BIND: update vendor tree to 9.5.2-P2
[dragonfly.git] / contrib / bind / lib / dns / dst_parse.c
CommitLineData
bbbf71a3
JL
1/*
2 * Portions Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 1999-2002 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
10 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
11 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
12 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
15 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 *
17 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
18 *
19 * Permission to use, copy, modify, and/or distribute this software for any
20 * purpose with or without fee is hereby granted, provided that the above
21 * copyright notice and this permission notice appear in all copies.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
24 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
26 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
27 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
28 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
29 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 */
31
32/*%
33 * Principal Author: Brian Wellington
34 * $Id: dst_parse.c,v 1.10.92.4 2009/03/02 23:46:31 tbox Exp $
35 */
36
37#include <config.h>
38
39#include <isc/base64.h>
40#include <isc/dir.h>
41#include <isc/fsaccess.h>
42#include <isc/lex.h>
43#include <isc/mem.h>
44#include <isc/string.h>
45#include <isc/util.h>
46
47#include "dst_internal.h"
48#include "dst_parse.h"
49#include "dst/result.h"
50
51#define DST_AS_STR(t) ((t).value.as_textregion.base)
52
53#define PRIVATE_KEY_STR "Private-key-format:"
54#define ALGORITHM_STR "Algorithm:"
55
56struct parse_map {
57 const int value;
58 const char *tag;
59};
60
61static struct parse_map map[] = {
62 {TAG_RSA_MODULUS, "Modulus:"},
63 {TAG_RSA_PUBLICEXPONENT, "PublicExponent:"},
64 {TAG_RSA_PRIVATEEXPONENT, "PrivateExponent:"},
65 {TAG_RSA_PRIME1, "Prime1:"},
66 {TAG_RSA_PRIME2, "Prime2:"},
67 {TAG_RSA_EXPONENT1, "Exponent1:"},
68 {TAG_RSA_EXPONENT2, "Exponent2:"},
69 {TAG_RSA_COEFFICIENT, "Coefficient:"},
70
71 {TAG_DH_PRIME, "Prime(p):"},
72 {TAG_DH_GENERATOR, "Generator(g):"},
73 {TAG_DH_PRIVATE, "Private_value(x):"},
74 {TAG_DH_PUBLIC, "Public_value(y):"},
75
76 {TAG_DSA_PRIME, "Prime(p):"},
77 {TAG_DSA_SUBPRIME, "Subprime(q):"},
78 {TAG_DSA_BASE, "Base(g):"},
79 {TAG_DSA_PRIVATE, "Private_value(x):"},
80 {TAG_DSA_PUBLIC, "Public_value(y):"},
81
82 {TAG_HMACMD5_KEY, "Key:"},
83 {TAG_HMACMD5_BITS, "Bits:"},
84
85 {TAG_HMACSHA1_KEY, "Key:"},
86 {TAG_HMACSHA1_BITS, "Bits:"},
87
88 {TAG_HMACSHA224_KEY, "Key:"},
89 {TAG_HMACSHA224_BITS, "Bits:"},
90
91 {TAG_HMACSHA256_KEY, "Key:"},
92 {TAG_HMACSHA256_BITS, "Bits:"},
93
94 {TAG_HMACSHA384_KEY, "Key:"},
95 {TAG_HMACSHA384_BITS, "Bits:"},
96
97 {TAG_HMACSHA512_KEY, "Key:"},
98 {TAG_HMACSHA512_BITS, "Bits:"},
99
100 {0, NULL}
101};
102
103static int
104find_value(const char *s, const unsigned int alg) {
105 int i;
106
107 for (i = 0; ; i++) {
108 if (map[i].tag == NULL)
109 return (-1);
110 else if (strcasecmp(s, map[i].tag) == 0 &&
111 TAG_ALG(map[i].value) == alg)
112 return (map[i].value);
113 }
114}
115
116static const char *
117find_tag(const int value) {
118 int i;
119
120 for (i = 0; ; i++) {
121 if (map[i].tag == NULL)
122 return (NULL);
123 else if (value == map[i].value)
124 return (map[i].tag);
125 }
126}
127
128static int
129check_rsa(const dst_private_t *priv) {
130 int i, j;
131 if (priv->nelements != RSA_NTAGS)
132 return (-1);
133 for (i = 0; i < RSA_NTAGS; i++) {
134 for (j = 0; j < priv->nelements; j++)
135 if (priv->elements[j].tag == TAG(DST_ALG_RSAMD5, i))
136 break;
137 if (j == priv->nelements)
138 return (-1);
139 }
140 return (0);
141}
142
143static int
144check_dh(const dst_private_t *priv) {
145 int i, j;
146 if (priv->nelements != DH_NTAGS)
