contrib/bind-9.2.4rc7/lib/dns/tkey.c

   1 /*
   2  * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2001  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /*
  19  * $Id: tkey.c,v 1.71.2.2 2004/03/09 06:11:09 marka Exp $
  20  */
  21
  22 #include <config.h>
  23
  24 #include <isc/buffer.h>
  25 #include <isc/entropy.h>
  26 #include <isc/md5.h>
  27 #include <isc/mem.h>
  28 #include <isc/string.h>
  29 #include <isc/util.h>
  30
  31 #include <dns/dnssec.h>
  32 #include <dns/fixedname.h>
  33 #include <dns/keyvalues.h>
  34 #include <dns/log.h>
  35 #include <dns/message.h>
  36 #include <dns/name.h>
  37 #include <dns/rdata.h>
  38 #include <dns/rdatalist.h>
  39 #include <dns/rdataset.h>
  40 #include <dns/rdatastruct.h>
  41 #include <dns/result.h>
  42 #include <dns/tkey.h>
  43 #include <dns/tsig.h>
  44
  45 #include <dst/dst.h>
  46 #include <dst/gssapi.h>
  47
  48 #define TKEY_RANDOM_AMOUNT 16
  49
  50 #define RETERR(x) do { \
  51         result = (x); \
  52         if (result != ISC_R_SUCCESS) \
  53                 goto failure; \
  54         } while (0)
  55
  56 static void
  57 tkey_log(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
  58
  59 static void
  60 tkey_log(const char *fmt, ...) {
  61         va_list ap;
  62
  63         va_start(ap, fmt);
  64         isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_GENERAL,
  65                        DNS_LOGMODULE_REQUEST, ISC_LOG_DEBUG(4), fmt, ap);
  66         va_end(ap);
  67 }
  68
  69 isc_result_t
  70 dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
  71 {
  72         dns_tkeyctx_t *tctx;
  73
  74         REQUIRE(mctx != NULL);
  75         REQUIRE(ectx != NULL);
  76         REQUIRE(tctxp != NULL && *tctxp == NULL);
  77
  78         tctx = isc_mem_get(mctx, sizeof(dns_tkeyctx_t));
  79         if (tctx == NULL)
  80                 return (ISC_R_NOMEMORY);
  81         tctx->mctx = NULL;
  82         isc_mem_attach(mctx, &tctx->mctx);
  83         tctx->ectx = NULL;
  84         isc_entropy_attach(ectx, &tctx->ectx);
  85         tctx->dhkey = NULL;
  86         tctx->domain = NULL;
  87         tctx->gsscred = NULL;
  88
  89         *tctxp = tctx;
  90         return (ISC_R_SUCCESS);
  91 }
  92
  93 void
  94 dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
  95         isc_mem_t *mctx;
  96         dns_tkeyctx_t *tctx;
  97
  98         REQUIRE(tctxp != NULL && *tctxp != NULL);
  99
 100         tctx = *tctxp;
 101         mctx = tctx->mctx;
 102
 103         if (tctx->dhkey != NULL)
 104                 dst_key_free(&tctx->dhkey);
 105         if (tctx->domain != NULL) {
 106                 if (dns_name_dynamic(tctx->domain))
 107                         dns_name_free(tctx->domain, mctx);
 108                 isc_mem_put(mctx, tctx->domain, sizeof(dns_name_t));
 109         }
 110         isc_entropy_detach(&tctx->ectx);
 111         isc_mem_put(mctx, tctx, sizeof(dns_tkeyctx_t));
 112         isc_mem_detach(&mctx);
 113         *tctxp = NULL;
 114 }
 115
 116 static isc_result_t
 117 add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 118                 isc_uint32_t ttl, dns_namelist_t *namelist)
 119 {
 120         isc_result_t result;
 121         isc_region_t r, newr;
 122         dns_rdata_t *newrdata = NULL;
 123         dns_name_t *newname = NULL;
 124         dns_rdatalist_t *newlist = NULL;
 125         dns_rdataset_t *newset = NULL;
 126         isc_buffer_t *tmprdatabuf = NULL;
 127
 128         RETERR(dns_message_gettemprdata(msg, &newrdata));
 129
 130         dns_rdata_toregion(rdata, &r);
 131         RETERR(isc_buffer_allocate(msg->mctx, &tmprdatabuf, r.length));
 132         isc_buffer_availableregion(tmprdatabuf, &newr);
 133         memcpy(newr.base, r.base, r.length);
 134         dns_rdata_fromregion(newrdata, rdata->rdclass, rdata->type, &newr);
 135         dns_message_takebuffer(msg, &tmprdatabuf);
 136
 137         RETERR(dns_message_gettempname(msg, &newname));
 138         dns_name_init(newname, NULL);
 139         RETERR(dns_name_dup(name, msg->mctx, newname));
 140
 141         RETERR(dns_message_gettemprdatalist(msg, &newlist));
 142         newlist->rdclass = newrdata->rdclass;
 143         newlist->type = newrdata->type;
 144         newlist->covers = 0;
 145         newlist->ttl = ttl;
 146         ISC_LIST_INIT(newlist->rdata);
 147         ISC_LIST_APPEND(newlist->rdata, newrdata, link);
 148
 149         RETERR(dns_message_gettemprdataset(msg, &newset));
 150         dns_rdataset_init(newset);
 151         RETERR(dns_rdatalist_tordataset(newlist, newset));
 152
 153         ISC_LIST_INIT(newname->list);
 154         ISC_LIST_APPEND(newname->list, newset, link);
 155
 156         ISC_LIST_APPEND(*namelist, newname, link);
 157
 158         return (ISC_R_SUCCESS);
 159
 160  failure:
 161         if (newrdata != NULL) {
 162                 if (ISC_LINK_LINKED(newrdata, link))
 163                         ISC_LIST_UNLINK(newlist->rdata, newrdata, link);
 164                 dns_message_puttemprdata(msg, &newrdata);
 165         }
 166         if (newname != NULL)
 167                 dns_message_puttempname(msg, &newname);
 168         if (newset != NULL) {
 169                 dns_rdataset_disassociate(newset);
 170                 dns_message_puttemprdataset(msg, &newset);
 171         }
 172         if (newlist != NULL)
 173                 dns_message_puttemprdatalist(msg, &newlist);
 174         return (result);
 175 }
 176
 177 static void
 178 free_namelist(dns_message_t *msg, dns_namelist_t *namelist) {
 179         dns_name_t *name;
 180         dns_rdataset_t *set;
 181
 182         while (!ISC_LIST_EMPTY(*namelist)) {
 183                 name = ISC_LIST_HEAD(*namelist);
 184                 ISC_LIST_UNLINK(*namelist, name, link);
 185                 while (!ISC_LIST_EMPTY(name->list)) {
 186                         set = ISC_LIST_HEAD(name->list);
 187                         ISC_LIST_UNLINK(name->list, set, link);
 188                         dns_message_puttemprdataset(msg, &set);
 189                 }
 190                 dns_message_puttempname(msg, &name);
 191         }
 192 }
 193
 194 static isc_result_t
 195 compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
 196                isc_region_t *serverrandomness, isc_buffer_t *secret)
 197 {
 198         isc_md5_t md5ctx;
 199         isc_region_t r, r2;
 200         unsigned char digests[32];
 201         unsigned int i;
 202
 203         isc_buffer_usedregion(shared, &r);
 204
 205         /*
 206          * MD5 ( query data | DH value ).
