contrib/bind-9.3/lib/dns/tkey.c

   1 /*
   2  * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /*
  19  * $Id: tkey.c,v 1.71.2.1.10.9 2006/01/04 23:50:20 marka Exp $
  20  */
  21
  22 #include <config.h>
  23
  24 #include <isc/buffer.h>
  25 #include <isc/entropy.h>
  26 #include <isc/md5.h>
  27 #include <isc/mem.h>
  28 #include <isc/string.h>
  29 #include <isc/util.h>
  30
  31 #include <dns/dnssec.h>
  32 #include <dns/fixedname.h>
  33 #include <dns/keyvalues.h>
  34 #include <dns/log.h>
  35 #include <dns/message.h>
  36 #include <dns/name.h>
  37 #include <dns/rdata.h>
  38 #include <dns/rdatalist.h>
  39 #include <dns/rdataset.h>
  40 #include <dns/rdatastruct.h>
  41 #include <dns/result.h>
  42 #include <dns/tkey.h>
  43 #include <dns/tsig.h>
  44
  45 #include <dst/dst.h>
  46 #include <dst/gssapi.h>
  47
  48 #define TKEY_RANDOM_AMOUNT 16
  49
  50 #define RETERR(x) do { \
  51         result = (x); \
  52         if (result != ISC_R_SUCCESS) \
  53                 goto failure; \
  54         } while (0)
  55
  56 static void
  57 tkey_log(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
  58
  59 static void
  60 tkey_log(const char *fmt, ...) {
  61         va_list ap;
  62
  63         va_start(ap, fmt);
  64         isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_GENERAL,
  65                        DNS_LOGMODULE_REQUEST, ISC_LOG_DEBUG(4), fmt, ap);
  66         va_end(ap);
  67 }
  68
  69 isc_result_t
  70 dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
  71 {
  72         dns_tkeyctx_t *tctx;
  73
  74         REQUIRE(mctx != NULL);
  75         REQUIRE(ectx != NULL);
  76         REQUIRE(tctxp != NULL && *tctxp == NULL);
  77
  78         tctx = isc_mem_get(mctx, sizeof(dns_tkeyctx_t));
  79         if (tctx == NULL)
  80                 return (ISC_R_NOMEMORY);
  81         tctx->mctx = NULL;
  82         isc_mem_attach(mctx, &tctx->mctx);
  83         tctx->ectx = NULL;
  84         isc_entropy_attach(ectx, &tctx->ectx);
  85         tctx->dhkey = NULL;
  86         tctx->domain = NULL;
  87         tctx->gsscred = NULL;
  88
  89         *tctxp = tctx;
  90         return (ISC_R_SUCCESS);
  91 }
  92
  93 void
  94 dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
  95         isc_mem_t *mctx;
  96         dns_tkeyctx_t *tctx;
  97
  98         REQUIRE(tctxp != NULL && *tctxp != NULL);
  99
 100         tctx = *tctxp;
 101         mctx = tctx->mctx;
 102
 103         if (tctx->dhkey != NULL)
 104                 dst_key_free(&tctx->dhkey);
 105         if (tctx->domain != NULL) {
 106                 if (dns_name_dynamic(tctx->domain))
 107                         dns_name_free(tctx->domain, mctx);
 108                 isc_mem_put(mctx, tctx->domain, sizeof(dns_name_t));
 109         }
 110         isc_entropy_detach(&tctx->ectx);
 111         isc_mem_put(mctx, tctx, sizeof(dns_tkeyctx_t));
 112         isc_mem_detach(&mctx);
 113         *tctxp = NULL;
 114 }
 115
 116 static isc_result_t
 117 add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 118                 isc_uint32_t ttl, dns_namelist_t *namelist)
 119 {
 120         isc_result_t result;
 121         isc_region_t r, newr;
 122         dns_rdata_t *newrdata = NULL;
 123         dns_name_t *newname = NULL;
 124         dns_rdatalist_t *newlist = NULL;
 125         dns_rdataset_t *newset = NULL;
 126         isc_buffer_t *tmprdatabuf = NULL;
 127
 128         RETERR(dns_message_gettemprdata(msg, &newrdata));
 129
 130         dns_rdata_toregion(rdata, &r);
 131         RETERR(isc_buffer_allocate(msg->mctx, &tmprdatabuf, r.length));
 132         isc_buffer_availableregion(tmprdatabuf, &newr);
 133         memcpy(newr.base, r.base, r.length);
 134         dns_rdata_fromregion(newrdata, rdata->rdclass, rdata->type, &newr);
 135         dns_message_takebuffer(msg, &tmprdatabuf);
 136
 137         RETERR(dns_message_gettempname(msg, &newname));
 138         dns_name_init(newname, NULL);
 139         RETERR(dns_name_dup(name, msg->mctx, newname));
 140
 141         RETERR(dns_message_gettemprdatalist(msg, &newlist));
 142         newlist->rdclass = newrdata->rdclass;
 143         newlist->type = newrdata->type;
 144         newlist->covers = 0;
 145         newlist->ttl = ttl;
 146         ISC_LIST_INIT(newlist->rdata);
 147         ISC_LIST_APPEND(newlist->rdata, newrdata, link);
 148
 149         RETERR(dns_message_gettemprdataset(msg, &newset));
 150         dns_rdataset_init(newset);
 151         RETERR(dns_rdatalist_tordataset(newlist, newset));
 152
 153         ISC_LIST_INIT(newname->list);
 154         ISC_LIST_APPEND(newname->list, newset, link);
 155
 156         ISC_LIST_APPEND(*namelist, newname, link);
 157
 158         return (ISC_R_SUCCESS);
 159
 160  failure:
 161         if (newrdata != NULL) {
 162                 if (ISC_LINK_LINKED(newrdata, link))
 163                         ISC_LIST_UNLINK(newlist->rdata, newrdata, link);
 164                 dns_message_puttemprdata(msg, &newrdata);
 165         }
 166         if (newname != NULL)
 167                 dns_message_puttempname(msg, &newname);
 168         if (newset != NULL) {
 169                 dns_rdataset_disassociate(newset);
 170                 dns_message_puttemprdataset(msg, &newset);
 171         }
 172         if (newlist != NULL)
 173                 dns_message_puttemprdatalist(msg, &newlist);
 174         return (result);
 175 }
 176
 177 static void
 178 free_namelist(dns_message_t *msg, dns_namelist_t *namelist) {
 179         dns_name_t *name;
 180         dns_rdataset_t *set;
 181
 182         while (!ISC_LIST_EMPTY(*namelist)) {
 183                 name = ISC_LIST_HEAD(*namelist);
 184                 ISC_LIST_UNLINK(*namelist, name, link);
 185                 while (!ISC_LIST_EMPTY(name->list)) {
 186                         set = ISC_LIST_HEAD(name->list);
 187                         ISC_LIST_UNLINK(name->list, set, link);
 188                         dns_message_puttemprdataset(msg, &set);
 189                 }
 190                 dns_message_puttempname(msg, &name);
 191         }
 192 }
 193
 194 static isc_result_t
 195 compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
 196                isc_region_t *serverrandomness, isc_buffer_t *secret)
 197 {
 198         isc_md5_t md5ctx;
 199         isc_region_t r, r2;
 200         unsigned char digests[32];
 201         unsigned int i;
 202
 203         isc_buffer_usedregion(shared, &r);
 204
 205         /*
 206          * MD5 ( query data | DH value ).
