contrib/bind-9.3/lib/dns/tkey.c

   1 /*
   2  * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /*
  19  * $Id: tkey.c,v 1.71.2.1.10.7 2005/06/12 00:02:26 marka Exp $
  20  */
  21
  22 #include <config.h>
  23
  24 #include <isc/buffer.h>
  25 #include <isc/entropy.h>
  26 #include <isc/md5.h>
  27 #include <isc/mem.h>
  28 #include <isc/string.h>
  29 #include <isc/util.h>
  30
  31 #include <dns/dnssec.h>
  32 #include <dns/fixedname.h>
  33 #include <dns/keyvalues.h>
  34 #include <dns/log.h>
  35 #include <dns/message.h>
  36 #include <dns/name.h>
  37 #include <dns/rdata.h>
  38 #include <dns/rdatalist.h>
  39 #include <dns/rdataset.h>
  40 #include <dns/rdatastruct.h>
  41 #include <dns/result.h>
  42 #include <dns/tkey.h>
  43 #include <dns/tsig.h>
  44
  45 #include <dst/dst.h>
  46 #include <dst/gssapi.h>
  47
  48 #define TKEY_RANDOM_AMOUNT 16
  49
  50 #define RETERR(x) do { \
  51         result = (x); \
  52         if (result != ISC_R_SUCCESS) \
  53                 goto failure; \
  54         } while (0)
  55
  56 static void
  57 tkey_log(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
  58
  59 static void
  60 tkey_log(const char *fmt, ...) {
  61         va_list ap;
  62
  63         va_start(ap, fmt);
  64         isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_GENERAL,
  65                        DNS_LOGMODULE_REQUEST, ISC_LOG_DEBUG(4), fmt, ap);
  66         va_end(ap);
  67 }
  68
  69 isc_result_t
  70 dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
  71 {
  72         dns_tkeyctx_t *tctx;
  73
  74         REQUIRE(mctx != NULL);
  75         REQUIRE(ectx != NULL);
  76         REQUIRE(tctxp != NULL && *tctxp == NULL);
  77
  78         tctx = isc_mem_get(mctx, sizeof(dns_tkeyctx_t));
  79         if (tctx == NULL)
  80                 return (ISC_R_NOMEMORY);
  81         tctx->mctx = NULL;
  82         isc_mem_attach(mctx, &tctx->mctx);
  83         tctx->ectx = NULL;
  84         isc_entropy_attach(ectx, &tctx->ectx);
  85         tctx->dhkey = NULL;
  86         tctx->domain = NULL;
  87         tctx->gsscred = NULL;
  88
  89         *tctxp = tctx;
  90         return (ISC_R_SUCCESS);
  91 }
  92
  93 void
  94 dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
  95         isc_mem_t *mctx;
  96         dns_tkeyctx_t *tctx;
  97
  98         REQUIRE(tctxp != NULL && *tctxp != NULL);
  99
 100         tctx = *tctxp;
 101         mctx = tctx->mctx;
 102
 103         if (tctx->dhkey != NULL)
 104                 dst_key_free(&tctx->dhkey);
 105         if (tctx->domain != NULL) {
 106                 if (dns_name_dynamic(tctx->domain))
 107                         dns_name_free(tctx->domain, mctx);
 108                 isc_mem_put(mctx, tctx->domain, sizeof(dns_name_t));
 109         }
 110         isc_entropy_detach(&tctx->ectx);
 111         isc_mem_put(mctx, tctx, sizeof(dns_tkeyctx_t));
 112         isc_mem_detach(&mctx);
 113         *tctxp = NULL;
 114 }
 115
 116 static isc_result_t
 117 add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 118                 isc_uint32_t ttl, dns_namelist_t *namelist)
 119 {
 120         isc_result_t result;
 121         isc_region_t r, newr;
 122         dns_rdata_t *newrdata = NULL;
 123         dns_name_t *newname = NULL;
 124         dns_rdatalist_t *newlist = NULL;
 125         dns_rdataset_t *newset = NULL;
 126         isc_buffer_t *tmprdatabuf = NULL;
 127
 128         RETERR(dns_message_gettemprdata(msg, &newrdata));
 129
 130         dns_rdata_toregion(rdata, &r);
 131         RETERR(isc_buffer_allocate(msg->mctx, &tmprdatabuf, r.length));
 132         isc_buffer_availableregion(tmprdatabuf, &newr);
 133         memcpy(newr.base, r.base, r.length);
 134         dns_rdata_fromregion(newrdata, rdata->rdclass, rdata->type, &newr);
 135         dns_message_takebuffer(msg, &tmprdatabuf);
 136
 137         RETERR(dns_message_gettempname(msg, &newname));
 138         dns_name_init(newname, NULL);
 139         RETERR(dns_name_dup(name, msg->mctx, newname));
 140
 141         RETERR(dns_message_gettemprdatalist(msg, &newlist));
 142         newlist->rdclass = newrdata->rdclass;
 143         newlist->type = newrdata->type;
 144         newlist->covers = 0;
 145         newlist->ttl = ttl;
 146         ISC_LIST_INIT(newlist->rdata);
 147         ISC_LIST_APPEND(newlist->rdata, newrdata, link);
 148
 149         RETERR(dns_message_gettemprdataset(msg, &newset));
 150         dns_rdataset_init(newset);
 151         RETERR(dns_rdatalist_tordataset(newlist, newset));
 152
 153         ISC_LIST_INIT(newname->list);
 154         ISC_LIST_APPEND(newname->list, newset, link);
 155
 156         ISC_LIST_APPEND(*namelist, newname, link);
 157
 158         return (ISC_R_SUCCESS);
 159
 160  failure:
 161         if (newrdata != NULL) {
 162                 if (ISC_LINK_LINKED(newrdata, link))
 163                         ISC_LIST_UNLINK(newlist->rdata, newrdata, link);
 164                 dns_message_puttemprdata(msg, &newrdata);
 165         }
 166         if (newname != NULL)
 167                 dns_message_puttempname(msg, &newname);
 168         if (newset != NULL) {
 169                 dns_rdataset_disassociate(newset);
 170                 dns_message_puttemprdataset(msg, &newset);
 171         }
 172         if (newlist != NULL)
 173                 dns_message_puttemprdatalist(msg, &newlist);
 174         return (result);
 175 }
 176
 177 static void
 178 free_namelist(dns_message_t *msg, dns_namelist_t *namelist) {
 179         dns_name_t *name;
 180         dns_rdataset_t *set;
 181
 182         while (!ISC_LIST_EMPTY(*namelist)) {
 183                 name = ISC_LIST_HEAD(*namelist);
 184                 ISC_LIST_UNLINK(*namelist, name, link);
 185                 while (!ISC_LIST_EMPTY(name->list)) {
 186                         set = ISC_LIST_HEAD(name->list);
 187                         ISC_LIST_UNLINK(name->list, set, link);
 188                         dns_message_puttemprdataset(msg, &set);
 189                 }
 190                 dns_message_puttempname(msg, &name);
 191         }
 192 }
 193
 194 static isc_result_t
 195 compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
 196                isc_region_t *serverrandomness, isc_buffer_t *secret)
 197 {
 198         isc_md5_t md5ctx;
 199         isc_region_t r, r2;
 200         unsigned char digests[32];
 201         unsigned int i;
 202
 203         isc_buffer_usedregion(shared, &r);
 204
 205         /*
 206          * MD5 ( query data | DH value ).