147 return (-1);
148 for (i = 0; i < DH_NTAGS; i++) {
149 for (j = 0; j < priv->nelements; j++)
150 if (priv->elements[j].tag == TAG(DST_ALG_DH, i))
151 break;
152 if (j == priv->nelements)
153 return (-1);
154 }
155 return (0);
156}
157
158static int
159check_dsa(const dst_private_t *priv) {
160 int i, j;
161 if (priv->nelements != DSA_NTAGS)
162 return (-1);
163 for (i = 0; i < DSA_NTAGS; i++) {
164 for (j = 0; j < priv->nelements; j++)
165 if (priv->elements[j].tag == TAG(DST_ALG_DSA, i))
166 break;
167 if (j == priv->nelements)
168 return (-1);
169 }
170 return (0);
171}
172
173static int
174check_hmac_md5(const dst_private_t *priv, isc_boolean_t old) {
175 int i, j;
176
177 if (priv->nelements != HMACMD5_NTAGS) {
178 /*
179 * If this is a good old format and we are accepting
180 * the old format return success.
181 */
182 if (old && priv->nelements == OLD_HMACMD5_NTAGS &&
183 priv->elements[0].tag == TAG_HMACMD5_KEY)
184 return (0);
185 return (-1);
186 }
187 /*
188 * We must be new format at this point.
189 */
190 for (i = 0; i < HMACMD5_NTAGS; i++) {
191 for (j = 0; j < priv->nelements; j++)
192 if (priv->elements[j].tag == TAG(DST_ALG_HMACMD5, i))
193 break;
194 if (j == priv->nelements)
195 return (-1);
196 }
197 return (0);
198}
199
200static int
201check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
202 unsigned int alg)
203{
204 unsigned int i, j;
205 if (priv->nelements != ntags)
206 return (-1);
207 for (i = 0; i < ntags; i++) {
208 for (j = 0; j < priv->nelements; j++)
209 if (priv->elements[j].tag == TAG(alg, i))
210 break;
211 if (j == priv->nelements)
212 return (-1);
213 }
214 return (0);
215}
216
217static int
218check_data(const dst_private_t *priv, const unsigned int alg,
219 isc_boolean_t old)
220{
221 /* XXXVIX this switch statement is too sparse to gen a jump table. */
222 switch (alg) {
223 case DST_ALG_RSAMD5:
224 case DST_ALG_RSASHA1:
225 return (check_rsa(priv));
226 case DST_ALG_DH:
227 return (check_dh(priv));
228 case DST_ALG_DSA:
229 return (check_dsa(priv));
230 case DST_ALG_HMACMD5:
231 return (check_hmac_md5(priv, old));
232 case DST_ALG_HMACSHA1:
233 return (check_hmac_sha(priv, HMACSHA1_NTAGS, alg));
234 case DST_ALG_HMACSHA224:
235 return (check_hmac_sha(priv, HMACSHA224_NTAGS, alg));
236 case DST_ALG_HMACSHA256:
237 return (check_hmac_sha(priv, HMACSHA256_NTAGS, alg));
238 case DST_ALG_HMACSHA384:
239 return (check_hmac_sha(priv, HMACSHA384_NTAGS, alg));
240 case DST_ALG_HMACSHA512:
241 return (check_hmac_sha(priv, HMACSHA512_NTAGS, alg));
242 default:
243 return (DST_R_UNSUPPORTEDALG);
244 }
245}
246
247void
248dst__privstruct_free(dst_private_t *priv, isc_mem_t *mctx) {
249 int i;
250
251 if (priv == NULL)
252 return;
253 for (i = 0; i < priv->nelements; i++) {
254 if (priv->elements[i].data == NULL)
255 continue;
256 memset(priv->elements[i].data, 0, MAXFIELDSIZE);
257 isc_mem_put(mctx, priv->elements[i].data, MAXFIELDSIZE);
258 }
259 priv->nelements = 0;
260}
261
262int
263dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
264 isc_mem_t *mctx, dst_private_t *priv)
265{
266 int n = 0, major, minor;
267 isc_buffer_t b;
268 isc_token_t token;
269 unsigned char *data = NULL;
270 unsigned int opt = ISC_LEXOPT_EOL;
271 isc_result_t ret;
272
273 REQUIRE(priv != NULL);
274
275 priv->nelements = 0;
276 memset(priv->elements, 0, sizeof(priv->elements));
277
278#define NEXTTOKEN(lex, opt, token) \
279 do { \
280 ret = isc_lex_gettoken(lex, opt, token); \
281 if (ret != ISC_R_SUCCESS) \
282 goto fail; \
283 } while (0)
284
285#define READLINE(lex, opt, token) \
286 do { \
287 ret = isc_lex_gettoken(lex, opt, token); \
288 if (ret == ISC_R_EOF) \
289 break; \
290 else if (ret != ISC_R_SUCCESS) \
291 goto fail; \
292 } while ((*token).type != isc_tokentype_eol)
293
294 /*
295 * Read the description line.
