Disconnect hostapd from building in base
[dragonfly.git] / contrib / ldns / tsig.c
1 /*
2  * tsig.c
3  *
4  * contains the functions needed for TSIG [RFC2845]
5  *
6  * (c) 2005-2006 NLnet Labs
7  * See the file LICENSE for the license
8  */
9
10 #include <ldns/config.h>
11
12 #include <ldns/ldns.h>
13
14 #include <strings.h>
15
16 #ifdef HAVE_SSL
17 #include <openssl/hmac.h>
18 #include <openssl/md5.h>
19 #endif /* HAVE_SSL */
20
21 char *
22 ldns_tsig_algorithm(ldns_tsig_credentials *tc)
23 {
24         return tc->algorithm;
25 }
26
27 char *
28 ldns_tsig_keyname(ldns_tsig_credentials *tc)
29 {
30         return tc->keyname;
31 }
32
33 char *
34 ldns_tsig_keydata(ldns_tsig_credentials *tc)
35 {
36         return tc->keydata;
37 }
38
39 char *
40 ldns_tsig_keyname_clone(ldns_tsig_credentials *tc)
41 {
42         return strdup(tc->keyname);
43 }
44
45 char *
46 ldns_tsig_keydata_clone(ldns_tsig_credentials *tc)
47 {
48         return strdup(tc->keydata);
49 }
50
51 /*
52  *  Makes an exact copy of the wire, but with the tsig rr removed
53  */
54 uint8_t *
55 ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len)
56 {
57         uint8_t *wire2 = NULL;
58         uint16_t qd_count;
59         uint16_t an_count;
60         uint16_t ns_count;
61         uint16_t ar_count;
62         ldns_rr *rr;
63
64         size_t pos;
65         uint16_t i;
66
67         ldns_status status;
68
69         if(wire_len < LDNS_HEADER_SIZE) {
70                 return NULL;
71         }
72         /* fake parse the wire */
73         qd_count = LDNS_QDCOUNT(wire);
74         an_count = LDNS_ANCOUNT(wire);
75         ns_count = LDNS_NSCOUNT(wire);
76         ar_count = LDNS_ARCOUNT(wire);
77
78         if (ar_count > 0) {
79                 ar_count--;
80         } else {
81                 return NULL;
82         }
83
84         pos = LDNS_HEADER_SIZE;
85
86         for (i = 0; i < qd_count; i++) {
87                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_QUESTION);
88                 if (status != LDNS_STATUS_OK) {
89                         return NULL;
90                 }
91                 ldns_rr_free(rr);
92         }
93
94         for (i = 0; i < an_count; i++) {
95                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_ANSWER);
96                 if (status != LDNS_STATUS_OK) {
97                         return NULL;
98                 }
99                 ldns_rr_free(rr);
100         }
101
102         for (i = 0; i < ns_count; i++) {
103                 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_AUTHORITY);
104                 if (status != LDNS_STATUS_OK) {
105                         return NULL;
106                 }
107                 ldns_rr_free(rr);
108         }
109
110         for (i = 0; i < ar_count; i++) {
111                 status = ldns_wire2rr(&rr, wire, wire_len, &pos,
112                                 LDNS_SECTION_ADDITIONAL);
113                 if (status != LDNS_STATUS_OK) {
114                         return NULL;
115                 }
116                 ldns_rr_free(rr);
117         }
118
119         *result_len = pos;
120         wire2 = LDNS_XMALLOC(uint8_t, *result_len);
121         if(!wire2) {
122                 return NULL;
123         }
124         memcpy(wire2, wire, *result_len);
125
126         ldns_write_uint16(wire2 + LDNS_ARCOUNT_OFF, ar_count);
127
128         return wire2;
129 }
130
131 #ifdef HAVE_SSL
132 static const EVP_MD *
133 ldns_digest_function(char *name)
134 {
135         /* these are the mandatory algorithms from RFC4635 */
136         /* The optional algorithms are not yet implemented */
137         if (strlen(name) == 12 
138                         && strncasecmp(name, "hmac-sha256.", 11) == 0) {
139 #ifdef HAVE_EVP_SHA256
140                 return EVP_sha256();
141 #else
142                 return NULL;
143 #endif
144         } else if (strlen(name) == 10
145                         && strncasecmp(name, "hmac-sha1.", 9) == 0) {
146                 return EVP_sha1();
147         } else if (strlen(name) == 25 
148                         && strncasecmp(name, "hmac-md5.sig-alg.reg.int.", 25) 
149                         == 0) {
