Disconnect hostapd from building in base
[dragonfly.git] / contrib / ldns / tsig.c
CommitLineData
ac996e71 1/*
825eb42b
JL
2 * tsig.c
3 *
4 * contains the functions needed for TSIG [RFC2845]
5 *
6 * (c) 2005-2006 NLnet Labs
7 * See the file LICENSE for the license
8 */
9
10#include <ldns/config.h>
11
12#include <ldns/ldns.h>
13
14#include <strings.h>
15
16#ifdef HAVE_SSL
17#include <openssl/hmac.h>
18#include <openssl/md5.h>
19#endif /* HAVE_SSL */
20
21char *
22ldns_tsig_algorithm(ldns_tsig_credentials *tc)
23{
24 return tc->algorithm;
25}
26
27char *
28ldns_tsig_keyname(ldns_tsig_credentials *tc)
29{
30 return tc->keyname;
31}
32
33char *
34ldns_tsig_keydata(ldns_tsig_credentials *tc)
35{
36 return tc->keydata;
37}
38
39char *
40ldns_tsig_keyname_clone(ldns_tsig_credentials *tc)
41{
42 return strdup(tc->keyname);
43}
44
45char *
46ldns_tsig_keydata_clone(ldns_tsig_credentials *tc)
47{
48 return strdup(tc->keydata);
49}
50
51/*
52 * Makes an exact copy of the wire, but with the tsig rr removed
53 */
54uint8_t *
55ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len)
56{
57 uint8_t *wire2 = NULL;
58 uint16_t qd_count;
59 uint16_t an_count;
60 uint16_t ns_count;
61 uint16_t ar_count;
62 ldns_rr *rr;
63
64 size_t pos;
65 uint16_t i;
66
67 ldns_status status;
68
b5dedcca
JL
69 if(wire_len < LDNS_HEADER_SIZE) {
70 return NULL;
71 }
825eb42b
JL
72 /* fake parse the wire */
73 qd_count = LDNS_QDCOUNT(wire);
74 an_count = LDNS_ANCOUNT(wire);
75 ns_count = LDNS_NSCOUNT(wire);
76 ar_count = LDNS_ARCOUNT(wire);
77
78 if (ar_count > 0) {
79 ar_count--;
80 } else {
81 return NULL;
82 }
83
84 pos = LDNS_HEADER_SIZE;
85
86 for (i = 0; i < qd_count; i++) {
87 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_QUESTION);
88 if (status != LDNS_STATUS_OK) {
89 return NULL;
90 }
91 ldns_rr_free(rr);
92 }
93
94 for (i = 0; i < an_count; i++) {
95 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_ANSWER);
96 if (status != LDNS_STATUS_OK) {
97 return NULL;
98 }
99 ldns_rr_free(rr);
100 }
101
102 for (i = 0; i < ns_count; i++) {
103 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_AUTHORITY);
104 if (status != LDNS_STATUS_OK) {
105 return NULL;
106 }
107 ldns_rr_free(rr);
108 }
109
110 for (i = 0; i < ar_count; i++) {
111 status = ldns_wire2rr(&rr, wire, wire_len, &pos,
112 LDNS_SECTION_ADDITIONAL);
113 if (status != LDNS_STATUS_OK) {
114 return NULL;
115 }
116 ldns_rr_free(rr);
117 }
118
119 *result_len = pos;
120 wire2 = LDNS_XMALLOC(uint8_t, *result_len);
b5dedcca
JL
121 if(!wire2) {
122 return NULL;
123 }
825eb42b
JL
124 memcpy(wire2, wire, *result_len);
125
126 ldns_write_uint16(wire2 + LDNS_ARCOUNT_OFF, ar_count);
127
128 return wire2;
129}
130
131#ifdef HAVE_SSL
132static const EVP_MD *
133ldns_digest_function(char *name)
134{
135 /* these are the mandatory algorithms from RFC4635 */
136 /* The optional algorithms are not yet implemented */
b5dedcca
JL
137 if (strlen(name) == 12
138 && strncasecmp(name, "hmac-sha256.", 11) == 0) {
825eb42b
JL
139#ifdef HAVE_EVP_SHA256
140 return EVP_sha256();
141#else
142 return NULL;
143#endif
b5dedcca
JL
144 } else if (strlen(name) == 10
145 && strncasecmp(name, "hmac-sha1.", 9) == 0) {
825eb42b 146 return EVP_sha1();
b5dedcca
JL
147 } else if (strlen(name) == 25
148 && strncasecmp(name, "hmac-md5.sig-alg.reg.int.", 25)
149 == 0) {
825eb42b 150 return EVP_md5();
b5dedcca 151 } else {
825eb42b 152 return NULL;
b5dedcca 153 }
825eb42b
JL
154}
155#endif
156
157#ifdef HAVE_SSL
158static ldns_status
159ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
160 const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf,
161 ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf,
ac996e71 162 ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
825eb42b 163{
b5dedcca 164 ldns_status status;
825eb42b
JL
165 char *wireformat;
166 int wiresize;
b5dedcca
JL
167 unsigned char *mac_bytes = NULL;
168 unsigned char *key_bytes = NULL;
825eb42b
JL
169 int key_size;
170 const EVP_MD *digester;
b5dedcca 171 char *algorithm_name = NULL;
825eb42b
JL
172 unsigned int md_len = EVP_MAX_MD_SIZE;
173 ldns_rdf *result = NULL;
174 ldns_buffer *data_buffer = NULL;
b5dedcca
JL
175 ldns_rdf *canonical_key_name_rdf = NULL;
176 ldns_rdf *canonical_algorithm_rdf = NULL;
177
178 if (key_name_rdf == NULL || algorithm_rdf == NULL) {
179 return LDNS_STATUS_NULL;
180 }
181 canonical_key_name_rdf = ldns_rdf_clone(key_name_rdf);
d1b2b5ca
JM
182 if (canonical_key_name_rdf == NULL) {
183 return LDNS_STATUS_MEM_ERR;
184 }
b5dedcca 185 canonical_algorithm_rdf = ldns_rdf_clone(algorithm_rdf);
d1b2b5ca
JM
186 if (canonical_algorithm_rdf == NULL) {
187 ldns_rdf_deep_free(canonical_key_name_rdf);
b5dedcca
JL
188 return LDNS_STATUS_MEM_ERR;
189 }
825eb42b
JL
190 /*
191 * prepare the digestable information
192 */
193 data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
b5dedcca
JL
194 if (!data_buffer) {
195 status = LDNS_STATUS_MEM_ERR;
196 goto clean;
ac996e71 197 }
825eb42b
JL
198 /* if orig_mac is not NULL, add it too */
199 if (orig_mac_rdf) {
200 (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
201 }
202 ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size);
ac996e71 203 if (!tsig_timers_only) {
b5dedcca
JL
204 ldns_dname2canonical(canonical_key_name_rdf);
205 (void)ldns_rdf2buffer_wire(data_buffer,
206 canonical_key_name_rdf);
ac996e71
JL
207 ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
208 ldns_buffer_write_u32(data_buffer, 0);
b5dedcca
JL
209 ldns_dname2canonical(canonical_algorithm_rdf);
210 (void)ldns_rdf2buffer_wire(data_buffer,
211 canonical_algorithm_rdf);
ac996e71 212 }
825eb42b
JL
213 (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf);
214 (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf);
ac996e71
JL
215 if (!tsig_timers_only) {
216 (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
217 (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
218 }
825eb42b
JL
219
220 wireformat = (char *) data_buffer->_data;
221 wiresize = (int) ldns_buffer_position(data_buffer);
222
223 algorithm_name = ldns_rdf2str(algorithm_rdf);
ac996e71 224 if(!algorithm_name) {
b5dedcca
JL
225 status = LDNS_STATUS_MEM_ERR;
226 goto clean;
ac996e71 227 }
825eb42b
JL
228
229 /* prepare the key */
230 key_bytes = LDNS_XMALLOC(unsigned char,
231 ldns_b64_pton_calculate_size(strlen(key_data)));
ac996e71 232 if(!key_bytes) {
b5dedcca
JL
233 status = LDNS_STATUS_MEM_ERR;
234 goto clean;
ac996e71
JL
235 }
236 key_size = ldns_b64_pton(key_data, key_bytes,
b5dedcca 237 ldns_b64_pton_calculate_size(strlen(key_data)));
825eb42b 238 if (key_size < 0) {
b5dedcca
JL
239 status = LDNS_STATUS_INVALID_B64;
240 goto clean;
825eb42b
JL
241 }
242 /* hmac it */
243 /* 2 spare bytes for the length */
ac996e71
JL
244 mac_bytes = LDNS_XMALLOC(unsigned char, md_len+2);
245 if(!mac_bytes) {
b5dedcca
JL
246 status = LDNS_STATUS_MEM_ERR;
247 goto clean;
ac996e71
JL
248 }
249 memset(mac_bytes, 0, md_len+2);
825eb42b
JL
250
251 digester = ldns_digest_function(algorithm_name);