296 */
297 NEXTTOKEN(lex, opt, &token);
298 if (token.type != isc_tokentype_string ||
299 strcmp(DST_AS_STR(token), PRIVATE_KEY_STR) != 0)
300 {
301 ret = DST_R_INVALIDPRIVATEKEY;
302 goto fail;
303 }
304
305 NEXTTOKEN(lex, opt, &token);
306 if (token.type != isc_tokentype_string ||
307 (DST_AS_STR(token))[0] != 'v')
308 {
309 ret = DST_R_INVALIDPRIVATEKEY;
310 goto fail;
311 }
312 if (sscanf(DST_AS_STR(token), "v%d.%d", &major, &minor) != 2)
313 {
314 ret = DST_R_INVALIDPRIVATEKEY;
315 goto fail;
316 }
317
318 if (major > MAJOR_VERSION ||
319 (major == MAJOR_VERSION && minor > MINOR_VERSION))
320 {
321 ret = DST_R_INVALIDPRIVATEKEY;
322 goto fail;
323 }
324
325 READLINE(lex, opt, &token);
326
327 /*
328 * Read the algorithm line.
329 */
330 NEXTTOKEN(lex, opt, &token);
331 if (token.type != isc_tokentype_string ||
332 strcmp(DST_AS_STR(token), ALGORITHM_STR) != 0)
333 {
334 ret = DST_R_INVALIDPRIVATEKEY;
335 goto fail;
336 }
337
338 NEXTTOKEN(lex, opt | ISC_LEXOPT_NUMBER, &token);
339 if (token.type != isc_tokentype_number ||
340 token.value.as_ulong != (unsigned long) dst_key_alg(key))
341 {
342 ret = DST_R_INVALIDPRIVATEKEY;
343 goto fail;
344 }
345
346 READLINE(lex, opt, &token);
347
348 /*
349 * Read the key data.