 207          */
 208         isc_md5_init(&md5ctx);
 209         isc_md5_update(&md5ctx, queryrandomness->base,
 210                        queryrandomness->length);
 211         isc_md5_update(&md5ctx, r.base, r.length);
 212         isc_md5_final(&md5ctx, digests);
 213
 214         /*
 215          * MD5 ( server data | DH value ).
 216          */
 217         isc_md5_init(&md5ctx);
 218         isc_md5_update(&md5ctx, serverrandomness->base,
 219                        serverrandomness->length);
 220         isc_md5_update(&md5ctx, r.base, r.length);
 221         isc_md5_final(&md5ctx, &digests[ISC_MD5_DIGESTLENGTH]);
 222
 223         /*
 224          * XOR ( DH value, MD5-1 | MD5-2).
 225          */
 226         isc_buffer_availableregion(secret, &r);
 227         isc_buffer_usedregion(shared, &r2);
 228         if (r.length < sizeof(digests) || r.length < r2.length)
 229                 return (ISC_R_NOSPACE);
 230         if (r2.length > sizeof(digests)) {
 231                 memcpy(r.base, r2.base, r2.length);
 232                 for (i = 0; i < sizeof(digests); i++)
 233                         r.base[i] ^= digests[i];
 234                 isc_buffer_add(secret, r2.length);
 235         } else {
 236                 memcpy(r.base, digests, sizeof(digests));
 237                 for (i = 0; i < r2.length; i++)
 238                         r.base[i] ^= r2.base[i];
 239                 isc_buffer_add(secret, sizeof(digests));
 240         }
 241         return (ISC_R_SUCCESS);
 242
 243 }
 244
 245 static isc_result_t
 246 process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 247                dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 248                dns_rdata_tkey_t *tkeyout,
 249                dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 250 {
 251         isc_result_t result = ISC_R_SUCCESS;
 252         dns_name_t *keyname, ourname;
 253         dns_rdataset_t *keyset = NULL;
 254         dns_rdata_t keyrdata = DNS_RDATA_INIT, ourkeyrdata = DNS_RDATA_INIT;
 255         isc_boolean_t found_key = ISC_FALSE, found_incompatible = ISC_FALSE;
 256         dst_key_t *pubkey = NULL;
 257         isc_buffer_t ourkeybuf, *shared = NULL;
 258         isc_region_t r, r2, ourkeyr;
 259         unsigned char keydata[DST_KEY_MAXSIZE];
 260         unsigned int sharedsize;
 261         isc_buffer_t secret;
 262         unsigned char *randomdata = NULL, secretdata[256];
 263         dns_ttl_t ttl = 0;
 264
 265         if (tctx->dhkey == NULL) {
 266                 tkey_log("process_dhtkey: tkey-dhkey not defined");
 267                 tkeyout->error = dns_tsigerror_badalg;
 268                 return (DNS_R_REFUSED);
 269         }
 270
 271         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
 272                 tkey_log("process_dhtkey: algorithms other than "
 273                          "hmac-md5 are not supported");
 274                 tkeyout->error = dns_tsigerror_badalg;
 275                 return (ISC_R_SUCCESS);
 276         }
 277
 278         /*
 279          * Look for a DH KEY record that will work with ours.
 280          */
 281         for (result = dns_message_firstname(msg, DNS_SECTION_ADDITIONAL);
 282              result == ISC_R_SUCCESS && !found_key;
 283              result = dns_message_nextname(msg, DNS_SECTION_ADDITIONAL))
 284         {
 285                 keyname = NULL;
 286                 dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
 287                 keyset = NULL;
 288                 result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
 289                                               &keyset);
 290                 if (result != ISC_R_SUCCESS)
 291                         continue;
 292
 293                 for (result = dns_rdataset_first(keyset);
 294                      result == ISC_R_SUCCESS && !found_key;
 295                      result = dns_rdataset_next(keyset))
 296                 {
 297                         dns_rdataset_current(keyset, &keyrdata);
 298                         pubkey = NULL;
 299                         result = dns_dnssec_keyfromrdata(keyname, &keyrdata,
 300                                                          msg->mctx, &pubkey);
 301                         if (result != ISC_R_SUCCESS) {
 302                                 dns_rdata_reset(&keyrdata);
 303                                 continue;
 304                         }
 305                         if (dst_key_alg(pubkey) == DNS_KEYALG_DH) {
 306                                 if (dst_key_paramcompare(pubkey, tctx->dhkey))
 307                                 {
 308                                         found_key = ISC_TRUE;
 309                                         ttl = keyset->ttl;
 310                                         break;
 311                                 } else
 312                                         found_incompatible = ISC_TRUE;
 313                         }
 314                         dst_key_free(&pubkey);
 315                         dns_rdata_reset(&keyrdata);
 316                 }
 317         }
 318
 319         if (!found_key) {
 320                 if (found_incompatible) {
 321                         tkey_log("process_dhtkey: found an incompatible key");
 322                         tkeyout->error = dns_tsigerror_badkey;
 323                         return (ISC_R_SUCCESS);
 324                 } else {
 325                         tkey_log("process_dhtkey: failed to find a key");
 326                         return (DNS_R_FORMERR);
 327                 }
 328         }
 329
 330         RETERR(add_rdata_to_list(msg, keyname, &keyrdata, ttl, namelist));
 331
 332         isc_buffer_init(&ourkeybuf, keydata, sizeof(keydata));
 333         RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
 334         isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
 335         dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
 336                              dns_rdatatype_key, &ourkeyr);
 337
 338         dns_name_init(&ourname, NULL);
 339         dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
 340
 341         /*
 342          * XXXBEW The TTL should be obtained from the database, if it exists.