252
253 if (digester) {
254 (void) HMAC(digester, key_bytes, key_size, (void *)wireformat,
255 (size_t) wiresize, mac_bytes + 2, &md_len);
256
257 ldns_write_uint16(mac_bytes, md_len);
258 result = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_INT16_DATA, md_len + 2,
259 mac_bytes);
260 } else {
b5dedcca
JL
261 status = LDNS_STATUS_CRYPTO_UNKNOWN_ALGO;
262 goto clean;
825eb42b 263 }
b5dedcca
JL
264 *tsig_mac = result;
265 status = LDNS_STATUS_OK;
266 clean:
825eb42b
JL
267 LDNS_FREE(mac_bytes);
268 LDNS_FREE(key_bytes);
b5dedcca 269 LDNS_FREE(algorithm_name);
825eb42b 270 ldns_buffer_free(data_buffer);
d1b2b5ca
JM
271 ldns_rdf_deep_free(canonical_algorithm_rdf);
272 ldns_rdf_deep_free(canonical_key_name_rdf);
b5dedcca 273 return status;
825eb42b
JL
274}
275#endif /* HAVE_SSL */
276
277
278#ifdef HAVE_SSL
279bool
ac996e71
JL
280ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char *key_name,
281 const char *key_data, ldns_rdf *orig_mac_rdf)
282{
283 return ldns_pkt_tsig_verify_next(pkt, wire, wirelen, key_name, key_data, orig_mac_rdf, 0);
284}
285
286bool
287ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char* key_name,
288 const char *key_data, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
825eb42b
JL
289{
290 ldns_rdf *fudge_rdf;
291 ldns_rdf *algorithm_rdf;
292 ldns_rdf *time_signed_rdf;
293 ldns_rdf *orig_id_rdf;
294 ldns_rdf *error_rdf;
295 ldns_rdf *other_data_rdf;
296 ldns_rdf *pkt_mac_rdf;
297 ldns_rdf *my_mac_rdf;
298 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
299 uint16_t pkt_id, orig_pkt_id;
300 ldns_status status;
301
302 uint8_t *prepared_wire = NULL;
303 size_t prepared_wire_size = 0;
304
305 ldns_rr *orig_tsig = ldns_pkt_tsig(pkt);
306
b5dedcca 307 if (!orig_tsig || ldns_rr_rd_count(orig_tsig) <= 6) {
825eb42b
JL
308 ldns_rdf_deep_free(key_name_rdf);
309 return false;
310 }
311 algorithm_rdf = ldns_rr_rdf(orig_tsig, 0);
312 time_signed_rdf = ldns_rr_rdf(orig_tsig, 1);
313 fudge_rdf = ldns_rr_rdf(orig_tsig, 2);
314 pkt_mac_rdf = ldns_rr_rdf(orig_tsig, 3);
315 orig_id_rdf = ldns_rr_rdf(orig_tsig, 4);
316 error_rdf = ldns_rr_rdf(orig_tsig, 5);
317 other_data_rdf = ldns_rr_rdf(orig_tsig, 6);
318
319 /* remove temporarily */
320 ldns_pkt_set_tsig(pkt, NULL);
321 /* temporarily change the id to the original id */
322 pkt_id = ldns_pkt_id(pkt);
323 orig_pkt_id = ldns_rdf2native_int16(orig_id_rdf);
324 ldns_pkt_set_id(pkt, orig_pkt_id);
325
326 prepared_wire = ldns_tsig_prepare_pkt_wire(wire, wirelen, &prepared_wire_size);
327
328 status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size,
329 key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
ac996e71 330 time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf, tsig_timers_only);
825eb42b
JL
331
332 LDNS_FREE(prepared_wire);
333
334 if (status != LDNS_STATUS_OK) {
335 ldns_rdf_deep_free(key_name_rdf);
336 return false;
337 }
338 /* Put back the values */
339 ldns_pkt_set_tsig(pkt, orig_tsig);
340 ldns_pkt_set_id(pkt, pkt_id);
341
342 ldns_rdf_deep_free(key_name_rdf);
343
344 if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) {
345 ldns_rdf_deep_free(my_mac_rdf);
346 return true;
347 } else {
348 ldns_rdf_deep_free(my_mac_rdf);
349 return false;
350 }
351}
352#endif /* HAVE_SSL */
353
354#ifdef HAVE_SSL
825eb42b
JL
355ldns_status
356ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
ac996e71
JL
357 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
358{