350 */
351 for (n = 0; n < MAXFIELDS; n++) {
352 int tag;
353 isc_region_t r;
354
355 do {
356 ret = isc_lex_gettoken(lex, opt, &token);
357 if (ret == ISC_R_EOF)
358 goto done;
359 if (ret != ISC_R_SUCCESS)
360 goto fail;
361 } while (token.type == isc_tokentype_eol);
362
363 if (token.type != isc_tokentype_string) {
364 ret = DST_R_INVALIDPRIVATEKEY;
365 goto fail;
366 }
367
368 tag = find_value(DST_AS_STR(token), alg);
369 if (tag < 0 || TAG_ALG(tag) != alg) {
370 ret = DST_R_INVALIDPRIVATEKEY;
371 goto fail;
372 }
373 priv->elements[n].tag = tag;
374
375 data = (unsigned char *) isc_mem_get(mctx, MAXFIELDSIZE);
376 if (data == NULL)
377 goto fail;
378
379 isc_buffer_init(&b, data, MAXFIELDSIZE);
380 ret = isc_base64_tobuffer(lex, &b, -1);
381 if (ret != ISC_R_SUCCESS)
382 goto fail;
383 isc_buffer_usedregion(&b, &r);
384 priv->elements[n].length = r.length;
385 priv->elements[n].data = r.base;
386
387 READLINE(lex, opt, &token);
388 data = NULL;
389 }
390 done:
391 priv->nelements = n;
392
393 if (check_data(priv, alg, ISC_TRUE) < 0)
394 goto fail;
395
396 return (ISC_R_SUCCESS);
397
398fail:
399 priv->nelements = n;
400 dst__privstruct_free(priv, mctx);
401 if (data != NULL)
402 isc_mem_put(mctx, data, MAXFIELDSIZE);
403
404 return (ret);
405}
406
407int
408dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
409 const char *directory)
410{
411 FILE *fp;
412 int ret, i;
413 isc_result_t iret;
414 char filename[ISC_DIR_NAMEMAX];
415 char buffer[MAXFIELDSIZE * 2];
416 isc_buffer_t b;
417 isc_fsaccess_t access;
418
419 REQUIRE(priv != NULL);
420
421 if (check_data(priv, dst_key_alg(key), ISC_FALSE) < 0)
422 return (DST_R_INVALIDPRIVATEKEY);
423
424 isc_buffer_init(&b, filename, sizeof(filename));
425 ret = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &b);
426 if (ret != ISC_R_SUCCESS)
427 return (ret);
428
429 if ((fp = fopen(filename, "w")) == NULL)
430 return (DST_R_WRITEERROR);
431
432 access = 0;
433 isc_fsaccess_add(ISC_FSACCESS_OWNER,
434 ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
435 &access);
436 (void)isc_fsaccess_set(filename, access);
437
438 /* XXXDCL return value should be checked for full filesystem */
439 fprintf(fp, "%s v%d.%d\n", PRIVATE_KEY_STR, MAJOR_VERSION,
440 MINOR_VERSION);
441
442 fprintf(fp, "%s %d ", ALGORITHM_STR, dst_key_alg(key));
443 /* XXXVIX this switch statement is too sparse to gen a jump table. */
444 switch (dst_key_alg(key)) {
445 case DST_ALG_RSAMD5:
446 fprintf(fp, "(RSA)\n");
447 break;
448 case DST_ALG_DH:
449 fprintf(fp, "(DH)\n");
450 break;
451 case DST_ALG_DSA:
452 fprintf(fp, "(DSA)\n");
453 break;
454 case DST_ALG_RSASHA1:
455 fprintf(fp, "(RSASHA1)\n");
456 break;
457 case DST_ALG_HMACMD5:
458 fprintf(fp, "(HMAC_MD5)\n");
459 break;
460 case DST_ALG_HMACSHA1:
461 fprintf(fp, "(HMAC_SHA1)\n");
462 break;
463 case DST_ALG_HMACSHA224:
464 fprintf(fp, "(HMAC_SHA224)\n");
465 break;
466 case DST_ALG_HMACSHA256:
467 fprintf(fp, "(HMAC_SHA256)\n");
468 break;
469 case DST_ALG_HMACSHA384:
470 fprintf(fp, "(HMAC_SHA384)\n");
471 break;
472 case DST_ALG_HMACSHA512:
473 fprintf(fp, "(HMAC_SHA512)\n");
474 break;
475 default:
476 fprintf(fp, "(?)\n");
477 break;
478 }
479
480 for (i = 0; i < priv->nelements; i++) {
481 isc_buffer_t b;
482 isc_region_t r;
483 const char *s;
484
485 s = find_tag(priv->elements[i].tag);
486
487 r.base = priv->elements[i].data;
488 r.length = priv->elements[i].length;
489 isc_buffer_init(&b, buffer, sizeof(buffer));
490 iret = isc_base64_totext(&r, sizeof(buffer), "", &b);
491 if (iret != ISC_R_SUCCESS) {
492 fclose(fp);
493 return (DST_R_INVALIDPRIVATEKEY);
494 }
495 isc_buffer_usedregion(&b, &r);
496
497 fprintf(fp, "%s ", s);
498 fwrite(r.base, 1, r.length, fp);
499 fprintf(fp, "\n");
500 }
501
502 fflush(fp);
503 iret = ferror(fp) ? DST_R_WRITEERROR : ISC_R_SUCCESS;
504 fclose(fp);
505 return (iret);
506}
507
508/*! \file */