 343          */
 344         RETERR(add_rdata_to_list(msg, &ourname, &ourkeyrdata, 0, namelist));
 345
 346         RETERR(dst_key_secretsize(tctx->dhkey, &sharedsize));
 347         RETERR(isc_buffer_allocate(msg->mctx, &shared, sharedsize));
 348
 349         result = dst_key_computesecret(pubkey, tctx->dhkey, shared);
 350         if (result != ISC_R_SUCCESS) {
 351                 tkey_log("process_dhtkey: failed to compute shared secret: %s",
 352                          isc_result_totext(result));
 353                 goto failure;
 354         }
 355         dst_key_free(&pubkey);
 356
 357         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
 358
 359         randomdata = isc_mem_get(tkeyout->mctx, TKEY_RANDOM_AMOUNT);
 360         if (randomdata == NULL)
 361                 goto failure;
 362
 363         result = isc_entropy_getdata(tctx->ectx, randomdata,
 364                                      TKEY_RANDOM_AMOUNT, NULL, 0);
 365         if (result != ISC_R_SUCCESS) {
 366                 tkey_log("process_dhtkey: failed to obtain entropy: %s",
 367                          isc_result_totext(result));
 368                 goto failure;
 369         }
 370
 371         r.base = randomdata;
 372         r.length = TKEY_RANDOM_AMOUNT;
 373         r2.base = tkeyin->key;
 374         r2.length = tkeyin->keylen;
 375         RETERR(compute_secret(shared, &r2, &r, &secret));
 376         isc_buffer_free(&shared);
 377
 378         RETERR(dns_tsigkey_create(name, &tkeyin->algorithm,
 379                                   isc_buffer_base(&secret),
 380                                   isc_buffer_usedlength(&secret),
 381                                   ISC_TRUE, signer, tkeyin->inception,
 382                                   tkeyin->expire, msg->mctx, ring, NULL));
 383
 384         /* This key is good for a long time */
 385         tkeyout->inception = tkeyin->inception;
 386         tkeyout->expire = tkeyin->expire;
 387
 388         tkeyout->key = randomdata;
 389         tkeyout->keylen = TKEY_RANDOM_AMOUNT;
 390
 391         return (ISC_R_SUCCESS);
 392
 393  failure:
 394         if (!ISC_LIST_EMPTY(*namelist))
 395                 free_namelist(msg, namelist);
 396         if (shared != NULL)
 397                 isc_buffer_free(&shared);
 398         if (pubkey != NULL)
 399                 dst_key_free(&pubkey);
 400         if (randomdata != NULL)
 401                 isc_mem_put(tkeyout->mctx, randomdata, TKEY_RANDOM_AMOUNT);
 402         return (result);
 403 }
 404
 405 static isc_result_t
 406 process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 407                 dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 408                 dns_rdata_tkey_t *tkeyout,
 409                 dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 410 {
 411         isc_result_t result = ISC_R_SUCCESS;
 412         dst_key_t *dstkey = NULL;
 413         void *gssctx = NULL;
 414         isc_stdtime_t now;
 415         isc_region_t intoken;
 416         unsigned char array[1024];
 417         isc_buffer_t outtoken;
 418
 419         UNUSED(namelist);
 420
 421         if (tctx->gsscred == NULL)
 422                 return (ISC_R_NOPERM);
 423
 424         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPI_NAME) &&
 425             !dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPIMS_NAME)) {
 426                 tkeyout->error = dns_tsigerror_badalg;
 427                 return (ISC_R_SUCCESS);
 428         }
 429
 430         intoken.base = tkeyin->key;
 431         intoken.length = tkeyin->keylen;
 432
 433         isc_buffer_init(&outtoken, array, sizeof(array));
 434         RETERR(dst_gssapi_acceptctx(name, tctx->gsscred, &intoken,
 435                                     &outtoken, &gssctx));
 436
 437         dstkey = NULL;
 438         RETERR(dst_key_fromgssapi(name, gssctx, msg->mctx, &dstkey));
 439
 440         result = dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
 441                                            dstkey, ISC_TRUE, signer,
 442                                            tkeyin->inception, tkeyin->expire,
 443                                            msg->mctx, ring, NULL);
 444 #if 1
 445         if (result != ISC_R_SUCCESS)
 446                 goto failure;
 447 #else
 448         if (result == ISC_R_NOTFOUND) {
 449                 tkeyout->error = dns_tsigerror_badalg;
 450                 return (ISC_R_SUCCESS);
 451         }
 452         if (result != ISC_R_SUCCESS)
 453                 goto failure;
 454 #endif
 455
 456         /* This key is good for a long time */
 457         isc_stdtime_get(&now);
 458         tkeyout->inception = tkeyin->inception;
 459         tkeyout->expire = tkeyin->expire;
 460
 461         tkeyout->key = isc_mem_get(msg->mctx,
 462                                    isc_buffer_usedlength(&outtoken));
 463         if (tkeyout->key == NULL) {
 464                 result = ISC_R_NOMEMORY;
 465                 goto failure;
 466         }
 467         tkeyout->keylen = isc_buffer_usedlength(&outtoken);
 468         memcpy(tkeyout->key, isc_buffer_base(&outtoken), tkeyout->keylen);
 469
 470         return (ISC_R_SUCCESS);
 471
 472  failure:
 473         if (dstkey != NULL)
 474                 dst_key_free(&dstkey);
 475
 476         return (result);
 477 }
 478
 479 static isc_result_t
 480 process_deletetkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 481                    dns_rdata_tkey_t *tkeyin,
 482                    dns_rdata_tkey_t *tkeyout,
 483                    dns_tsig_keyring_t *ring,
 484                    dns_namelist_t *namelist)
 485 {
 486         isc_result_t result;
 487         dns_tsigkey_t *tsigkey = NULL;
 488         dns_name_t *identity;
 489
 490         UNUSED(msg);
 491         UNUSED(namelist);
 492
 493         result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 494         if (result != ISC_R_SUCCESS) {
 495                 tkeyout->error = dns_tsigerror_badname;
 496                 return (ISC_R_SUCCESS);
 497         }
 498
 499         /*
 500          * Only allow a delete if the identity that created the key is the
 501          * same as the identity that signed the message.