 207          */
 208         isc_md5_init(&md5ctx);
 209         isc_md5_update(&md5ctx, queryrandomness->base,
 210                        queryrandomness->length);
 211         isc_md5_update(&md5ctx, r.base, r.length);
 212         isc_md5_final(&md5ctx, digests);
 213
 214         /*
 215          * MD5 ( server data | DH value ).
 216          */
 217         isc_md5_init(&md5ctx);
 218         isc_md5_update(&md5ctx, serverrandomness->base,
 219                        serverrandomness->length);
 220         isc_md5_update(&md5ctx, r.base, r.length);
 221         isc_md5_final(&md5ctx, &digests[ISC_MD5_DIGESTLENGTH]);
 222
 223         /*
 224          * XOR ( DH value, MD5-1 | MD5-2).
 225          */
 226         isc_buffer_availableregion(secret, &r);
 227         isc_buffer_usedregion(shared, &r2);
 228         if (r.length < sizeof(digests) || r.length < r2.length)
 229                 return (ISC_R_NOSPACE);
 230         if (r2.length > sizeof(digests)) {
 231                 memcpy(r.base, r2.base, r2.length);
 232                 for (i = 0; i < sizeof(digests); i++)
 233                         r.base[i] ^= digests[i];
 234                 isc_buffer_add(secret, r2.length);
 235         }
 236         else {
 237                 memcpy(r.base, digests, sizeof(digests));
 238                 for (i = 0; i < r2.length; i++)
 239                         r.base[i] ^= r2.base[i];
 240                 isc_buffer_add(secret, sizeof(digests));
 241         }
 242         return (ISC_R_SUCCESS);
 243
 244 }
 245
 246 static isc_result_t
 247 process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 248                dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 249                dns_rdata_tkey_t *tkeyout,
 250                dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 251 {
 252         isc_result_t result = ISC_R_SUCCESS;
 253         dns_name_t *keyname, ourname;
 254         dns_rdataset_t *keyset = NULL;
 255         dns_rdata_t keyrdata = DNS_RDATA_INIT, ourkeyrdata = DNS_RDATA_INIT;
 256         isc_boolean_t found_key = ISC_FALSE, found_incompatible = ISC_FALSE;
 257         dst_key_t *pubkey = NULL;
 258         isc_buffer_t ourkeybuf, *shared = NULL;
 259         isc_region_t r, r2, ourkeyr;
 260         unsigned char keydata[DST_KEY_MAXSIZE];
 261         unsigned int sharedsize;
 262         isc_buffer_t secret;
 263         unsigned char *randomdata = NULL, secretdata[256];
 264         dns_ttl_t ttl = 0;
 265
 266         if (tctx->dhkey == NULL) {
 267                 tkey_log("process_dhtkey: tkey-dhkey not defined");
 268                 tkeyout->error = dns_tsigerror_badalg;
 269                 return (DNS_R_REFUSED);
 270         }
 271
 272         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
 273                 tkey_log("process_dhtkey: algorithms other than "
 274                          "hmac-md5 are not supported");
 275                 tkeyout->error = dns_tsigerror_badalg;
 276                 return (ISC_R_SUCCESS);
 277         }
 278
 279         /*
 280          * Look for a DH KEY record that will work with ours.
 281          */
 282         for (result = dns_message_firstname(msg, DNS_SECTION_ADDITIONAL);
 283              result == ISC_R_SUCCESS && !found_key;
 284              result = dns_message_nextname(msg, DNS_SECTION_ADDITIONAL))
 285         {
 286                 keyname = NULL;
 287                 dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
 288                 keyset = NULL;
 289                 result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
 290                                               &keyset);
 291                 if (result != ISC_R_SUCCESS)
 292                         continue;
 293
 294                 for (result = dns_rdataset_first(keyset);
 295                      result == ISC_R_SUCCESS && !found_key;
 296                      result = dns_rdataset_next(keyset))
 297                 {
 298                         dns_rdataset_current(keyset, &keyrdata);
 299                         pubkey = NULL;
 300                         result = dns_dnssec_keyfromrdata(keyname, &keyrdata,
 301                                                          msg->mctx, &pubkey);
 302                         if (result != ISC_R_SUCCESS) {
 303                                 dns_rdata_reset(&keyrdata);
 304                                 continue;
 305                         }
 306                         if (dst_key_alg(pubkey) == DNS_KEYALG_DH) {
 307                                 if (dst_key_paramcompare(pubkey, tctx->dhkey))
 308                                 {
 309                                         found_key = ISC_TRUE;
 310                                         ttl = keyset->ttl;
 311                                         break;
 312                                 }
 313                                 else
 314                                         found_incompatible = ISC_TRUE;
 315                         }
 316                         dst_key_free(&pubkey);
 317                         dns_rdata_reset(&keyrdata);
 318                 }
 319         }
 320
 321         if (!found_key) {
 322                 if (found_incompatible) {
 323                         tkey_log("process_dhtkey: found an incompatible key");
 324                         tkeyout->error = dns_tsigerror_badkey;
 325                         return (ISC_R_SUCCESS);
 326                 } else {
 327                         tkey_log("process_dhtkey: failed to find a key");
 328                         return (DNS_R_FORMERR);
 329                 }
 330         }
 331
 332         RETERR(add_rdata_to_list(msg, keyname, &keyrdata, ttl, namelist));
 333
 334         isc_buffer_init(&ourkeybuf, keydata, sizeof(keydata));
 335         RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
 336         isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
 337         dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
 338                              dns_rdatatype_key, &ourkeyr);
 339
 340         dns_name_init(&ourname, NULL);
 341         dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
 342
 343         /*
 344          * XXXBEW The TTL should be obtained from the database, if it exists.