 207          */
 208         isc_md5_init(&md5ctx);
 209         isc_md5_update(&md5ctx, queryrandomness->base,
 210                        queryrandomness->length);
 211         isc_md5_update(&md5ctx, r.base, r.length);
 212         isc_md5_final(&md5ctx, digests);
 213
 214         /*
 215          * MD5 ( server data | DH value ).
 216          */
 217         isc_md5_init(&md5ctx);
 218         isc_md5_update(&md5ctx, serverrandomness->base,
 219                        serverrandomness->length);
 220         isc_md5_update(&md5ctx, r.base, r.length);
 221         isc_md5_final(&md5ctx, &digests[ISC_MD5_DIGESTLENGTH]);
 222
 223         /*
 224          * XOR ( DH value, MD5-1 | MD5-2).
 225          */
 226         isc_buffer_availableregion(secret, &r);
 227         isc_buffer_usedregion(shared, &r2);
 228         if (r.length < sizeof(digests) || r.length < r2.length)
 229                 return (ISC_R_NOSPACE);
 230         if (r2.length > sizeof(digests)) {
 231                 memcpy(r.base, r2.base, r2.length);
 232                 for (i = 0; i < sizeof(digests); i++)
 233                         r.base[i] ^= digests[i];
 234                 isc_buffer_add(secret, r2.length);
 235         } else {
 236                 memcpy(r.base, digests, sizeof(digests));
 237                 for (i = 0; i < r2.length; i++)
 238                         r.base[i] ^= r2.base[i];
 239                 isc_buffer_add(secret, sizeof(digests));
 240         }
 241         return (ISC_R_SUCCESS);
 242
 243 }
 244
 245 static isc_result_t
 246 process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 247                dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 248                dns_rdata_tkey_t *tkeyout,
 249                dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 250 {
 251         isc_result_t result = ISC_R_SUCCESS;
 252         dns_name_t *keyname, ourname;
 253         dns_rdataset_t *keyset = NULL;
 254         dns_rdata_t keyrdata = DNS_RDATA_INIT, ourkeyrdata = DNS_RDATA_INIT;
 255         isc_boolean_t found_key = ISC_FALSE, found_incompatible = ISC_FALSE;
 256         dst_key_t *pubkey = NULL;
 257         isc_buffer_t ourkeybuf, *shared = NULL;
 258         isc_region_t r, r2, ourkeyr;
 259         unsigned char keydata[DST_KEY_MAXSIZE];
 260         unsigned int sharedsize;
 261         isc_buffer_t secret;
 262         unsigned char *randomdata = NULL, secretdata[256];
 263         dns_ttl_t ttl = 0;
 264
 265         if (tctx->dhkey == NULL) {
 266                 tkey_log("process_dhtkey: tkey-dhkey not defined");
 267                 tkeyout->error = dns_tsigerror_badalg;
 268                 return (DNS_R_REFUSED);
 269         }
 270
 271         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
 272                 tkey_log("process_dhtkey: algorithms other than "
 273                          "hmac-md5 are not supported");
 274                 tkeyout->error = dns_tsigerror_badalg;
 275                 return (ISC_R_SUCCESS);
 276         }
 277
 278         /*
 279          * Look for a DH KEY record that will work with ours.
 280          */
 281         for (result = dns_message_firstname(msg, DNS_SECTION_ADDITIONAL);
 282              result == ISC_R_SUCCESS && !found_key;
 283              result = dns_message_nextname(msg, DNS_SECTION_ADDITIONAL))
 284         {
 285                 keyname = NULL;
 286                 dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
 287                 keyset = NULL;
 288                 result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
 289                                               &keyset);
 290                 if (result != ISC_R_SUCCESS)
 291                         continue;
 292
 293                 for (result = dns_rdataset_first(keyset);
 294                      result == ISC_R_SUCCESS && !found_key;
 295                      result = dns_rdataset_next(keyset))
 296                 {
 297                         dns_rdataset_current(keyset, &keyrdata);
 298                         pubkey = NULL;
 299                         result = dns_dnssec_keyfromrdata(keyname, &keyrdata,
 300                                                          msg->mctx, &pubkey);
 301                         if (result != ISC_R_SUCCESS) {
 302                                 dns_rdata_reset(&keyrdata);
 303                                 continue;
 304                         }
 305                         if (dst_key_alg(pubkey) == DNS_KEYALG_DH) {
 306                                 if (dst_key_paramcompare(pubkey, tctx->dhkey))
 307                                 {
 308                                         found_key = ISC_TRUE;
 309                                         ttl = keyset->ttl;
 310                                         break;
 311                                 } else
 312                                         found_incompatible = ISC_TRUE;
 313                         }
 314                         dst_key_free(&pubkey);
 315                         dns_rdata_reset(&keyrdata);
 316                 }
 317         }
 318
 319         if (!found_key) {
 320                 if (found_incompatible) {
 321                         tkey_log("process_dhtkey: found an incompatible key");
 322                         tkeyout->error = dns_tsigerror_badkey;
 323                         return (ISC_R_SUCCESS);
 324                 } else {
 325                         tkey_log("process_dhtkey: failed to find a key");
 326                         return (DNS_R_FORMERR);
 327                 }
 328         }
 329
 330         RETERR(add_rdata_to_list(msg, keyname, &keyrdata, ttl, namelist));
 331
 332         isc_buffer_init(&ourkeybuf, keydata, sizeof(keydata));
 333         RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
 334         isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
 335         dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
 336                              dns_rdatatype_key, &ourkeyr);
 337
 338         dns_name_init(&ourname, NULL);
 339         dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
 340
 341         /*
 342          * XXXBEW The TTL should be obtained from the database, if it exists.