 502          */
 503         identity = dns_tsigkey_identity(tsigkey);
 504         if (identity == NULL || !dns_name_equal(identity, signer)) {
 505                 dns_tsigkey_detach(&tsigkey);
 506                 return (DNS_R_REFUSED);
 507         }
 508
 509         /*
 510          * Set the key to be deleted when no references are left.  If the key
 511          * was not generated with TKEY and is in the config file, it may be
 512          * reloaded later.
 513          */
 514         dns_tsigkey_setdeleted(tsigkey);
 515
 516         /* Release the reference */
 517         dns_tsigkey_detach(&tsigkey);
 518
 519         return (ISC_R_SUCCESS);
 520 }
 521
 522 isc_result_t
 523 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 524                       dns_tsig_keyring_t *ring)
 525 {
 526         isc_result_t result = ISC_R_SUCCESS;
 527         dns_rdata_tkey_t tkeyin, tkeyout;
 528         isc_boolean_t freetkeyin = ISC_FALSE;
 529         dns_name_t *qname, *name, *keyname, *signer, tsigner;
 530         dns_fixedname_t fkeyname;
 531         dns_rdataset_t *tkeyset;
 532         dns_rdata_t rdata;
 533         dns_namelist_t namelist;
 534         char tkeyoutdata[512];
 535         isc_buffer_t tkeyoutbuf;
 536
 537         REQUIRE(msg != NULL);
 538         REQUIRE(tctx != NULL);
 539         REQUIRE(ring != NULL);
 540
 541         ISC_LIST_INIT(namelist);
 542
 543         /*
 544          * Interpret the question section.
 545          */
 546         result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 547         if (result != ISC_R_SUCCESS)
 548                 return (DNS_R_FORMERR);
 549
 550         qname = NULL;
 551         dns_message_currentname(msg, DNS_SECTION_QUESTION, &qname);
 552
 553         /*
 554          * Look for a TKEY record that matches the question.
 555          */
 556         tkeyset = NULL;
 557         name = NULL;
 558         result = dns_message_findname(msg, DNS_SECTION_ADDITIONAL, qname,
 559                                       dns_rdatatype_tkey, 0, &name, &tkeyset);
 560         if (result != ISC_R_SUCCESS) {
 561                 /*
 562                  * Try the answer section, since that's where Win2000
 563                  * puts it.
 564                  */
 565                 if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
 566                                          dns_rdatatype_tkey, 0, &name,
 567                                          &tkeyset) != ISC_R_SUCCESS)
 568                 {
 569                         result = DNS_R_FORMERR;
 570                         tkey_log("dns_tkey_processquery: couldn't find a TKEY "
 571                                  "matching the question");
 572                         goto failure;
 573                 }
 574         }
 575         result = dns_rdataset_first(tkeyset);
 576         if (result != ISC_R_SUCCESS) {
 577                 result = DNS_R_FORMERR;
 578                 goto failure;
 579         }
 580         dns_rdata_init(&rdata);
 581         dns_rdataset_current(tkeyset, &rdata);
 582
 583         RETERR(dns_rdata_tostruct(&rdata, &tkeyin, NULL));
 584         freetkeyin = ISC_TRUE;
 585
 586         if (tkeyin.error != dns_rcode_noerror) {
 587                 result = DNS_R_FORMERR;
 588                 goto failure;
 589         }
 590
 591         /*
 592          * Before we go any farther, verify that the message was signed.
 593          * GSSAPI TKEY doesn't require a signature, the rest do.
 594          */
 595         dns_name_init(&tsigner, NULL);
 596         result = dns_message_signer(msg, &tsigner);
 597         if (result != ISC_R_SUCCESS) {
 598                 if (tkeyin.mode == DNS_TKEYMODE_GSSAPI &&
 599                     result == ISC_R_NOTFOUND)
 600                        signer = NULL;
 601                 else {
 602                         tkey_log("dns_tkey_processquery: query was not "
 603                                  "properly signed - rejecting");
 604                         result = DNS_R_FORMERR;
 605                         goto failure;
 606                 }
 607         } else
 608                 signer = &tsigner;
 609
 610         tkeyout.common.rdclass = tkeyin.common.rdclass;
 611         tkeyout.common.rdtype = tkeyin.common.rdtype;
 612         ISC_LINK_INIT(&tkeyout.common, link);
 613         tkeyout.mctx = msg->mctx;
 614
 615         dns_name_init(&tkeyout.algorithm, NULL);
 616         dns_name_clone(&tkeyin.algorithm, &tkeyout.algorithm);
 617
 618         tkeyout.inception = tkeyout.expire = 0;
 619         tkeyout.mode = tkeyin.mode;
 620         tkeyout.error = 0;
 621         tkeyout.keylen = tkeyout.otherlen = 0;
 622         tkeyout.key = tkeyout.other = NULL;
 623
 624         /*
 625          * A delete operation must have a fully specified key name.  If this
 626          * is not a delete, we do the following:
 627          * if (qname != ".")