 345          */
 346         RETERR(add_rdata_to_list(msg, &ourname, &ourkeyrdata, 0, namelist));
 347
 348         RETERR(dst_key_secretsize(tctx->dhkey, &sharedsize));
 349         RETERR(isc_buffer_allocate(msg->mctx, &shared, sharedsize));
 350
 351         result = dst_key_computesecret(pubkey, tctx->dhkey, shared);
 352         if (result != ISC_R_SUCCESS) {
 353                 tkey_log("process_dhtkey: failed to compute shared secret: %s",
 354                          isc_result_totext(result));
 355                 goto failure;
 356         }
 357         dst_key_free(&pubkey);
 358
 359         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
 360
 361         randomdata = isc_mem_get(tctx->mctx, TKEY_RANDOM_AMOUNT);
 362         if (randomdata == NULL)
 363                 goto failure;
 364
 365         result = isc_entropy_getdata(tctx->ectx, randomdata,
 366                                      TKEY_RANDOM_AMOUNT, NULL, 0);
 367         if (result != ISC_R_SUCCESS) {
 368                 tkey_log("process_dhtkey: failed to obtain entropy: %s",
 369                          isc_result_totext(result));
 370                 goto failure;
 371         }
 372
 373         r.base = randomdata;
 374         r.length = TKEY_RANDOM_AMOUNT;
 375         r2.base = tkeyin->key;
 376         r2.length = tkeyin->keylen;
 377         RETERR(compute_secret(shared, &r2, &r, &secret));
 378         isc_buffer_free(&shared);
 379
 380         RETERR(dns_tsigkey_create(name, &tkeyin->algorithm,
 381                                   isc_buffer_base(&secret),
 382                                   isc_buffer_usedlength(&secret),
 383                                   ISC_TRUE, signer, tkeyin->inception,
 384                                   tkeyin->expire, msg->mctx, ring, NULL));
 385
 386         /* This key is good for a long time */
 387         tkeyout->inception = tkeyin->inception;
 388         tkeyout->expire = tkeyin->expire;
 389
 390         tkeyout->key = randomdata;
 391         tkeyout->keylen = TKEY_RANDOM_AMOUNT;
 392
 393         return (ISC_R_SUCCESS);
 394
 395  failure:
 396         if (!ISC_LIST_EMPTY(*namelist))
 397                 free_namelist(msg, namelist);
 398         if (shared != NULL)
 399                 isc_buffer_free(&shared);
 400         if (pubkey != NULL)
 401                 dst_key_free(&pubkey);
 402         if (randomdata == NULL)
 403                 isc_mem_put(tctx->mctx, randomdata, TKEY_RANDOM_AMOUNT);
 404         return (result);
 405 }
 406
 407 static isc_result_t
 408 process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 409                 dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
 410                 dns_rdata_tkey_t *tkeyout,
 411                 dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
 412 {
 413         isc_result_t result = ISC_R_SUCCESS;
 414         dst_key_t *dstkey = NULL;
 415         void *gssctx = NULL;
 416         isc_stdtime_t now;
 417         isc_region_t intoken;
 418         unsigned char array[1024];
 419         isc_buffer_t outtoken;
 420
 421         UNUSED(namelist);
 422
 423         if (tctx->gsscred == NULL)
 424                 return (ISC_R_NOPERM);
 425
 426         if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPI_NAME) &&
 427             !dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPIMS_NAME)) {
 428                 tkeyout->error = dns_tsigerror_badalg;
 429                 return (ISC_R_SUCCESS);
 430         }
 431
 432         intoken.base = tkeyin->key;
 433         intoken.length = tkeyin->keylen;
 434
 435         isc_buffer_init(&outtoken, array, sizeof(array));
 436         RETERR(dst_gssapi_acceptctx(name, tctx->gsscred, &intoken,
 437                                     &outtoken, &gssctx));
 438
 439         dstkey = NULL;
 440         RETERR(dst_key_fromgssapi(name, gssctx, msg->mctx, &dstkey));
 441
 442         result = dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
 443                                            dstkey, ISC_TRUE, signer,
 444                                            tkeyin->inception, tkeyin->expire,
 445                                            msg->mctx, ring, NULL);
 446         if (result != ISC_R_SUCCESS)
 447                 goto failure;
 448
 449         if (result == ISC_R_NOTFOUND) {
 450                 tkeyout->error = dns_tsigerror_badalg;
 451                 return (ISC_R_SUCCESS);
 452         }
 453         if (result != ISC_R_SUCCESS)
 454                 goto failure;
 455
 456         /* This key is good for a long time */
 457         isc_stdtime_get(&now);
 458         tkeyout->inception = tkeyin->inception;
 459         tkeyout->expire = tkeyin->expire;
 460
 461         tkeyout->key = isc_mem_get(msg->mctx,
 462                                    isc_buffer_usedlength(&outtoken));
 463         if (tkeyout->key == NULL) {
 464                 result = ISC_R_NOMEMORY;
 465                 goto failure;
 466         }
 467         tkeyout->keylen = isc_buffer_usedlength(&outtoken);
 468         memcpy(tkeyout->key, isc_buffer_base(&outtoken), tkeyout->keylen);
 469
 470         return (ISC_R_SUCCESS);
 471
 472  failure:
 473         if (dstkey != NULL)
 474                 dst_key_free(&dstkey);
 475
 476         return (result);
 477 }
 478
 479 static isc_result_t
 480 process_deletetkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 481                    dns_rdata_tkey_t *tkeyin,
 482                    dns_rdata_tkey_t *tkeyout,
 483                    dns_tsig_keyring_t *ring,
 484                    dns_namelist_t *namelist)
 485 {
 486         isc_result_t result;
 487         dns_tsigkey_t *tsigkey = NULL;
 488         dns_name_t *identity;
 489
 490         UNUSED(msg);
 491         UNUSED(namelist);
 492
 493         result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 494         if (result != ISC_R_SUCCESS) {
 495                 tkeyout->error = dns_tsigerror_badname;
 496                 return (ISC_R_SUCCESS);
 497         }
 498
 499         /*
 500          * Only allow a delete if the identity that created the key is the
 501          * same as the identity that signed the message.