150                 return EVP_md5();
151         } else {
152                 return NULL;
153         }
154 }
155 #endif
156
157 #ifdef HAVE_SSL
158 static ldns_status
159 ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
160                 const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf,
161                 ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf,
162                 ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
163 {
164         ldns_status status;
165         char *wireformat;
166         int wiresize;
167         unsigned char *mac_bytes = NULL;
168         unsigned char *key_bytes = NULL;
169         int key_size;
170         const EVP_MD *digester;
171         char *algorithm_name = NULL;
172         unsigned int md_len = EVP_MAX_MD_SIZE;
173         ldns_rdf *result = NULL;
174         ldns_buffer *data_buffer = NULL;
175         ldns_rdf *canonical_key_name_rdf = NULL;
176         ldns_rdf *canonical_algorithm_rdf = NULL;
177         
178         if (key_name_rdf == NULL || algorithm_rdf == NULL) {
179                 return LDNS_STATUS_NULL;
180         }
181         canonical_key_name_rdf  = ldns_rdf_clone(key_name_rdf);
182         if (canonical_key_name_rdf == NULL) {
183                 return LDNS_STATUS_MEM_ERR;
184         }
185         canonical_algorithm_rdf = ldns_rdf_clone(algorithm_rdf);
186         if (canonical_algorithm_rdf == NULL) {
187                 ldns_rdf_deep_free(canonical_key_name_rdf);
188                 return LDNS_STATUS_MEM_ERR;
189         }
190         /*
191          * prepare the digestable information
192          */
193         data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
194         if (!data_buffer) {
195                 status = LDNS_STATUS_MEM_ERR;
196                 goto clean;
197         }
198         /* if orig_mac is not NULL, add it too */
199         if (orig_mac_rdf) {
200                 (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
201         }
202         ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size);
203         if (!tsig_timers_only) {
204                 ldns_dname2canonical(canonical_key_name_rdf);
205                 (void)ldns_rdf2buffer_wire(data_buffer, 
206                                 canonical_key_name_rdf);
207                 ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
208                 ldns_buffer_write_u32(data_buffer, 0);
209                 ldns_dname2canonical(canonical_algorithm_rdf);
210                 (void)ldns_rdf2buffer_wire(data_buffer, 
211                                 canonical_algorithm_rdf);
212         }
213         (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf);
214         (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf);
215         if (!tsig_timers_only) {
216                 (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
217                 (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
218         }
219
220         wireformat = (char *) data_buffer->_data;
221         wiresize = (int) ldns_buffer_position(data_buffer);
222
223         algorithm_name = ldns_rdf2str(algorithm_rdf);
224         if(!algorithm_name) {
225                 status = LDNS_STATUS_MEM_ERR;
226                 goto clean;
227         }
228
229         /* prepare the key */
230         key_bytes = LDNS_XMALLOC(unsigned char,
231                         ldns_b64_pton_calculate_size(strlen(key_data)));
232         if(!key_bytes) {
233                 status = LDNS_STATUS_MEM_ERR;
234                 goto clean;
235         }
236         key_size = ldns_b64_pton(key_data, key_bytes,
237         ldns_b64_pton_calculate_size(strlen(key_data)));
238         if (key_size < 0) {
239                 status = LDNS_STATUS_INVALID_B64;
240                 goto clean;
241         }
242         /* hmac it */
243         /* 2 spare bytes for the length */
244         mac_bytes = LDNS_XMALLOC(unsigned char, md_len+2);
245         if(!mac_bytes) {
246                 status = LDNS_STATUS_MEM_ERR;
247                 goto clean;
248         }
249         memset(mac_bytes, 0, md_len+2);
250