 628          *      keyname = qname + defaultdomain
 629          * else
 630          *      keyname = <random hex> + defaultdomain
 631          */
 632         if (tkeyin.mode != DNS_TKEYMODE_DELETE) {
 633                 dns_tsigkey_t *tsigkey = NULL;
 634
 635                 if (tctx->domain == NULL) {
 636                         tkey_log("dns_tkey_processquery: tkey-domain not set");
 637                         result = DNS_R_REFUSED;
 638                         goto failure;
 639                 }
 640
 641                 dns_fixedname_init(&fkeyname);
 642                 keyname = dns_fixedname_name(&fkeyname);
 643
 644                 if (!dns_name_equal(qname, dns_rootname)) {
 645                         unsigned int n = dns_name_countlabels(qname);
 646                         RUNTIME_CHECK(dns_name_copy(qname, keyname, NULL)
 647                                       == ISC_R_SUCCESS);
 648                         dns_name_getlabelsequence(keyname, 0, n - 1, keyname);
 649                 } else {
 650                         static char hexdigits[16] = {
 651                                 '0', '1', '2', '3', '4', '5', '6', '7',
 652                                 '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
 653                         unsigned char randomdata[16];
 654                         char randomtext[32];
 655                         isc_buffer_t b;
 656                         unsigned int i, j;
 657
 658                         result = isc_entropy_getdata(tctx->ectx,
 659                                                      randomdata,
 660                                                      sizeof(randomdata),
 661                                                      NULL, 0);
 662                         if (result != ISC_R_SUCCESS)
 663                                 goto failure;
 664
 665                         for (i = 0, j = 0; i < sizeof(randomdata); i++) {
 666                                 unsigned char val = randomdata[i];
 667                                 randomtext[j++] = hexdigits[val >> 4];
 668                                 randomtext[j++] = hexdigits[val & 0xF];
 669                         }
 670                         isc_buffer_init(&b, randomtext, sizeof(randomtext));
 671                         isc_buffer_add(&b, sizeof(randomtext));
 672                         result = dns_name_fromtext(keyname, &b, NULL,
 673                                                    ISC_FALSE, NULL);
 674                         if (result != ISC_R_SUCCESS)
 675                                 goto failure;
 676                 }
 677                 result = dns_name_concatenate(keyname, tctx->domain,
 678                                               keyname, NULL);
 679                 if (result != ISC_R_SUCCESS)
 680                         goto failure;
 681
 682                 result = dns_tsigkey_find(&tsigkey, keyname, NULL, ring);
 683                 if (result == ISC_R_SUCCESS) {
 684                         tkeyout.error = dns_tsigerror_badname;
 685                         dns_tsigkey_detach(&tsigkey);
 686                         goto failure_with_tkey;
 687                 } else if (result != ISC_R_NOTFOUND)
 688                         goto failure;
 689         } else
 690                 keyname = qname;
 691
 692         switch (tkeyin.mode) {
 693                 case DNS_TKEYMODE_DIFFIEHELLMAN:
 694                         tkeyout.error = dns_rcode_noerror;
 695                         RETERR(process_dhtkey(msg, signer, keyname, &tkeyin,
 696                                               tctx, &tkeyout, ring,
 697                                               &namelist));
 698                         break;
 699                 case DNS_TKEYMODE_GSSAPI:
 700                         tkeyout.error = dns_rcode_noerror;
 701                         RETERR(process_gsstkey(msg, signer, keyname, &tkeyin,
 702                                                tctx, &tkeyout, ring,
 703                                                &namelist));
 704                         break;
 705                 case DNS_TKEYMODE_DELETE:
 706                         tkeyout.error = dns_rcode_noerror;
 707                         RETERR(process_deletetkey(msg, signer, keyname,
 708                                                   &tkeyin, &tkeyout,
 709                                                   ring, &namelist));
 710                         break;
 711                 case DNS_TKEYMODE_SERVERASSIGNED:
 712                 case DNS_TKEYMODE_RESOLVERASSIGNED:
 713                         result = DNS_R_NOTIMP;
 714                         goto failure;
 715                 default:
 716                         tkeyout.error = dns_tsigerror_badmode;
 717         }
 718
 719  failure_with_tkey:
 720         dns_rdata_init(&rdata);
 721         isc_buffer_init(&tkeyoutbuf, tkeyoutdata, sizeof(tkeyoutdata));
 722         result = dns_rdata_fromstruct(&rdata, tkeyout.common.rdclass,
 723                                       tkeyout.common.rdtype, &tkeyout,
 724                                       &tkeyoutbuf);
 725
 726         if (freetkeyin) {
 727                 dns_rdata_freestruct(&tkeyin);
 728                 freetkeyin = ISC_FALSE;
 729         }
 730
 731         if (tkeyout.key != NULL)
 732                 isc_mem_put(msg->mctx, tkeyout.key, tkeyout.keylen);
 733         if (tkeyout.other != NULL)
 734                 isc_mem_put(msg->mctx, tkeyout.other, tkeyout.otherlen);
 735         if (result != ISC_R_SUCCESS)
 736                 goto failure;
 737
 738         RETERR(add_rdata_to_list(msg, keyname, &rdata, 0, &namelist));
 739
 740         RETERR(dns_message_reply(msg, ISC_TRUE));
 741
 742         name = ISC_LIST_HEAD(namelist);
 743         while (name != NULL) {
 744                 dns_name_t *next = ISC_LIST_NEXT(name, link);
 745                 ISC_LIST_UNLINK(namelist, name, link);
 746                 dns_message_addname(msg, name, DNS_SECTION_ANSWER);
 747                 name = next;
 748         }
 749
 750         return (ISC_R_SUCCESS);
 751
 752  failure:
 753         if (freetkeyin)
 754                 dns_rdata_freestruct(&tkeyin);
 755         if (!ISC_LIST_EMPTY(namelist))
 756                 free_namelist(msg, &namelist);