 502          */
 503         identity = dns_tsigkey_identity(tsigkey);
 504         if (identity == NULL || !dns_name_equal(identity, signer)) {
 505                 dns_tsigkey_detach(&tsigkey);
 506                 return (DNS_R_REFUSED);
 507         }
 508
 509         /*
 510          * Set the key to be deleted when no references are left.  If the key
 511          * was not generated with TKEY and is in the config file, it may be
 512          * reloaded later.
 513          */
 514         dns_tsigkey_setdeleted(tsigkey);
 515
 516         /* Release the reference */
 517         dns_tsigkey_detach(&tsigkey);
 518
 519         return (ISC_R_SUCCESS);
 520 }
 521
 522 isc_result_t
 523 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 524                       dns_tsig_keyring_t *ring)
 525 {
 526         isc_result_t result = ISC_R_SUCCESS;
 527         dns_rdata_tkey_t tkeyin, tkeyout;
 528         isc_boolean_t freetkeyin = ISC_FALSE;
 529         dns_name_t *qname, *name, *keyname, *signer, tsigner;
 530         dns_fixedname_t fkeyname;
 531         dns_rdataset_t *tkeyset;
 532         dns_rdata_t rdata;
 533         dns_namelist_t namelist;
 534         char tkeyoutdata[512];
 535         isc_buffer_t tkeyoutbuf;
 536
 537         REQUIRE(msg != NULL);
 538         REQUIRE(tctx != NULL);
 539         REQUIRE(ring != NULL);
 540
 541         ISC_LIST_INIT(namelist);
 542
 543         /*
 544          * Interpret the question section.
 545          */
 546         result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 547         if (result != ISC_R_SUCCESS)
 548                 return (DNS_R_FORMERR);
 549
 550         qname = NULL;
 551         dns_message_currentname(msg, DNS_SECTION_QUESTION, &qname);
 552
 553         /*
 554          * Look for a TKEY record that matches the question.
 555          */
 556         tkeyset = NULL;
 557         name = NULL;
 558         result = dns_message_findname(msg, DNS_SECTION_ADDITIONAL, qname,
 559                                       dns_rdatatype_tkey, 0, &name, &tkeyset);
 560         if (result != ISC_R_SUCCESS) {
 561                 /*
 562                  * Try the answer section, since that's where Win2000
 563                  * puts it.
 564                  */
 565                 if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
 566                                          dns_rdatatype_tkey, 0, &name,
 567                                          &tkeyset) != ISC_R_SUCCESS)
 568                 {
 569                         result = DNS_R_FORMERR;
 570                         tkey_log("dns_tkey_processquery: couldn't find a TKEY "
 571                                  "matching the question");
 572                         goto failure;
 573                 }
 574         }
 575         result = dns_rdataset_first(tkeyset);
 576         if (result != ISC_R_SUCCESS) {
 577                 result = DNS_R_FORMERR;
 578                 goto failure;
 579         }
 580         dns_rdata_init(&rdata);
 581         dns_rdataset_current(tkeyset, &rdata);
 582
 583         RETERR(dns_rdata_tostruct(&rdata, &tkeyin, NULL));
 584         freetkeyin = ISC_TRUE;
 585
 586         if (tkeyin.error != dns_rcode_noerror) {
 587                 result = DNS_R_FORMERR;
 588                 goto failure;
 589         }
 590
 591         /*
 592          * Before we go any farther, verify that the message was signed.
 593          * GSSAPI TKEY doesn't require a signature, the rest do.
 594          */
 595         dns_name_init(&tsigner, NULL);
 596         result = dns_message_signer(msg, &tsigner);
 597         if (result != ISC_R_SUCCESS) {
 598                 if (tkeyin.mode == DNS_TKEYMODE_GSSAPI &&
 599                     result == ISC_R_NOTFOUND)
 600                        signer = NULL;
 601                 else {
 602                         tkey_log("dns_tkey_processquery: query was not "
 603                                  "properly signed - rejecting");
 604                         result = DNS_R_FORMERR;
 605                         goto failure;
 606                 }
 607         } else
 608                 signer = &tsigner;
 609
 610         tkeyout.common.rdclass = tkeyin.common.rdclass;
 611         tkeyout.common.rdtype = tkeyin.common.rdtype;
 612         ISC_LINK_INIT(&tkeyout.common, link);
 613         tkeyout.mctx = msg->mctx;
 614
 615         dns_name_init(&tkeyout.algorithm, NULL);
 616         dns_name_clone(&tkeyin.algorithm, &tkeyout.algorithm);
 617
 618         tkeyout.inception = tkeyout.expire = 0;
 619         tkeyout.mode = tkeyin.mode;
 620         tkeyout.error = 0;
 621         tkeyout.keylen = tkeyout.otherlen = 0;
 622         tkeyout.key = tkeyout.other = NULL;
 623
 624         /*
 625          * A delete operation must have a fully specified key name.  If this
 626          * is not a delete, we do the following:
 627          * if (qname != ".")