 343          */
 344         RETERR(add_rdata_to_list(msg, &ourname, &ourkeyrdata, 0, namelist));
 345
 346         RETERR(dst_key_secretsize(tctx->dhkey, &sharedsize));
 347         RETERR(isc_buffer_allocate(msg->mctx, &shared, sharedsize));
 348
 349         result = dst_key_computesecret(pubkey, tctx->dhkey, shared);
 350         if (result != ISC_R_SUCCESS) {
 351                 tkey_log("process_dhtkey: failed to compute shared secret: %s",
 352                          isc_result_totext(result));
 353                 goto failure;
 354         }
 355         dst_key_free(&pubkey);
 356
 357         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
 358
 359         randomdata = isc_mem_get(tkeyout->mctx, TKEY_RANDOM_AMOUNT);
 360         if (randomdata == NULL)
 361                 goto failure;
 362
 363         result = isc_entropy_getdata(tctx->ectx, randomdata,
 364                                      TKEY_RANDOM_AMOUNT, NULL, 0);
 365         if (result != ISC_R_SUCCESS) {
 366                 tkey_log("process_dhtkey: failed to obtain entropy: %s",
 367                          isc_result_totext(result));
 368                 goto failure;
 369         }
 370
 371         r.base = randomdata;
 372         r.length = TKEY_RANDOM_AMOUNT;
 373         r2.base = tkeyin->key;
 374         r2.length = tkeyin->keylen;
 375         RETERR(compute_secret(shared, &r2, &r, &secret));
 376         isc_buffer_free(&shared);
 377
 378         RETERR(dns_tsigkey_create(name, &tkeyin->algorithm,
 379                                   isc_buffer_base(&secret),
 380                                   isc_buffer_usedlength(&secret),
 381                                   ISC_TRUE, signer, tkeyin->inception,
 382                                   tkeyin->expire, msg->mctx, ring, NULL));
 383
 384         /* This key is good for a long time */
 385         tkeyout->inception = tkeyin->inception;
 386         tkeyout->expire = tkeyin->expire;
 387
 388         tkeyout->key = randomdata;
 389         tkeyout->keylen = TKEY_RANDOM_AMOUNT;
 390
 391         return (ISC_R_SUCCESS);
 392
 393  failure:
 394         if (!ISC_LIST_EMPTY(*namelist))
 395                 free_namelist(msg, namelist);
 396         if (shared != NULL)
 397                 isc_buffer_free(&shared);
 398         if (pubkey != NULL)
 399                 dst_key_free(&pubkey);
 400         if (randomdata != NULL)
 401                 isc_mem_put(tkeyout->mctx, randomdata, TKEY_RANDOM_AMOUNT);
 402         return (result);
 403 }
 404
 405 static isc_result_t
 406 process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 407                 dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 408                 dns_rdata_tkey_t *tkeyout,
 409                 dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 410 {
 411         isc_result_t result = ISC_R_SUCCESS;
 412         dst_key_t *dstkey = NULL;
 413         void *gssctx = NULL;
 414         isc_stdtime_t now;
 415         isc_region_t intoken;
 416         unsigned char array[1024];
 417         isc_buffer_t outtoken;
 418
 419         UNUSED(namelist);
 420
 421         if (tctx->gsscred == NULL)
 422                 return (ISC_R_NOPERM);
 423
 424         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPI_NAME) &&
 425             !dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPIMS_NAME)) {
 426                 tkeyout->error = dns_tsigerror_badalg;
 427                 return (ISC_R_SUCCESS);
 428         }
 429
 430         intoken.base = tkeyin->key;
 431         intoken.length = tkeyin->keylen;
 432
 433         isc_buffer_init(&outtoken, array, sizeof(array));
 434         RETERR(dst_gssapi_acceptctx(name, tctx->gsscred, &intoken,
 435                                     &outtoken, &gssctx));
 436
 437         dstkey = NULL;
 438         RETERR(dst_key_fromgssapi(name, gssctx, msg->mctx, &dstkey));
 439
 440         result = dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
 441                                            dstkey, ISC_TRUE, signer,
 442                                            tkeyin->inception, tkeyin->expire,
 443                                            msg->mctx, ring, NULL);
 444         if (result != ISC_R_SUCCESS)
 445                 goto failure;
 446
 447         if (result == ISC_R_NOTFOUND) {
 448                 tkeyout->error = dns_tsigerror_badalg;
 449                 return (ISC_R_SUCCESS);
 450         }
 451         if (result != ISC_R_SUCCESS)
 452                 goto failure;
 453
 454         /* This key is good for a long time */
 455         isc_stdtime_get(&now);
 456         tkeyout->inception = tkeyin->inception;
 457         tkeyout->expire = tkeyin->expire;
 458
 459         tkeyout->key = isc_mem_get(msg->mctx,
 460                                    isc_buffer_usedlength(&outtoken));
 461         if (tkeyout->key == NULL) {
 462                 result = ISC_R_NOMEMORY;
 463                 goto failure;
 464         }
 465         tkeyout->keylen = isc_buffer_usedlength(&outtoken);
 466         memcpy(tkeyout->key, isc_buffer_base(&outtoken), tkeyout->keylen);
 467
 468         return (ISC_R_SUCCESS);
 469
 470  failure:
 471         if (dstkey != NULL)
 472                 dst_key_free(&dstkey);
 473
 474         return (result);
 475 }
 476
 477 static isc_result_t
 478 process_deletetkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 479                    dns_rdata_tkey_t *tkeyin,
 480                    dns_rdata_tkey_t *tkeyout,
 481                    dns_tsig_keyring_t *ring,
 482                    dns_namelist_t *namelist)
 483 {
 484         isc_result_t result;
 485         dns_tsigkey_t *tsigkey = NULL;
 486         dns_name_t *identity;
 487
 488         UNUSED(msg);
 489         UNUSED(namelist);
 490
 491         result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 492         if (result != ISC_R_SUCCESS) {
 493                 tkeyout->error = dns_tsigerror_badname;
 494                 return (ISC_R_SUCCESS);
 495         }
 496
 497         /*
 498          * Only allow a delete if the identity that created the key is the
 499          * same as the identity that signed the message.