251         digester = ldns_digest_function(algorithm_name);
252
253         if (digester) {
254                 (void) HMAC(digester, key_bytes, key_size, (void *)wireformat,
255                             (size_t) wiresize, mac_bytes + 2, &md_len);
256
257                 ldns_write_uint16(mac_bytes, md_len);
258                 result = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_INT16_DATA, md_len + 2,
259                                 mac_bytes);
260         } else {
261                 status = LDNS_STATUS_CRYPTO_UNKNOWN_ALGO;
262                 goto clean;
263         }
264         *tsig_mac = result;
265         status = LDNS_STATUS_OK;
266   clean:
267         LDNS_FREE(mac_bytes);
268         LDNS_FREE(key_bytes);
269         LDNS_FREE(algorithm_name);
270         ldns_buffer_free(data_buffer);
271         ldns_rdf_deep_free(canonical_algorithm_rdf);
272         ldns_rdf_deep_free(canonical_key_name_rdf);
273         return status;
274 }
275 #endif /*  HAVE_SSL */
276
277
278 #ifdef HAVE_SSL
279 bool
280 ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char *key_name,
281         const char *key_data, ldns_rdf *orig_mac_rdf)
282 {
283         return ldns_pkt_tsig_verify_next(pkt, wire, wirelen, key_name, key_data, orig_mac_rdf, 0);
284 }
285
286 bool
287 ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char* key_name,
288         const char *key_data, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
289 {
290         ldns_rdf *fudge_rdf;
291         ldns_rdf *algorithm_rdf;
292         ldns_rdf *time_signed_rdf;
293         ldns_rdf *orig_id_rdf;
294         ldns_rdf *error_rdf;
295         ldns_rdf *other_data_rdf;
296         ldns_rdf *pkt_mac_rdf;
297         ldns_rdf *my_mac_rdf;
298         ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
299         uint16_t pkt_id, orig_pkt_id;
300         ldns_status status;
301
302         uint8_t *prepared_wire = NULL;
303         size_t prepared_wire_size = 0;
304
305         ldns_rr *orig_tsig = ldns_pkt_tsig(pkt);
306
307         if (!orig_tsig || ldns_rr_rd_count(orig_tsig) <= 6) {
308                 ldns_rdf_deep_free(key_name_rdf);
309                 return false;
310         }
311         algorithm_rdf = ldns_rr_rdf(orig_tsig, 0);
312         time_signed_rdf = ldns_rr_rdf(orig_tsig, 1);
313         fudge_rdf = ldns_rr_rdf(orig_tsig, 2);
314         pkt_mac_rdf = ldns_rr_rdf(orig_tsig, 3);
315         orig_id_rdf = ldns_rr_rdf(orig_tsig, 4);
316         error_rdf = ldns_rr_rdf(orig_tsig, 5);
317         other_data_rdf = ldns_rr_rdf(orig_tsig, 6);
318
319         /* remove temporarily */
320         ldns_pkt_set_tsig(pkt, NULL);
321         /* temporarily change the id to the original id */
322         pkt_id = ldns_pkt_id(pkt);
323         orig_pkt_id = ldns_rdf2native_int16(orig_id_rdf);
324         ldns_pkt_set_id(pkt, orig_pkt_id);
325
326         prepared_wire = ldns_tsig_prepare_pkt_wire(wire, wirelen, &prepared_wire_size);
327
328         status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size,
329                         key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
330                         time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf, tsig_timers_only);
331
332         LDNS_FREE(prepared_wire);
333
334         if (status != LDNS_STATUS_OK) {
335                 ldns_rdf_deep_free(key_name_rdf);
336                 return false;
337         }
338         /* Put back the values */
339         ldns_pkt_set_tsig(pkt, orig_tsig);
340         ldns_pkt_set_id(pkt, pkt_id);
341
342         ldns_rdf_deep_free(key_name_rdf);
343
344         if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) {
345                 ldns_rdf_deep_free(my_mac_rdf);
346                 return true;
347         } else {
348                 ldns_rdf_deep_free(my_mac_rdf);
349                 return false;
350         }
351 }
352 #endif /* HAVE_SSL */
353
354 #ifdef HAVE_SSL
355 ldns_status
356 ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
357         uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
358 {
359         return ldns_pkt_tsig_sign_next(pkt, key_name, key_data, fudge, algorithm_name, query_mac, 0);
360 }