 628          *      keyname = qname + defaultdomain
 629          * else
 630          *      keyname = <random hex> + defaultdomain
 631          */
 632         if (tkeyin.mode != DNS_TKEYMODE_DELETE) {
 633                 dns_tsigkey_t *tsigkey = NULL;
 634
 635                 if (tctx->domain == NULL) {
 636                         tkey_log("dns_tkey_processquery: tkey-domain not set");
 637                         result = DNS_R_REFUSED;
 638                         goto failure;
 639                 }
 640
 641                 dns_fixedname_init(&fkeyname);
 642                 keyname = dns_fixedname_name(&fkeyname);
 643
 644                 if (!dns_name_equal(qname, dns_rootname)) {
 645                         unsigned int n = dns_name_countlabels(qname);
 646                         dns_name_copy(qname, keyname, NULL);
 647                         dns_name_getlabelsequence(keyname, 0, n - 1, keyname);
 648                 }
 649                 else {
 650                         static char hexdigits[16] = {
 651                                 '0', '1', '2', '3', '4', '5', '6', '7',
 652                                 '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
 653                         unsigned char randomdata[16];
 654                         char randomtext[32];
 655                         isc_buffer_t b;
 656                         unsigned int i, j;
 657
 658                         result = isc_entropy_getdata(tctx->ectx,
 659                                                      randomdata,
 660                                                      sizeof(randomdata),
 661                                                      NULL, 0);
 662                         if (result != ISC_R_SUCCESS)
 663                                 goto failure;
 664
 665                         for (i = 0, j = 0; i < sizeof(randomdata); i++) {
 666                                 unsigned char val = randomdata[i];
 667                                 randomtext[j++] = hexdigits[val >> 4];
 668                                 randomtext[j++] = hexdigits[val & 0xF];
 669                         }
 670                         isc_buffer_init(&b, randomtext, sizeof(randomtext));
 671                         isc_buffer_add(&b, sizeof(randomtext));
 672                         result = dns_name_fromtext(keyname, &b, NULL,
 673                                                    ISC_FALSE, NULL);
 674                         if (result != ISC_R_SUCCESS)
 675                                 goto failure;
 676                 }
 677                 result = dns_name_concatenate(keyname, tctx->domain,
 678                                               keyname, NULL);
 679                 if (result != ISC_R_SUCCESS)
 680                         goto failure;
 681
 682                 result = dns_tsigkey_find(&tsigkey, keyname, NULL, ring);
 683                 if (result == ISC_R_SUCCESS) {
 684                         tkeyout.error = dns_tsigerror_badname;
 685                         dns_tsigkey_detach(&tsigkey);
 686                         goto failure_with_tkey;
 687                 }
 688                 else if (result != ISC_R_NOTFOUND)
 689                         goto failure;
 690         }
 691         else
 692                 keyname = qname;
 693
 694         switch (tkeyin.mode) {
 695                 case DNS_TKEYMODE_DIFFIEHELLMAN:
 696                         tkeyout.error = dns_rcode_noerror;
 697                         RETERR(process_dhtkey(msg, signer, keyname, &tkeyin,
 698                                               tctx, &tkeyout, ring,
 699                                               &namelist));
 700                         break;
 701                 case DNS_TKEYMODE_GSSAPI:
 702                         tkeyout.error = dns_rcode_noerror;
 703                         RETERR(process_gsstkey(msg, signer, keyname, &tkeyin,
 704                                                tctx, &tkeyout, ring,
 705                                                &namelist));
 706                         break;
 707                 case DNS_TKEYMODE_DELETE:
 708                         tkeyout.error = dns_rcode_noerror;
 709                         RETERR(process_deletetkey(msg, signer, keyname,
 710                                                   &tkeyin, &tkeyout,
 711                                                   ring, &namelist));
 712                         break;
 713                 case DNS_TKEYMODE_SERVERASSIGNED:
 714                 case DNS_TKEYMODE_RESOLVERASSIGNED:
 715                         result = DNS_R_NOTIMP;
 716                         goto failure;
 717                 default:
 718                         tkeyout.error = dns_tsigerror_badmode;
 719         }
 720
 721  failure_with_tkey:
 722         dns_rdata_init(&rdata);
 723         isc_buffer_init(&tkeyoutbuf, tkeyoutdata, sizeof(tkeyoutdata));
 724         result = dns_rdata_fromstruct(&rdata, tkeyout.common.rdclass,
 725                                       tkeyout.common.rdtype, &tkeyout,
 726                                       &tkeyoutbuf);
 727
 728         if (freetkeyin) {
 729                 dns_rdata_freestruct(&tkeyin);
 730                 freetkeyin = ISC_FALSE;
 731         }
 732
 733         if (tkeyout.key != NULL)
 734                 isc_mem_put(msg->mctx, tkeyout.key, tkeyout.keylen);
 735         if (tkeyout.other != NULL)
 736                 isc_mem_put(msg->mctx, tkeyout.other, tkeyout.otherlen);
 737         if (result != ISC_R_SUCCESS)
 738                 goto failure;
 739
 740         RETERR(add_rdata_to_list(msg, keyname, &rdata, 0, &namelist));
 741
 742         RETERR(dns_message_reply(msg, ISC_TRUE));
 743
 744         name = ISC_LIST_HEAD(namelist);
 745         while (name != NULL) {
 746                 dns_name_t *next = ISC_LIST_NEXT(name, link);
 747                 ISC_LIST_UNLINK(namelist, name, link);
 748                 dns_message_addname(msg, name, DNS_SECTION_ANSWER);
 749                 name = next;
 750         }
 751
 752         return (ISC_R_SUCCESS);
 753
 754  failure:
 755         if (freetkeyin)
 756                 dns_rdata_freestruct(&tkeyin);
 757         if (!ISC_LIST_EMPTY(namelist))
 758                 free_namelist(msg, &namelist);
 759         return (result);