 500          */
 501         identity = dns_tsigkey_identity(tsigkey);
 502         if (identity == NULL || !dns_name_equal(identity, signer)) {
 503                 dns_tsigkey_detach(&tsigkey);
 504                 return (DNS_R_REFUSED);
 505         }
 506
 507         /*
 508          * Set the key to be deleted when no references are left.  If the key
 509          * was not generated with TKEY and is in the config file, it may be
 510          * reloaded later.
 511          */
 512         dns_tsigkey_setdeleted(tsigkey);
 513
 514         /* Release the reference */
 515         dns_tsigkey_detach(&tsigkey);
 516
 517         return (ISC_R_SUCCESS);
 518 }
 519
 520 isc_result_t
 521 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 522                       dns_tsig_keyring_t *ring)
 523 {
 524         isc_result_t result = ISC_R_SUCCESS;
 525         dns_rdata_tkey_t tkeyin, tkeyout;
 526         isc_boolean_t freetkeyin = ISC_FALSE;
 527         dns_name_t *qname, *name, *keyname, *signer, tsigner;
 528         dns_fixedname_t fkeyname;
 529         dns_rdataset_t *tkeyset;
 530         dns_rdata_t rdata;
 531         dns_namelist_t namelist;
 532         char tkeyoutdata[512];
 533         isc_buffer_t tkeyoutbuf;
 534
 535         REQUIRE(msg != NULL);
 536         REQUIRE(tctx != NULL);
 537         REQUIRE(ring != NULL);
 538
 539         ISC_LIST_INIT(namelist);
 540
 541         /*
 542          * Interpret the question section.
 543          */
 544         result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 545         if (result != ISC_R_SUCCESS)
 546                 return (DNS_R_FORMERR);
 547
 548         qname = NULL;
 549         dns_message_currentname(msg, DNS_SECTION_QUESTION, &qname);
 550
 551         /*
 552          * Look for a TKEY record that matches the question.
 553          */
 554         tkeyset = NULL;
 555         name = NULL;
 556         result = dns_message_findname(msg, DNS_SECTION_ADDITIONAL, qname,
 557                                       dns_rdatatype_tkey, 0, &name, &tkeyset);
 558         if (result != ISC_R_SUCCESS) {
 559                 /*
 560                  * Try the answer section, since that's where Win2000
 561                  * puts it.
 562                  */
 563                 if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
 564                                          dns_rdatatype_tkey, 0, &name,
 565                                          &tkeyset) != ISC_R_SUCCESS)
 566                 {
 567                         result = DNS_R_FORMERR;
 568                         tkey_log("dns_tkey_processquery: couldn't find a TKEY "
 569                                  "matching the question");
 570                         goto failure;
 571                 }
 572         }
 573         result = dns_rdataset_first(tkeyset);
 574         if (result != ISC_R_SUCCESS) {
 575                 result = DNS_R_FORMERR;
 576                 goto failure;
 577         }
 578         dns_rdata_init(&rdata);
 579         dns_rdataset_current(tkeyset, &rdata);
 580
 581         RETERR(dns_rdata_tostruct(&rdata, &tkeyin, NULL));
 582         freetkeyin = ISC_TRUE;
 583
 584         if (tkeyin.error != dns_rcode_noerror) {
 585                 result = DNS_R_FORMERR;
 586                 goto failure;
 587         }
 588
 589         /*
 590          * Before we go any farther, verify that the message was signed.
 591          * GSSAPI TKEY doesn't require a signature, the rest do.
 592          */
 593         dns_name_init(&tsigner, NULL);
 594         result = dns_message_signer(msg, &tsigner);
 595         if (result != ISC_R_SUCCESS) {
 596                 if (tkeyin.mode == DNS_TKEYMODE_GSSAPI &&
 597                     result == ISC_R_NOTFOUND)
 598                        signer = NULL;
 599                 else {
 600                         tkey_log("dns_tkey_processquery: query was not "
 601                                  "properly signed - rejecting");
 602                         result = DNS_R_FORMERR;
 603                         goto failure;
 604                 }
 605         } else
 606                 signer = &tsigner;
 607
 608         tkeyout.common.rdclass = tkeyin.common.rdclass;
 609         tkeyout.common.rdtype = tkeyin.common.rdtype;
 610         ISC_LINK_INIT(&tkeyout.common, link);
 611         tkeyout.mctx = msg->mctx;
 612
 613         dns_name_init(&tkeyout.algorithm, NULL);
 614         dns_name_clone(&tkeyin.algorithm, &tkeyout.algorithm);
 615
 616         tkeyout.inception = tkeyout.expire = 0;
 617         tkeyout.mode = tkeyin.mode;
 618         tkeyout.error = 0;
 619         tkeyout.keylen = tkeyout.otherlen = 0;
 620         tkeyout.key = tkeyout.other = NULL;
 621
 622         /*
 623          * A delete operation must have a fully specified key name.  If this
 624          * is not a delete, we do the following:
 625          * if (qname != ".")