359 return ldns_pkt_tsig_sign_next(pkt, key_name, key_data, fudge, algorithm_name, query_mac, 0);
360}
361
362ldns_status
363ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data,
364 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only)
825eb42b
JL
365{
366 ldns_rr *tsig_rr;
367 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
368 ldns_rdf *fudge_rdf = NULL;
369 ldns_rdf *orig_id_rdf = NULL;
370 ldns_rdf *algorithm_rdf;
371 ldns_rdf *error_rdf = NULL;
372 ldns_rdf *mac_rdf = NULL;
373 ldns_rdf *other_data_rdf = NULL;
374
375 ldns_status status = LDNS_STATUS_OK;
376
377 uint8_t *pkt_wire = NULL;
378 size_t pkt_wire_len;
379
380 struct timeval tv_time_signed;
381 uint8_t *time_signed = NULL;
382 ldns_rdf *time_signed_rdf = NULL;
383
384 algorithm_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, algorithm_name);
b5dedcca
JL
385 if(!key_name_rdf || !algorithm_rdf) {
386 status = LDNS_STATUS_MEM_ERR;
387 goto clean;
388 }
825eb42b
JL
389
390 /* eww don't have create tsigtime rdf yet :( */
391 /* bleh :p */
392 if (gettimeofday(&tv_time_signed, NULL) == 0) {
393 time_signed = LDNS_XMALLOC(uint8_t, 6);
b5dedcca
JL
394 if(!time_signed) {
395 status = LDNS_STATUS_MEM_ERR;
396 goto clean;
397 }
825eb42b
JL
398 ldns_write_uint64_as_uint48(time_signed,
399 (uint64_t)tv_time_signed.tv_sec);
400 } else {
401 status = LDNS_STATUS_INTERNAL_ERR;
402 goto clean;
403 }
404
405 time_signed_rdf = ldns_rdf_new(LDNS_RDF_TYPE_TSIGTIME, 6, time_signed);
b5dedcca
JL
406 if(!time_signed_rdf) {
407 LDNS_FREE(time_signed);
408 status = LDNS_STATUS_MEM_ERR;
409 goto clean;
410 }
825eb42b
JL
411
412 fudge_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, fudge);
413
414 orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt));
415
416 error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0);
417
418 other_data_rdf = ldns_native2rdf_int16_data(0, NULL);
419
b5dedcca
JL
420 if(!fudge_rdf || !orig_id_rdf || !error_rdf || !other_data_rdf) {
421 status = LDNS_STATUS_MEM_ERR;
422 goto clean;
423 }
fd185f4d 424
825eb42b
JL
425 if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) {
426 status = LDNS_STATUS_ERR;
427 goto clean;
428 }
429
430 status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len,
431 key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
ac996e71 432 time_signed_rdf, error_rdf, other_data_rdf, query_mac, tsig_timers_only);
825eb42b
JL
433
434 if (!mac_rdf) {
435 goto clean;
436 }
437
438 LDNS_FREE(pkt_wire);
439
440 /* Create the TSIG RR */
441 tsig_rr = ldns_rr_new();
b5dedcca
JL
442 if(!tsig_rr) {
443 status = LDNS_STATUS_MEM_ERR;
444 goto clean;
445 }
825eb42b
JL
446 ldns_rr_set_owner(tsig_rr, key_name_rdf);
447 ldns_rr_set_class(tsig_rr, LDNS_RR_CLASS_ANY);
448 ldns_rr_set_type(tsig_rr, LDNS_RR_TYPE_TSIG);
449 ldns_rr_set_ttl(tsig_rr, 0);
450
451 ldns_rr_push_rdf(tsig_rr, algorithm_rdf);
452 ldns_rr_push_rdf(tsig_rr, time_signed_rdf);
453 ldns_rr_push_rdf(tsig_rr, fudge_rdf);
454 ldns_rr_push_rdf(tsig_rr, mac_rdf);
455 ldns_rr_push_rdf(tsig_rr, orig_id_rdf);
456 ldns_rr_push_rdf(tsig_rr, error_rdf);
457 ldns_rr_push_rdf(tsig_rr, other_data_rdf);
458
459 ldns_pkt_set_tsig(pkt, tsig_rr);
460
461 return status;
462
463 clean:
fd185f4d 464 LDNS_FREE(pkt_wire);
825eb42b
JL
465 ldns_rdf_free(key_name_rdf);
466 ldns_rdf_free(algorithm_rdf);
467 ldns_rdf_free(time_signed_rdf);
468 ldns_rdf_free(fudge_rdf);
469 ldns_rdf_free(orig_id_rdf);
470 ldns_rdf_free(error_rdf);
471 ldns_rdf_free(other_data_rdf);
472 return status;
473}
474#endif /* HAVE_SSL */