 760 }
 761
 762 static isc_result_t
 763 buildquery(dns_message_t *msg, dns_name_t *name,
 764            dns_rdata_tkey_t *tkey)
 765 {
 766         dns_name_t *qname = NULL, *aname = NULL;
 767         dns_rdataset_t *question = NULL, *tkeyset = NULL;
 768         dns_rdatalist_t *tkeylist = NULL;
 769         dns_rdata_t *rdata = NULL;
 770         isc_buffer_t *dynbuf = NULL;
 771         isc_result_t result;
 772
 773         REQUIRE(msg != NULL);
 774         REQUIRE(name != NULL);
 775         REQUIRE(tkey != NULL);
 776
 777         RETERR(dns_message_gettempname(msg, &qname));
 778         RETERR(dns_message_gettempname(msg, &aname));
 779
 780         RETERR(dns_message_gettemprdataset(msg, &question));
 781         dns_rdataset_init(question);
 782         dns_rdataset_makequestion(question, dns_rdataclass_any,
 783                                   dns_rdatatype_tkey);
 784
 785         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 512));
 786         RETERR(dns_message_gettemprdata(msg, &rdata));
 787         RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
 788                                     dns_rdatatype_tkey, tkey, dynbuf));
 789         dns_message_takebuffer(msg, &dynbuf);
 790
 791         RETERR(dns_message_gettemprdatalist(msg, &tkeylist));
 792         tkeylist->rdclass = dns_rdataclass_any;
 793         tkeylist->type = dns_rdatatype_tkey;
 794         tkeylist->covers = 0;
 795         tkeylist->ttl = 0;
 796         ISC_LIST_INIT(tkeylist->rdata);
 797         ISC_LIST_APPEND(tkeylist->rdata, rdata, link);
 798
 799         RETERR(dns_message_gettemprdataset(msg, &tkeyset));
 800         dns_rdataset_init(tkeyset);
 801         RETERR(dns_rdatalist_tordataset(tkeylist, tkeyset));
 802
 803         dns_name_init(qname, NULL);
 804         dns_name_clone(name, qname);
 805
 806         dns_name_init(aname, NULL);
 807         dns_name_clone(name, aname);
 808
 809         ISC_LIST_APPEND(qname->list, question, link);
 810         ISC_LIST_APPEND(aname->list, tkeyset, link);
 811
 812         dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
 813         dns_message_addname(msg, aname, DNS_SECTION_ADDITIONAL);
 814
 815         return (ISC_R_SUCCESS);
 816
 817  failure:
 818         if (qname != NULL)
 819                 dns_message_puttempname(msg, &qname);
 820         if (aname != NULL)
 821                 dns_message_puttempname(msg, &aname);
 822         if (question != NULL) {
 823                 dns_rdataset_disassociate(question);
 824                 dns_message_puttemprdataset(msg, &question);
 825         }
 826         if (dynbuf != NULL)
 827                 isc_buffer_free(&dynbuf);
 828         return (result);
 829 }
 830
 831 isc_result_t
 832 dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 833                       dns_name_t *algorithm, isc_buffer_t *nonce,
 834                       isc_uint32_t lifetime)
 835 {
 836         dns_rdata_tkey_t tkey;
 837         dns_rdata_t *rdata = NULL;
 838         isc_buffer_t *dynbuf = NULL;
 839         isc_region_t r;
 840         dns_name_t keyname;
 841         dns_namelist_t namelist;
 842         isc_result_t result;
 843         isc_stdtime_t now;
 844
 845         REQUIRE(msg != NULL);
 846         REQUIRE(key != NULL);
 847         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
 848         REQUIRE(dst_key_isprivate(key));
 849         REQUIRE(name != NULL);
 850         REQUIRE(algorithm != NULL);
 851
 852         tkey.common.rdclass = dns_rdataclass_any;
 853         tkey.common.rdtype = dns_rdatatype_tkey;
 854         ISC_LINK_INIT(&tkey.common, link);
 855         tkey.mctx = msg->mctx;
 856         dns_name_init(&tkey.algorithm, NULL);
 857         dns_name_clone(algorithm, &tkey.algorithm);
 858         isc_stdtime_get(&now);
 859         tkey.inception = now;
 860         tkey.expire = now + lifetime;
 861         tkey.mode = DNS_TKEYMODE_DIFFIEHELLMAN;
 862         if (nonce != NULL)
 863                 isc_buffer_usedregion(nonce, &r);
 864         else {
 865                 r.base = isc_mem_get(msg->mctx, 0);
 866                 r.length = 0;
 867         }
 868         tkey.error = 0;
 869         tkey.key = r.base;
 870         tkey.keylen =  r.length;
 871         tkey.other = NULL;
 872         tkey.otherlen = 0;
 873
 874         RETERR(buildquery(msg, name, &tkey));
 875
 876         if (nonce == NULL)
 877                 isc_mem_put(msg->mctx, r.base, 0);
 878
 879         RETERR(dns_message_gettemprdata(msg, &rdata));
 880         RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
 881         RETERR(dst_key_todns(key, dynbuf));
 882         isc_buffer_usedregion(dynbuf, &r);
 883         dns_rdata_fromregion(rdata, dns_rdataclass_any,
 884                              dns_rdatatype_key, &r);
 885         dns_message_takebuffer(msg, &dynbuf);
 886
 887         dns_name_init(&keyname, NULL);
 888         dns_name_clone(dst_key_name(key), &keyname);
 889
 890         ISC_LIST_INIT(namelist);
 891         RETERR(add_rdata_to_list(msg, &keyname, rdata, 0, &namelist));
 892         dns_message_addname(msg, ISC_LIST_HEAD(namelist),
 893                             DNS_SECTION_ADDITIONAL);
 894
 895         return (ISC_R_SUCCESS);
 896
 897  failure:
 898
 899         if (dynbuf != NULL)
 900                 isc_buffer_free(&dynbuf);
 901         return (result);
 902 }
 903
 904 isc_result_t
 905 dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name,
 906                        dns_name_t *gname, void *cred,
 907                        isc_uint32_t lifetime, void **context)
 908 {
 909         dns_rdata_tkey_t tkey;
 910         isc_result_t result;
 911         isc_stdtime_t now;
 912         isc_buffer_t token;
 913         unsigned char array[1024];
 914
 915         REQUIRE(msg != NULL);
 916         REQUIRE(name != NULL);
 917         REQUIRE(gname != NULL);
 918         REQUIRE(context != NULL && *context == NULL);
 919
 920         isc_buffer_init(&token, array, sizeof(array));
 921         result = dst_gssapi_initctx(gname, cred, NULL, &token, context);
 922         if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
 923                 return (result);
 924
 925         tkey.common.rdclass = dns_rdataclass_any;
 926         tkey.common.rdtype = dns_rdatatype_tkey;