 626          *      keyname = qname + defaultdomain
 627          * else
 628          *      keyname = <random hex> + defaultdomain
 629          */
 630         if (tkeyin.mode != DNS_TKEYMODE_DELETE) {
 631                 dns_tsigkey_t *tsigkey = NULL;
 632
 633                 if (tctx->domain == NULL) {
 634                         tkey_log("dns_tkey_processquery: tkey-domain not set");
 635                         result = DNS_R_REFUSED;
 636                         goto failure;
 637                 }
 638
 639                 dns_fixedname_init(&fkeyname);
 640                 keyname = dns_fixedname_name(&fkeyname);
 641
 642                 if (!dns_name_equal(qname, dns_rootname)) {
 643                         unsigned int n = dns_name_countlabels(qname);
 644                         RUNTIME_CHECK(dns_name_copy(qname, keyname, NULL)
 645                                       == ISC_R_SUCCESS);
 646                         dns_name_getlabelsequence(keyname, 0, n - 1, keyname);
 647                 } else {
 648                         static char hexdigits[16] = {
 649                                 '0', '1', '2', '3', '4', '5', '6', '7',
 650                                 '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
 651                         unsigned char randomdata[16];
 652                         char randomtext[32];
 653                         isc_buffer_t b;
 654                         unsigned int i, j;
 655
 656                         result = isc_entropy_getdata(tctx->ectx,
 657                                                      randomdata,
 658                                                      sizeof(randomdata),
 659                                                      NULL, 0);
 660                         if (result != ISC_R_SUCCESS)
 661                                 goto failure;
 662
 663                         for (i = 0, j = 0; i < sizeof(randomdata); i++) {
 664                                 unsigned char val = randomdata[i];
 665                                 randomtext[j++] = hexdigits[val >> 4];
 666                                 randomtext[j++] = hexdigits[val & 0xF];
 667                         }
 668                         isc_buffer_init(&b, randomtext, sizeof(randomtext));
 669                         isc_buffer_add(&b, sizeof(randomtext));
 670                         result = dns_name_fromtext(keyname, &b, NULL,
 671                                                    ISC_FALSE, NULL);
 672                         if (result != ISC_R_SUCCESS)
 673                                 goto failure;
 674                 }
 675                 result = dns_name_concatenate(keyname, tctx->domain,
 676                                               keyname, NULL);
 677                 if (result != ISC_R_SUCCESS)
 678                         goto failure;
 679
 680                 result = dns_tsigkey_find(&tsigkey, keyname, NULL, ring);
 681                 if (result == ISC_R_SUCCESS) {
 682                         tkeyout.error = dns_tsigerror_badname;
 683                         dns_tsigkey_detach(&tsigkey);
 684                         goto failure_with_tkey;
 685                 } else if (result != ISC_R_NOTFOUND)
 686                         goto failure;
 687         } else
 688                 keyname = qname;
 689
 690         switch (tkeyin.mode) {
 691                 case DNS_TKEYMODE_DIFFIEHELLMAN:
 692                         tkeyout.error = dns_rcode_noerror;
 693                         RETERR(process_dhtkey(msg, signer, keyname, &tkeyin,
 694                                               tctx, &tkeyout, ring,
 695                                               &namelist));
 696                         break;
 697                 case DNS_TKEYMODE_GSSAPI:
 698                         tkeyout.error = dns_rcode_noerror;
 699                         RETERR(process_gsstkey(msg, signer, keyname, &tkeyin,
 700                                                tctx, &tkeyout, ring,
 701                                                &namelist));
 702                         break;
 703                 case DNS_TKEYMODE_DELETE:
 704                         tkeyout.error = dns_rcode_noerror;
 705                         RETERR(process_deletetkey(msg, signer, keyname,
 706                                                   &tkeyin, &tkeyout,
 707                                                   ring, &namelist));
 708                         break;
 709                 case DNS_TKEYMODE_SERVERASSIGNED:
 710                 case DNS_TKEYMODE_RESOLVERASSIGNED:
 711                         result = DNS_R_NOTIMP;
 712                         goto failure;
 713                 default:
 714                         tkeyout.error = dns_tsigerror_badmode;
 715         }
 716
 717  failure_with_tkey:
 718         dns_rdata_init(&rdata);
 719         isc_buffer_init(&tkeyoutbuf, tkeyoutdata, sizeof(tkeyoutdata));
 720         result = dns_rdata_fromstruct(&rdata, tkeyout.common.rdclass,
 721                                       tkeyout.common.rdtype, &tkeyout,
 722                                       &tkeyoutbuf);
 723
 724         if (freetkeyin) {
 725                 dns_rdata_freestruct(&tkeyin);
 726                 freetkeyin = ISC_FALSE;
 727         }
 728
 729         if (tkeyout.key != NULL)
 730                 isc_mem_put(msg->mctx, tkeyout.key, tkeyout.keylen);
 731         if (tkeyout.other != NULL)
 732                 isc_mem_put(msg->mctx, tkeyout.other, tkeyout.otherlen);
 733         if (result != ISC_R_SUCCESS)
 734                 goto failure;
 735
 736         RETERR(add_rdata_to_list(msg, keyname, &rdata, 0, &namelist));
 737
 738         RETERR(dns_message_reply(msg, ISC_TRUE));
 739
 740         name = ISC_LIST_HEAD(namelist);
 741         while (name != NULL) {
 742                 dns_name_t *next = ISC_LIST_NEXT(name, link);
 743                 ISC_LIST_UNLINK(namelist, name, link);
 744                 dns_message_addname(msg, name, DNS_SECTION_ANSWER);
 745                 name = next;
 746         }
 747
 748         return (ISC_R_SUCCESS);
 749
 750  failure:
 751         if (freetkeyin)
 752                 dns_rdata_freestruct(&tkeyin);
 753         if (!ISC_LIST_EMPTY(namelist))
 754                 free_namelist(msg, &namelist);
