contrib/ldns/tsig.c

   1 /*
   2  * tsig.c
   3  *
   4  * contains the functions needed for TSIG [RFC2845]
   5  *
   6  * (c) 2005-2006 NLnet Labs
   7  * See the file LICENSE for the license
   8  */
   9
  10 #include <ldns/config.h>
  11
  12 #include <ldns/ldns.h>
  13
  14 #include <strings.h>
  15
  16 #ifdef HAVE_SSL
  17 #include <openssl/hmac.h>
  18 #include <openssl/md5.h>
  19 #endif /* HAVE_SSL */
  20
  21 char *
  22 ldns_tsig_algorithm(ldns_tsig_credentials *tc)
  23 {
  24         return tc->algorithm;
  25 }
  26
  27 char *
  28 ldns_tsig_keyname(ldns_tsig_credentials *tc)
  29 {
  30         return tc->keyname;
  31 }
  32
  33 char *
  34 ldns_tsig_keydata(ldns_tsig_credentials *tc)
  35 {
  36         return tc->keydata;
  37 }
  38
  39 char *
  40 ldns_tsig_keyname_clone(ldns_tsig_credentials *tc)
  41 {
  42         return strdup(tc->keyname);
  43 }
  44
  45 char *
  46 ldns_tsig_keydata_clone(ldns_tsig_credentials *tc)
  47 {
  48         return strdup(tc->keydata);
  49 }
  50
  51 /*
  52  *  Makes an exact copy of the wire, but with the tsig rr removed
  53  */
  54 uint8_t *
  55 ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len)
  56 {
  57         uint8_t *wire2 = NULL;
  58         uint16_t qd_count;
  59         uint16_t an_count;
  60         uint16_t ns_count;
  61         uint16_t ar_count;
  62         ldns_rr *rr;
  63
  64         size_t pos;
  65         uint16_t i;
  66
  67         ldns_status status;
  68
  69         /* fake parse the wire */
  70         qd_count = LDNS_QDCOUNT(wire);
  71         an_count = LDNS_ANCOUNT(wire);
  72         ns_count = LDNS_NSCOUNT(wire);
  73         ar_count = LDNS_ARCOUNT(wire);
  74
  75         if (ar_count > 0) {
  76                 ar_count--;
  77         } else {
  78                 return NULL;
  79         }
  80
  81         pos = LDNS_HEADER_SIZE;
  82
  83         for (i = 0; i < qd_count; i++) {
  84                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_QUESTION);
  85                 if (status != LDNS_STATUS_OK) {
  86                         return NULL;
  87                 }
  88                 ldns_rr_free(rr);
  89         }
  90
  91         for (i = 0; i < an_count; i++) {
  92                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_ANSWER);
  93                 if (status != LDNS_STATUS_OK) {
  94                         return NULL;
  95                 }
  96                 ldns_rr_free(rr);
  97         }
  98
  99         for (i = 0; i < ns_count; i++) {
 100                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_AUTHORITY);
 101                 if (status != LDNS_STATUS_OK) {
 102                         return NULL;
 103                 }
 104                 ldns_rr_free(rr);
 105         }
 106
 107         for (i = 0; i < ar_count; i++) {
 108                 status = ldns_wire2rr(&rr, wire, wire_len, &pos,
 109                                 LDNS_SECTION_ADDITIONAL);
 110                 if (status != LDNS_STATUS_OK) {
 111                         return NULL;
 112                 }
 113                 ldns_rr_free(rr);
 114         }
 115
 116         *result_len = pos;
 117         wire2 = LDNS_XMALLOC(uint8_t, *result_len);
 118         memcpy(wire2, wire, *result_len);
 119
 120         ldns_write_uint16(wire2 + LDNS_ARCOUNT_OFF, ar_count);
 121
 122         return wire2;
 123 }
 124
 125 #ifdef HAVE_SSL
 126 static const EVP_MD *
 127 ldns_digest_function(char *name)
 128 {
 129         /* these are the mandatory algorithms from RFC4635 */
 130         /* The optional algorithms are not yet implemented */
 131         if (strlen(name) == 12 && strncasecmp(name, "hmac-sha256.", 11) == 0) {
 132 #ifdef HAVE_EVP_SHA256
 133                 return EVP_sha256();
 134 #else
 135                 return NULL;
 136 #endif
 137         } else if (strlen(name) == 10 && strncasecmp(name, "hmac-sha1.", 9) == 0)
 138                 return EVP_sha1();
 139         else if (strlen(name) == 25 && strncasecmp(name,
 140                      "hmac-md5.sig-alg.reg.int.", 25) == 0)
 141                 return EVP_md5();
 142         else
 143                 return NULL;
 144 }
 145 #endif
 146
 147 #ifdef HAVE_SSL
 148 static ldns_status
 149 ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
 150                 const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf,
 151                 ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf,
 152                 ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf)