 927         ISC_LINK_INIT(&tkey.common, link);
 928         tkey.mctx = NULL;
 929         dns_name_init(&tkey.algorithm, NULL);
 930         dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 931         isc_stdtime_get(&now);
 932         tkey.inception = now;
 933         tkey.expire = now + lifetime;
 934         tkey.mode = DNS_TKEYMODE_GSSAPI;
 935         tkey.error = 0;
 936         tkey.key = isc_buffer_base(&token);
 937         tkey.keylen = isc_buffer_usedlength(&token);
 938         tkey.other = NULL;
 939         tkey.otherlen = 0;
 940
 941         RETERR(buildquery(msg, name, &tkey));
 942
 943         return (ISC_R_SUCCESS);
 944
 945  failure:
 946         return (result);
 947 }
 948
 949 isc_result_t
 950 dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key) {
 951         dns_rdata_tkey_t tkey;
 952
 953         REQUIRE(msg != NULL);
 954         REQUIRE(key != NULL);
 955
 956         tkey.common.rdclass = dns_rdataclass_any;
 957         tkey.common.rdtype = dns_rdatatype_tkey;
 958         ISC_LINK_INIT(&tkey.common, link);
 959         tkey.mctx = msg->mctx;
 960         dns_name_init(&tkey.algorithm, NULL);
 961         dns_name_clone(key->algorithm, &tkey.algorithm);
 962         tkey.inception = tkey.expire = 0;
 963         tkey.mode = DNS_TKEYMODE_DELETE;
 964         tkey.error = 0;
 965         tkey.keylen = tkey.otherlen = 0;
 966         tkey.key = tkey.other = NULL;
 967
 968         return (buildquery(msg, &key->name, &tkey));
 969 }
 970
 971 static isc_result_t
 972 find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 973           int section)
 974 {
 975         dns_rdataset_t *tkeyset;
 976         isc_result_t result;
 977
 978         result = dns_message_firstname(msg, section);
 979         while (result == ISC_R_SUCCESS) {
 980                 *name = NULL;
 981                 dns_message_currentname(msg, section, name);
 982                 tkeyset = NULL;
 983                 result = dns_message_findtype(*name, dns_rdatatype_tkey, 0,
 984                                               &tkeyset);
 985                 if (result == ISC_R_SUCCESS) {
 986                         result = dns_rdataset_first(tkeyset);
 987                         if (result != ISC_R_SUCCESS)
 988                                 return (result);
 989                         dns_rdataset_current(tkeyset, rdata);
 990                         return (ISC_R_SUCCESS);
 991                 }
 992                 result = dns_message_nextname(msg, section);
 993         }
 994         if (result == ISC_R_NOMORE)
 995                 return (ISC_R_NOTFOUND);
 996         return (result);
 997 }
 998
 999 isc_result_t
1000 dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1001                            dst_key_t *key, isc_buffer_t *nonce,
1002                            dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
1003 {
1004         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1005         dns_name_t keyname, *tkeyname, *theirkeyname, *ourkeyname, *tempname;
1006         dns_rdataset_t *theirkeyset = NULL, *ourkeyset = NULL;
1007         dns_rdata_t theirkeyrdata = DNS_RDATA_INIT;
1008         dst_key_t *theirkey = NULL;
1009         dns_rdata_tkey_t qtkey, rtkey;
1010         unsigned char secretdata[256];
1011         unsigned int sharedsize;
1012         isc_buffer_t *shared = NULL, secret;
1013         isc_region_t r, r2;
1014         isc_result_t result;
1015         isc_boolean_t freertkey = ISC_FALSE;
1016
1017         REQUIRE(qmsg != NULL);
1018         REQUIRE(rmsg != NULL);
1019         REQUIRE(key != NULL);
1020         REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
1021         REQUIRE(dst_key_isprivate(key));
1022         if (outkey != NULL)
1023                 REQUIRE(*outkey == NULL);
1024
1025         if (rmsg->rcode != dns_rcode_noerror)
1026                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1027         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1028         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1029         freertkey = ISC_TRUE;
1030
1031         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1032                          DNS_SECTION_ADDITIONAL));
1033         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1034
1035         if (rtkey.error != dns_rcode_noerror ||
1036             rtkey.mode != DNS_TKEYMODE_DIFFIEHELLMAN ||
1037             rtkey.mode != qtkey.mode ||
1038             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1039             rmsg->rcode != dns_rcode_noerror)
1040         {
1041                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1042                          "or error set");
1043                 result = DNS_R_INVALIDTKEY;
1044                 dns_rdata_freestruct(&qtkey);
1045                 goto failure;
1046         }
1047
1048         dns_rdata_freestruct(&qtkey);
1049
1050         dns_name_init(&keyname, NULL);
1051         dns_name_clone(dst_key_name(key), &keyname);
1052
1053         ourkeyname = NULL;
1054         ourkeyset = NULL;
1055         RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
1056                                     dns_rdatatype_key, 0, &ourkeyname,
1057                                     &ourkeyset));
1058
1059         result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
1060         while (result == ISC_R_SUCCESS) {
1061                 theirkeyname = NULL;
1062                 dns_message_currentname(rmsg, DNS_SECTION_ANSWER,
1063                                         &theirkeyname);
1064                 if (dns_name_equal(theirkeyname, ourkeyname))
1065                         goto next;
1066                 theirkeyset = NULL;
1067                 result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
1068                                               0, &theirkeyset);
1069                 if (result == ISC_R_SUCCESS) {
1070                         RETERR(dns_rdataset_first(theirkeyset));
1071                         break;
1072                 }
1073  next:
1074                 result = dns_message_nextname(rmsg, DNS_SECTION_ANSWER);
1075         }
1076
1077         if (theirkeyset == NULL) {
1078                 tkey_log("dns_tkey_processdhresponse: failed to find server "
1079                          "key");