 755         return (result);
 756 }
 757
 758 static isc_result_t
 759 buildquery(dns_message_t *msg, dns_name_t *name,
 760            dns_rdata_tkey_t *tkey)
 761 {
 762         dns_name_t *qname = NULL, *aname = NULL;
 763         dns_rdataset_t *question = NULL, *tkeyset = NULL;
 764         dns_rdatalist_t *tkeylist = NULL;
 765         dns_rdata_t *rdata = NULL;
 766         isc_buffer_t *dynbuf = NULL;
 767         isc_result_t result;
 768
 769         REQUIRE(msg != NULL);
 770         REQUIRE(name != NULL);
 771         REQUIRE(tkey != NULL);
 772
 773         RETERR(dns_message_gettempname(msg, &qname));
 774         RETERR(dns_message_gettempname(msg, &aname));
 775
 776         RETERR(dns_message_gettemprdataset(msg, &question));
 777         dns_rdataset_init(question);
 778         dns_rdataset_makequestion(question, dns_rdataclass_any,
 779                                   dns_rdatatype_tkey);
 780
 781         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 512));
 782         RETERR(dns_message_gettemprdata(msg, &rdata));
 783         RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
 784                                     dns_rdatatype_tkey, tkey, dynbuf));
 785         dns_message_takebuffer(msg, &dynbuf);
 786
 787         RETERR(dns_message_gettemprdatalist(msg, &tkeylist));
 788         tkeylist->rdclass = dns_rdataclass_any;
 789         tkeylist->type = dns_rdatatype_tkey;
 790         tkeylist->covers = 0;
 791         tkeylist->ttl = 0;
 792         ISC_LIST_INIT(tkeylist->rdata);
 793         ISC_LIST_APPEND(tkeylist->rdata, rdata, link);
 794
 795         RETERR(dns_message_gettemprdataset(msg, &tkeyset));
 796         dns_rdataset_init(tkeyset);
 797         RETERR(dns_rdatalist_tordataset(tkeylist, tkeyset));
 798
 799         dns_name_init(qname, NULL);
 800         dns_name_clone(name, qname);
 801
 802         dns_name_init(aname, NULL);
 803         dns_name_clone(name, aname);
 804
 805         ISC_LIST_APPEND(qname->list, question, link);
 806         ISC_LIST_APPEND(aname->list, tkeyset, link);
 807
 808         dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
 809         dns_message_addname(msg, aname, DNS_SECTION_ADDITIONAL);
 810
 811         return (ISC_R_SUCCESS);
 812
 813  failure:
 814         if (qname != NULL)
 815                 dns_message_puttempname(msg, &qname);
 816         if (aname != NULL)
 817                 dns_message_puttempname(msg, &aname);
 818         if (question != NULL) {
 819                 dns_rdataset_disassociate(question);
 820                 dns_message_puttemprdataset(msg, &question);
 821         }
 822         if (dynbuf != NULL)
 823                 isc_buffer_free(&dynbuf);
 824         return (result);
 825 }
 826
 827 isc_result_t
 828 dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 829                       dns_name_t *algorithm, isc_buffer_t *nonce,
 830                       isc_uint32_t lifetime)
 831 {
 832         dns_rdata_tkey_t tkey;
 833         dns_rdata_t *rdata = NULL;
 834         isc_buffer_t *dynbuf = NULL;
 835         isc_region_t r;
 836         dns_name_t keyname;
 837         dns_namelist_t namelist;
 838         isc_result_t result;
 839         isc_stdtime_t now;
 840
 841         REQUIRE(msg != NULL);
 842         REQUIRE(key != NULL);
 843         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
 844         REQUIRE(dst_key_isprivate(key));
 845         REQUIRE(name != NULL);
 846         REQUIRE(algorithm != NULL);
 847
 848         tkey.common.rdclass = dns_rdataclass_any;
 849         tkey.common.rdtype = dns_rdatatype_tkey;
 850         ISC_LINK_INIT(&tkey.common, link);
 851         tkey.mctx = msg->mctx;
 852         dns_name_init(&tkey.algorithm, NULL);
 853         dns_name_clone(algorithm, &tkey.algorithm);
 854         isc_stdtime_get(&now);
 855         tkey.inception = now;
 856         tkey.expire = now + lifetime;
 857         tkey.mode = DNS_TKEYMODE_DIFFIEHELLMAN;
 858         if (nonce != NULL)
 859                 isc_buffer_usedregion(nonce, &r);
 860         else {
 861                 r.base = isc_mem_get(msg->mctx, 0);
 862                 r.length = 0;
 863         }
 864         tkey.error = 0;
 865         tkey.key = r.base;
 866         tkey.keylen =  r.length;
 867         tkey.other = NULL;
 868         tkey.otherlen = 0;
 869
 870         RETERR(buildquery(msg, name, &tkey));
 871
 872         if (nonce == NULL)
 873                 isc_mem_put(msg->mctx, r.base, 0);
 874
 875         RETERR(dns_message_gettemprdata(msg, &rdata));
 876         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
 877         RETERR(dst_key_todns(key, dynbuf));
 878         isc_buffer_usedregion(dynbuf, &r);
 879         dns_rdata_fromregion(rdata, dns_rdataclass_any,
 880                              dns_rdatatype_key, &r);
 881         dns_message_takebuffer(msg, &dynbuf);
 882
 883         dns_name_init(&keyname, NULL);
 884         dns_name_clone(dst_key_name(key), &keyname);
 885
 886         ISC_LIST_INIT(namelist);
 887         RETERR(add_rdata_to_list(msg, &keyname, rdata, 0, &namelist));
 888         dns_message_addname(msg, ISC_LIST_HEAD(namelist),
 889                             DNS_SECTION_ADDITIONAL);
 890
 891         return (ISC_R_SUCCESS);
 892
 893  failure:
 894
 895         if (dynbuf != NULL)
 896                 isc_buffer_free(&dynbuf);
 897         return (result);
 898 }
 899
 900 isc_result_t
 901 dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name,
 902                        dns_name_t *gname, void *cred,
 903                        isc_uint32_t lifetime, void **context)
 904 {
 905         dns_rdata_tkey_t tkey;
 906         isc_result_t result;
 907         isc_stdtime_t now;
 908         isc_buffer_t token;
 909         unsigned char array[1024];
 910
 911         REQUIRE(msg != NULL);
 912         REQUIRE(name != NULL);
 913         REQUIRE(gname != NULL);
 914         REQUIRE(context != NULL && *context == NULL);
 915
 916         isc_buffer_init(&token, array, sizeof(array));
 917         result = dst_gssapi_initctx(gname, cred, NULL, &token, context);
 918         if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
 919                 return (result);
 920
 921         tkey.common.rdclass = dns_rdataclass_any;
 922         tkey.common.rdtype = dns_rdatatype_tkey;