 153 {
 154         char *wireformat;
 155         int wiresize;
 156         unsigned char *mac_bytes;
 157         unsigned char *key_bytes;
 158         int key_size;
 159         const EVP_MD *digester;
 160         char *algorithm_name;
 161         unsigned int md_len = EVP_MAX_MD_SIZE;
 162         ldns_rdf *result = NULL;
 163         ldns_buffer *data_buffer = NULL;
 164
 165         /*
 166          * prepare the digestable information
 167          */
 168         data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
 169         /* if orig_mac is not NULL, add it too */
 170         if (orig_mac_rdf) {
 171                 (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
 172         }
 173         ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size);
 174         (void)ldns_rdf2buffer_wire(data_buffer, key_name_rdf);
 175         ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
 176         ldns_buffer_write_u32(data_buffer, 0);
 177         (void)ldns_rdf2buffer_wire(data_buffer, algorithm_rdf);
 178         (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf);
 179         (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf);
 180         (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
 181         (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
 182
 183         wireformat = (char *) data_buffer->_data;
 184         wiresize = (int) ldns_buffer_position(data_buffer);
 185
 186         algorithm_name = ldns_rdf2str(algorithm_rdf);
 187
 188         /* prepare the key */
 189         key_bytes = LDNS_XMALLOC(unsigned char,
 190                         ldns_b64_pton_calculate_size(strlen(key_data)));
 191         key_size = ldns_b64_pton(key_data, key_bytes, strlen(key_data) * 2);
 192         if (key_size < 0) {
 193                 /* LDNS_STATUS_INVALID_B64 */
 194                 return LDNS_STATUS_INVALID_B64;
 195         }
 196         /* hmac it */
 197         /* 2 spare bytes for the length */
 198         mac_bytes = LDNS_XMALLOC(unsigned char, md_len);
 199         memset(mac_bytes, 0, md_len);
 200
 201         digester = ldns_digest_function(algorithm_name);
 202
 203         if (digester) {
 204                 (void) HMAC(digester, key_bytes, key_size, (void *)wireformat,
 205                             (size_t) wiresize, mac_bytes + 2, &md_len);
 206
 207                 ldns_write_uint16(mac_bytes, md_len);
 208                 result = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_INT16_DATA, md_len + 2,
 209                                 mac_bytes);
 210         } else {
 211                 return LDNS_STATUS_CRYPTO_UNKNOWN_ALGO;
 212         }
 213
 214         LDNS_FREE(algorithm_name);
 215         LDNS_FREE(mac_bytes);
 216         LDNS_FREE(key_bytes);
 217         ldns_buffer_free(data_buffer);
 218
 219         *tsig_mac = result;
 220
 221         return LDNS_STATUS_OK;
 222 }
 223 #endif /*  HAVE_SSL */
 224
 225
 226 #ifdef HAVE_SSL
 227 bool
 228 ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen,
 229                 const char *key_name, const char *key_data, ldns_rdf *orig_mac_rdf)
 230 {
 231         ldns_rdf *fudge_rdf;
 232         ldns_rdf *algorithm_rdf;
 233         ldns_rdf *time_signed_rdf;
 234         ldns_rdf *orig_id_rdf;
 235         ldns_rdf *error_rdf;
 236         ldns_rdf *other_data_rdf;
 237         ldns_rdf *pkt_mac_rdf;
 238         ldns_rdf *my_mac_rdf;
 239         ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
 240         uint16_t pkt_id, orig_pkt_id;
 241         ldns_status status;
 242
 243         uint8_t *prepared_wire = NULL;
 244         size_t prepared_wire_size = 0;
 245
 246         ldns_rr *orig_tsig = ldns_pkt_tsig(pkt);
 247
 248         if (!orig_tsig) {
 249                 ldns_rdf_deep_free(key_name_rdf);
 250                 return false;
 251         }
 252         algorithm_rdf = ldns_rr_rdf(orig_tsig, 0);
 253         time_signed_rdf = ldns_rr_rdf(orig_tsig, 1);
 254         fudge_rdf = ldns_rr_rdf(orig_tsig, 2);
 255         pkt_mac_rdf = ldns_rr_rdf(orig_tsig, 3);
 256         orig_id_rdf = ldns_rr_rdf(orig_tsig, 4);
 257         error_rdf = ldns_rr_rdf(orig_tsig, 5);
 258         other_data_rdf = ldns_rr_rdf(orig_tsig, 6);
 259
 260         /* remove temporarily */
 261         ldns_pkt_set_tsig(pkt, NULL);
 262         /* temporarily change the id to the original id */
 263         pkt_id = ldns_pkt_id(pkt);
 264         orig_pkt_id = ldns_rdf2native_int16(orig_id_rdf);
 265         ldns_pkt_set_id(pkt, orig_pkt_id);