1080                 result = ISC_R_NOTFOUND;
1081                 goto failure;
1082         }
1083
1084         dns_rdataset_current(theirkeyset, &theirkeyrdata);
1085         RETERR(dns_dnssec_keyfromrdata(theirkeyname, &theirkeyrdata,
1086                                        rmsg->mctx, &theirkey));
1087
1088         RETERR(dst_key_secretsize(key, &sharedsize));
1089         RETERR(isc_buffer_allocate(rmsg->mctx, &shared, sharedsize));
1090
1091         RETERR(dst_key_computesecret(theirkey, key, shared));
1092
1093         isc_buffer_init(&secret, secretdata, sizeof(secretdata));
1094
1095         r.base = rtkey.key;
1096         r.length = rtkey.keylen;
1097         if (nonce != NULL)
1098                 isc_buffer_usedregion(nonce, &r2);
1099         else {
1100                 r2.base = isc_mem_get(rmsg->mctx, 0);
1101                 r2.length = 0;
1102         }
1103         RETERR(compute_secret(shared, &r2, &r, &secret));
1104         if (nonce == NULL)
1105                 isc_mem_put(rmsg->mctx, r2.base, 0);
1106
1107         isc_buffer_usedregion(&secret, &r);
1108         result = dns_tsigkey_create(tkeyname, &rtkey.algorithm,
1109                                     r.base, r.length, ISC_TRUE,
1110                                     NULL, rtkey.inception, rtkey.expire,
1111                                     rmsg->mctx, ring, outkey);
1112         isc_buffer_free(&shared);
1113         dns_rdata_freestruct(&rtkey);
1114         dst_key_free(&theirkey);
1115         return (result);
1116
1117  failure:
1118         if (shared != NULL)
1119                 isc_buffer_free(&shared);
1120
1121         if (theirkey != NULL)
1122                 dst_key_free(&theirkey);
1123
1124         if (freertkey)
1125                 dns_rdata_freestruct(&rtkey);
1126
1127         return (result);
1128 }
1129
1130 isc_result_t
1131 dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1132                             dns_name_t *gname, void *cred, void **context,
1133                             dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring)
1134 {
1135         dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
1136         dns_name_t *tkeyname;
1137         dns_rdata_tkey_t rtkey, qtkey;
1138         isc_buffer_t outtoken;
1139         dst_key_t *dstkey = NULL;
1140         isc_region_t r;
1141         isc_result_t result;
1142         unsigned char array[1024];
1143
1144         REQUIRE(qmsg != NULL);
1145         REQUIRE(rmsg != NULL);
1146         REQUIRE(gname != NULL);
1147         if (outkey != NULL)
1148                 REQUIRE(*outkey == NULL);
1149
1150         if (rmsg->rcode != dns_rcode_noerror)
1151                 return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1152         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1153         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1154
1155         RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
1156                          DNS_SECTION_ADDITIONAL));
1157         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1158
1159         if (rtkey.error != dns_rcode_noerror ||
1160             rtkey.mode != DNS_TKEYMODE_GSSAPI ||
1161             !dns_name_equal(&rtkey.algorithm, &rtkey.algorithm))
1162         {
1163                 tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
1164                          "or error set");
1165                 result = DNS_R_INVALIDTKEY;
1166                 goto failure;
1167         }
1168
1169         isc_buffer_init(&outtoken, array, sizeof(array));
1170         r.base = rtkey.key;
1171         r.length = rtkey.keylen;
1172         RETERR(dst_gssapi_initctx(gname, cred, &r, &outtoken, context));
1173
1174         dstkey = NULL;
1175         RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
1176                                   &dstkey));
1177
1178         RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
1179                                          dstkey, ISC_TRUE, NULL,
1180                                          rtkey.inception, rtkey.expire,
1181                                          rmsg->mctx, ring, outkey));
1182
1183         dns_rdata_freestruct(&rtkey);
1184         return (result);
1185
1186  failure:
1187         return (result);
1188 }
1189
1190 isc_result_t
1191 dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
1192                                dns_tsig_keyring_t *ring)
1193 {
1194         dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
1195         dns_name_t *tkeyname, *tempname;
1196         dns_rdata_tkey_t qtkey, rtkey;
1197         dns_tsigkey_t *tsigkey = NULL;
1198         isc_result_t result;
1199
1200         REQUIRE(qmsg != NULL);
1201         REQUIRE(rmsg != NULL);
1202
1203         if (rmsg->rcode != dns_rcode_noerror)
1204                 return(ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
1205
1206         RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
1207         RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
1208
1209         RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata,
1210                          DNS_SECTION_ADDITIONAL));
1211         RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
1212
1213         if (rtkey.error != dns_rcode_noerror ||
1214             rtkey.mode != DNS_TKEYMODE_DELETE ||
1215             rtkey.mode != qtkey.mode ||
1216             !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
1217             rmsg->rcode != dns_rcode_noerror)
1218         {
1219                 tkey_log("dns_tkey_processdeleteresponse: tkey mode invalid "
1220                          "or error set");
1221                 result = DNS_R_INVALIDTKEY;
1222                 dns_rdata_freestruct(&qtkey);
1223                 dns_rdata_freestruct(&rtkey);
1224                 goto failure;
1225         }
1226
1227         dns_rdata_freestruct(&qtkey);
1228
1229         RETERR(dns_tsigkey_find(&tsigkey, tkeyname, &rtkey.algorithm, ring));
1230
1231         dns_rdata_freestruct(&rtkey);
1232
1233         /*
1234          * Mark the key as deleted.
1235          */
1236         dns_tsigkey_setdeleted(tsigkey);
1237         /*
1238          * Release the reference.
1239          */
1240         dns_tsigkey_detach(&tsigkey);
1241
1242  failure:
1243         return (result);
1244 }