 923         ISC_LINK_INIT(&tkey.common, link);
 924         tkey.mctx = NULL;
 925         dns_name_init(&tkey.algorithm, NULL);
 926         dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 927         isc_stdtime_get(&now);
 928         tkey.inception = now;
 929         tkey.expire = now + lifetime;
 930         tkey.mode = DNS_TKEYMODE_GSSAPI;
 931         tkey.error = 0;
 932         tkey.key = isc_buffer_base(&token);
 933         tkey.keylen = isc_buffer_usedlength(&token);
 934         tkey.other = NULL;
 935         tkey.otherlen = 0;
 936
 937         RETERR(buildquery(msg, name, &tkey));
 938
 939         return (ISC_R_SUCCESS);
 940
 941  failure:
 942         return (result);
 943 }
 944
 945 isc_result_t
 946 dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key) {
 947         dns_rdata_tkey_t tkey;
 948
 949         REQUIRE(msg != NULL);
 950         REQUIRE(key != NULL);
 951
 952         tkey.common.rdclass = dns_rdataclass_any;
 953         tkey.common.rdtype = dns_rdatatype_tkey;
 954         ISC_LINK_INIT(&tkey.common, link);
 955         tkey.mctx = msg->mctx;
 956         dns_name_init(&tkey.algorithm, NULL);
 957         dns_name_clone(key->algorithm, &tkey.algorithm);
 958         tkey.inception = tkey.expire = 0;
 959         tkey.mode = DNS_TKEYMODE_DELETE;
 960         tkey.error = 0;
 961         tkey.keylen = tkey.otherlen = 0;
 962         tkey.key = tkey.other = NULL;
 963
 964         return (buildquery(msg, &key->name, &tkey));
 965 }
 966
 967 static isc_result_t
 968 find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 969           int section)
 970 {
 971         dns_rdataset_t *tkeyset;
 972         isc_result_t result;
 973
 974         result = dns_message_firstname(msg, section);
 975         while (result == ISC_R_SUCCESS) {
 976                 *name = NULL;
 977                 dns_message_currentname(msg, section, name);
 978                 tkeyset = NULL;
 979                 result = dns_message_findtype(*name, dns_rdatatype_tkey, 0,
 980                                               &tkeyset);
 981                 if (result == ISC_R_SUCCESS) {
 982                         result = dns_rdataset_first(tkeyset);
 983                         if (result != ISC_R_SUCCESS)
 984                                 return (result);
 985                         dns_rdataset_current(tkeyset, rdata);
 986                         return (ISC_R_SUCCESS);
 987                 }
 988                 result = dns_message_nextname(msg, section);
 989         }
 990         if (result == ISC_R_NOMORE)
 991                 return (ISC_R_NOTFOUND);
 992         return (result);
 993 }
 994
 995 isc_result_t
 996 dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 997                            dst_key_t *key, isc_buffer_t *nonce,
 998                            dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
 999 {
1000         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1001         dns_name_t keyname, *tkeyname, *theirkeyname, *ourkeyname, *tempname;
1002         dns_rdataset_t *theirkeyset = NULL, *ourkeyset = NULL;
1003         dns_rdata_t theirkeyrdata = DNS_RDATA_INIT;
1004         dst_key_t *theirkey = NULL;
1005         dns_rdata_tkey_t qtkey, rtkey;
1006         unsigned char secretdata[256];
1007         unsigned int sharedsize;
1008         isc_buffer_t *shared = NULL, secret;
1009         isc_region_t r, r2;
1010         isc_result_t result;
1011         isc_boolean_t freertkey = ISC_FALSE;
1012
1013         REQUIRE(qmsg != NULL);
1014         REQUIRE(rmsg != NULL);
1015         REQUIRE(key != NULL);
1016         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
1017         REQUIRE(dst_key_isprivate(key));
1018         if (outkey != NULL)
1019                 REQUIRE(*outkey == NULL);
1020
1021         if (rmsg->rcode != dns_rcode_noerror)
1022                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1023         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1024         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1025         freertkey = ISC_TRUE;
1026
1027         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1028                          DNS_SECTION_ADDITIONAL));
1029         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1030
1031         if (rtkey.error != dns_rcode_noerror ||
1032             rtkey.mode != DNS_TKEYMODE_DIFFIEHELLMAN ||
1033             rtkey.mode != qtkey.mode ||
1034             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1035             rmsg->rcode != dns_rcode_noerror)
1036         {
1037                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1038                          "or error set");
1039                 result = DNS_R_INVALIDTKEY;
1040                 dns_rdata_freestruct(&qtkey);
1041                 goto failure;
1042         }
1043
1044         dns_rdata_freestruct(&qtkey);
1045
1046         dns_name_init(&keyname, NULL);
1047         dns_name_clone(dst_key_name(key), &keyname);
1048
1049         ourkeyname = NULL;
1050         ourkeyset = NULL;
1051         RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
1052                                     dns_rdatatype_key, 0, &ourkeyname,
1053                                     &ourkeyset));
1054
1055         result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
1056         while (result == ISC_R_SUCCESS) {
1057                 theirkeyname = NULL;
1058                 dns_message_currentname(rmsg, DNS_SECTION_ANSWER,
1059                                         &theirkeyname);
1060                 if (dns_name_equal(theirkeyname, ourkeyname))
1061                         goto next;
1062                 theirkeyset = NULL;
1063                 result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
1064                                               0, &theirkeyset);
1065                 if (result == ISC_R_SUCCESS) {
1066                         RETERR(dns_rdataset_first(theirkeyset));
1067                         break;
1068                 }
1069  next:
1070                 result = dns_message_nextname(rmsg, DNS_SECTION_ANSWER);
1071         }
1072
1073         if (theirkeyset == NULL) {
1074                 tkey_log("dns_tkey_processdhresponse: failed to find server "