 266
 267         prepared_wire = ldns_tsig_prepare_pkt_wire(wire, wirelen, &prepared_wire_size);
 268
 269         status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size,
 270                         key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
 271                         time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf);
 272
 273         LDNS_FREE(prepared_wire);
 274
 275         if (status != LDNS_STATUS_OK) {
 276                 ldns_rdf_deep_free(key_name_rdf);
 277                 return false;
 278         }
 279         /* Put back the values */
 280         ldns_pkt_set_tsig(pkt, orig_tsig);
 281         ldns_pkt_set_id(pkt, pkt_id);
 282
 283         ldns_rdf_deep_free(key_name_rdf);
 284
 285         if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) {
 286                 ldns_rdf_deep_free(my_mac_rdf);
 287                 return true;
 288         } else {
 289                 ldns_rdf_deep_free(my_mac_rdf);
 290                 return false;
 291         }
 292 }
 293 #endif /* HAVE_SSL */
 294
 295 #ifdef HAVE_SSL
 296 /* TODO: memory :p */
 297 ldns_status
 298 ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
 299                 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
 300 {
 301         ldns_rr *tsig_rr;
 302         ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
 303         ldns_rdf *fudge_rdf = NULL;
 304         ldns_rdf *orig_id_rdf = NULL;
 305         ldns_rdf *algorithm_rdf;
 306         ldns_rdf *error_rdf = NULL;
 307         ldns_rdf *mac_rdf = NULL;
 308         ldns_rdf *other_data_rdf = NULL;
 309
 310         ldns_status status = LDNS_STATUS_OK;
 311
 312         uint8_t *pkt_wire = NULL;
 313         size_t pkt_wire_len;
 314
 315         struct timeval tv_time_signed;
 316         uint8_t *time_signed = NULL;
 317         ldns_rdf *time_signed_rdf = NULL;
 318
 319         algorithm_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, algorithm_name);
 320
 321         /* eww don't have create tsigtime rdf yet :( */
 322         /* bleh :p */
 323         if (gettimeofday(&tv_time_signed, NULL) == 0) {
 324                 time_signed = LDNS_XMALLOC(uint8_t, 6);
 325                 ldns_write_uint64_as_uint48(time_signed,
 326                                 (uint64_t)tv_time_signed.tv_sec);
 327         } else {
 328                 status = LDNS_STATUS_INTERNAL_ERR;
 329                 goto clean;
 330         }
 331
 332         time_signed_rdf = ldns_rdf_new(LDNS_RDF_TYPE_TSIGTIME, 6, time_signed);
 333
 334         fudge_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, fudge);
 335
 336         orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt));
 337
 338         error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0);
 339
 340         other_data_rdf = ldns_native2rdf_int16_data(0, NULL);
 341
 342         if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) {
 343                 status = LDNS_STATUS_ERR;
 344                 goto clean;
 345         }
 346
 347         status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len,
 348                         key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
 349                         time_signed_rdf, error_rdf, other_data_rdf, query_mac);
 350
 351         if (!mac_rdf) {
 352                 goto clean;
 353         }
 354
 355         LDNS_FREE(pkt_wire);
 356
 357         /* Create the TSIG RR */
 358         tsig_rr = ldns_rr_new();
 359         ldns_rr_set_owner(tsig_rr, key_name_rdf);
 360         ldns_rr_set_class(tsig_rr, LDNS_RR_CLASS_ANY);
 361         ldns_rr_set_type(tsig_rr, LDNS_RR_TYPE_TSIG);
 362         ldns_rr_set_ttl(tsig_rr, 0);
 363
 364         ldns_rr_push_rdf(tsig_rr, algorithm_rdf);
 365         ldns_rr_push_rdf(tsig_rr, time_signed_rdf);
 366         ldns_rr_push_rdf(tsig_rr, fudge_rdf);
 367         ldns_rr_push_rdf(tsig_rr, mac_rdf);
 368         ldns_rr_push_rdf(tsig_rr, orig_id_rdf);
 369         ldns_rr_push_rdf(tsig_rr, error_rdf);
 370         ldns_rr_push_rdf(tsig_rr, other_data_rdf);
 371
 372         ldns_pkt_set_tsig(pkt, tsig_rr);
 373
 374         return status;
 375
 376   clean:
 377         ldns_rdf_free(key_name_rdf);
 378         ldns_rdf_free(algorithm_rdf);
 379         ldns_rdf_free(time_signed_rdf);
 380         ldns_rdf_free(fudge_rdf);
 381         ldns_rdf_free(orig_id_rdf);
 382         ldns_rdf_free(error_rdf);
 383         ldns_rdf_free(other_data_rdf);
 384         return status;
 385 }
 386 #endif /* HAVE_SSL */