 757         return (result);
 758 }
 759
 760 static isc_result_t
 761 buildquery(dns_message_t *msg, dns_name_t *name,
 762            dns_rdata_tkey_t *tkey)
 763 {
 764         dns_name_t *qname = NULL, *aname = NULL;
 765         dns_rdataset_t *question = NULL, *tkeyset = NULL;
 766         dns_rdatalist_t *tkeylist = NULL;
 767         dns_rdata_t *rdata = NULL;
 768         isc_buffer_t *dynbuf = NULL;
 769         isc_result_t result;
 770
 771         REQUIRE(msg != NULL);
 772         REQUIRE(name != NULL);
 773         REQUIRE(tkey != NULL);
 774
 775         RETERR(dns_message_gettempname(msg, &qname));
 776         RETERR(dns_message_gettempname(msg, &aname));
 777
 778         RETERR(dns_message_gettemprdataset(msg, &question));
 779         dns_rdataset_init(question);
 780         dns_rdataset_makequestion(question, dns_rdataclass_any,
 781                                   dns_rdatatype_tkey);
 782
 783         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 512));
 784         RETERR(dns_message_gettemprdata(msg, &rdata));
 785         RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
 786                                     dns_rdatatype_tkey, tkey, dynbuf));
 787         dns_message_takebuffer(msg, &dynbuf);
 788
 789         RETERR(dns_message_gettemprdatalist(msg, &tkeylist));
 790         tkeylist->rdclass = dns_rdataclass_any;
 791         tkeylist->type = dns_rdatatype_tkey;
 792         tkeylist->covers = 0;
 793         tkeylist->ttl = 0;
 794         ISC_LIST_INIT(tkeylist->rdata);
 795         ISC_LIST_APPEND(tkeylist->rdata, rdata, link);
 796
 797         RETERR(dns_message_gettemprdataset(msg, &tkeyset));
 798         dns_rdataset_init(tkeyset);
 799         RETERR(dns_rdatalist_tordataset(tkeylist, tkeyset));
 800
 801         dns_name_init(qname, NULL);
 802         dns_name_clone(name, qname);
 803
 804         dns_name_init(aname, NULL);
 805         dns_name_clone(name, aname);
 806
 807         ISC_LIST_APPEND(qname->list, question, link);
 808         ISC_LIST_APPEND(aname->list, tkeyset, link);
 809
 810         dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
 811         dns_message_addname(msg, aname, DNS_SECTION_ADDITIONAL);
 812
 813         return (ISC_R_SUCCESS);
 814
 815  failure:
 816         if (qname != NULL)
 817                 dns_message_puttempname(msg, &qname);
 818         if (aname != NULL)
 819                 dns_message_puttempname(msg, &aname);
 820         if (question != NULL) {
 821                 dns_rdataset_disassociate(question);
 822                 dns_message_puttemprdataset(msg, &question);
 823         }
 824         if (dynbuf != NULL)
 825                 isc_buffer_free(&dynbuf);
 826         return (result);
 827 }
 828
 829 isc_result_t
 830 dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 831                       dns_name_t *algorithm, isc_buffer_t *nonce,
 832                       isc_uint32_t lifetime)
 833 {
 834         dns_rdata_tkey_t tkey;
 835         dns_rdata_t *rdata = NULL;
 836         isc_buffer_t *dynbuf = NULL;
 837         isc_region_t r;
 838         dns_name_t keyname;
 839         dns_namelist_t namelist;
 840         isc_result_t result;
 841         isc_stdtime_t now;
 842
 843         REQUIRE(msg != NULL);
 844         REQUIRE(key != NULL);
 845         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
 846         REQUIRE(dst_key_isprivate(key));
 847         REQUIRE(name != NULL);
 848         REQUIRE(algorithm != NULL);
 849
 850         tkey.common.rdclass = dns_rdataclass_any;
 851         tkey.common.rdtype = dns_rdatatype_tkey;
 852         ISC_LINK_INIT(&tkey.common, link);
 853         tkey.mctx = msg->mctx;
 854         dns_name_init(&tkey.algorithm, NULL);
 855         dns_name_clone(algorithm, &tkey.algorithm);
 856         isc_stdtime_get(&now);
 857         tkey.inception = now;
 858         tkey.expire = now + lifetime;
 859         tkey.mode = DNS_TKEYMODE_DIFFIEHELLMAN;
 860         if (nonce != NULL)
 861                 isc_buffer_usedregion(nonce, &r);
 862         else {
 863                 r.base = isc_mem_get(msg->mctx, 0);
 864                 r.length = 0;
 865         }
 866         tkey.error = 0;
 867         tkey.key = r.base;
 868         tkey.keylen =  r.length;
 869         tkey.other = NULL;
 870         tkey.otherlen = 0;
 871
 872         RETERR(buildquery(msg, name, &tkey));
 873
 874         if (nonce == NULL)
 875                 isc_mem_put(msg->mctx, r.base, 0);
 876
 877         RETERR(dns_message_gettemprdata(msg, &rdata));
 878         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
 879         RETERR(dst_key_todns(key, dynbuf));
 880         isc_buffer_usedregion(dynbuf, &r);
 881         dns_rdata_fromregion(rdata, dns_rdataclass_any,
 882                              dns_rdatatype_key, &r);
 883         dns_message_takebuffer(msg, &dynbuf);
 884
 885         dns_name_init(&keyname, NULL);
 886         dns_name_clone(dst_key_name(key), &keyname);
 887
 888         ISC_LIST_INIT(namelist);
 889         RETERR(add_rdata_to_list(msg, &keyname, rdata, 0, &namelist));
 890         dns_message_addname(msg, ISC_LIST_HEAD(namelist),
 891                             DNS_SECTION_ADDITIONAL);
 892
 893         return (ISC_R_SUCCESS);
 894
 895  failure:
 896
 897         if (dynbuf != NULL)
 898                 isc_buffer_free(&dynbuf);
 899         return (result);
 900 }
 901
 902 isc_result_t
 903 dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name,
 904                        dns_name_t *gname, void *cred,
 905                        isc_uint32_t lifetime, void **context)
 906 {
 907         dns_rdata_tkey_t tkey;
 908         isc_result_t result;
 909         isc_stdtime_t now;
 910         isc_buffer_t token;
 911         unsigned char array[1024];
 912
 913         REQUIRE(msg != NULL);
 914         REQUIRE(name != NULL);
 915         REQUIRE(gname != NULL);
 916         REQUIRE(context != NULL && *context == NULL);
 917
 918         isc_buffer_init(&token, array, sizeof(array));
 919         result = dst_gssapi_initctx(gname, cred, NULL, &token, context);
 920         if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
 921                 return (result);
 922
 923         tkey.common.rdclass = dns_rdataclass_any;
 924         tkey.common.rdtype = dns_rdatatype_tkey;