1075                          "key");
1076                 result = ISC_R_NOTFOUND;
1077                 goto failure;
1078         }
1079
1080         dns_rdataset_current(theirkeyset, &theirkeyrdata);
1081         RETERR(dns_dnssec_keyfromrdata(theirkeyname, &theirkeyrdata,
1082                                        rmsg->mctx, &theirkey));
1083
1084         RETERR(dst_key_secretsize(key, &sharedsize));
1085         RETERR(isc_buffer_allocate(rmsg->mctx, &shared, sharedsize));
1086
1087         RETERR(dst_key_computesecret(theirkey, key, shared));
1088
1089         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
1090
1091         r.base = rtkey.key;
1092         r.length = rtkey.keylen;
1093         if (nonce != NULL)
1094                 isc_buffer_usedregion(nonce, &r2);
1095         else {
1096                 r2.base = isc_mem_get(rmsg->mctx, 0);
1097                 r2.length = 0;
1098         }
1099         RETERR(compute_secret(shared, &r2, &r, &secret));
1100         if (nonce == NULL)
1101                 isc_mem_put(rmsg->mctx, r2.base, 0);
1102
1103         isc_buffer_usedregion(&secret, &r);
1104         result = dns_tsigkey_create(tkeyname, &rtkey.algorithm,
1105                                     r.base, r.length, ISC_TRUE,
1106                                     NULL, rtkey.inception, rtkey.expire,
1107                                     rmsg->mctx, ring, outkey);
1108         isc_buffer_free(&shared);
1109         dns_rdata_freestruct(&rtkey);
1110         dst_key_free(&theirkey);
1111         return (result);
1112
1113  failure:
1114         if (shared != NULL)
1115                 isc_buffer_free(&shared);
1116
1117         if (theirkey != NULL)
1118                 dst_key_free(&theirkey);
1119
1120         if (freertkey)
1121                 dns_rdata_freestruct(&rtkey);
1122
1123         return (result);
1124 }
1125
1126 isc_result_t
1127 dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1128                             dns_name_t *gname, void *cred, void **context,
1129                             dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
1130 {
1131         dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
1132         dns_name_t *tkeyname;
1133         dns_rdata_tkey_t rtkey, qtkey;
1134         isc_buffer_t outtoken;
1135         dst_key_t *dstkey = NULL;
1136         isc_region_t r;
1137         isc_result_t result;
1138         unsigned char array[1024];
1139
1140         REQUIRE(qmsg != NULL);
1141         REQUIRE(rmsg != NULL);
1142         REQUIRE(gname != NULL);
1143         if (outkey != NULL)
1144                 REQUIRE(*outkey == NULL);
1145
1146         if (rmsg->rcode != dns_rcode_noerror)
1147                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1148         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1149         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1150
1151         RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
1152                          DNS_SECTION_ADDITIONAL));
1153         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1154
1155         if (rtkey.error != dns_rcode_noerror ||
1156             rtkey.mode != DNS_TKEYMODE_GSSAPI ||
1157             !dns_name_equal(&rtkey.algorithm, &rtkey.algorithm))
1158         {
1159                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1160                          "or error set");
1161                 result = DNS_R_INVALIDTKEY;
1162                 goto failure;
1163         }
1164
1165         isc_buffer_init(&outtoken, array, sizeof(array));
1166         r.base = rtkey.key;
1167         r.length = rtkey.keylen;
1168         RETERR(dst_gssapi_initctx(gname, cred, &r, &outtoken, context));
1169
1170         dstkey = NULL;
1171         RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
1172                                   &dstkey));
1173
1174         RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
1175                                          dstkey, ISC_TRUE, NULL,
1176                                          rtkey.inception, rtkey.expire,
1177                                          rmsg->mctx, ring, outkey));
1178
1179         dns_rdata_freestruct(&rtkey);
1180         return (result);
1181
1182  failure:
1183         return (result);
1184 }
1185
1186 isc_result_t
1187 dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1188                                dns_tsig_keyring_t *ring)
1189 {
1190         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1191         dns_name_t *tkeyname, *tempname;
1192         dns_rdata_tkey_t qtkey, rtkey;
1193         dns_tsigkey_t *tsigkey = NULL;
1194         isc_result_t result;
1195
1196         REQUIRE(qmsg != NULL);
1197         REQUIRE(rmsg != NULL);
1198
1199         if (rmsg->rcode != dns_rcode_noerror)
1200                 return(ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1201
1202         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1203         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1204
1205         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1206                          DNS_SECTION_ADDITIONAL));
1207         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1208
1209         if (rtkey.error != dns_rcode_noerror ||
1210             rtkey.mode != DNS_TKEYMODE_DELETE ||
1211             rtkey.mode != qtkey.mode ||
1212             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1213             rmsg->rcode != dns_rcode_noerror)
1214         {
1215                 tkey_log("dns_tkey_processdeleteresponse: tkey mode invalid "
1216                          "or error set");
1217                 result = DNS_R_INVALIDTKEY;
1218                 dns_rdata_freestruct(&qtkey);
1219                 dns_rdata_freestruct(&rtkey);
1220                 goto failure;
1221         }
1222
1223         dns_rdata_freestruct(&qtkey);
1224
1225         RETERR(dns_tsigkey_find(&tsigkey, tkeyname, &rtkey.algorithm, ring));
1226
1227         dns_rdata_freestruct(&rtkey);
1228
1229         /*
1230          * Mark the key as deleted.
1231          */
1232         dns_tsigkey_setdeleted(tsigkey);
1233         /*
1234          * Release the reference.
1235          */
1236         dns_tsigkey_detach(&tsigkey);
1237
1238  failure:
1239         return (result);
1240 }