361
362 ldns_status
363 ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data,
364         uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only)
365 {
366         ldns_rr *tsig_rr;
367         ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
368         ldns_rdf *fudge_rdf = NULL;
369         ldns_rdf *orig_id_rdf = NULL;
370         ldns_rdf *algorithm_rdf;
371         ldns_rdf *error_rdf = NULL;
372         ldns_rdf *mac_rdf = NULL;
373         ldns_rdf *other_data_rdf = NULL;
374
375         ldns_status status = LDNS_STATUS_OK;
376
377         uint8_t *pkt_wire = NULL;
378         size_t pkt_wire_len;
379
380         struct timeval tv_time_signed;
381         uint8_t *time_signed = NULL;
382         ldns_rdf *time_signed_rdf = NULL;
383
384         algorithm_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, algorithm_name);
385         if(!key_name_rdf || !algorithm_rdf) {
386                 status = LDNS_STATUS_MEM_ERR;
387                 goto clean;
388         }
389
390         /* eww don't have create tsigtime rdf yet :( */
391         /* bleh :p */
392         if (gettimeofday(&tv_time_signed, NULL) == 0) {
393                 time_signed = LDNS_XMALLOC(uint8_t, 6);
394                 if(!time_signed) {
395                         status = LDNS_STATUS_MEM_ERR;
396                         goto clean;
397                 }
398                 ldns_write_uint64_as_uint48(time_signed,
399                                 (uint64_t)tv_time_signed.tv_sec);
400         } else {
401                 status = LDNS_STATUS_INTERNAL_ERR;
402                 goto clean;
403         }
404
405         time_signed_rdf = ldns_rdf_new(LDNS_RDF_TYPE_TSIGTIME, 6, time_signed);
406         if(!time_signed_rdf) {
407                 LDNS_FREE(time_signed);
408                 status = LDNS_STATUS_MEM_ERR;
409                 goto clean;
410         }
411
412         fudge_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, fudge);
413
414         orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt));
415
416         error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0);
417
418         other_data_rdf = ldns_native2rdf_int16_data(0, NULL);
419
420         if(!fudge_rdf || !orig_id_rdf || !error_rdf || !other_data_rdf) {
421                 status = LDNS_STATUS_MEM_ERR;
422                 goto clean;
423         }
424
425         if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) {
426                 status = LDNS_STATUS_ERR;
427                 goto clean;
428         }
429
430         status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len,
431                         key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
432                         time_signed_rdf, error_rdf, other_data_rdf, query_mac, tsig_timers_only);
433
434         if (!mac_rdf) {
435                 goto clean;
436         }
437
438         LDNS_FREE(pkt_wire);
439
440         /* Create the TSIG RR */
441         tsig_rr = ldns_rr_new();
442         if(!tsig_rr) {
443                 status = LDNS_STATUS_MEM_ERR;
444                 goto clean;
445         }
446         ldns_rr_set_owner(tsig_rr, key_name_rdf);
447         ldns_rr_set_class(tsig_rr, LDNS_RR_CLASS_ANY);
448         ldns_rr_set_type(tsig_rr, LDNS_RR_TYPE_TSIG);
449         ldns_rr_set_ttl(tsig_rr, 0);
450
451         ldns_rr_push_rdf(tsig_rr, algorithm_rdf);
452         ldns_rr_push_rdf(tsig_rr, time_signed_rdf);
453         ldns_rr_push_rdf(tsig_rr, fudge_rdf);
454         ldns_rr_push_rdf(tsig_rr, mac_rdf);
455         ldns_rr_push_rdf(tsig_rr, orig_id_rdf);
456         ldns_rr_push_rdf(tsig_rr, error_rdf);
457         ldns_rr_push_rdf(tsig_rr, other_data_rdf);
458
459         ldns_pkt_set_tsig(pkt, tsig_rr);
460
461         return status;
462
463   clean:
464         LDNS_FREE(pkt_wire);
465         ldns_rdf_free(key_name_rdf);
466         ldns_rdf_free(algorithm_rdf);
467         ldns_rdf_free(time_signed_rdf);
468         ldns_rdf_free(fudge_rdf);
469         ldns_rdf_free(orig_id_rdf);
470         ldns_rdf_free(error_rdf);
471         ldns_rdf_free(other_data_rdf);
472         return status;
473 }
474 #endif /* HAVE_SSL */