 925         ISC_LINK_INIT(&tkey.common, link);
 926         tkey.mctx = NULL;
 927         dns_name_init(&tkey.algorithm, NULL);
 928         dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 929         isc_stdtime_get(&now);
 930         tkey.inception = now;
 931         tkey.expire = now + lifetime;
 932         tkey.mode = DNS_TKEYMODE_GSSAPI;
 933         tkey.error = 0;
 934         tkey.key = isc_buffer_base(&token);
 935         tkey.keylen = isc_buffer_usedlength(&token);
 936         tkey.other = NULL;
 937         tkey.otherlen = 0;
 938
 939         RETERR(buildquery(msg, name, &tkey));
 940
 941         return (ISC_R_SUCCESS);
 942
 943  failure:
 944         return (result);
 945 }
 946
 947 isc_result_t
 948 dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key) {
 949         dns_rdata_tkey_t tkey;
 950
 951         REQUIRE(msg != NULL);
 952         REQUIRE(key != NULL);
 953
 954         tkey.common.rdclass = dns_rdataclass_any;
 955         tkey.common.rdtype = dns_rdatatype_tkey;
 956         ISC_LINK_INIT(&tkey.common, link);
 957         tkey.mctx = msg->mctx;
 958         dns_name_init(&tkey.algorithm, NULL);
 959         dns_name_clone(key->algorithm, &tkey.algorithm);
 960         tkey.inception = tkey.expire = 0;
 961         tkey.mode = DNS_TKEYMODE_DELETE;
 962         tkey.error = 0;
 963         tkey.keylen = tkey.otherlen = 0;
 964         tkey.key = tkey.other = NULL;
 965
 966         return (buildquery(msg, &key->name, &tkey));
 967 }
 968
 969 static isc_result_t
 970 find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 971           int section)
 972 {
 973         dns_rdataset_t *tkeyset;
 974         isc_result_t result;
 975
 976         result = dns_message_firstname(msg, section);
 977         while (result == ISC_R_SUCCESS) {
 978                 *name = NULL;
 979                 dns_message_currentname(msg, section, name);
 980                 tkeyset = NULL;
 981                 result = dns_message_findtype(*name, dns_rdatatype_tkey, 0,
 982                                               &tkeyset);
 983                 if (result == ISC_R_SUCCESS) {
 984                         result = dns_rdataset_first(tkeyset);
 985                         if (result != ISC_R_SUCCESS)
 986                                 return (result);
 987                         dns_rdataset_current(tkeyset, rdata);
 988                         return (ISC_R_SUCCESS);
 989                 }
 990                 result = dns_message_nextname(msg, section);
 991         }
 992         if (result == ISC_R_NOMORE)
 993                 return (ISC_R_NOTFOUND);
 994         return (result);
 995 }
 996
 997 isc_result_t
 998 dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 999                            dst_key_t *key, isc_buffer_t *nonce,
1000                            dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
1001 {
1002         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1003         dns_name_t keyname, *tkeyname, *theirkeyname, *ourkeyname, *tempname;
1004         dns_rdataset_t *theirkeyset = NULL, *ourkeyset = NULL;
1005         dns_rdata_t theirkeyrdata = DNS_RDATA_INIT;
1006         dst_key_t *theirkey = NULL;
1007         dns_rdata_tkey_t qtkey, rtkey;
1008         unsigned char secretdata[256];
1009         unsigned int sharedsize;
1010         isc_buffer_t *shared = NULL, secret;
1011         isc_region_t r, r2;
1012         isc_result_t result;
1013         isc_boolean_t freertkey = ISC_FALSE;
1014
1015         REQUIRE(qmsg != NULL);
1016         REQUIRE(rmsg != NULL);
1017         REQUIRE(key != NULL);
1018         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
1019         REQUIRE(dst_key_isprivate(key));
1020         if (outkey != NULL)
1021                 REQUIRE(*outkey == NULL);
1022
1023         if (rmsg->rcode != dns_rcode_noerror)
1024                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1025         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1026         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1027         freertkey = ISC_TRUE;
1028
1029         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1030                          DNS_SECTION_ADDITIONAL));
1031         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1032
1033         if (rtkey.error != dns_rcode_noerror ||
1034             rtkey.mode != DNS_TKEYMODE_DIFFIEHELLMAN ||
1035             rtkey.mode != qtkey.mode ||
1036             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1037             rmsg->rcode != dns_rcode_noerror)
1038         {
1039                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1040                          "or error set");
1041                 result = DNS_R_INVALIDTKEY;
1042                 dns_rdata_freestruct(&qtkey);
1043                 goto failure;
1044         }
1045
1046         dns_rdata_freestruct(&qtkey);
1047
1048         dns_name_init(&keyname, NULL);
1049         dns_name_clone(dst_key_name(key), &keyname);
1050
1051         ourkeyname = NULL;
1052         ourkeyset = NULL;
1053         RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
1054                                     dns_rdatatype_key, 0, &ourkeyname,
1055                                     &ourkeyset));
1056
1057         result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
1058         while (result == ISC_R_SUCCESS) {
1059                 theirkeyname = NULL;
1060                 dns_message_currentname(rmsg, DNS_SECTION_ANSWER,
1061                                         &theirkeyname);
1062                 if (dns_name_equal(theirkeyname, ourkeyname))
1063                         goto next;
1064                 theirkeyset = NULL;
1065                 result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
1066                                               0, &theirkeyset);
1067                 if (result == ISC_R_SUCCESS) {
1068                         RETERR(dns_rdataset_first(theirkeyset));
1069                         break;
1070                 }
1071  next:
1072                 result = dns_message_nextname(rmsg, DNS_SECTION_ANSWER);
1073         }
1074
1075         if (theirkeyset == NULL) {
1076                 tkey_log("dns_tkey_processdhresponse: failed to find server "
