | + if args.note: |
| 141 | + txt += f'; n=\\"{args.note}\\"' |
| 142 | + |
| 143 | + if args.restrict: |
| 144 | + txt += '; s=email' |
| 145 | + |
| 146 | + flags = [] |
| 147 | + if args.testing: |
| 148 | + flags.append('y') |
| 149 | + if args.no_subdomains: |
| 150 | + flags.append('s') |
| 151 | + if flags: |
| 152 | + txt += f'; t={":".join(flags)}' |
| 153 | + |
| 154 | + txt += f'; p={pkey}' |
| 155 | + |
| 156 | + # Write it out |
| 157 | + with open(f'{fname_base}.txt', 'w') as f: |
| 158 | + if args.format == 'bare': |
| 159 | + f.write(pkey) |
| 160 | + elif args.format in ('testkey', 'text'): |
| 161 | + if args.format == 'testkey': |
| 162 | + f.write(f'{args.selector}._domainkey.{args.domain} ') |
| 163 | + f.write(txt.replace('\\"', '"')) |
| 164 | + else: |
| 165 | + f.write(f'{args.selector}._domainkey') |
| 166 | + if args.fqdn: |
| 167 | + f.write(f'.{args.domain}.') |
| 168 | + f.write('\tIN\tTXT\t( "') |
| 169 | + # Individual strings within a TXT record are limited to 255 bytes |
| 170 | + f.write('"\n\t"'.join(txt[i : i + 255] for i in range(0, len(txt), 255))) |
| 171 | + f.write('" )') |
| 172 | + f.write('\n') |
| 173 | + |
| 174 | + |
| 175 | +if __name__ == '__main__': |
| 176 | + main() |
0 commit comments