1077                          "key");
1078                 result = ISC_R_NOTFOUND;
1079                 goto failure;
1080         }
1081
1082         dns_rdataset_current(theirkeyset, &theirkeyrdata);
1083         RETERR(dns_dnssec_keyfromrdata(theirkeyname, &theirkeyrdata,
1084                                        rmsg->mctx, &theirkey));
1085
1086         RETERR(dst_key_secretsize(key, &sharedsize));
1087         RETERR(isc_buffer_allocate(rmsg->mctx, &shared, sharedsize));
1088
1089         RETERR(dst_key_computesecret(theirkey, key, shared));
1090
1091         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
1092
1093         r.base = rtkey.key;
1094         r.length = rtkey.keylen;
1095         if (nonce != NULL)
1096                 isc_buffer_usedregion(nonce, &r2);
1097         else {
1098                 r2.base = isc_mem_get(rmsg->mctx, 0);
1099                 r2.length = 0;
1100         }
1101         RETERR(compute_secret(shared, &r2, &r, &secret));
1102         if (nonce == NULL)
1103                 isc_mem_put(rmsg->mctx, r2.base, 0);
1104
1105         isc_buffer_usedregion(&secret, &r);
1106         result = dns_tsigkey_create(tkeyname, &rtkey.algorithm,
1107                                     r.base, r.length, ISC_TRUE,
1108                                     NULL, rtkey.inception, rtkey.expire,
1109                                     rmsg->mctx, ring, outkey);
1110         isc_buffer_free(&shared);
1111         dns_rdata_freestruct(&rtkey);
1112         dst_key_free(&theirkey);
1113         return (result);
1114
1115  failure:
1116         if (shared != NULL)
1117                 isc_buffer_free(&shared);
1118
1119         if (theirkey != NULL)
1120                 dst_key_free(&theirkey);
1121
1122         if (freertkey)
1123                 dns_rdata_freestruct(&rtkey);
1124
1125         return (result);
1126 }
1127
1128 isc_result_t
1129 dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1130                             dns_name_t *gname, void *cred, void **context,
1131                             dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
1132 {
1133         dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
1134         dns_name_t *tkeyname;
1135         dns_rdata_tkey_t rtkey, qtkey;
1136         isc_buffer_t outtoken;
1137         dst_key_t *dstkey = NULL;
1138         isc_region_t r;
1139         isc_result_t result;
1140         unsigned char array[1024];
1141
1142         REQUIRE(qmsg != NULL);
1143         REQUIRE(rmsg != NULL);
1144         REQUIRE(gname != NULL);
1145         if (outkey != NULL)
1146                 REQUIRE(*outkey == NULL);
1147
1148         if (rmsg->rcode != dns_rcode_noerror)
1149                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1150         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1151         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1152
1153         RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
1154                          DNS_SECTION_ADDITIONAL));
1155         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1156
1157         if (rtkey.error != dns_rcode_noerror ||
1158             rtkey.mode != DNS_TKEYMODE_GSSAPI ||
1159             !dns_name_equal(&rtkey.algorithm, &rtkey.algorithm))
1160         {
1161                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1162                          "or error set");
1163                 result = DNS_R_INVALIDTKEY;
1164                 goto failure;
1165         }
1166
1167         isc_buffer_init(&outtoken, array, sizeof(array));
1168         r.base = rtkey.key;
1169         r.length = rtkey.keylen;
1170         RETERR(dst_gssapi_initctx(gname, cred, &r, &outtoken, context));
1171
1172         dstkey = NULL;
1173         RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
1174                                   &dstkey));
1175
1176         RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
1177                                          dstkey, ISC_TRUE, NULL,
1178                                          rtkey.inception, rtkey.expire,
1179                                          rmsg->mctx, ring, outkey));
1180
1181         dns_rdata_freestruct(&rtkey);
1182         return (result);
1183
1184  failure:
1185         return (result);
1186 }
1187
1188 isc_result_t
1189 dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1190                                dns_tsig_keyring_t *ring)
1191 {
1192         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1193         dns_name_t *tkeyname, *tempname;
1194         dns_rdata_tkey_t qtkey, rtkey;
1195         dns_tsigkey_t *tsigkey = NULL;
1196         isc_result_t result;
1197
1198         REQUIRE(qmsg != NULL);
1199         REQUIRE(rmsg != NULL);
1200
1201         if (rmsg->rcode != dns_rcode_noerror)
1202                 return(ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1203
1204         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1205         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1206
1207         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1208                          DNS_SECTION_ADDITIONAL));
1209         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1210
1211         if (rtkey.error != dns_rcode_noerror ||
1212             rtkey.mode != DNS_TKEYMODE_DELETE ||
1213             rtkey.mode != qtkey.mode ||
1214             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1215             rmsg->rcode != dns_rcode_noerror)
1216         {
1217                 tkey_log("dns_tkey_processdeleteresponse: tkey mode invalid "
1218                          "or error set");
1219                 result = DNS_R_INVALIDTKEY;
1220                 dns_rdata_freestruct(&qtkey);
1221                 dns_rdata_freestruct(&rtkey);
1222                 goto failure;
1223         }
1224
1225         dns_rdata_freestruct(&qtkey);
1226
1227         RETERR(dns_tsigkey_find(&tsigkey, tkeyname, &rtkey.algorithm, ring));
1228
1229         dns_rdata_freestruct(&rtkey);
1230
1231         /*
1232          * Mark the key as deleted.
1233          */
1234         dns_tsigkey_setdeleted(tsigkey);
1235         /*
1236          * Release the reference.
1237          */
1238         dns_tsigkey_detach(&tsigkey);
1239
1240  failure:
1241         return (result);
1242 }